- --help before a subcommand is parsed as the root's persistent flag and
stripped from args, which works for most subcommands since they share
the same flag object with root
- run/create register their own local help flag (no -h, to avoid a
shorthand clash with --hostname), which shadows root's and never saw
the value, so the container ran instead of printing usage
- propagate the parsed value into a subcommand's local help flag when
one shadows the root's, in HandleGlobalFlags
Fixes#7473
Signed-off-by: Nick Sieger <nick@nicksieger.com>
follow-up to 18958e4c02, which updated
the e2e workflow, but forgot to update the other workflows.
Replace the CODECOV_TOKEN secret with GitHub Actions OIDC authentication.
Codecov supports tokenless uploads for public repositories, but
authenticated uploads are still needed to protect coverage results on
protected branches from unauthorized uploads.
Grant `id-token: write` at the job level to allow Codecov to request
a short-lived OIDC token. This permission does not grant repository
write access, and scoping it to the job avoids granting it to other
jobs added to the workflow in the future.
Coverage uploads from forked pull requests continue to use Codecov's
tokenless upload mechanism.
See https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Replace the CODECOV_TOKEN secret with GitHub Actions OIDC authentication.
Codecov supports tokenless uploads for public repositories, but
authenticated uploads are still needed to protect coverage results on
protected branches from unauthorized uploads.
Grant `id-token: write` at the job level to allow Codecov to request
a short-lived OIDC token. This permission does not grant repository
write access, and scoping it to the job avoids granting it to other
jobs added to the workflow in the future.
Coverage uploads from forked pull requests continue to use Codecov's
tokenless upload mechanism.
See https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
OTEL providers provided by this library to plugins were not properly
shut down. Metrics from the CLI were forcibly flushed in a separate area
and the `buildx` command does its own flushing, but this didn't apply to
traces.
Add shutdown on post run for plugins using `OnFinalize`. This will allow
compose to use the tracer provider from this library rather than roll
its own custom one.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
full diff: https://github.com/golang/net/compare/v0.61.0...v0.62.0
This release addresss the following security issues:
- html: avoid quadratic complexity when coalescing text nodes
When coalescing adjacent text nodes in addText and fosterParent,
appending to an existing TextNode's Data via string concatenation
(n.Data += text) reallocated and copied the accumulated string on every
token. Inputs containing many short text runs separated by ignored end
tags (such as "a") caused O(n^2) allocations and byte copies.
Accumulate coalesced text in per-node byte slices during parsing and
materialize Data strings once at the end of parse.
Thanks to Markus Magnuson for reporting this issue.
This is CVE-2026-78661 and Go issue https://go.dev/issue/82224.
- html: check all ancestor namespace transitions when rendering raw text
In childTextNodesAreLiteral, walking up the tree previously stopped at
the nearest foreign ancestor once an HTML integration point was found.
However, that integration point may itself be a descendant of an element
that was foster-parented into a foreign namespace (such as or
fostered under ), causing a parser to resolve the
subtree in a different foreign namespace upon re-parsing the rendered
output.
Continue walking the full ancestor chain and verify that every
transition from a non-empty namespace occurs at an HTML integration
point before emitting literal text.
Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276) for reporting this issue.
This is CVE-2026-97045 and Go issue https://go.dev/issue/82622.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Replace the hardcoded list of supported OS/architecture combinations with
syntax validation using containerd/platforms.
This allows annotating manifests with platforms that are not explicitly
known to the CLI, while still rejecting missing or malformed values.
The validation uses a FormatAll/Parse roundtrip until containerd/platforms
provides a dedicated validation function.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Pass -w to the Go linker to reduce binary size while retaining the
symbol table for tools that inspect Go binaries.
For a linux/arm64 build, this reduces the CLI binary from 39,809,791
to 31,310,197 bytes: a saving of 8.5 MB (21.4%).
Place the default before caller-supplied GO_LDFLAGS so builds can
retain DWARF by passing GO_LDFLAGS="-w=0".
Before
ls -l /go/src/github.com/docker/cli/build/docker-linux-arm64
-rwxr-xr-x 1 root root 39809791 Oct 29 17:34 /go/src/github.com/docker/cli/build/docker-linux-arm64
After
ls -l /go/src/github.com/docker/cli/build/docker-linux-arm64
-rwxr-xr-x 1 root root 31310197 Oct 29 17:36 /go/src/github.com/docker/cli/build/docker-linux-arm64
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
TerminatePrompt created a pipe for the prompt's stdin but discarded the
write end. Once the garbage collector finalized it, the write end was
closed, the prompt read EOF and treated it as "no", and the command
returned "prune has been cancelled" instead of prompt.ErrTerminated.
This keeps both ends of the pipe referenced and closes them in t.Cleanup.
This change also drops the OutBuffer().Len() check:
the writer hook only fires after
the write has completed, so the check proved nothing, and it raced with
the prompt's later writes under -race.
This change also applies the same fix to the identical copy in cmd/docker-trust.
Signed-off-by: Hamir <hirehamir@gmail.com>
Mend Renovate
Sebastiaan van Stijn
Nick Sieger
Sebastiaan van Stijn
Jonathan A. Sternberg
Paweł Gronowski
dependabot[bot]
吴小白
Hamir