Update containerd/continuity dependency

[nadinelyab]

v0.2.2 of containerd/continuity has a dependency that contains a CVE (CVE-2020-26160 on github.com/dgrijalva/jwt-go). This pull requests updates the version of containerd/continuity to v0.3.0 which does not contain the vulnerable dependency.

[mfridman]

This indirect dependency was pulled in because of https://github.com/ory/dockertest.

I've submitted a patch upstream ory/dockertest#352 to update https://github.com/containerd/continuity to the latest version.

You should now be able to update the ory/dockertest dependency within goose. Do you want to update this PR?

[nadinelyab]

Thanks! Updated, let me know if that looks good.

[nadinelyab]

Hi @mfridman
Any update on this?

[mfridman]

Sorry, got a bit swamped recently.

@nadinelyab Since upstream hasn't pushed a release yet, can you do:

go get github.com/ory/dockertest/v3@e38b9742dc7ddbc2e7f3079103a194b890d4ab85
go mod tidy
go mod verify

That hash is the current latest commit on `v3 branch. That should fix it up.

[nadinelyab]

Ok thanks hopefully this is alright

[mfridman]

Awesome, thank you for your contribution @nadinelyab.

Sorry for the back and forth, whenever someone submits a change to go.mod I always pull the PR and and verify standard module commands produce no changes. Such as go mod tidy and all deps are verified with go mod verify. We should probably add a check for this in CI 🤔

[VojtechVitek]

👍 Thank you