starred/cli
1
0
Fork 0
mirror of https://github.com/docker/cli.git synced 2026-09-27 17:56:04 -04:00
Code Issues Packages Projects Releases Wiki Activity
13,007 Commits 15 Branches 323 Tags
175b4e0a989df951c3ac299136c566cbe7cb3af0
Commit Graph
13007 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Sebastiaan van Stijn 4e6e8fe5c8 vendor: github.com/docker/go-connections v0.8.0 
- sockets: set socket permissions without overriding umask
- sockets: improve abstract Unix socket handling
- sockets: InmemSocket: add DialContext
- sockets: remove double error decoration
- sockets: test-enhancements and improve coverage

full diff: https://github.com/docker/go-connections/compare/v0.7.0...v0.8.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-25 19:47:59 +02:00
Sebastiaan van Stijn 5b21d378b0 Merge pull request #7118 from docker/dependabot/github_actions/codeql-actions-15f4d34eb1 
build(deps): bump the codeql-actions group with 3 updates
 2026-07-25 04:05:04 +02:00
Sebastiaan van Stijn 532dcc37f5 vendor: google.golang.org/grpc v1.82.1 
Fixes xDS RBAC and HTTP/2 Vulnerabilities: GHSA-hrxh-6v49-42gf

full diff: https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-25 03:59:22 +02:00
Sebastiaan van Stijn 19a0ee3926 Merge pull request #7113 from nikolauspschuetz/test-device-opts-validators 
opts: add tests for weight/throttle device opts validators
 2026-07-25 02:16:11 +02:00
Sebastiaan van Stijn c700ac42b6 Merge pull request #7103 from hirehamir/fix/stray-pipe-in-docker-create-help-message 
fix: stray `|` pipe in `docker create --help`
 2026-07-25 02:01:52 +02:00
Sebastiaan van Stijn 03b45495db Merge pull request #7116 from docker/dependabot/github_actions/actions/setup-go-7.0.0 
build(deps): bump actions/setup-go from 6.5.0 to 7.0.0
 2026-07-25 01:51:41 +02:00
Sebastiaan van Stijn 8061c90dcd Merge pull request #7110 from HajimohammadiNet/fix-container-rm-force-output 
container rm: suppress forced not found errors
 2026-07-25 01:50:41 +02:00
Sebastiaan van Stijn 80698fa987 Merge pull request #7120 from docker/dependabot/github_actions/actions/checkout-7.0.1 
build(deps): bump actions/checkout from 7.0.0 to 7.0.1
 2026-07-25 01:41:59 +02:00
AmirHossein HajiMohammadi ee4c249cc2 container rm: suppress forced not found errors 
Signed-off-by: AmirHossein HajiMohammadi <a.hajimohammadi@rahkar.team>
 2026-07-24 17:38:57 +03:30
Sebastiaan van Stijn 9391c9889c Merge pull request #7119 from thaJeztah/bump_go_archive_0.2.1 
vendor: github.com/moby/go-archive v0.2.1
 2026-07-24 12:11:36 +02:00
dependabot[bot] 90d14d3e7e build(deps): bump actions/checkout from 7.0.0 to 7.0.1 
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 08:43:24 +00:00
Sebastiaan van Stijn 349fad1635 vendor: github.com/moby/go-archive v0.2.1 
full diff: https://github.com/moby/go-archive/compare/v0.2.0...v0.2.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-23 23:05:30 +02:00
dependabot[bot] a3ea9a43e0 build(deps): bump the codeql-actions group with 3 updates 
Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

Updates `github/codeql-action/autobuild` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-23 08:46:14 +00:00
dependabot[bot] fd78fdc62d build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-22 08:46:48 +00:00
Nikolaus Schuetz 8f3477fca1 Add tests for weight/throttle device opts validators 
opts/weightdevice.go and opts/throttledevice.go had no tests, unlike the
sibling opts. Add table-driven coverage for ValidateWeightDevice,
ValidateThrottleBpsDevice, ValidateThrottleIOpsDevice and the Set/GetList
paths, including boundary (weight 0/10/1000/overflow) and error cases.

Signed-off-by: Nikolaus Schuetz <nikolauspschuetz@gmail.com>
 2026-07-20 13:47:09 -07:00
Paweł Gronowski 7a54334eb0 Merge pull request #7082 from thaJeztah/prompt_cleans_step1 
internal/prompt: Confirm: don't wrap stdIn
 2026-07-20 17:29:42 +02:00
Sebastiaan van Stijn 617d772fcc Merge pull request #7112 from vvoland/makesocket 
docker.Makefile: Use active context socket
 2026-07-17 17:52:07 +02:00
Paweł Gronowski 7aef4c8479 docker.Makefile: Use active context socket 
The development and e2e containers hard-code /var/run/docker.sock, so
rootless and other local contexts cannot expose their daemon socket.
Resolve the active context's Docker endpoint and strip the unix scheme
before using it as the bind source.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-07-17 15:33:12 +02:00
Paweł Gronowski dc997612d0 Merge pull request #7007 from lohitkolluri/e2e/private-registry-pull-push-5965 
e2e: add private registry pull/push regression test
 2026-07-16 14:18:00 +02:00
Sebastiaan van Stijn 7ea9e2158c Merge pull request #7107 from docker/dependabot/github_actions/codeql-actions-e021b9f00e 
build(deps): bump the codeql-actions group with 3 updates
 2026-07-16 02:01:21 +02:00
dependabot[bot] 3519704227 build(deps): bump the codeql-actions group with 3 updates 
Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.36.3 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `github/codeql-action/autobuild` from 4.36.3 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `github/codeql-action/analyze` from 4.36.3 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 08:46:00 +00:00
Hamir 0133bfa4fd fix: stray | pipe in docker create --help 
Signed-off-by: Hamir <hirehamir@gmail.com>
 2026-07-10 17:38:18 -07:00
Sebastiaan van Stijn 09754bc280 Merge pull request #7100 from docker/dependabot/github_actions/docker-actions-4dfd9f9ba8 
build(deps): bump docker/login-action from 4.3.0 to 4.4.0 in the docker-actions group
 2026-07-10 19:47:32 +02:00
Paweł Gronowski 48370883e0 Merge pull request #7102 from vvoland/sync-master 
gha/sync-release-branch: Use actions write permission
 2026-07-10 19:35:02 +02:00
Paweł Gronowski 18d4f4ff6d gha/sync-release-branch: Use actions write permission 
`workflows` is not a supported GITHUB_TOKEN permission key, so GitHub
rejects the workflow definition. Use the valid `actions` permission
for both jobs.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-07-10 17:06:49 +02:00
Sebastiaan van Stijn 1423089969 Merge pull request #7101 from vvoland/sync-master 
sync-release-branch: Run from master against selected release
 2026-07-10 15:22:02 +02:00
Paweł Gronowski 5853360a94 gha/sync-release-branch: Add workflows write permission 
Without it GitHub rejects the push:

```
refusing to allow a GitHub App to create or update workflow `.github/workflows/build.yml` without `workflows` permission
```

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-07-10 13:49:45 +02:00
Paweł Gronowski f816d5c003 sync-release-branch: Run from master against selected release 
The workflow previously inferred its target from the dispatch ref,
requiring operators to always sync the release branch with the
workflow/scripts on master.

Accept the release branch as an input, keep the dispatched master
checkout as the script source, and merge in a detached worktree at the
selected release revision.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-07-10 13:49:45 +02:00
Paweł Gronowski 25a1d41669 Merge pull request #7094 from thaJeztah/rm_go_reportcard 
README: remove Go Report Card badge
 2026-07-10 12:27:07 +02:00
dependabot[bot] 45d1a6cccf build(deps): bump docker/login-action in the docker-actions group 
Bumps the docker-actions group with 1 update: [docker/login-action](https://github.com/docker/login-action).


Updates `docker/login-action` from 4.3.0 to 4.4.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/c99871dec2022cc055c062a10cc1a1310835ceb4...af1e73f918a031802d376d3c8bbc3fe56130a9b0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-10 08:46:40 +00:00
Sebastiaan van Stijn ba55f0c3b1 Merge pull request #7096 from docker/dependabot/github_actions/docker-actions-c21f7ea42a 
build(deps): bump the docker-actions group with 3 updates
 2026-07-10 08:39:04 +02:00
Sebastiaan van Stijn 9c1b7fc671 Merge pull request #7095 from docker/dependabot/github_actions/codeql-actions-920a780463 
build(deps): bump the codeql-actions group with 3 updates
 2026-07-10 08:37:26 +02:00
Sebastiaan van Stijn a8ddac1a8e Merge pull request #7098 from vvoland/sync-editor 
scripts/sync-branch: Fix non-interactive merge
 2026-07-10 08:31:05 +02:00
mickael emirkanian 2d978b80ae docs(authz): clarify daemon parsing semantics 
Signed-off-by: mickael emirkanian <mickael.emirkanian@docker.com>
 2026-07-09 13:36:32 -04:00
Paweł Gronowski f57e528457 scripts/sync-branch: Fix non-interactive merge 
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-07-09 16:51:33 +02:00
Sebastiaan van Stijn 9ba113bc5d Merge pull request #7091 from vvoland/gha-sync-release 
gha: Add release branch sync workflow
 2026-07-09 14:29:42 +02:00
dependabot[bot] cd79c7ebfc build(deps): bump the docker-actions group with 3 updates 
Bumps the docker-actions group with 3 updates: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action), [docker/login-action](https://github.com/docker/login-action) and [docker/metadata-action](https://github.com/docker/metadata-action).


Updates `docker/setup-buildx-action` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5...bb05f3f5519dd87d3ba754cc423b652a5edd6d2c)

Updates `docker/login-action` from 4.2.0 to 4.3.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...c99871dec2022cc055c062a10cc1a1310835ceb4)

Updates `docker/metadata-action` from 6.1.0 to 6.2.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](https://github.com/docker/metadata-action/compare/80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9...dc802804100637a589fabce1cb79ff13a1411302)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-actions
- dependency-name: docker/login-action
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-actions
- dependency-name: docker/metadata-action
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 08:47:18 +00:00
dependabot[bot] 042528819a build(deps): bump the codeql-actions group with 3 updates 
Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.36.2 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a)

Updates `github/codeql-action/autobuild` from 4.36.2 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a)

Updates `github/codeql-action/analyze` from 4.36.2 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 08:46:24 +00:00
Sebastiaan van Stijn 8c9e2f353e README: remove Go Report Card badge 
The project was sunset;

> After more than a decade of serving the ecosystem, the time
> has come to sunset Go Report Card. Following the loss of our
> primary infrastructure sponsor, maintaining the web app is
> no longer sustainable.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-09 01:03:31 +02:00
Sebastiaan van Stijn a86b9aa542 Merge pull request #7090 from docker/dependabot/go_modules/cmd/docker-trust/go_modules-a3c8a40308 
build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /cmd/docker-trust in the go_modules group across 1 directory
 2026-07-08 23:31:27 +02:00
Paweł Gronowski 182f56fe8c gha: Add release branch sync workflow 
Add a manually dispatched workflow for maintainers to sync a Docker
release branch to a selected release tag.

The sync-release-branch job checks out the release branch, computes
the list of unmerged tags up to the requested tag via
scripts/unmerged-tags, merges them in order via scripts/sync-branch
using git merge --no-ff (resolving conflicts by taking the tag's
content), then pushes the result to a temporary branch.

The push-release-branch job runs after manual approval via the
docker-releases environment. It verifies that neither the release
branch nor the temporary branch moved since the sync job ran before
force-advancing the release branch and deleting the temporary branch.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-07-08 20:22:22 +02:00
Sebastiaan van Stijn e5c424fd70 Merge pull request #7092 from docker/dependabot/github_actions/docker-actions-78c0e55afe 
build(deps): bump the docker-actions group with 2 updates
 2026-07-08 15:00:29 +02:00
dependabot[bot] 145e7f83cd build(deps): bump the docker-actions group with 2 updates 
Bumps the docker-actions group with 2 updates: [docker/bake-action](https://github.com/docker/bake-action) and [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action).


Updates `docker/bake-action` from 7.2.0 to 7.3.0
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/6614cfa25eff9a0b2b2697efb0b6159e7680d584...d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b)

Updates `docker/setup-qemu-action` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/06116385d9baf250c9f4dcb4858b16962ea869c3...96fe6ef7f33517b61c61be40b68a1882f3264fb8)

---
updated-dependencies:
- dependency-name: docker/bake-action
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-actions
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-08 10:20:16 +00:00
Paweł Gronowski e8ded3fce7 Merge pull request #7085 from thaJeztah/dependabot_group 
gha: dependabot: group docker/* and codeql action updates
 2026-07-08 12:15:03 +02:00
dependabot[bot] 91db63cf5b build(deps): bump golang.org/x/crypto 
Bumps the go_modules group with 1 update in the /cmd/docker-trust directory: [golang.org/x/crypto](https://github.com/golang/crypto).


Updates `golang.org/x/crypto` from 0.50.0 to 0.52.0
- [Commits](https://github.com/golang/crypto/compare/v0.50.0...v0.52.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.52.0
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-08 09:15:41 +00:00
Paweł Gronowski d4218f26dc Merge pull request #7087 from thaJeztah/update_go1.26.5 
update to go1.26.5
 2026-07-08 11:14:40 +02:00
Sebastiaan van Stijn 6d245daa91 update to go1.26.5 
go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls
and os packages, as well as bug fixes to the compiler, the runtime, the
go command, and the net, os, and syscall packages. See the Go 1.26.5
milestone on our issue tracker for details;

- https://github.com/golang/go/issues?q=milestone%3AGo1.26.5+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.26.4...go1.26.5

From the security announcement:

We have just released Go versions 1.26.5 and 1.25.12, minor point releases.

These releases include 2 security fixes following the security policy:

- os: Root escape via symlink plus trailing slash

  On Unix systems, opening a file in an os.Root improperly
  followed symlinks to locations outside of the Root when
  the final path component of the a path is a symbolic link
  and the path ends in /.

  For example, root.Open("symlink/") would open "symlink"
  even when "symlink" is a symbolic link pointing outside of the root.

  On Unix, openat(fd, path, O_NOFOLLOW) will follow symlinks
  in path when path ends in a /. Root failed to account for
  this behavior, permitting paths with a trailing / to escape.
  It now properly sanitizes the path parameter provided to openat.

  hanks to Mundur for reporting this issue.

  This is CVE-2026-39822 and Go issue https://go.dev/issue/79005.

- crypto/tls: Encrypted Client Hello privacy leak

  he Encrypted Client Hello implementation would leak the pre-shared key
  dentities during the handshake, allowing a passive network observer who can
  ollect handshakes to de-anonymize the hostname of the server, even when ECH was
  eing used.

  Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.

  This is CVE-2026-42505 and Go issue https://go.dev/issue/79282.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-08 00:01:42 +02:00
Sebastiaan van Stijn 2282b23f02 gha: dependabot: group docker/* and codeql action updates 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-07 15:56:25 +02:00
Sebastiaan van Stijn fd3497683d internal/prompt: Confirm: don't wrap stdIn 
This was a remnant from when `PromptForConfirmation` accepted a `InStream`;
it was added in [moby@30b8f08], which got left behind when [cli@37ccc00]
updated its signature to accept a plain `io.Reader`.

While updating, also update the comment to provide more context on the reason
we're unconditionally using `os.Stdin` on Windows.

[moby@30b8f08]: https://github.com/moby/moby/commit/30b8f084436a2a1d5e8523fcd2c5ea64cc805224
[cli@37ccc00]: https://github.com/docker/cli/commit/37ccc00d0e14461bcf29e98669773625dfed2fce

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-07 14:19:44 +02:00
Sebastiaan van Stijn 2abf92e95c cli/command: PromptUserForCredentials: don't mutate cli 
PromptUserForCredentials accepted a Cli as argument so that it could swap
the input stream on Windows (cli.SetIn).

Given that we only require this swap for the duration of this function (if
needed at all), we can use a local variable that either uses cli.In() or
os.Stdin (on Windows).

We currently still need to wrap the os.Stdin into a streams.In, but can use
the raw os.Stdin (and/or cli.In().File()) once prompt.DisableInputEcho is
updated.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-07 14:19:20 +02:00