build(deps): bump github.com/Microsoft/hcsshim from 0.12.7 to 0.12.8 #3584
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [github.com/Microsoft/hcsshim](https://github.com/Microsoft/hcsshim) from 0.12.7 to 0.12.8. - [Release notes](https://github.com/Microsoft/hcsshim/releases) - [Commits](microsoft/hcsshim@v0.12.7...v0.12.8) --- updated-dependencies: - dependency-name: github.com/Microsoft/hcsshim dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
added
dependencies
|
Changelog is a bit head scratching. Anyhow, updating to errdefs 0.3 is definitely a breaking change, so, I don't think we can update this for the time being. |
|
So, it is actually containerd 1.7.23 which updated from errdefs 0.1 to 0.3? Not sure I understand why - isn't it just breaking? Since we all moved to @AkihiroSuda not sure what the story is - are we supposed to revert to containerd/containerd/errdefs? or upgrade everything to latest errdefs? |
|
Tentatively #3585 |
|
Update: It looks like things might be fine with nerdctl 1.7 (see linked PR) For main/v2, it seems to be more of a problem though - since this commit microsoft/hcsshim@8d48d87#diff-870cda2e943cddd5b705db9dee89be152789f5e106c9a12b3ba7336adad94ddbR9 is now forcing a transitive dependency on containerd (v1.7 in their case), we would now pull that in as well and depend on containerd v1.7 again - in a context where hcsshim has been reluctant to migrate to v2 (microsoft/hcsshim#1958), and their main branch is breaking compatibility (which will require containerd changes). I am still confused as to why we would make these changes to errdefs that late in the v2 cycle. @AkihiroSuda ideally, hcsshim would retract that release - and/or we pin it here and stay on 0.12.7 until it is figured out. |
|
Needs the next RC of containerd The dependency on v1.7 is annoying but probably not worth retracting the release |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
bot
deleted the
dependabot/go_modules/github.com/Microsoft/hcsshim-0.12.8
branch
So containerd v2 will depend on containerd v1.7? |
|
Yes, at least in v2.0.0 |
And the reason is because we want to have containerd/errdefs v0.3 instead of v0.1? |
|
Yes |
I am sure it is worth it. |
To voice opinions clearly: this would be bad for anyone depending on containerd, or nerdctl, and will make things more confusing. It does not seem like there is any value in the errdefs update, and only obvious downsides - especially at a time like rc5+. We have been much more conservative on minor dependencies updates. |
|
FYI: this was discussed in: |
There does not seem to be a discussion in there. The argument about "a need to update", or "package instability" came with no issue pointed at, no details (and was first made on Jul 17). The sheer fact that the author made hcsshim revert to containerd/errdefs 1.7 makes it clear enough what is going on. |
Bumps github.com/Microsoft/hcsshim from 0.12.7 to 0.12.8.
Release notes
Sourced from github.com/Microsoft/hcsshim's releases.
Commits
8d48d87Update containerd to v1.7.23 (#2295)4ad298fFixing typo (#2289)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)