Bump dependencies

[marquiz]

Update outdated deps.

[marquiz]

@klihub @chrishenzie @mikebrow

[klihub]

@marquiz Unfortunately we can't do this across the board just like that. We are a 'library package' and a direct dependency of cri-o and containerd. If we bump any of our dependency beyond what they have now in main/HEAD, we implictly force them to bump their dependencies, too. And if we want to keep the possibility of updating NRI in still active maintenance branches, then the limitation might be more severe. And many of the deps here try to bump deps beyond what is currently in either of those runtimes main/HEAD.

So IMO, at least the lower of the current corresponding deps in cri-o and containerd main/HEAD should be considered to upper bound where we can bump to. If we think we should update some maintenance branches to our next release, then the lowest of the current corresponding deps within those becomes the upper limit.

[marquiz]

Good point. I changed the main module to bump to the lowest non-CVE-versions. I think plugins can be updated without this limitation...

[klihub]

Good point. I changed the main module to bump to the lowest non-CVE-versions. I think plugins can be updated without this limitation...

Yes, definitely. It only applies to core NRI. Plugins can be freely updated to the latest versions.

[klihub]

LGTM.

[mikebrow]

LGTM