GitHub Actions retired macOS 14 runners on November 2, 2026.
Replace macos-14 with macos-26 to continue testing on supported
macOS versions.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- --help before a subcommand is parsed as the root's persistent flag and
stripped from args, which works for most subcommands since they share
the same flag object with root
- run/create register their own local help flag (no -h, to avoid a
shorthand clash with --hostname), which shadows root's and never saw
the value, so the container ran instead of printing usage
- propagate the parsed value into a subcommand's local help flag when
one shadows the root's, in HandleGlobalFlags
Fixes#7473
Signed-off-by: Nick Sieger <nick@nicksieger.com>
Since commit f7a909d56b, ContainerContext.Names returns an empty string
when truncating and every name of the container contains a slash. Before
that change, all names were printed in that case.
Classic Swarm prefixes container names with the node-name
("/<node-name>/<container-name>"), so `docker ps` against a classic Swarm
API printed an empty NAMES column.
Restore the fallback to printing all names when no name without slashes
is found.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Drew Erny <derny@mirantis.com>
follow-up to 18958e4c02, which updated
the e2e workflow, but forgot to update the other workflows.
Replace the CODECOV_TOKEN secret with GitHub Actions OIDC authentication.
Codecov supports tokenless uploads for public repositories, but
authenticated uploads are still needed to protect coverage results on
protected branches from unauthorized uploads.
Grant `id-token: write` at the job level to allow Codecov to request
a short-lived OIDC token. This permission does not grant repository
write access, and scoping it to the job avoids granting it to other
jobs added to the workflow in the future.
Coverage uploads from forked pull requests continue to use Codecov's
tokenless upload mechanism.
See https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Replace the CODECOV_TOKEN secret with GitHub Actions OIDC authentication.
Codecov supports tokenless uploads for public repositories, but
authenticated uploads are still needed to protect coverage results on
protected branches from unauthorized uploads.
Grant `id-token: write` at the job level to allow Codecov to request
a short-lived OIDC token. This permission does not grant repository
write access, and scoping it to the job avoids granting it to other
jobs added to the workflow in the future.
Coverage uploads from forked pull requests continue to use Codecov's
tokenless upload mechanism.
See https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
OTEL providers provided by this library to plugins were not properly
shut down. Metrics from the CLI were forcibly flushed in a separate area
and the `buildx` command does its own flushing, but this didn't apply to
traces.
Add shutdown on post run for plugins using `OnFinalize`. This will allow
compose to use the tracer provider from this library rather than roll
its own custom one.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
full diff: https://github.com/golang/net/compare/v0.61.0...v0.62.0
This release addresss the following security issues:
- html: avoid quadratic complexity when coalescing text nodes
When coalescing adjacent text nodes in addText and fosterParent,
appending to an existing TextNode's Data via string concatenation
(n.Data += text) reallocated and copied the accumulated string on every
token. Inputs containing many short text runs separated by ignored end
tags (such as "a") caused O(n^2) allocations and byte copies.
Accumulate coalesced text in per-node byte slices during parsing and
materialize Data strings once at the end of parse.
Thanks to Markus Magnuson for reporting this issue.
This is CVE-2026-78661 and Go issue https://go.dev/issue/82224.
- html: check all ancestor namespace transitions when rendering raw text
In childTextNodesAreLiteral, walking up the tree previously stopped at
the nearest foreign ancestor once an HTML integration point was found.
However, that integration point may itself be a descendant of an element
that was foster-parented into a foreign namespace (such as or
fostered under ), causing a parser to resolve the
subtree in a different foreign namespace upon re-parsing the rendered
output.
Continue walking the full ancestor chain and verify that every
transition from a non-empty namespace occurs at an HTML integration
point before emitting literal text.
Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276) for reporting this issue.
This is CVE-2026-97045 and Go issue https://go.dev/issue/82622.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Replace the hardcoded list of supported OS/architecture combinations with
syntax validation using containerd/platforms.
This allows annotating manifests with platforms that are not explicitly
known to the CLI, while still rejecting missing or malformed values.
The validation uses a FormatAll/Parse roundtrip until containerd/platforms
provides a dedicated validation function.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Pass -w to the Go linker to reduce binary size while retaining the
symbol table for tools that inspect Go binaries.
For a linux/arm64 build, this reduces the CLI binary from 39,809,791
to 31,310,197 bytes: a saving of 8.5 MB (21.4%).
Place the default before caller-supplied GO_LDFLAGS so builds can
retain DWARF by passing GO_LDFLAGS="-w=0".
Before
ls -l /go/src/github.com/docker/cli/build/docker-linux-arm64
-rwxr-xr-x 1 root root 39809791 Oct 29 17:34 /go/src/github.com/docker/cli/build/docker-linux-arm64
After
ls -l /go/src/github.com/docker/cli/build/docker-linux-arm64
-rwxr-xr-x 1 root root 31310197 Oct 29 17:36 /go/src/github.com/docker/cli/build/docker-linux-arm64
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sebastiaan van Stijn
Sebastiaan van Stijn
Paweł Gronowski
Mend Renovate
Nick Sieger
Drew ErnyandClaude Opus 5.5
Jonathan A. Sternberg
dependabot[bot]
吴小白