[austinvazquez]

Description

Backports google.golang.org/protobuf updates for release/1.1 to resolve false positive warnings for package < 1.33.0:

1. build(deps): bump google.golang.org/protobuf from 1.27.1 to 1.28.0 #3428
2. build(deps): bump google.golang.org/protobuf from 1.28.0 to 1.28.1 #3543
3. build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.29.0 #3764
4. build(deps): bump google.golang.org/protobuf from 1.29.0 to 1.29.1 #3769
5. build(deps): bump google.golang.org/protobuf from 1.29.1 to 1.30.0 #3775
6. build(deps): bump google.golang.org/protobuf from 1.30.0 to 1.31.0 #3915
7. build(deps): bump google.golang.org/protobuf from 1.31.0 to 1.32.0 #4155
8. build(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0 #4216

[rata]

false positive warnings for package < 1.33.0

What were the warnings? How do you trigger them?

[austinvazquez]

@rata, I see the warning when running govulncheck; however, this is a false positive as runc does not use/vendor the affected packages.

[runc]$ govulncheck -mode=binary runc
=== Symbol Results ===

Vulnerability #1: GO-2024-2611
    Infinite loop in JSON unmarshaling in google.golang.org/protobuf
  More info: https://pkg.go.dev/vuln/GO-2024-2611
  Module: google.golang.org/protobuf
    Found in: google.golang.org/protobuf@v1.27.1
    Fixed in: google.golang.org/protobuf@v1.33.0
    Vulnerable symbols found:
      #1: json.Decoder.Peek
      #2: json.Decoder.Read
      #3: protojson.Unmarshal
      #4: protojson.UnmarshalOptions.Unmarshal

Your code is affected by 1 vulnerability from 1 module.
This scan found no other vulnerabilities in packages you import or modules you
require.
Use '-show verbose' for more details.
[runc]$ 

[rata]

@austinvazquez oh, govulncheck, thanks!

I've verified locally that make vendor passes fine, just in case.

LGTM.