Repository navigation
chore(deps): remove unused opencontainers/runc replace - #1339
Conversation
|
Claude finished @mbevc1's task in 46s —— View job Follow-up review — PR #1339Previous findings: None. No prior inline review comments exist on this PR, and the earlier Claude comment never got past the initial "I'll analyze this" placeholder — there's no actual prior review to follow up on. New commits: The PR still contains a single commit ( Review of the change: Clean, minimal two-line removal — no bugs, security issues, or regressions. No new inline comments posted. |
The replace was added in 2021 to force a patched runc while it was an indirect dependency, and bumped to v1.1.2 in 2022. runc left the module graph in January 2023, so the directive has selected nothing since: go mod why reports the module as not needed, go.sum has no runc entries, and no package imports it on any release platform. Scanners that read go.mod text can still flag runc 1.1.2 for CVE-2024-21626, and if runc ever returned as a dependency the replace would silently pin that vulnerable version.
016ca8e to
6a422c7
Compare
Remove the
replace github.com/opencontainers/runc => v1.1.2directive fromgo.mod. runc left the module graph in January 2023, so the replace has selected nothing since, but scanners that readgo.modtext can still flag runc 1.1.2 for CVE-2024-21626, and the replace would silently pin that version if runc ever returned as a dependency.Evidence that runc is unused
go mod why -m github.com/opencontainers/runcreports "main module does not need module github.com/opencontainers/runc".go mod graphhas no edges to it,go list -m alldoes not list it, andgo.sumhas no runc entries.go list -deps -test ./...finds no runc packages for linux, darwin and windows on amd64 and arm64, tests included.go mod tidyleavesgo.modandgo.sumunchanged apart from these two lines, andgo build ./...andgo vet ./...pass..gofile references runc.History
12f13022): added as a replace to v1.0.3 to force a patched runc while it was an indirect dependency.58ae936c): bumped to v1.1.2 for the same reason.3e38f162): runc's indirect require was removed and runc left the graph; the replace stayed behind.Checklist
charts/k8s-reporter/) updated, if needed. Note: these changes live in a separate PR