Upgrade containerd and image-spec for the vulnerabilities

[mopp]

Background

We have used migrate in our applications and configured Dependabot alerts by GitHub.
It notified us that containerd and image-spec had vulnerabilities. But we don't use them directly.
Then, I created this PR to upgrade.

I am not sure how migrate use them 🙏

[mopp]

See https://github.com/containerd/containerd/releases/tag/v1.5.8

[mopp]

See https://github.com/opencontainers/image-spec/releases/tag/v1.0.2

[mopp]

See cenkalti/backoff@v4.0.2...v4.1.1

[coveralls]

Pull Request Test Coverage Report for Build 1553106903

• 0 of 0 changed or added relevant lines in 0 files are covered.
• 12 unchanged lines in 1 file lost coverage.
• Overall coverage increased (+0.06%) to 57.8%

---

Files with Coverage Reduction	New Missed Lines	%
source/migration.go	12	13.64%

Totals
Change from base Build 1497266502:	0.06%
Covered Lines:	3731
Relevant Lines:	6455

---

💛 - Coveralls

[dhui]

My guess is that these dependencies are via dktest but there may be other packages that depend on these packages as well. I'm not too concerned about these from a security perspective since these packages should only be used when tests are running, so you shouldn't be vulnerable via migrate unless you're running the migrate tests. Nonetheless, we'll make sure this is fixed in the next release.

[dhui]

Could you try updating dktest to v0.3.8 and run go mod tidy to see if that fixes the issue?

[mopp]

Thanks for your comment.
Ah, I misunderstood. These libraries are also indirect dependencies from migrate.
Please check the commit
9975d48

Yes, I know that migrate uses them in the test only. But the Dependabot alerts by GitHub does not regard that unfortunately and just send us vulnerability alert 😢 So the reason why I sent this PR is just to suppress the alert in our repository.

Thanks.

[mopp]

See https://github.com/dhui/dktest/releases/tag/v0.3.8

[xrn]

@dhui any chance for a new release with these changes?

[Tarang]

Any chance this can be put into release?

[maknahar]

Any Idea when this change can be released?

[xrn]

@dhui ?

[dhui]

I just updated dktest to v0.3.10 in migrate (master branch) which should fix known security issues and appease the security vulnerability scanners. If you'd also like to quiet your vulnerability scanners, use the master branch until the next release is cut. Although the master branch is not stable, any issues caused by recent changes (e.g. PR merges) will be promptly addressed.