gpp_maybe Security update for containerized-data-importer

SUSE-SLE-Module-Containers-15-SP7-2026-2493

This update for containerized-data-importer fixes the following issues: - Security: re-vendor Go dependencies to address CVEs tracked against containerized-data-importer (backport of upstream PR #4110, post-v1.65.0). Fixed by this update: * google.golang.org/grpc 1.65.0 -> 1.79.3: bsc#1260295 (CVE-2026-33186) * golang.org/x/net 0.33.0 -> 0.48.0: bsc#1238699 (CVE-2025-22870), bsc#1241838 (CVE-2025-22872), bsc#1251495 (CVE-2025-47911), bsc#1251689 (CVE-2025-58190) * golang.org/x/crypto 0.31.0 -> 0.46.0: CVE-2025-22869, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181 (no separate CDI bug filed) * go.opentelemetry.io/otel 1.28.0 -> 1.41.0: CVE-2026-29181 (otel is pulled in transitively at 1.39.0 by the grpc bump; pinned to 1.41.0 so the update does not introduce it) - Record CVEs already fixed by the x/net release vendored in 1.64.0 (x/net 0.33.0), not previously noted in the changelog: bsc#1236523 (CVE-2023-45288), bsc#1230323 (CVE-2023-39325)

• Release Date
  Jun 22 2026
• References
  Bugzilla: 1241838, 1251495, 1260295, 1236523, 1251689, 1230323, 1238699
  CVEs: CVE-2025-58181, CVE-2025-22870, CVE-2025-47914, CVE-2026-29181, CVE-2025-22872, CVE-2023-45288, CVE-2025-47913, CVE-2025-22869, CVE-2026-33186, CVE-2023-39325, CVE-2025-58190, CVE-2025-47911
• Type
  security
• Severity
  important

cloud_download Downloads

Containers Module 15.7 aarch64

• Packages
  containerized-data-importer
  Container native virtualization

  1.64.0-150700.9.11.1 lock src

  containerized-data-importer-manifests
  YAML manifests used to install CDI

  1.64.0-150700.9.11.1 lock rpm

Containers Module 15.7 x86_64

• Packages
  containerized-data-importer
  Container native virtualization

  1.64.0-150700.9.11.1 lock src

  containerized-data-importer-manifests
  YAML manifests used to install CDI

  1.64.0-150700.9.11.1 lock rpm