This release includes 12 security fixes following the security policy:
- net/http: HTTP/1 server crash due to MaxBytesReader header race
For HTTP/1 servers, when MaxBytesReader's limit is exceeded,
"Connection: close" header is automatically set without synchronization,
which might race with another header being set explicitly in the server
handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or
MaxBytesHandler can crash due to runtime panic if its handler reads the
request body concurrently with writing the response header.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-97054 and Go issue https://go.dev/issue/82563.
- cmd/go: unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags
Building a malicious package that uses cgo could cause arbitrary code execution
at build time through several compiler and linker flags permitted in "#cgo"
directives.
Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec
files, and CRT startup objects to an attacker-controlled directory; "-target" in
Clang falls back to executing target helper tools from the current working
directory when not found in PATH; "-isysroot" and "-Wl,-syslibroot" can pass a
regular file on disk to GNU ld.bfd, which interprets it as a positional linker
script; and "-x" permitted specifying arbitrary compiler input languages beyond
those supported by cgo.
"--sysroot" and "-target" are now disallowed in "#cgo" flags, "-isysroot" and
"-Wl,-syslibroot" are verified not to point to regular files, and "-x" is
restricted to the C, C++, Objective-C, and assembler languages supported by cgo.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97033 and Go issue https://go.dev/issue/82577.
- cmd/go: arbitrary command execution via GCC spec files in cgo linker search directories
When using GCC, building a malicious package that uses cgo could cause arbitrary
command execution at link time via untrusted GCC spec files ("specs" or
"*.spec").
When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS",
GCC's built-in link spec evaluates "%:include(libgomp.spec)" or
"%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot
directories (including subdirectories and multilib sibling directories such as
"../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is
used or when "-fsanitize=" is combined with "-static" or "-static-lib*".
The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories
(and the working and package directories when applicable) that contain GCC spec
files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97034 and Go issue https://go.dev/issue/82576.
- cmd/go: unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo
When using Clang or GCC, building a malicious package that uses cgo could cause
unexpected code execution at build time or write files to arbitrary
directories via "-gen-" or "-gnat" flags in "#cgo" directives.
The "-g*" wildcard in the compiler and linker flag allowlists previously
matched Clang's two-argument "-gen-cdb-fragment-path " flag and GCC's
two-argument "-gnatO " flag, permitting compilation database fragments
and sidecar output files to be written to arbitrary directories and
desynchronizing flag argument parsing between the go command and the compiler
driver so that subsequent arguments could be passed as unvalidated positional
inputs to the linker.
"-gen-" and "-gnat" flags are now disallowed in "#cgo" compiler and linker
flags.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97035 and Go issue https://go.dev/issue/82575.
- cmd/go: arbitrary code execution during build on darwin via "-l to_library" in cgo
On Darwin, building a malicious package that uses cgo could cause arbitrary code
execution when using the Apple linker due to passing "-l to_library " in a
"#cgo LDFLAGS" directive.
The Apple linker recombines the separated arguments "-l" and "to_library" into
"-lto_library", which loads an arbitrary LTO plugin dynamic library at link
time.
The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS",
rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and
"-library-path", and checks recombined "-l" arguments against disallowed linker
flags and patterns.
Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/) for reporting this issue.
This is CVE-2026-97036 and Go issue https://go.dev/issue/82574.
- cmd/go: linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo
Building a malicious package that uses cgo could cause arbitrary code execution
at link time by passing linker script files to the host linker via "#cgo LDFLAGS".
Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath",
"-Wl,--just-symbols", and "-Wl,-undefined") previously accepted a bare second
argument without a "-Wl," prefix, which the compiler driver passes directly to
the linker as a positional input file. Additionally, when using GNU ld.bfd,
flags such as "-framework", "-Wl,-framework", "-Wl,-undefined",
"-Wl,--just-symbols", "-Wl,-R", "-Wl,-subsystem", and (on non-Darwin platforms)
"-Wl,-sectcreate" could cause ld.bfd to interpret their arguments as linker
scripts if they named a regular file on disk.
The go command now requires a "-Wl," prefix on the second token of split "-Wl,"
flags (except "-Wl,-R"), verifies that these flags do not reference linker
script files, and disallows bare "-Wl,--warn-backrefs-exclude".
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97037 and Go issue https://go.dev/issue/82573.
- cmd/go: arbitrary code execution via crafted .syso files and cgo linker input files
Building a malicious package containing ".syso" files or cgo linker inputs could
inject arbitrary linker flags or execute arbitrary code at link time.
Linker input files—including ".syso" files, direct object or library inputs in
"#cgo LDFLAGS", and libraries in "-L" directories—were passed to the external
linker without validating their format or checking for embedded linker options.
Across platforms, this allowed executing GNU ld implicit linker scripts
disguised as libraries or ".syso" files (or loaded via "-l:" or "-l"
containing path separators), injecting unallowlisted linker flags via PE/COFF
".drectve" sections on Windows or Mach-O "LC_LINKER_OPTION" load commands on
Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation
sections in ELF, PE/COFF, or Mach-O objects.
The go command now verifies that ".syso" files, direct linker inputs, and
libraries in "-L" directories are valid binary objects or archives that do not
contain unallowlisted ".drectve" directives, "LC_LINKER_OPTION" load commands,
or LTO IR sections, and disallows "-l:" and ":", "=", or path
separators in "-l" flags.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97038 and Go issue https://go.dev/issue/82572.
- cmd/go: flag sanitization bypass via "#cgo pkg-config:" directives
Building a malicious package that uses "#cgo pkg-config:" directives could
load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker
flags.
The pkg-config flag allowlist previously permitted "--with-path=" and
"--personality=", allowed "--define-variable=" values beginning with "=" or "$"
(which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or
"-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc"
or containing path separators or "..", which caused pkg-config to load local
".pc" files directly from the package directory. In addition, flags returned by
"pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether
internal linking is safe.
The go command now disallows "--with-path=", "--personality=", leading "=" or
"$" characters in "--define-variable=" values, and local ".pc" paths in
"#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal
linking compatibility.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97039 and Go issue https://go.dev/issue/82571.
- cmd/go, cmd/link: cgo directive injection via .syso files disguised as Go object files
Building a package containing a crafted ".syso" file could bypass cgo flag
validation and inject arbitrary linker flags when linking.
When loading ".syso" entries from a package archive, the linker only checked for
recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling
through to Go object parsing. A ".syso" file beginning with a "go object" header
was parsed as a Go compiler object, allowing untrusted cgo metadata directives
(such as "cgo_ldflag" or "cgo_dynamic_linker") embedded in the ".syso" file to
be passed to the external linker without validation. Additionally, ".syso"
filenames longer than 16 bytes lost their ".syso" extension when truncated in
archive headers, and unrecognized ".syso" formats forced external linking in
pure-Go builds.
The linker now rejects ".syso" files that are not recognized host object
formats, and "cmd/go" and "cmd/pack" preserve the ".syso" suffix when truncating
long archive member names.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-97040 and Go issue https://go.dev/issue/82570.
- cmd/compile, cmd/link: host linker flag injection via //go:cgo_* directives
Building a malicious package containing "//go:cgo_*" compiler directives could
inject arbitrary flags into the external linker invocation on ELF platforms.
The compiler and linker did not reject commas in "//go:cgo_import_dynamic",
"//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static",
and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic
linker path using "-Wl,--dynamic-linker,". Furthermore, the two-argument
form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source
files) could overwrite the external symbol name of a symbol already marked for
cgo export. A symbol name or dynamic linker path containing a comma or leading
"@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into
arbitrary host linker flags or response file arguments.
The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic
linker directives, the linker passes "-Wl,--dynamic-linker=", and
"cgo_import_dynamic" no longer overwrites symbols exported via
"cgo_export_dynamic" or "cgo_export_static".
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-97041 and Go issue https://go.dev/issue/82569.
- cmd/cgo, cmd/compile, cmd/link: linker flag injection via cgo_import_dynamic and PE DLL names
Building a malicious package that uses "//go:cgo_import_dynamic" or links
against a crafted PE object on Windows could pass unsafe library arguments to
the external linker.
The compiler only checked the first character of the library name in
"//go:cgo_import_dynamic" directives and skipped validation in cgo-generated
files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate
imported DLL names extracted from PE object files before emitting "-l"
flags for the external linker, allowing a crafted DLL name containing ".." path
traversal or special characters to reference arbitrary files on disk.
The compiler now validates every character of the library name in
"//go:cgo_import_dynamic" directives (including in cgo-generated files on
Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject
PE imported DLL names containing path separators, "..", ":", or leading "-" or
"@".
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97042 and Go issue https://go.dev/issue/82568.
- cmd/go, cmd/compile: unexpected code execution via escaped quotes in //go:cgo_ldflag
Building a malicious package that uses cgo could bypass "#cgo LDFLAGS"
validation and cause unexpected code execution at build time, or cause the go
command to panic, via crafted quoting in "//go:cgo_ldflag" directives.
When "cmd/cgo" generates "_cgo_gotypes.go", it quotes each "#cgo LDFLAGS"
argument with strconv.Quote in a "//go:cgo_ldflag" directive, but "cmd/compile"
and "cmd/go" parsed those directives by splitting on raw quote characters
without handling backslash escapes or unquoting the string. This mismatch
allowed disallowed linker flags or unvalidated linker search paths to be
smuggled past the go command's flag checks and passed to the external linker.
In addition, deduplicating LDFLAGS in the go command could panic with an
out-of-bounds slice index when a prefix of the flag list matched near the end
of the slice.
"cmd/compile" and "cmd/go" now properly handle backslash-escaped quotes and
unquote "//go:cgo_*" pragma strings with strconv.Unquote, and the slice bounds
check in processCgoOutputs has been fixed.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97043 and Go issue https://go.dev/issue/82567.
release notes: https://go.dev/doc/devel/release#go1.27.4
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The CLI flushes traces and metrics at exit with a 50ms timeout
(ExportTimeout). The OTLP gRPC exporters were created with the default
retry policy, so when the endpoint refuses the connection the export
keeps backing off until the timeout expires instead of returning.
This happens on every command when the current context points at a
unix socket that has no listener, for example Docker Desktop's context
while Desktop is not running, which leaves its analytics socket file
behind. A retry cannot complete within 50ms anyway, so turn retries off.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Alexandre Zollinger Chohfi <alzollin@microsoft.com>
GitHub Actions retired macOS 14 runners on November 2, 2026.
Replace macos-14 with macos-26 to continue testing on supported
macOS versions.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- --help before a subcommand is parsed as the root's persistent flag and
stripped from args, which works for most subcommands since they share
the same flag object with root
- run/create register their own local help flag (no -h, to avoid a
shorthand clash with --hostname), which shadows root's and never saw
the value, so the container ran instead of printing usage
- propagate the parsed value into a subcommand's local help flag when
one shadows the root's, in HandleGlobalFlags
Fixes#7473
Signed-off-by: Nick Sieger <nick@nicksieger.com>
Since commit f7a909d56b, ContainerContext.Names returns an empty string
when truncating and every name of the container contains a slash. Before
that change, all names were printed in that case.
Classic Swarm prefixes container names with the node-name
("/<node-name>/<container-name>"), so `docker ps` against a classic Swarm
API printed an empty NAMES column.
Restore the fallback to printing all names when no name without slashes
is found.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Drew Erny <derny@mirantis.com>
follow-up to 18958e4c02, which updated
the e2e workflow, but forgot to update the other workflows.
Replace the CODECOV_TOKEN secret with GitHub Actions OIDC authentication.
Codecov supports tokenless uploads for public repositories, but
authenticated uploads are still needed to protect coverage results on
protected branches from unauthorized uploads.
Grant `id-token: write` at the job level to allow Codecov to request
a short-lived OIDC token. This permission does not grant repository
write access, and scoping it to the job avoids granting it to other
jobs added to the workflow in the future.
Coverage uploads from forked pull requests continue to use Codecov's
tokenless upload mechanism.
See https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Replace the CODECOV_TOKEN secret with GitHub Actions OIDC authentication.
Codecov supports tokenless uploads for public repositories, but
authenticated uploads are still needed to protect coverage results on
protected branches from unauthorized uploads.
Grant `id-token: write` at the job level to allow Codecov to request
a short-lived OIDC token. This permission does not grant repository
write access, and scoping it to the job avoids granting it to other
jobs added to the workflow in the future.
Coverage uploads from forked pull requests continue to use Codecov's
tokenless upload mechanism.
See https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
OTEL providers provided by this library to plugins were not properly
shut down. Metrics from the CLI were forcibly flushed in a separate area
and the `buildx` command does its own flushing, but this didn't apply to
traces.
Add shutdown on post run for plugins using `OnFinalize`. This will allow
compose to use the tracer provider from this library rather than roll
its own custom one.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
full diff: https://github.com/golang/net/compare/v0.61.0...v0.62.0
This release addresss the following security issues:
- html: avoid quadratic complexity when coalescing text nodes
When coalescing adjacent text nodes in addText and fosterParent,
appending to an existing TextNode's Data via string concatenation
(n.Data += text) reallocated and copied the accumulated string on every
token. Inputs containing many short text runs separated by ignored end
tags (such as "a") caused O(n^2) allocations and byte copies.
Accumulate coalesced text in per-node byte slices during parsing and
materialize Data strings once at the end of parse.
Thanks to Markus Magnuson for reporting this issue.
This is CVE-2026-78661 and Go issue https://go.dev/issue/82224.
- html: check all ancestor namespace transitions when rendering raw text
In childTextNodesAreLiteral, walking up the tree previously stopped at
the nearest foreign ancestor once an HTML integration point was found.
However, that integration point may itself be a descendant of an element
that was foster-parented into a foreign namespace (such as or
fostered under ), causing a parser to resolve the
subtree in a different foreign namespace upon re-parsing the rendered
output.
Continue walking the full ancestor chain and verify that every
transition from a non-empty namespace occurs at an HTML integration
point before emitting literal text.
Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276) for reporting this issue.
This is CVE-2026-97045 and Go issue https://go.dev/issue/82622.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Replace the hardcoded list of supported OS/architecture combinations with
syntax validation using containerd/platforms.
This allows annotating manifests with platforms that are not explicitly
known to the CLI, while still rejecting missing or malformed values.
The validation uses a FormatAll/Parse roundtrip until containerd/platforms
provides a dedicated validation function.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Pass -w to the Go linker to reduce binary size while retaining the
symbol table for tools that inspect Go binaries.
For a linux/arm64 build, this reduces the CLI binary from 39,809,791
to 31,310,197 bytes: a saving of 8.5 MB (21.4%).
Place the default before caller-supplied GO_LDFLAGS so builds can
retain DWARF by passing GO_LDFLAGS="-w=0".
Before
ls -l /go/src/github.com/docker/cli/build/docker-linux-arm64
-rwxr-xr-x 1 root root 39809791 Oct 29 17:34 /go/src/github.com/docker/cli/build/docker-linux-arm64
After
ls -l /go/src/github.com/docker/cli/build/docker-linux-arm64
-rwxr-xr-x 1 root root 31310197 Oct 29 17:36 /go/src/github.com/docker/cli/build/docker-linux-arm64
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
TerminatePrompt created a pipe for the prompt's stdin but discarded the
write end. Once the garbage collector finalized it, the write end was
closed, the prompt read EOF and treated it as "no", and the command
returned "prune has been cancelled" instead of prompt.ErrTerminated.
This keeps both ends of the pipe referenced and closes them in t.Cleanup.
This change also drops the OutBuffer().Len() check:
the writer hook only fires after
the write has completed, so the check proved nothing, and it raced with
the prompt's later writes under -race.
This change also applies the same fix to the identical copy in cmd/docker-trust.
Signed-off-by: Hamir <hirehamir@gmail.com>
- cpu: add amd64 v2/v3/v4 feature bits
- darwin: expose setpriority PRIO_DARWIN_* constants
- unix/darwin: add missing pwritev test case on darwin/arm64
- unix/darwin: add O_EXEC and O_SEARCH on darwin
- unix/darwin: pass fcntl data as unsafe.Pointer in FcntlF{lock,store} on darwin
- unix/linux: don't warn about closed stderr from child process
- unix/linux: unify ppc64x syscall wrappers
- unix: add listns syscall introduced in Linux 6.19
- unix: add Mmsghdr for linux
- unix: add PrctlArg5Ptr
- unix: align the getdents buffer
- unix: extend z/OS support
- unix: keep generated types compilable with current cgo
- unix: pass xattr data as unsafe.Pointer in BSD xattr syscalls
- unix: provide linux/sparc64 assembly for syscalls
- unix: return syscall error in *listxattrNS on BSD
- unix: update glibc to 2.44
- unix: update linux to v7.2
- unix: use the stat64 family and fix Stat_t on linux/sparc64
- windows: drop arm
full diff: https://github.com/golang/sys/compare/v0.48.0...v0.49.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This release includes 1 security fix following the security policy:
- crypto/x509: mitigation for security concerns with a specific Certificate Authority
We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.
Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.
We highly recommend immediately upgrading to this release.
This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.
release notes: https://go.dev/doc/devel/release#go1.26.10
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Wrap errors in the OAuth manager instead of logging them, preserving
the underlying cause while allowing callers to detect startup failures.
Log failures at the fallback handler and scope the device-code login
result to its branch.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Remove extra newline before message
- Include the token in the URL (instead of requiring the user to manually
enter it on the website).
- Improve the "call to action"; ENTER can be used to automatically open
the browser (but the user can manually open it instead), and CTRL-C can
be used to cancel the login.
- Remove the "Waiting for authentication in the browser…" message, which
could be confusing if no browser was opened (yet), instead print a message
after successfully requesting the browser to be opened.
When running `docker login`;
docker login
i Info → Using web-based login. To sign in with credentials on the command line, use 'docker login -u <username>'
Your one-time device confirmation code is: NRJL-BLRL
Open this URL to authenticate: https://login.docker.com/activate?user_code=NRJL-BLRL
Press ENTER to open the URL in your browser, or Ctrl+C to cancel.
After pressing `ENTER`, it either prints the "success" message;
Press ENTER to open the URL in your browser, or Ctrl+C to cancel.
Opening browser…
or a failure when unable to launch a browser;
Press ENTER to open the URL in your browser, or Ctrl+C to cancel.
No browser found. Open the URL above manually to continue.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Before this patch, pressing `ENTER` to open the browser would silently
discard the error;
docker login
i Info → Using web-based login. To sign in with credentials on the command line, use 'docker login -u <username>'
Your one-time device confirmation code is: VGTB-VKBG
Press ENTER to open your browser or submit your device code here: https://login.docker.com/activate
Waiting for authentication in the browser…
With this patch, a failure is printed, so that the user can manually open
the URL (or cancel the login);
docker login
i Info → Using web-based login. To sign in with credentials on the command line, use 'docker login -u <username>'
Your one-time device confirmation code is: SZFX-BSGP
Press ENTER to open your browser or submit your device code here: https://login.docker.com/activate
Waiting for authentication in the browser…
No browser found. Open the URL above manually to continue.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Make the output less verbose, and combine the "web-based login" message
with the info message that's already printed.
Before this patch:
docker login
USING WEB-BASED LOGIN
i Info → To sign in with credentials on the command line, use 'docker login -u <username>'
Your one-time device confirmation code is: VVPV-NSSL
Press ENTER to open your browser or submit your device code here: https://login.docker.com/activate
Waiting for authentication in the browser…
With this patch:
docker login
i Info → Using web-based login. To sign in with credentials on the command line, use 'docker login -u <username>'
Your one-time device confirmation code is: QBBD-PQNS
Press ENTER to open your browser or submit your device code here: https://login.docker.com/activate
Waiting for authentication in the browser…
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Check the context after reading stdin to avoid launching the browser
if login was canceled while waiting for ENTER.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Running "docker nonexistent --version" printed the CLI version and
exited 0, so it couldn't be used to check whether a command or plugin
is available. Without "--version" the same invocation fails with an
"unknown command" error.
When no built-in command or plugin matches, runDocker falls through to
executing the root command, and cobra handles the "--version" flag
before the root command reports the unknown command. Unset the root
command's version in that fallback, so the standard unknown-command
error is returned.
A global "--version" flag ("docker --version nonexistent") is parsed
before the command name and still prints the version, as do
"docker --version" and "docker nonexistent --help".
Signed-off-by: Nimesh Kulkarni <167794819+GitNimay@users.noreply.github.com>
The plugin only used lazyregexp for two small, fixed name patterns.
Replaced it with regexp.MustCompile without changing validation.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Both entry points use NewRootCmd, which adds subcommands directly.
Removed the unused registry registration and constructor.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The plugin only needed progress display and an auxiliary callback.
Inlined that use while preserving cancellation and terminal handling.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Explain that variable value is optional and is taken from environment
if not set.
Clarify the meaning of ARG, and mention that ENV overrides ARG of the
same name.
Move example to the end, and refer to the Dockerfile and buildx docs
for more details (replacing the obsolete link).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Allow plugins to return informational messages without the next-steps heading
or indentation. Invoke each hook once and render generic messages before the
shared next-steps block.
Centralize grouping and formatting in PrintMessages, with a callback for
template evaluation and error handling. This avoids the need for an
intermediate EvaluatedMessage type and simplifies hook collection to return
the original responses.
Skip messages containing only whitespace while preserving empty lines
within non-empty messages. Keep PrintNextSteps as a deprecated wrapper
to preserve existing callers and output.
Update the printer tests and remove the obsolete appendMessages helper
and its tests.
Co-authored-by: Nicolas Beck <nicolas.beck@docker.com>
Signed-off-by: Nicolas Beck <nicolas.beck@docker.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Show installation guidance and a documentation link when the offload
plugin is missing or invalid. Handle this before command execution so
plugin-specific flags and --help also receive the guidance.
Signed-off-by: Nicolas Beck <nicolas.beck@docker.com>
- Treat the remaining invisible format controls as zero width
- Treat bidi isolates and other invisible format characters as zero width
- Measure ambiguous Latin letters as one cell in East Asian locales
- Fix width mismatches found by the Hegel property tests
- Recognise CJK locales regardless of charset spelling
full diff: https://github.com/mattn/go-runewidth/compare/v0.0.30...v0.0.31
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This release includes 15 security fixes following the security policy:
- net/http: HTTP/2 server crash due to HPACK encoder race
HTTP/2 servers could end up crashing due to inadvertently
modifying its HPACK encoder concurrently. This happens because the
server modifies the HPACK encoder from two goroutines without
synchronization: one uses the encoder to encode a HEADERS frame as part
of a response sent to a client and the other modifies the encoder's
table size when handling a SETTINGS frame containing
SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can
repeatedly send a request while changing the header table size to crash
the server.
Fix this issue by not applying SETTINGS_HEADER_TABLE_SIZE immediately.
Instead, buffer any SETTINGS_HEADER_TABLE_SIZE received, and only apply
the new value prior to the next time the server writes a frame.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-97032 and Go issue https://go.dev/issue/81867.
- net/http: HTTP/2 server memory exhaustion due to Trailer headers
When "Trailer" headers are sent by a client, the HTTP server internally
uses the header values to populate the Request.Trailer map passed to the
server handler. Because Request.Trailer is a map, each entry incurs
memory overhead. For HTTP/2 servers, a malicious client can exploit this
by sending a "Trailer" header that declares a large number of fields,
causing the server to allocate a disproportionate amount of memory while
bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits.
This exploit is not applicable for HTTP/1 servers, which do not support
multiplexing a large number of requests over one TCP connection, and
whose Server.MaxHeaderBytes are calculated differently.
Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits are now
applied towards the trailer fields declared in "Trailer" headers.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-78659 and Go issue https://go.dev/issue/81857.
- crypto/tls: reject malformed ECH outer extension references
Multiple ECH outer extension references are not
permitted under RFC 9849; previously, a client
could send a well-crafted packet that could
trigger memory exhaustion in the server process
by specifying multiple references.
We now reject these as malformed and curb the
memory amplification vector as a result.
This is CVE-2026-97031 and Go issue https://go.dev/issue/81855.
- cmd/go: checksum bypass for golang.org/fips140
Previously, a user operating inside of a malicious
Go project that defines a bogus golang.org/fips140
and operates a malicious GOMODPROXY the user chooses
to connect to can serve an arbitrary module in its
place.
We now unpack the trusted ziphash for the bundled
golang.org/fips140 module and construct its entry
in the GOMODCACHE such that it can be verified by
the toolchain.
This is CVE-2026-94444 and Go issue https://go.dev/issue/81833.
- cmd/go: checksum database bypass for golang.org/toolchain
Previously, a user operating inside of a malicious
Go project that defines a bogus golang.org/toolchain
go.sum entry and operates a malicious GOMODPROXY the
user chooses to use can bypass the intended checksum.
We now ensure that golang.org/toolchain always goes
to the network for the canonical checksum.
This is CVE-2026-94447 and Go issue https://go.dev/issue/81834.
- html/template: reset context tracking on consecutive template expressions
When a JavaScript template literal contains
consecutive expressions, the context tracking
state was not properly reset upon entering a
new expression.
We now ensure that template-literal expression
entries correctly reset context variables so all
subsequent regular expression literals are
accurately recognized and escaped.
This is CVE-2026-94448 and Go issue https://go.dev/issue/81821.
- html/template: recognize yield as regexp preceder keyword
A trusted template author may have previously
written a valid template wherein the use of
the yield keyword would not be correctly
escaped.
We now ensure that valid keyword uses are
escaped and non-keyword uses are not escaped.
This is CVE-2026-97030 and Go issue https://go.dev/issue/81823.
- net/textproto, mime/multipart: memory limit bypass when parsing MIME headers
Parsing a multipart form could bypass memory limits and read an
arbitrarily long line into memory when the remaining limit at the
start of a part was less than 400 bytes.
Multipart form memory limits are now properly enforced in this situation.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-94440 and Go issue https://go.dev/issue/81741.
- net/http: HTTP/1 client connection desynchronization after CONNECT rejection
When http.Transport sends an HTTP/1 CONNECT request with a non-empty
Request.Body, it writes the body directly to the connection without
framing after the request headers. If the server rejects the CONNECT
request with a non-2xx keep-alive response, Transport returns the
connection to the idle pool. Because CONNECT requests do not have a
request body, the server may interpret the trailing body bytes as a
subsequent pipelined HTTP/1.1 request on the connection, leaving the
pooled connection desynchronized and causing the next caller that reuses
it to read the response to the injected request. In reverse proxies
(including httputil.ReverseProxy) that forward CONNECT requests through
a shared Transport, this can lead to cross-user response poisoning.
The HTTP/1 transport now closes a connection after sending a CONNECT
request, regardless of the response status.
In addition, ReverseProxy now rejects incoming CONNECT requests
with a 405 Method Not Allowed response. ReverseProxy has never handled
CONNECT requests in a useful fashion (it does not convert the
connection into a bidirectional tunnel), so we do not expect this
change to negatively affect any current users.
Thanks to Xclow3n (Rajat Raghav) for reporting this issue.
This is CVE-2026-56866 and Go issue https://go.dev/issue/81740.
- net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response
When an HTTP server handler sent a 2xx response to an HTTP/1 CONNECT request
and returned without hijacking the connection, the server improperly continued
to read and serve requests from the connection. Since a 2xx response to an
HTTP/1 CONNECT converts the connection into a tunnel, the server should not
treat the connection as continuing to contain HTTP.
The impact of this misbehavior is mostly limited to potential request smuggling,
where an intermediate proxy considers the data on the connection to be tunneled
and the server considers it to be HTTP.
The HTTP/1 server now always closes a connection after responding to a CONNECT
request, regardless of the response status.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-94439 and Go issue https://go.dev/issue/81744.
- net/http: excessive CPU consumption from repeated initial window changes
A malicious HTTP/2 peer could cause excessive CPU consumption in the
client or server by opening a large number of streams and then sending
many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
The HTTP/2 client and server now efficiently handle changes to the
initial window size (O(1) rather than O(number of streams)).
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-78669 and Go issue https://go.dev/issue/81742.
- net/http: HTTP/2 transport accepts malformed framing-related headers
Historically, we have been rather lax about malformed framing-related
headers in our HTTP/2 implementation, as they cannot interfere with
HTTP/2 framing. However, this makes it possible for our HTTP/2
implementation to forward responses containing such headers to an HTTP/1
client when acting as a reverse proxy. If the HTTP/1 client also does
not behave strictly enough, this can result in response smuggling.
We now delete malformed framing-related headers when received by our
HTTP/2 transport, so they will not be forwarded to a potentially
vulnerable HTTP/1 client.
Thanks to TJ Barton for reporting this issue.
This is CVE-2026-78660 and Go issue https://go.dev/issue/81115.
- os: Root.Mkdir(All) can follow junctions out of the root on Windows
On Windows, when the target of Root.Mkdir or Root.MkdirAll was a junction
pointing to an empty location, the operation would create a directory at
the junction target even when that target was located outside the root.
This only applies to operations where the last path component is a
junction (path/to/junction, but not path/junction/target).
Root.Mkdir and Root.MkdirAll now correctly avoid resolving junctions.
Thanks to Daniele Ballarini for reporting this issue.
This is CVE-2026-56857 and Go issue https://go.dev/issue/81739.
- net/http: lack of limit on size of parsed Range headers
When parsing a Range header containing a large number of small ranges,
FileServer(FS), ServeContent, and ServeFile(FS) could consume an excessive
amount of CPU.
These functions now ignore Range headers containing more than 200 ranges.
The limit is controlled by the new httpservecontentmaxranges=
GODEBUG setting. Setting GODEBUG=httpservecontentmaxranges=0
disables the limit.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-78667 and Go issue https://go.dev/issue/81858.
- net/http: double flow control refund on HTTP/2 server streams
The HTTP/2 server could refund connection-level flow control twice for the same data:
Once when a client resets a stream (refunding data for any sent-but-unread portion
of the stream), and again when a request handler reads the buffered data.
A malicious client could exploit this to bypass the configured connection-level
flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still
limited by the concurrent stream limit and stream-level flow control.
The HTTP/2 server now waits to refund connection-level flow control for reset
streams until after the request handler is complete.
Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/) for reporting this issue.
This is CVE-2026-78663 and Go issue https://go.dev/issue/81743.
release notes: https://go.dev/doc/devel/release#go1.26.9
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Explain how to install the Offload plugin when --cloud cannot find it,
and link to the cloud flag documentation. Preserve diagnostic details
for invalid or incompatible plugins and limit installation guidance
to Offload.
Use standard default-value handling in the resolution tests to satisfy
the lint complexity limit without changing test coverage.
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
Signed-off-by: Nicolas Beck <nicolas.beck@docker.com>
Add a "master" engine-version to the e2e matrix to catch regressions
against the upcoming engine release before it reaches an rc.
There is no "master" dind image, so just copy the engine binary from the
moby/moby-bin:master image and put it into the latest dind image.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
- Wrap: measure grapheme clusters, not runes
- Skip grapheme segmentation for text that cannot form clusters
- Keep strings that are not valid UTF-8 on the segmenter - #111
- Take the rune fast path in the Truncate functions too
full diff: https://github.com/mattn/go-runewidth/compare/v0.0.29...v0.0.30
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Forward stdin and stderr to cloud context providers when both are
terminals, allowing prompts during --cloud resolution. Pass file handles
directly to preserve terminal detection and leave piped or redirected
input available to the requested command.
Use the standard console handles when Windows terminal wrappers hide
their underlying files. Keep stdout reserved for the JSON response.
Signed-off-by: Nicolas Beck <nicolas.beck@docker.com>
docker --cloud build rejected every BuildKit-only flag (--secret, --ssh,
--push, --output, ...) because cloudHelpRequest parsed remaining args
against the legacy build command's flag set before processAliases
rewrites build into a buildx invocation. Treat build/bake/builder/image
build the same as plugin commands: only recognize --help/-h immediately
after the resolved command path instead of validating flags.
Fixes#7350
Signed-off-by: Nick Sieger <nick@nicksieger.com>
Resolve it through the offload plugin by default, with a provider
override in features.cloud in the Docker config.
Require the selected plugin to declare the cloud-context-resolver
feature in its metadata before showing the flag in help and completion
or invoking its __resolve-context operation.
Resolve through WithContextResolver, after the config file and context
store are loaded but before client initialization, without wrapping or
re-executing Docker.
Forward --context to downstream plugins so they need not support
--cloud or repeat provisioning. Skip provisioning for help, version,
and completion requests. Report unknown flags and missing flag values
before provisioning, so a mistyped invocation fails without creating
cloud resources or contacting the engine selected before resolution.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
- Add lzw reader/writer
- ci: test against go1.27.x, drop go1.24.x
- flate: Writer L7-9 with dictionary can emit the dictionary to stream
- gzhttp: limit jitter hash to jitterBuffer bytes
- s2: arm64 assembly encoders, lowered from the amd64 avo program
- s2: clamp the Go EncodeBetter skip to match the assembly
- xpress: add Microsoft XPRESS (MS-XCA) decompression
- xxhash: bound input of non-preemptive assembly
- zstd, huff0: improved arm64 lowering, and narrow two table loads to MOVWQZX
- zstd/huff0: break false partial-register dependencies in seqdec/4X decoders
- zstd/huff0: fold two ISA-gap x86 idioms in the avo arm64 lowering
full diff: https://github.com/klauspost/compress/compare/v1.19.2...v1.20.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Callers that choose the context from configuration had to do it before
Initialize. That meant loading the config file and context store
themselves and handling --config a second time.
WithContextResolver runs a callback inside Initialize after the config
file and context store are loaded, but before telemetry and endpoint
initialization. A non-empty result replaces the selected context, an
empty result keeps normal selection, and an error aborts
initialization.
The API client and endpoint are resolved lazily, so they use the
overridden context.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Plugins had no generic way to declare support for optional CLI
contracts, so each one would need its own top-level metadata field.
Add Features, keyed by feature name. Values are arbitrary JSON so a
feature can carry more than a boolean.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
`--gpus count=1,2` and `--gpus 1,2` silently replace the first count, while `--gpus 1,count=2` correctly reports a duplicate.
Normalize shorthand counts to the `count` key before checking duplicates. Tests cover both orders, multiple shorthand values, and `all`; rejected options do not append a device request.
Signed-off-by: Alexandre Rodrigues <alexandre3ylf@gmail.com>
- cpu: add ppc64le POWER10 detection
- cpu: add basic support for GOARCH=sparc64
- cpu: disable AVX+ on netbsd/amd64
relates to "runtime: async preemption corrupts AVX (YMM) state on netbsd/amd64"
- internal/cpu: detect RISC-V VLENB when the vector extension is available
- unix: add missing HWTSTAMP_* constants
- unix: add pidfd constants and type
- unix: add IoctlPidfdInfo
- unix: add IPMI interface
- unix: align Ifreq so its union accessors cannot fault
- unix: stop generating sparc termbits from the generic header
- windows: add SO_SNDTIMEO constant for socket options
full diff: https://github.com/golang/sys/compare/v0.47.0...v0.48.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Adds Unicode 17 support
- Fast paths for ASCII
- ANSI escape sequences as grapheme clusters
- Implement UTF-8 C1 control sequences
- Implement 8-bit ANSI
Breaking change
The returned iterator type from FromString() and FromBytes() is now a pointer.
This will not present a problem if you are just using it in the typical way,
which is assigning to a local variable and iterating.
If you are embedding this iterator into another object, and therefore declaring
its type, this change might break your compilation. You’ll need to change to a
pointer type. Apologies if so — this seems like a small enough change that a
v3 would be a bit much.
full diff: https://github.com/clipperhouse/uax29/compare/v2.2.0...v2.7.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When client.New rejects an invalid Docker host or other client option,
it returns a nil concrete client with an error.
Returning that pointer directly as client.APIClient stores a typed-nil
interface, so lazy version checks dereference it.
Return an error instead.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Extract construction of the cluster volume spec from runCreate, and use
struct literals for the individual cluster volume options.
Also simplify topology parsing by reusing ConvertKVStringsToMap, use
slices.SortFunc for deterministic secret ordering, and use max to clamp
negative capacity values to zero.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Use filepath.Rel and filepath.IsLocal instead of comparing path prefixes
as strings when checking that a path stays within the config directory.
Also avoid calling Dir multiple times when constructing and validating
the path.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Inline the sub-slice lookup into stringSliceReplaceAt and use
slices.Equal to compare candidate ranges. When a specific index is
required, check that position directly instead of searching the full
slice.
This also fixes overlapping matches and uses slices.Concat to construct
the replacement result.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
translateV2AuthError only unwraps a url.Error from Do(); a 401
status never went through it. Use errhttp.ToNative so Auth()
treats that 401 as unauthorized and stops.
Signed-off-by: Dean Chen <862469039@qq.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Plugin hook output (such as Gordon's "What's next:" hint) was rendered
before the command's own error message because hooks were invoked inside
runDocker while the error was only printed in main() after runDocker
returned.
Print the error to stderr before invoking the hooks, and replace the
error with a status-only StatusError so main() does not print the same
message a second time. The original error message is captured up-front
and still passed to the plugin hooks.
The inline error-printing block in runDocker is extracted into a
printCommandError helper so the new behavior can be unit-tested
directly without spinning up runDocker.
TestPrintCommandError covers each branch of the helper: nil error,
generic error (printed and replaced with StatusError), StatusError
with/without message, context.Canceled (raw and wrapped), and
errCtxSignalTerminated.
Signed-off-by: Mohammed Olabie <olabiedev@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Use 'docker plugin ls --format' to extract plugin names and IDs, escaping colons in the plugin name (e.g. repo:tag) so zsh _describe treats the ID correctly as description.
Fixes#2761
Signed-off-by: FrancescoCastaldi <francesco.castaldi@mapsgroup.it>
Client-side login (daemon down) was wrapping a 401 as a plain error, so
Auth() moved on to the next endpoint. That can print Login Succeeded if
the HTTP fallback happens to answer 200.
Fixes#7237
Signed-off-by: Dean Chen <862469039@qq.com>
A global service is one task per matching node, not one per
node in the swarm. Say that next to --mode and --constraint.
Signed-off-by: Dean Chen <862469039@qq.com>
The synopsis only listed containers, networks, images, and volumes,
but the command always prunes unused build cache (including BuildKit
cache mounts). Align the description with the interactive warning.
Signed-off-by: Dean Chen <862469039@qq.com>
2026-08-10 09:45:49 +05:00
673 changed files with 30468 additions and 10259 deletions
id-token:write# needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
runs-on:${{ matrix.os }}
runs-on:${{ matrix.os }}
env:
env:
GOPATH:${{ github.workspace }}
GOPATH:${{ github.workspace }}
@@ -53,9 +59,9 @@ jobs:
fail-fast:false
fail-fast:false
matrix:
matrix:
os:
os:
- macos-14 # macOS 14 on arm64 (Apple Silicon M1)
- macos-15-intel # macOS 15 on Intel
- macos-15 # macOS 15 on arm64 (Apple Silicon M1)
- macos-15 # macOS 15 on arm64 (Apple Silicon M1)
- macos-26 # macOS 26 on arm64 (Apple Silicon M1)
- macos-26-intel # macOS 26 on Intel
# - windows-2022 # FIXME: some tests are failing on the Windows runner, as well as on Appveyor since June 24, 2018: https://ci.appveyor.com/project/docker/cli/history
# - windows-2022 # FIXME: some tests are failing on the Windows runner, as well as on Appveyor since June 24, 2018: https://ci.appveyor.com/project/docker/cli/history
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Sebastiaan van Stijn
dependabot[bot]
Sebastiaan van Stijn
Paweł Gronowski
Mend Renovate
Alexandre Zollinger ChohfiandCopilot App
Nick Sieger
Drew ErnyandClaude Opus 5.5
Jonathan A. Sternberg
吴小白
Hamir
Nimesh Kulkarni
Kir Kolyshkin
Nicolas Beck
Tanvir Tian
Alexandre Rodrigues
KeelTrace
Youfu Zhang
Dean Chen
Mohammed Olabie
FrancescoCastaldi
Kamyar mofakhami