starred/cli
1
0
Fork 0
mirror of https://github.com/docker/cli.git synced 2026-11-13 08:13:40 -04:00
Code Issues Packages Projects Releases Wiki Activity
13,317 Commits 15 Branches 332 Tags
v29.10.0-rc.2
Commit Graph
882 Commits
Author SHA1 Message Date
Sebastiaan van Stijn 2f478a083d vendor: github.com/docker/docker-credential-helpers v0.9.13 
- update to go1.27.4
- ci: use OIDC authentication for Codecov uploads
- ci: replace retired macOS 14 runner with macOS 26, add ubuntu 26.04, windows 2025
- ci: update dependabot cooldown config
- update to golangci-lint v2.15.0 (compatible with go1.27)

full diff: https://github.com/docker/docker-credential-helpers/compare/v0.9.12...v0.9.13

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-10 22:47:45 +01:00
Sebastiaan van Stijn c55feebf74 vendor: golang.org/x/text v0.44.0 
- internal/export/idna: avoid excessive work in Punycode encoding
- language: count '_' alongside '-' in ParseAcceptLanguage guard
- go.mod: update golang.org/x dependencies

full diff: https://github.com/golang/text/compare/v0.43.0...v0.44.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-10 20:26:15 +01:00
Sebastiaan van Stijn 83d2f9c986 vendor: golang.org/x/term v0.48.0 
no changes in vendored code

- go.mod: update golang.org/x dependencies

full diff: https://github.com/golang/term/compare/v0.47.0...v0.48.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-10 20:25:24 +01:00
Sebastiaan van Stijn bc9b8d9a15 vendor: golang.org/x/mod v0.43.0 
no changes in vendored code

full diff: https://github.com/golang/mod/compare/v0.42.0...v0.43.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-10 20:24:26 +01:00
Sebastiaan van Stijn 6758ba62d0 vendor: golang.org/x/sync v0.25.0 
full diff: https://github.com/golang/sync/compare/v0.24.0...v0.25.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-10 20:23:34 +01:00
Sebastiaan van Stijn 3399deb9e7 vendor: golang.org/x/sys v0.50.0 
full diff: https://github.com/golang/sys/compare/f5cb0306ac0e...v0.50.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-10 15:48:48 +01:00
Paweł Gronowski e863f84b15 vendor: github.com/moby/moby/client v0.7.0-dev (402d0a16f131) 
full diff: https://github.com/moby/moby/compare/client/v0.6.2...402d0a16f131

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-11-06 02:23:19 +01:00
Paweł Gronowski e969249cf5 vendor: github.com/moby/moby/api v1.57.0-dev (402d0a16f131) 
full diff: https://github.com/moby/moby/compare/api/v1.56.1...402d0a16f131

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-11-06 02:21:44 +01:00
Sebastiaan van Stijn e63c04ae28 vendor: github.com/moby/sys/capability v0.5.0 
full diff: https://github.com/moby/sys/compare/capability/v0.4.0...capability/v0.5.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-06 00:23:28 +01:00
Sebastiaan van Stijn 8fa64e724a vendor: golang.org/x/sys f5cb0306ac0e (fix for go1.27) 
includes a fix for https://go.dev/issue/82324

full diff: https://github.com/golang/sys/compare/v0.49.0...f5cb0306ac0e4b93b83ddd53c36d6693af3214e3

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-05 23:23:39 +01:00
Sebastiaan van Stijn 682373a887 vendor: github.com/Azure/go-ansiterm 51075c6ea6bc 
full diff: https://github.com/Azure/go-ansiterm/compare/8c912ac31dd4...51075c6ea6bc

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-05 13:44:53 +01:00
Sebastiaan van Stijn fb2fe0eac7 Merge pull request #7468 from thaJeztah/bump_otels 
vendor: go.opentelemetry.io/otel v1.47.0, contrib v0.72.0
 2026-11-03 22:57:33 +01:00
Paweł Gronowski 920919bd15 Merge pull request #7469 from thaJeztah/bump_compress 
vendor: github.com/klauspost/compress v1.20.2 (security)
 2026-11-03 22:33:58 +01:00
Paweł Gronowski beafae2696 Merge pull request #7442 from thaJeztah/bump_creds_helpers 
vendor: github.com/docker/docker-credential-helpers v0.9.12
 2026-11-03 22:30:04 +01:00
Sebastiaan van Stijn b9456fd725 vendor: github.com/klauspost/compress v1.20.2 
includes a fix for CVE-2026-116591 / [GHSA-fpmh-frq8-7rj8]

full diff: https://github.com/klauspost/compress/compare/v1.20.1...v1.20.2

[GHSA-fpmh-frq8-7rj8]: https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-03 22:27:00 +01:00
Sebastiaan van Stijn 7a75f75b96 vendor: go.opentelemetry.io/otel v1.47.0, contrib v0.72.0 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-03 22:23:13 +01:00
Sebastiaan van Stijn 77ebef3df8 vendor: github.com/moby/swarmkit/v2 v2.1.3 
full diff: https://github.com/moby/swarmkit/compare/v2.1.2...v2.1.3

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-03 21:11:01 +01:00
Sebastiaan van Stijn 82b833e57a vendor: golang.org/x/net v0.62.0 
full diff: https://github.com/golang/net/compare/v0.61.0...v0.62.0

This release addresss the following security issues:

- html: avoid quadratic complexity when coalescing text nodes

    When coalescing adjacent text nodes in addText and fosterParent,
    appending to an existing TextNode's Data via string concatenation
    (n.Data += text) reallocated and copied the accumulated string on every
    token. Inputs containing many short text runs separated by ignored end
    tags (such as "a") caused O(n^2) allocations and byte copies.

    Accumulate coalesced text in per-node byte slices during parsing and
    materialize Data strings once at the end of parse.

    Thanks to Markus Magnuson for reporting this issue.

    This is CVE-2026-78661 and Go issue https://go.dev/issue/82224.

- html: check all ancestor namespace transitions when rendering raw text

    In childTextNodesAreLiteral, walking up the tree previously stopped at
    the nearest foreign ancestor once an HTML integration point was found.
    However, that integration point may itself be a descendant of an element
    that was foster-parented into a foreign namespace (such as or
    fostered under ), causing a parser to resolve the
    subtree in a different foreign namespace upon re-parsing the rendered
    output.

    Continue walking the full ancestor chain and verify that every
    transition from a non-empty namespace occurs at an HTML integration
    point before emitting literal text.

    Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276) for reporting this issue.

    This is CVE-2026-97045 and Go issue https://go.dev/issue/82622.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-03 14:55:15 +01:00
Sebastiaan van Stijn 81e4a109a3 vendor: github.com/go-jose/go-jose/v4 v4.1.7 
Fixed Security Issues

- Thumbprint: reject invalid RSA key [GHSA-r39w-98wm-9pp6]
- json: backport stdlib fix for embedded unexported field [GHSA-27pc-rm86-68pq]
- Detect if headers are set by presence in the map [GHSA-p9j4-2j95-j4rv]
- limit RSA size in certificate verify [GHSA-v6h2-qj3f-2h6v]
- Limit recipients and signatures in JWE/JWS [GHSA-c67m-wr4h-2ccg]

Fixed

- jwk: fix bug in x5c parsing
- reject base64-encoded "null" in protected headers

Deprecated

- deprecate ParseEncrypted / ParseSigned

full diff: https://github.com/go-jose/go-jose/compare/v4.1.6...v4.1.7

[GHSA-r39w-98wm-9pp6]: https://github.com/go-jose/go-jose/security/advisories/GHSA-r39w-98wm-9pp6
[GHSA-27pc-rm86-68pq]: https://github.com/go-jose/go-jose/security/advisories/GHSA-27pc-rm86-68pq
[GHSA-p9j4-2j95-j4rv]: https://github.com/go-jose/go-jose/security/advisories/GHSA-p9j4-2j95-j4rv
[GHSA-v6h2-qj3f-2h6v]: https://github.com/go-jose/go-jose/security/advisories/GHSA-v6h2-qj3f-2h6v
[GHSA-c67m-wr4h-2ccg]: https://github.com/go-jose/go-jose/security/advisories/GHSA-c67m-wr4h-2ccg

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-03 14:24:18 +01:00
Paweł Gronowski e7ece565b2 Merge pull request #7460 from thaJeztah/bump_yaml 
vendor: go.yaml.in/yaml/v3 v3.0.6 (security)
 2026-11-03 14:20:18 +01:00
Sebastiaan van Stijn 796f9633b4 vendor: go.yaml.in/yaml/v3 v3.0.6 
resolve: hint-class literal merge-key string "<<" so it's quoted on encode

full diff: https://github.com/yaml/go-yaml/compare/v3.0.5...v3.0.6

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-03 11:54:24 +01:00
Sebastiaan van Stijn ccccec73b0 vendor: github.com/go-jose/go-jose/v4 v4.1.6 
- contains a fix for CVE-2026-116587 / [GHSA-mgcc-cww5-fp2q]

full diff: https://github.com/go-jose/go-jose/compare/v4.1.5...v4.1.6

[GHSA-mgcc-cww5-fp2q]: https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-28 22:38:48 +01:00
Sebastiaan van Stijn dd8edb6863 vendor: github.com/docker/docker-credential-helpers v0.9.12 
no changes in vendored code

full diff: https://github.com/docker/docker-credential-helpers/compare/v0.9.9...v0.9.12

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-28 14:23:04 +01:00
Sebastiaan van Stijn 6998c79cfd vendor: golang.org/x/net v0.61.0 
- quic: properly check for allowed frame types in a packet

full diff: https://github.com/golang/net/compare/v0.60.0...v0.61.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-20 13:41:27 +02:00
Sebastiaan van Stijn c7bdacad70 vendor: golang.org/x/text v0.43.0 
- secure/bidirule: lazily precompute ASCII table
- unicode/bidi: avoid quadratic behavior in Paragraph.Order and Paragraph.Line

full diff: https://github.com/golang/text/compare/v0.42.0...v0.43.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-20 13:40:24 +02:00
Sebastiaan van Stijn 1faf23e25f vendor: golang.org/x/term v0.47.0 
full diff: https://github.com/golang/term/compare/v0.46.0...v0.47.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-20 13:39:46 +02:00
Sebastiaan van Stijn b8dd18fe2c vendor: golang.org/x/sync v0.24.0 
full diff: https://github.com/golang/sync/compare/v0.23.0...v0.24.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-20 13:39:09 +02:00
Sebastiaan van Stijn a3539bd5c9 vendor: golang.org/x/mod v0.42.0 
full diff: https://github.com/golang/mod/compare/v0.41.0...v0.42.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-20 13:38:32 +02:00
Sebastiaan van Stijn adfb114576 vendor: golang.org/x/sys v0.49.0 
- cpu: add amd64 v2/v3/v4 feature bits
- darwin: expose setpriority PRIO_DARWIN_* constants
- unix/darwin: add missing pwritev test case on darwin/arm64
- unix/darwin: add O_EXEC and O_SEARCH on darwin
- unix/darwin: pass fcntl data as unsafe.Pointer in FcntlF{lock,store} on darwin
- unix/linux: don't warn about closed stderr from child process
- unix/linux: unify ppc64x syscall wrappers
- unix: add listns syscall introduced in Linux 6.19
- unix: add Mmsghdr for linux
- unix: add PrctlArg5Ptr
- unix: align the getdents buffer
- unix: extend z/OS support
- unix: keep generated types compilable with current cgo
- unix: pass xattr data as unsafe.Pointer in BSD xattr syscalls
- unix: provide linux/sparc64 assembly for syscalls
- unix: return syscall error in *listxattrNS on BSD
- unix: update glibc to 2.44
- unix: update linux to v7.2
- unix: use the stat64 family and fix Stat_t on linux/sparc64
- windows: drop arm

full diff: https://github.com/golang/sys/compare/v0.48.0...v0.49.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-20 13:37:40 +02:00
Sebastiaan van Stijn 1600418944 vendor: github.com/fvbommel/sortorder v1.2.1 
full diff: https://github.com/fvbommel/sortorder/compare/v1.2.0...v1.2.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-20 12:46:38 +02:00
Sebastiaan van Stijn 8da8b00555 vendor: github.com/Microsoft/go-winio v0.6.3 
- improve interoperability with stdlib sentinel errors and deprecate aliases

full diff: https://github.com/Microsoft/go-winio/compare/f19d9717deb0...v0.6.3

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-10 15:28:26 +02:00
Paweł Gronowski 45c2317672 Merge pull request #7366 from thaJeztah/bump_runewidth 
vendor: github.com/mattn/go-runewidth v0.0.31
 2026-10-08 22:27:38 +02:00
Paweł Gronowski 730c880b35 vendor: github.com/moby/moby/client v0.6.2 
full diff: https://github.com/moby/moby/compare/client/v0.6.1...client/v0.6.2

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-10-08 22:08:10 +02:00
Sebastiaan van Stijn e63e4fe498 vendor: github.com/mattn/go-runewidth v0.0.31 
- Treat the remaining invisible format controls as zero width
- Treat bidi isolates and other invisible format characters as zero width
- Measure ambiguous Latin letters as one cell in East Asian locales
- Fix width mismatches found by the Hegel property tests
- Recognise CJK locales regardless of charset spelling

full diff: https://github.com/mattn/go-runewidth/compare/v0.0.30...v0.0.31

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-08 21:51:14 +02:00
Paweł Gronowski e7df01fe6e Merge pull request #7361 from thaJeztah/bump_go_connections 
vendor: github.com/docker/go-connections v0.8.2
 2026-10-08 20:31:48 +02:00
Paweł Gronowski 949bf401dd vendor: golang.org/x/net v0.60.0 
full diff: https://golang.org/x/net/compare/v0.59.0...v0.60.0

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-10-08 20:25:01 +02:00
Sebastiaan van Stijn 63445d6b70 vendor: github.com/docker/go-connections v0.8.2 
v0.8.2

- sockets: preserve configured TLS ALPN protocols
- ci: add dependabot to update actions
- ci: update runners to Ubuntu 26.04
- build(deps): bump actions/checkout from 6.0.2 to 7.0.1
- build(deps): bump actions/setup-go from 6.3.0 to 7.0.0
- build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.3.0

full diff: https://github.com/docker/go-connections/compare/v0.8.1...v0.8.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-08 16:03:13 +02:00
Sebastiaan van Stijn 4ae247756e vendor: github.com/Azure/go-ansiterm 8c912ac31dd4 
- update minimum go version to go1.17
- update minimum golang.org/x/sys to v0.1.0

full diff: https://github.com/Azure/go-ansiterm/compare/e937bb47801a...8c912ac31dd4

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-07 23:56:10 +02:00
Sebastiaan van Stijn e11705385d vendor: github.com/mattn/go-runewidth v0.0.30 
- Wrap: measure grapheme clusters, not runes
- Skip grapheme segmentation for text that cannot form clusters
- Keep strings that are not valid UTF-8 on the segmenter - #111
- Take the rune fast path in the Truncate functions too

full diff: https://github.com/mattn/go-runewidth/compare/v0.0.29...v0.0.30

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-06 11:07:44 +02:00
Paweł Gronowski 48988f5c12 Merge pull request #7347 from thaJeztah/bump_containerd_logs 
vendor: github.com/containerd/log v0.2.0
 2026-10-01 22:33:07 +02:00
Sebastiaan van Stijn e3559d29fb Merge pull request #7348 from thaJeztah/bump_client 
vendor: github.com/moby/moby/client v0.6.1, moby/api v1.56.1
 2026-10-01 22:32:20 +02:00
Sebastiaan van Stijn 886ab250f0 vendor: github.com/moby/moby/client v0.6.1, moby/api v1.56.1 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-01 22:23:55 +02:00
Sebastiaan van Stijn 58eea06064 vendor: github.com/Azure/go-ansiterm e937bb47801a 
full diff: https://github.com/Azure/go-ansiterm/compare/faa5f7b0171c...e937bb47801ae0fd8fb8ff02743f6a93e2b51982

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-01 21:31:49 +02:00
Sebastiaan van Stijn 482a140ce7 Merge pull request #7345 from thaJeztah/bump_go_winio 
vendor: github.com/Microsoft/go-winio f19d9717deb0
 2026-10-01 20:00:59 +02:00
Sebastiaan van Stijn 3caafba34f vendor: github.com/containerd/log v0.2.0 
full diff: https://github.com/containerd/log/compare/v0.1.0...v0.2.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-01 19:44:52 +02:00
Sebastiaan van Stijn 07339fa78f vendor: github.com/klauspost/compress v1.20.1 
full diff: https://github.com/klauspost/compress/compare/v1.20.0...v1.20.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-01 19:34:03 +02:00
Sebastiaan van Stijn 637be3d60c vendor: github.com/klauspost/compress v1.20.0 
- Add lzw reader/writer
- ci: test against go1.27.x, drop go1.24.x
- flate: Writer L7-9 with dictionary can emit the dictionary to stream
- gzhttp: limit jitter hash to jitterBuffer bytes
- s2: arm64 assembly encoders, lowered from the amd64 avo program
- s2: clamp the Go EncodeBetter skip to match the assembly
- xpress: add Microsoft XPRESS (MS-XCA) decompression
- xxhash: bound input of non-preemptive assembly
- zstd, huff0: improved arm64 lowering, and narrow two table loads to MOVWQZX
- zstd/huff0: break false partial-register dependencies in seqdec/4X decoders
- zstd/huff0: fold two ISA-gap x86 idioms in the avo arm64 lowering

full diff: https://github.com/klauspost/compress/compare/v1.19.2...v1.20.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-01 19:33:28 +02:00
Sebastiaan van Stijn 6868874c98 vendor: github.com/Microsoft/go-winio f19d9717deb0 
full diff: https://github.com/Microsoft/go-winio/compare/v0.6.2...f19d9717deb0a33bb37c3580481dd1909782fc03

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-01 19:29:12 +02:00
Paweł Gronowski 48baf6c322 Merge pull request #7306 from thaJeztah/bump_x_deps 
vendor: update golang.org/x/* deps
 2026-09-14 18:05:00 +02:00
Paweł Gronowski 47a06aa077 Merge pull request #7293 from thaJeztah/bump_uax29 
vendor: github.com/clipperhouse/uax29/v2 v2.7.0
 2026-09-14 18:03:28 +02:00