fix(deps): vuln major upgrades — 22 packages (major: 1 · minor: 18 · patch: 3) by gh-worker-campaigns-3e9aa4[bot] · Pull Request #1102 · DataDog/chaos-controller

gh-worker-campaigns-3e9aa4 · 2026-07-28T14:14:32Z

Summary: Critical-severity security update — 25 packages upgraded (MAJOR changes included)

Manifests changed:

. (go)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
golang.org/x/crypto	v0.50.0	v0.54.0	minor	Transitive	21 CRITICAL, 6 HIGH, 12 MEDIUM, 1 UNKNOWN
github.com/containerd/containerd	v1.7.30	v2.3.3	major	Direct	4 CRITICAL, 10 HIGH, 4 MEDIUM
golang.org/x/net	v0.53.0	v0.57.0	minor	Transitive	2 CRITICAL, 11 MEDIUM, 1 UNKNOWN
google.golang.org/grpc	v1.80.0	v1.82.1	minor	Direct	2 HIGH
go.opentelemetry.io/otel	v1.43.0	v1.44.0	minor	Direct	3 MEDIUM
k8s.io/api	v0.35.2	v0.36.3	unstable	Direct	-
k8s.io/apimachinery	v0.35.2	v0.36.3	unstable	Direct	-
k8s.io/client-go	v0.35.2	v0.36.3	unstable	Direct	-
github.com/felixge/httpsnoop	v1.0.4	v1.1.0	minor	Transitive	-
github.com/fsnotify/fsnotify	v1.9.0	v1.10.1	minor	Direct	-
github.com/opencontainers/runtime-spec	v1.1.0	v1.3.0	minor	Transitive	-
github.com/pelletier/go-toml/v2	v2.3.1	v2.4.3	minor	Transitive	-
github.com/prometheus/client_golang	v1.23.2	v1.24.1	minor	Transitive	-
go.opentelemetry.io/otel/metric	v1.43.0	v1.44.0	minor	Transitive	-
go.opentelemetry.io/otel/trace	v1.43.0	v1.44.0	minor	Direct	-
go.opentelemetry.io/proto/otlp	v1.10.0	v1.11.0	minor	Transitive	-
golang.org/x/mod	v0.36.0	v0.38.0	minor	Transitive	-
golang.org/x/sync	v0.20.0	v0.22.0	minor	Transitive	-
golang.org/x/sys	v0.43.0	v0.47.0	minor	Direct	1 UNKNOWN
golang.org/x/term	v0.42.0	v0.45.0	minor	Transitive	-
golang.org/x/text	v0.37.0	v0.40.0	minor	Transitive	1 UNKNOWN
k8s.io/klog/v2	v2.130.1	v2.140.0	minor	Direct	-
k8s.io/api	v0.35.2	v0.35.7	patch	Direct	-
k8s.io/apimachinery	v0.35.2	v0.35.7	patch	Direct	-
k8s.io/client-go	v0.35.2	v0.35.7	patch	Direct	-

Warning

Major Version Upgrade

This update includes major version changes that may contain breaking changes. Please:

Review the changelog/release notes for breaking changes
Test thoroughly in a staging environment
Update any code that depends on changed APIs
Ensure all tests pass before merging

Security Details

🚨 Critical & High Severity (45 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
github.com/containerd/containerd	CVE-2026-50195	critical	containerd: CRI checkpoint import allows local image tag poisoning	v1.7.30	-	View
github.com/containerd/containerd	GO-2026-5338	critical	containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd	v1.7.30	-	View
github.com/containerd/containerd	GO-2026-5758	critical	containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull in github.com/containerd/containerd	v1.7.30	1.7.33	View
github.com/containerd/containerd	CVE-2026-53488	critical	containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull	v1.7.30	-	View
golang.org/x/crypto	GHSA-5cgq-3rg8-m6cv	CRITICAL	golang.org/x/crypto vulnerable to auth bypass via unenforced @Revoked status	v0.50.0	0.52.0	View
golang.org/x/crypto	GO-2026-5021	critical	Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts	v0.50.0	0.52.0	View
golang.org/x/crypto	GHSA-89gr-r52h-f8rx	CRITICAL	golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed	v0.50.0	0.52.0	View
golang.org/x/crypto	CVE-2026-39831	critical	Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh	v0.50.0	-	View
golang.org/x/crypto	GHSA-f5wc-c3c7-36mc	CRITICAL	golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys	v0.50.0	0.52.0	View
golang.org/x/crypto	CVE-2026-39834	critical	Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh	v0.50.0	-	View
golang.org/x/crypto	GHSA-rm3j-f69w-wqmq	CRITICAL	golang.org/x/crypto vulnerable to infinite loop on large channel writes	v0.50.0	0.52.0	View
golang.org/x/crypto	GO-2026-5020	critical	Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh	v0.50.0	0.52.0	View
golang.org/x/crypto	CVE-2026-39832	CRITICAL	Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent	v0.50.0	-	View
golang.org/x/crypto	CVE-2026-42508	critical	Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts	v0.50.0	-	View
golang.org/x/crypto	GO-2026-5019	critical	Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh	v0.50.0	0.52.0	View
golang.org/x/crypto	GHSA-vgwf-h737-ff37	CRITICAL	golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses	v0.50.0	0.52.0	View
golang.org/x/crypto	CVE-2026-39830	CRITICAL	Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh	v0.50.0	-	View
golang.org/x/crypto	GO-2026-5017	CRITICAL	Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh	v0.50.0	0.52.0	View
golang.org/x/crypto	GO-2026-5005	CRITICAL	Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent	v0.50.0	0.52.0	View
golang.org/x/crypto	GO-2026-5006	CRITICAL	Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent	v0.50.0	0.52.0	View
golang.org/x/crypto	GO-2026-5023	critical	Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh	v0.50.0	0.52.0	View
golang.org/x/crypto	GHSA-x527-x647-q7gg	CRITICAL	golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement	v0.50.0	0.52.0	View
golang.org/x/crypto	CVE-2026-46595	critical	Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh	v0.50.0	-	View
golang.org/x/crypto	GHSA-jppx-rxg9-jmrx	CRITICAL	golang.org/x/crypto doesn't enforce invoking key constraints	v0.50.0	0.52.0	View
golang.org/x/crypto	CVE-2026-39833	CRITICAL	Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent	v0.50.0	-	View
golang.org/x/net	GO-2026-5026	critical	Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna	v0.53.0	0.55.0	View
golang.org/x/net	CVE-2026-39821	critical	Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna	v0.53.0	-	View
github.com/containerd/containerd	GHSA-xhf5-7wjv-pqxp	HIGH	containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull	v1.7.30	1.7.33	View
github.com/containerd/containerd	GO-2026-5622	high	Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd	v1.7.30	-	View
github.com/containerd/containerd	GO-2026-5064	high	containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd	v1.7.30	-	View
github.com/containerd/containerd	GO-2026-5378	HIGH	containerd user ID handling bypass allows runAsNonRoot evasion in github.com/containerd/containerd	v1.7.30	1.7.32	View
github.com/containerd/containerd	CVE-2026-46680	HIGH	containerd user ID handling bypass allows runAsNonRoot evasion	v1.7.30	-	View
github.com/containerd/containerd	GHSA-rgh6-rfwx-v388	HIGH	Arbitrary host CRI log file read via symlink following in CRI checkpoint restore	v1.7.30	-	View
github.com/containerd/containerd	GHSA-fqw6-gf59-qr4w	HIGH	containerd user ID handling bypass allows runAsNonRoot evasion	v1.7.30	1.7.32	View
github.com/containerd/containerd	CVE-2026-53489	high	containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore	v1.7.30	-	View
github.com/containerd/containerd	CVE-2026-53492	high	containerd CRI checkpoint restore CDI annotation smuggling	v1.7.30	-	View
github.com/containerd/containerd	GHSA-33vj-92qq-66hc	HIGH	containerd CRI checkpoint restore CDI annotation smuggling	v1.7.30	-	View
golang.org/x/crypto	CVE-2026-39829	HIGH	Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh	v0.50.0	-	View
golang.org/x/crypto	GHSA-w879-237q-wc7r	HIGH	golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS	v0.50.0	0.52.0	View
golang.org/x/crypto	GO-2026-5018	HIGH	Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh	v0.50.0	0.52.0	View
golang.org/x/crypto	GO-2026-5013	high	Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh	v0.50.0	0.52.0	View
golang.org/x/crypto	CVE-2026-46597	high	Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh	v0.50.0	-	View
golang.org/x/crypto	GHSA-q4h4-gmj2-qvw2	HIGH	golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic	v0.50.0	0.52.0	View
google.golang.org/grpc	GO-2026-6061	HIGH	Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc	v1.80.0	1.82.1	View
google.golang.org/grpc	GHSA-hrxh-6v49-42gf	HIGH	gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities	v1.80.0	1.82.1	View

ℹ️ Other Vulnerabilities (34)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
github.com/containerd/containerd	GO-2026-5475	medium	containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerd	v1.7.30	1.7.33	View
github.com/containerd/containerd	CVE-2026-47262	medium	containerd image-triggered runtime DoS via unbounded group parsing	v1.7.30	-	View
go.opentelemetry.io/otel	CVE-2026-41178	medium	OpenTelemetry-Go's baggage parsing no longer caps raw header length	v1.43.0	-	View
go.opentelemetry.io/otel	GO-2026-5158	medium	Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel	v1.43.0	1.42.0	View
golang.org/x/crypto	GO-2026-5015	medium	Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh	v0.50.0	0.52.0	View
golang.org/x/crypto	CVE-2026-39835	medium	Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh	v0.50.0	-	View
golang.org/x/crypto	GO-2026-5016	medium	Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh	v0.50.0	0.52.0	View
golang.org/x/crypto	CVE-2026-39827	medium	Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh	v0.50.0	-	View
golang.org/x/crypto	CVE-2026-46598	medium	Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent	v0.50.0	-	View
golang.org/x/crypto	GO-2026-5033	medium	Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent	v0.50.0	0.52.0	View
golang.org/x/net	GO-2026-5030	medium	Invoking duplicate attributes can cause XSS in golang.org/x/net/html	v0.53.0	0.55.0	View
golang.org/x/net	CVE-2026-27136	medium	Invoking duplicate attributes can cause XSS in golang.org/x/net/html	v0.53.0	-	View
golang.org/x/net	GO-2026-5025	medium	Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html	v0.53.0	0.55.0	View
golang.org/x/net	CVE-2026-42506	medium	Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html	v0.53.0	-	View
golang.org/x/net	GO-2026-5029	medium	Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html	v0.53.0	0.55.0	View
golang.org/x/net	CVE-2026-25681	medium	Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html	v0.53.0	-	View
golang.org/x/net	GO-2026-5027	medium	Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html	v0.53.0	0.55.0	View
golang.org/x/net	CVE-2026-42502	medium	Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html	v0.53.0	-	View
golang.org/x/net	GO-2026-5028	medium	Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html	v0.53.0	0.55.0	View
golang.org/x/net	CVE-2026-25680	medium	Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html	v0.53.0	-	View
github.com/containerd/containerd	GHSA-jpcc-p29g-p8mq	MODERATE	containerd image-triggered runtime DoS via unbounded group parsing	v1.7.30	1.7.33	View
github.com/containerd/containerd	GHSA-cvxm-645q-p574	MODERATE	containerd: CRI checkpoint import allows local image tag poisoning	v1.7.30	-	View
go.opentelemetry.io/otel	GHSA-5wrp-cwcj-q835	MODERATE	opentelemetry-go's baggage parsing no longer caps raw header length	v1.43.0	-	View
golang.org/x/crypto	GHSA-qpw4-5x99-6vjp	MODERATE	golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS	v0.50.0	0.52.0	View
golang.org/x/crypto	GHSA-9m57-25v3-79x9	MODERATE	golang.org/x/crypto: Invoking pathological inputs can lead to client panic	v0.50.0	0.52.0	View
golang.org/x/crypto	GHSA-78mq-xcr3-xm33	MODERATE	golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow	v0.50.0	0.52.0	View
golang.org/x/crypto	CVE-2026-39828	MODERATE	Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh	v0.50.0	-	View
golang.org/x/crypto	GHSA-45gg-vh54-h5m9	MODERATE	golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions	v0.50.0	0.52.0	View
golang.org/x/crypto	GO-2026-5014	MODERATE	Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh	v0.50.0	0.52.0	View
golang.org/x/net	GHSA-5cv4-jp36-h3mw	MODERATE	Go Net HTML parser is vulnerable to denial of service	v0.53.0	0.55.0	View
golang.org/x/crypto	GO-2026-5932	unknown	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues	v0.50.0	-	View
golang.org/x/net	GO-2026-5942	unknown	Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage	v0.53.0	0.56.0	View
golang.org/x/sys	GO-2026-5024	unknown	Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows	v0.43.0	0.44.0	-
golang.org/x/text	GO-2026-5970	unknown	Infinite loop on invalid input in golang.org/x/text	v0.37.0	0.39.0	-

⚠️ Dependencies that have Reached EOL (1)

Dependency	Unsafe Version	EOL Date	New Version	Path	Case
github.com/opencontainers/runtime-spec	`v1.1.0`	Jul 22, 2026	`v1.3.0`	`go.mod`	-

Pausing automation
Set the case status to Blocked in Case Management to pause ADMS automation for this dependency. ADMS will skip updating it in the manifest while its case is Blocked — other dependencies in this PR (or future PRs) are unaffected. ADMS never changes a Blocked case's status automatically; move it back to Open (or another active status) yourself when you're ready to resume. See the case link in the table above.

Review Checklist

Extra review is recommended for this update:

Review changes for compatibility with your code
Check release notes for breaking changes
Run integration tests to verify service behavior
Test in staging environment before production
Monitor key metrics after deployment
Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

…: 3)

datadog-datadog-prod-us1 · 2026-07-28T14:18:59Z

✨ Unblock PR with BitsAI

⚠️ Warnings

🚦 8 Pipeline jobs failed

CI | docker-build (handler)

CI | docker-build (manager)

CI | lint-and-format

View all 8 failed jobs.

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 3b4d522 | Docs | Datadog PR Page | Give us feedback!}

gh-worker-campaigns-3e9aa4 · 2026-07-31T14:07:01Z

Auto-rebase failed: unresolvable conflicts

The following files contain non-dependency changes that cannot be automatically resolved:

vendor/modules.txt

Please rebase manually.

_{Auto-Rebase · Add no-auto-rebase to opt out}

ADMS: vuln major upgrades — 22 packages (major: 1 · minor: 18 · patch…

3b4d522

…: 3)

gh-worker-campaigns-3e9aa4 Bot added campaigner-automated-change adms-custom-action-failed adms-critical-severity adms-fixes-eol adms-go adms-high-severity adms-major-update adms-medium-severity adms-mode-all-vulns adms-dependency-update labels Jul 28, 2026

gh-worker-campaigns-3e9aa4 Bot added the rebase-conflict label Jul 31, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): vuln major upgrades — 22 packages (major: 1 · minor: 18 · patch: 3) - #1102

fix(deps): vuln major upgrades — 22 packages (major: 1 · minor: 18 · patch: 3) #1102
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/major/go/0-1785247588

gh-worker-campaigns-3e9aa4 Bot commented Jul 28, 2026

Uh oh!

datadog-datadog-prod-us1 Bot commented Jul 28, 2026 •

edited by datadog-datadog-prod-us1-2 Bot

Loading

Uh oh!

gh-worker-campaigns-3e9aa4 Bot commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

gh-worker-campaigns-3e9aa4 Bot commented Jul 28, 2026

Updates

Security Details

Review Checklist

Uh oh!

datadog-datadog-prod-us1 Bot commented Jul 28, 2026 • edited by datadog-datadog-prod-us1-2 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

Uh oh!

gh-worker-campaigns-3e9aa4 Bot commented Jul 31, 2026

Auto-rebase failed: unresolvable conflicts

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

datadog-datadog-prod-us1 Bot commented Jul 28, 2026 •

edited by datadog-datadog-prod-us1-2 Bot

Loading