full diff: https://github.com/golang/net/compare/v0.61.0...v0.62.0
This release addresss the following security issues:
- html: avoid quadratic complexity when coalescing text nodes
When coalescing adjacent text nodes in addText and fosterParent,
appending to an existing TextNode's Data via string concatenation
(n.Data += text) reallocated and copied the accumulated string on every
token. Inputs containing many short text runs separated by ignored end
tags (such as "a") caused O(n^2) allocations and byte copies.
Accumulate coalesced text in per-node byte slices during parsing and
materialize Data strings once at the end of parse.
Thanks to Markus Magnuson for reporting this issue.
This is CVE-2026-78661 and Go issue https://go.dev/issue/82224.
- html: check all ancestor namespace transitions when rendering raw text
In childTextNodesAreLiteral, walking up the tree previously stopped at
the nearest foreign ancestor once an HTML integration point was found.
However, that integration point may itself be a descendant of an element
that was foster-parented into a foreign namespace (such as or
fostered under ), causing a parser to resolve the
subtree in a different foreign namespace upon re-parsing the rendered
output.
Continue walking the full ancestor chain and verify that every
transition from a non-empty namespace occurs at an HTML integration
point before emitting literal text.
Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276) for reporting this issue.
This is CVE-2026-97045 and Go issue https://go.dev/issue/82622.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Replace the hardcoded list of supported OS/architecture combinations with
syntax validation using containerd/platforms.
This allows annotating manifests with platforms that are not explicitly
known to the CLI, while still rejecting missing or malformed values.
The validation uses a FormatAll/Parse roundtrip until containerd/platforms
provides a dedicated validation function.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Pass -w to the Go linker to reduce binary size while retaining the
symbol table for tools that inspect Go binaries.
For a linux/arm64 build, this reduces the CLI binary from 39,809,791
to 31,310,197 bytes: a saving of 8.5 MB (21.4%).
Place the default before caller-supplied GO_LDFLAGS so builds can
retain DWARF by passing GO_LDFLAGS="-w=0".
Before
ls -l /go/src/github.com/docker/cli/build/docker-linux-arm64
-rwxr-xr-x 1 root root 39809791 Oct 29 17:34 /go/src/github.com/docker/cli/build/docker-linux-arm64
After
ls -l /go/src/github.com/docker/cli/build/docker-linux-arm64
-rwxr-xr-x 1 root root 31310197 Oct 29 17:36 /go/src/github.com/docker/cli/build/docker-linux-arm64
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- cpu: add amd64 v2/v3/v4 feature bits
- darwin: expose setpriority PRIO_DARWIN_* constants
- unix/darwin: add missing pwritev test case on darwin/arm64
- unix/darwin: add O_EXEC and O_SEARCH on darwin
- unix/darwin: pass fcntl data as unsafe.Pointer in FcntlF{lock,store} on darwin
- unix/linux: don't warn about closed stderr from child process
- unix/linux: unify ppc64x syscall wrappers
- unix: add listns syscall introduced in Linux 6.19
- unix: add Mmsghdr for linux
- unix: add PrctlArg5Ptr
- unix: align the getdents buffer
- unix: extend z/OS support
- unix: keep generated types compilable with current cgo
- unix: pass xattr data as unsafe.Pointer in BSD xattr syscalls
- unix: provide linux/sparc64 assembly for syscalls
- unix: return syscall error in *listxattrNS on BSD
- unix: update glibc to 2.44
- unix: update linux to v7.2
- unix: use the stat64 family and fix Stat_t on linux/sparc64
- windows: drop arm
full diff: https://github.com/golang/sys/compare/v0.48.0...v0.49.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This release includes 1 security fix following the security policy:
- crypto/x509: mitigation for security concerns with a specific Certificate Authority
We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.
Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.
We highly recommend immediately upgrading to this release.
This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.
release notes: https://go.dev/doc/devel/release#go1.26.10
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Wrap errors in the OAuth manager instead of logging them, preserving
the underlying cause while allowing callers to detect startup failures.
Log failures at the fallback handler and scope the device-code login
result to its branch.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Remove extra newline before message
- Include the token in the URL (instead of requiring the user to manually
enter it on the website).
- Improve the "call to action"; ENTER can be used to automatically open
the browser (but the user can manually open it instead), and CTRL-C can
be used to cancel the login.
- Remove the "Waiting for authentication in the browser…" message, which
could be confusing if no browser was opened (yet), instead print a message
after successfully requesting the browser to be opened.
When running `docker login`;
docker login
i Info → Using web-based login. To sign in with credentials on the command line, use 'docker login -u <username>'
Your one-time device confirmation code is: NRJL-BLRL
Open this URL to authenticate: https://login.docker.com/activate?user_code=NRJL-BLRL
Press ENTER to open the URL in your browser, or Ctrl+C to cancel.
After pressing `ENTER`, it either prints the "success" message;
Press ENTER to open the URL in your browser, or Ctrl+C to cancel.
Opening browser…
or a failure when unable to launch a browser;
Press ENTER to open the URL in your browser, or Ctrl+C to cancel.
No browser found. Open the URL above manually to continue.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Before this patch, pressing `ENTER` to open the browser would silently
discard the error;
docker login
i Info → Using web-based login. To sign in with credentials on the command line, use 'docker login -u <username>'
Your one-time device confirmation code is: VGTB-VKBG
Press ENTER to open your browser or submit your device code here: https://login.docker.com/activate
Waiting for authentication in the browser…
With this patch, a failure is printed, so that the user can manually open
the URL (or cancel the login);
docker login
i Info → Using web-based login. To sign in with credentials on the command line, use 'docker login -u <username>'
Your one-time device confirmation code is: SZFX-BSGP
Press ENTER to open your browser or submit your device code here: https://login.docker.com/activate
Waiting for authentication in the browser…
No browser found. Open the URL above manually to continue.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Make the output less verbose, and combine the "web-based login" message
with the info message that's already printed.
Before this patch:
docker login
USING WEB-BASED LOGIN
i Info → To sign in with credentials on the command line, use 'docker login -u <username>'
Your one-time device confirmation code is: VVPV-NSSL
Press ENTER to open your browser or submit your device code here: https://login.docker.com/activate
Waiting for authentication in the browser…
With this patch:
docker login
i Info → Using web-based login. To sign in with credentials on the command line, use 'docker login -u <username>'
Your one-time device confirmation code is: QBBD-PQNS
Press ENTER to open your browser or submit your device code here: https://login.docker.com/activate
Waiting for authentication in the browser…
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Check the context after reading stdin to avoid launching the browser
if login was canceled while waiting for ENTER.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Running "docker nonexistent --version" printed the CLI version and
exited 0, so it couldn't be used to check whether a command or plugin
is available. Without "--version" the same invocation fails with an
"unknown command" error.
When no built-in command or plugin matches, runDocker falls through to
executing the root command, and cobra handles the "--version" flag
before the root command reports the unknown command. Unset the root
command's version in that fallback, so the standard unknown-command
error is returned.
A global "--version" flag ("docker --version nonexistent") is parsed
before the command name and still prints the version, as do
"docker --version" and "docker nonexistent --help".
Signed-off-by: Nimesh Kulkarni <167794819+GitNimay@users.noreply.github.com>
The plugin only used lazyregexp for two small, fixed name patterns.
Replaced it with regexp.MustCompile without changing validation.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Both entry points use NewRootCmd, which adds subcommands directly.
Removed the unused registry registration and constructor.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The plugin only needed progress display and an auxiliary callback.
Inlined that use while preserving cancellation and terminal handling.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Explain that variable value is optional and is taken from environment
if not set.
Clarify the meaning of ARG, and mention that ENV overrides ARG of the
same name.
Move example to the end, and refer to the Dockerfile and buildx docs
for more details (replacing the obsolete link).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Sebastiaan van Stijn
Paweł Gronowski
Sebastiaan van Stijn
Mend Renovate
dependabot[bot]
吴小白
Nimesh Kulkarni
Kir Kolyshkin