fix: update testcontainers to v0.27.0 to remediate CVE-2025-62518

[Vui-Chee]

Summary

This PR updates the testcontainers dependency from v0.24.0 to v0.27.0 to remediate CVE-2025-62518 (GHSA-j5gw-2vrg-8fgx), a HIGH severity vulnerability in tokio-tar.

Vulnerability Details

• CVE ID: CVE-2025-62518
• GHSA ID: GHSA-j5gw-2vrg-8fgx
• Severity: HIGH (CVSS 8.1)
• Issue: PAX header desynchronization allowing tar archive entry smuggling
• Affected: tokio-tar <= 0.3.1 (no patched version available)
• Fixed in: astral-tokio-tar >= 0.5.6 (replacement package)
• Impact Scope: Test framework only (ExternalNode test infrastructure)

Dependency Chain

Before:

op-rbuilder (0.3.1)
└── testcontainers (0.24.0)
    └── tokio-tar (0.3.1) ← VULNERABLE

After:

op-rbuilder (0.3.1)
└── testcontainers (0.27.0)
    └── astral-tokio-tar (0.5.6) ← FIXED

Changes Made

1. Updated Dependencies:

   • testcontainers: 0.24.0 → 0.27.0
   • Updated Cargo.lock via cargo update -p testcontainers

2. Fixed Breaking API Changes in bollard (used by testcontainers):

   • Updated imports: Config → ContainerCreateBody
   • Moved Options types to query_parameters module
   • Moved model types to separate models module
   • Removed generic type parameters from Options structs (e.g., StartContainerOptions<String> → StartContainerOptions)
   • Changed boolean Option fields to plain bools in AttachContainerOptions
   • Updated CreateImageOptions fields to use Option<String>

3. Files Modified:

   • crates/op-rbuilder/Cargo.toml: Updated testcontainers version
   • Cargo.lock: Updated dependency tree
   • crates/op-rbuilder/src/tests/framework/external.rs: Fixed API compatibility

Verification

✅ Vulnerability Remediation:

• cargo tree -i tokio-tar: Package no longer in dependency tree
• cargo tree -p testcontainers: Confirms astral-tokio-tar v0.5.6 is used
• cargo audit: No tokio-tar vulnerabilities found

✅ Compilation Checks:

• cargo build -p op-rbuilder --bin op-rbuilder: Success
• cargo build -p op-rbuilder --bin tester --features testing: Success
• cargo clippy --all-features: No warnings

✅ Test Suite:

• cargo test -p op-rbuilder --features testing: All 110 tests pass

References

• CVE-2025-62518: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62518
• GHSA-j5gw-2vrg-8fgx: GHSA-j5gw-2vrg-8fgx
• testcontainers fix: https://github.com/testcontainers/testcontainers-rs/releases/tag/v0.25.1

[julio4]

lgtm

[Vui-Chee]

@julio4 The nightly lint failed on an old crate shellexpand. But this crate is no longer maintained and seems not updated for a while. It is very likely that the CI linting checks will continue to fail.

[julio4]

@julio4 The nightly lint failed on an old crate shellexpand. But this crate is no longer maintained and seems not updated for a while. It is very likely that the CI linting checks will continue to fail.

yes I noticed I'll fix it asap and merge this!