starred/cli
1
0
Fork 0
mirror of https://github.com/docker/cli.git synced 2026-08-27 10:05:33 -05:00
Code Issues Packages Projects Releases Wiki Activity
12,939 Commits 13 Branches 320 Tags
v29.7.0
Commit Graph
252 Commits
Author SHA1 Message Date
dependabot[bot]andGitHub af626e1ed7 build(deps): bump the codeql-actions group across 1 directory with 3 updates 
Bumps the codeql-actions group with 3 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.1 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)

Updates `github/codeql-action/autobuild` from 4.37.1 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)

Updates `github/codeql-action/analyze` from 4.37.1 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-30 08:46:12 +00:00
CrazyMaxandCrazyMax ad8dce1012 ci: use docker github builder to build bin image 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-07-29 16:32:49 +02:00
Paweł Gronowski 52b1160c85 gha: bump docker/login-action from 4.4.0 to 4.5.0 
OIDC login requires docker/login-action v4.5.0 or newer

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-07-28 15:38:23 +02:00
Paweł Gronowski 5ff2ff6311 gha/build: Use OIDC for Docker Hub login 
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-07-28 14:28:40 +02:00
Sebastiaan van StijnandGitHub 5b21d378b0 Merge pull request #7118 from docker/dependabot/github_actions/codeql-actions-15f4d34eb1 
build(deps): bump the codeql-actions group with 3 updates
 2026-07-25 04:05:04 +02:00
Sebastiaan van StijnandGitHub 03b45495db Merge pull request #7116 from docker/dependabot/github_actions/actions/setup-go-7.0.0 
build(deps): bump actions/setup-go from 6.5.0 to 7.0.0
 2026-07-25 01:51:41 +02:00
dependabot[bot]andGitHub 90d14d3e7e build(deps): bump actions/checkout from 7.0.0 to 7.0.1 
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 08:43:24 +00:00
dependabot[bot]andGitHub a3ea9a43e0 build(deps): bump the codeql-actions group with 3 updates 
Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

Updates `github/codeql-action/autobuild` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-23 08:46:14 +00:00
dependabot[bot]andGitHub fd78fdc62d build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-22 08:46:48 +00:00
dependabot[bot]andGitHub 3519704227 build(deps): bump the codeql-actions group with 3 updates 
Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.36.3 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `github/codeql-action/autobuild` from 4.36.3 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `github/codeql-action/analyze` from 4.36.3 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 08:46:00 +00:00
Sebastiaan van StijnandGitHub 09754bc280 Merge pull request #7100 from docker/dependabot/github_actions/docker-actions-4dfd9f9ba8 
build(deps): bump docker/login-action from 4.3.0 to 4.4.0 in the docker-actions group
 2026-07-10 19:47:32 +02:00
Paweł Gronowski 18d4f4ff6d gha/sync-release-branch: Use actions write permission 
`workflows` is not a supported GITHUB_TOKEN permission key, so GitHub
rejects the workflow definition. Use the valid `actions` permission
for both jobs.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-07-10 17:06:49 +02:00
Paweł Gronowski 5853360a94 gha/sync-release-branch: Add workflows write permission 
Without it GitHub rejects the push:

```
refusing to allow a GitHub App to create or update workflow `.github/workflows/build.yml` without `workflows` permission
```

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-07-10 13:49:45 +02:00
Paweł Gronowski f816d5c003 sync-release-branch: Run from master against selected release 
The workflow previously inferred its target from the dispatch ref,
requiring operators to always sync the release branch with the
workflow/scripts on master.

Accept the release branch as an input, keep the dispatched master
checkout as the script source, and merge in a detached worktree at the
selected release revision.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-07-10 13:49:45 +02:00
dependabot[bot]andGitHub 45d1a6cccf build(deps): bump docker/login-action in the docker-actions group 
Bumps the docker-actions group with 1 update: [docker/login-action](https://github.com/docker/login-action).


Updates `docker/login-action` from 4.3.0 to 4.4.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/c99871dec2022cc055c062a10cc1a1310835ceb4...af1e73f918a031802d376d3c8bbc3fe56130a9b0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-10 08:46:40 +00:00
Sebastiaan van StijnandGitHub ba55f0c3b1 Merge pull request #7096 from docker/dependabot/github_actions/docker-actions-c21f7ea42a 
build(deps): bump the docker-actions group with 3 updates
 2026-07-10 08:39:04 +02:00
Sebastiaan van StijnandGitHub 9c1b7fc671 Merge pull request #7095 from docker/dependabot/github_actions/codeql-actions-920a780463 
build(deps): bump the codeql-actions group with 3 updates
 2026-07-10 08:37:26 +02:00
Sebastiaan van StijnandGitHub 9ba113bc5d Merge pull request #7091 from vvoland/gha-sync-release 
gha: Add release branch sync workflow
 2026-07-09 14:29:42 +02:00
dependabot[bot]andGitHub cd79c7ebfc build(deps): bump the docker-actions group with 3 updates 
Bumps the docker-actions group with 3 updates: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action), [docker/login-action](https://github.com/docker/login-action) and [docker/metadata-action](https://github.com/docker/metadata-action).


Updates `docker/setup-buildx-action` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5...bb05f3f5519dd87d3ba754cc423b652a5edd6d2c)

Updates `docker/login-action` from 4.2.0 to 4.3.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...c99871dec2022cc055c062a10cc1a1310835ceb4)

Updates `docker/metadata-action` from 6.1.0 to 6.2.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](https://github.com/docker/metadata-action/compare/80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9...dc802804100637a589fabce1cb79ff13a1411302)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-actions
- dependency-name: docker/login-action
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-actions
- dependency-name: docker/metadata-action
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 08:47:18 +00:00
dependabot[bot]andGitHub 042528819a build(deps): bump the codeql-actions group with 3 updates 
Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.36.2 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a)

Updates `github/codeql-action/autobuild` from 4.36.2 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a)

Updates `github/codeql-action/analyze` from 4.36.2 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 08:46:24 +00:00
Paweł Gronowski 182f56fe8c gha: Add release branch sync workflow 
Add a manually dispatched workflow for maintainers to sync a Docker
release branch to a selected release tag.

The sync-release-branch job checks out the release branch, computes
the list of unmerged tags up to the requested tag via
scripts/unmerged-tags, merges them in order via scripts/sync-branch
using git merge --no-ff (resolving conflicts by taking the tag's
content), then pushes the result to a temporary branch.

The push-release-branch job runs after manual approval via the
docker-releases environment. It verifies that neither the release
branch nor the temporary branch moved since the sync job ran before
force-advancing the release branch and deleting the temporary branch.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-07-08 20:22:22 +02:00
dependabot[bot]andGitHub 145e7f83cd build(deps): bump the docker-actions group with 2 updates 
Bumps the docker-actions group with 2 updates: [docker/bake-action](https://github.com/docker/bake-action) and [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action).


Updates `docker/bake-action` from 7.2.0 to 7.3.0
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/6614cfa25eff9a0b2b2697efb0b6159e7680d584...d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b)

Updates `docker/setup-qemu-action` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/06116385d9baf250c9f4dcb4858b16962ea869c3...96fe6ef7f33517b61c61be40b68a1882f3264fb8)

---
updated-dependencies:
- dependency-name: docker/bake-action
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-actions
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-08 10:20:16 +00:00
Paweł GronowskiandGitHub e8ded3fce7 Merge pull request #7085 from thaJeztah/dependabot_group 
gha: dependabot: group docker/* and codeql action updates
 2026-07-08 12:15:03 +02:00
Sebastiaan van Stijn 6d245daa91 update to go1.26.5 
go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls
and os packages, as well as bug fixes to the compiler, the runtime, the
go command, and the net, os, and syscall packages. See the Go 1.26.5
milestone on our issue tracker for details;

- https://github.com/golang/go/issues?q=milestone%3AGo1.26.5+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.26.4...go1.26.5

From the security announcement:

We have just released Go versions 1.26.5 and 1.25.12, minor point releases.

These releases include 2 security fixes following the security policy:

- os: Root escape via symlink plus trailing slash

  On Unix systems, opening a file in an os.Root improperly
  followed symlinks to locations outside of the Root when
  the final path component of the a path is a symbolic link
  and the path ends in /.

  For example, root.Open("symlink/") would open "symlink"
  even when "symlink" is a symbolic link pointing outside of the root.

  On Unix, openat(fd, path, O_NOFOLLOW) will follow symlinks
  in path when path ends in a /. Root failed to account for
  this behavior, permitting paths with a trailing / to escape.
  It now properly sanitizes the path parameter provided to openat.

  hanks to Mundur for reporting this issue.

  This is CVE-2026-39822 and Go issue https://go.dev/issue/79005.

- crypto/tls: Encrypted Client Hello privacy leak

  he Encrypted Client Hello implementation would leak the pre-shared key
  dentities during the handshake, allowing a passive network observer who can
  ollect handshakes to de-anonymize the hostname of the server, even when ECH was
  eing used.

  Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.

  This is CVE-2026-42505 and Go issue https://go.dev/issue/79282.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-08 00:01:42 +02:00
Sebastiaan van Stijn 2282b23f02 gha: dependabot: group docker/* and codeql action updates 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-07 15:56:25 +02:00
Paweł Gronowski da2622ed8e Update docker-agent-action to v2.0.2 
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-07-06 11:35:08 +02:00
Sebastiaan van StijnandGitHub c4c704e62b Merge pull request #7079 from derekmisler/fix/pr-review-trigger-concurrency 
ci: add concurrency group to pr-review-trigger to prevent duplicate reviews
 2026-07-02 16:40:57 +02:00
Derek MislerandDerek Misler 1c742902b6 ci: add concurrency group and remove bot filter in pr-review-trigger 
Add a concurrency group keyed on PR number to prevent duplicate reviews
from simultaneous review_requested events.

Remove the sender.type != 'Bot' guard so Dependabot PRs remain
reviewable — per maintainer feedback, those reviews are useful for
catching behavior changes in dependency updates.

Signed-off-by: Derek Misler <derek.misler@docker.com>
 2026-07-02 14:26:26 +00:00
dependabot[bot]andGitHub 444bab12d9 build(deps): bump actions/setup-go from 6.3.0 to 6.5.0 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.3.0 to 6.5.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/4b73464bb391d4059bd26b0524d20df3927bd417...924ae3a1cded613372ab5595356fb5720e22ba16)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-30 08:44:46 +00:00
Sebastiaan van StijnandGitHub 22b8f1396e Merge pull request #7069 from docker-agent/auto/migrate-to-docker-agent-action 
chore: migrate cagent-action to docker-agent-action (v2.0.0)
 2026-06-25 22:05:29 +02:00
Docker Agent f9dc4e413b chore: bump docker-agent-action to v2.0.1 
Signed-off-by: Docker Agent <svc-github-docker-agent@docker.com>
 2026-06-24 13:32:46 +00:00
dependabot[bot]andGitHub 7eb15d3454 build(deps): bump actions/checkout from 6.0.3 to 7.0.0 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-24 08:42:35 +00:00
Sebastiaan van StijnandGitHub 033b0ff9ff Merge pull request #7063 from docker/dependabot/github_actions/crazy-max/dot-github/dot-github/workflows/zizmor.yml-1.10.1 
build(deps): bump crazy-max/.github/.github/workflows/zizmor.yml from 1.10.0 to 1.10.1
 2026-06-22 16:42:54 +02:00
dependabot[bot]andGitHub a97303090d build(deps): bump docker/cagent-action/.github/workflows/review-pr.yml 
Bumps [docker/cagent-action/.github/workflows/review-pr.yml](https://github.com/docker/cagent-action) from 1.5.4 to 1.5.5.
- [Release notes](https://github.com/docker/cagent-action/releases)
- [Commits](https://github.com/docker/cagent-action/compare/3f5dc9969f307d3c76acb7e9ccaefdd96bd62f4b...367a30ddb41e0156459d03750f508eac03f3c38a)

---
updated-dependencies:
- dependency-name: docker/cagent-action/.github/workflows/review-pr.yml
  dependency-version: 1.5.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-22 08:43:57 +00:00
dependabot[bot]andGitHub d516a10f93 build(deps): bump crazy-max/.github/.github/workflows/zizmor.yml 
Bumps [crazy-max/.github/.github/workflows/zizmor.yml](https://github.com/crazy-max/.github) from 1.10.0 to 1.10.1.
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](https://github.com/crazy-max/.github/compare/716fd1c51a46c5d93a41d44a94b439c9ee802536...46267a6e61cd56aac2fc79943df180152f4c89d6)

---
updated-dependencies:
- dependency-name: crazy-max/.github/.github/workflows/zizmor.yml
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-19 08:42:27 +00:00
Sebastiaan van StijnandGitHub 86cf0a5185 Merge pull request #7043 from docker/dependabot/github_actions/crazy-max/dot-github/dot-github/workflows/zizmor.yml-1.10.0 
build(deps): bump crazy-max/.github/.github/workflows/zizmor.yml from 1.8.0 to 1.10.0
 2026-06-11 14:44:57 +02:00
dependabot[bot]andGitHub a23b1c6770 build(deps): bump github/codeql-action from 4.36.1 to 4.36.2 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.36.1 to 4.36.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/87557b9c84dde89fdd9b10e88954ac2f4248e463...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-11 08:44:24 +00:00
dependabot[bot]andGitHub 3a197287d2 build(deps): bump crazy-max/.github/.github/workflows/zizmor.yml 
Bumps [crazy-max/.github/.github/workflows/zizmor.yml](https://github.com/crazy-max/.github) from 1.8.0 to 1.10.0.
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](https://github.com/crazy-max/.github/compare/9ba6e6f9450baf3b1237f8035c1fdc45932510bd...716fd1c51a46c5d93a41d44a94b439c9ee802536)

---
updated-dependencies:
- dependency-name: crazy-max/.github/.github/workflows/zizmor.yml
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-11 08:42:57 +00:00
Sebastiaan van StijnandGitHub 54f330978e Merge pull request #7028 from docker/dependabot/github_actions/docker/setup-qemu-action-4.1.0 
build(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0
 2026-06-10 15:49:05 +02:00
Sebastiaan van StijnandGitHub e8f837ba7f Merge pull request #7034 from docker/dependabot/github_actions/actions/checkout-6.0.3 
build(deps): bump actions/checkout from 6.0.2 to 6.0.3
 2026-06-09 16:12:57 +02:00
dependabot[bot]andGitHub 9caec62f25 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-09 08:44:17 +00:00
dependabot[bot]andGitHub 6d9c126733 build(deps): bump github/codeql-action from 4.36.0 to 4.36.1 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.36.0 to 4.36.1.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...87557b9c84dde89fdd9b10e88954ac2f4248e463)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.36.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-09 08:43:54 +00:00
dependabot[bot]andGitHub d788f2d81f build(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 4.0.0 to 4.1.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/ce360397dd3f832beb865e1373c09c0e9f86d70a...06116385d9baf250c9f4dcb4858b16962ea869c3)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-04 01:23:33 +00:00
Paweł Gronowski a1cf501956 gha: Add docker cagent PR reviewer workflows 
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-06-03 19:18:44 +02:00
Sebastiaan van StijnandGitHub 37c3d316cc Merge pull request #7024 from thaJeztah/add_zizmor 
gha: add zizmor workflow
 2026-06-03 18:13:43 +02:00
Paweł Gronowski b458dc9e81 update to go1.26.4 
This release include 3 security fixes following the security policy:

- mime: quadratic complexity in WordDecoder.DecodeHeader

    Decoding a maliciously-crafted MIME header containing many invalid
    encoded-words could consume excessive CPU.
    The MIME decoder now better handles this case.

    Thanks to p4p3r (https://hackerone.com/p4p3r_hak) for reporting this issue.

    This is CVE-2026-42504 and Go issue https://go.dev/issue/79217.

- net/textproto: arbitrary input are included in errors without any escaping

    When returning errors, functions in the net/textproto package would
    include its input as part of the error, without any escaping. Note that
    said input is often controlled by external parties when using this
    package naturally. For example, a net/http client uses ReadMIMEHeader
    when parsing the headers it receive from a server.

    As a result, an attacker could inject arbitrary content into the error.
    Practically, this can result in an attacker injecting misleading
    content, terminal control bytes, etc. into a victim's output or logs.

    This is CVE-2026-42507 and Go issue https://go.dev/issue/79346

- crypto/x509: split candidate hostname only once

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop
    over all DNS Subject Alternative Name (SAN) entries. This caused
    strings.Split(host, ".") to execute repeatedly on the same input hostname.

    With a large DNS SAN list, verification costs scaled quadratically based on the
    number of SAN entries multiplied by the hostname's label count. Because
    x509.Verify validates hostnames before building the certificate chain, this
    overhead occurred even for untrusted certificates.

    Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.

    This is CVE-2026-27145 and https://go.dev/issue/79694.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.26.4

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-06-03 17:07:58 +02:00
Sebastiaan van Stijn 1953194bd5 gha: apply zizmor fixes 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-03 16:45:20 +02:00
Sebastiaan van Stijn ac0419ea90 gha: add zizmor workflow 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-03 12:03:45 +02:00
Paweł GronowskiandGitHub 3a85952984 Merge pull request #7020 from thaJeztah/full_semver 
ci: update comments to show full (major.minor.patch) version
 2026-06-02 15:18:14 +02:00
Sebastiaan van Stijn 69c3f5c7af ci: update comments to show full (major.minor.patch) version 
This makes it easier to verify the sha matches the tag, and may help
with dependabot not updating the version-comment correctly.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-01 15:21:54 +02:00