mirror of
https://github.com/docker/cli.git
synced 2026-11-14 00:33:51 -04:00
Sebastiaan van Stijn
82b833e57a
full diff: https://github.com/golang/net/compare/v0.61.0...v0.62.0 This release addresss the following security issues: - html: avoid quadratic complexity when coalescing text nodes When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse. Thanks to Markus Magnuson for reporting this issue. This is CVE-2026-78661 and Go issue https://go.dev/issue/82224. - html: check all ancestor namespace transitions when rendering raw text In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or fostered under ), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text. Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276) for reporting this issue. This is CVE-2026-97045 and Go issue https://go.dev/issue/82622. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
112 lines
4.6 KiB
AMPL
112 lines
4.6 KiB
AMPL
module github.com/docker/cli
|
|
|
|
// 'vendor.mod' enables use of 'go mod vendor' to managed 'vendor/' directory.
|
|
// There is no 'go.mod' file, as that would imply opting in for all the rules
|
|
// around SemVer, which this repo cannot abide by as it uses CalVer.
|
|
|
|
go 1.26.0
|
|
|
|
tool (
|
|
github.com/cpuguy83/go-md2man/v2 // for scripts/docs/generate-man.sh
|
|
golang.org/x/mod/modfile // for module compatibility check
|
|
)
|
|
|
|
require (
|
|
dario.cat/mergo v1.0.2
|
|
github.com/containerd/errdefs v1.0.0
|
|
github.com/containerd/errdefs/pkg v0.3.0
|
|
github.com/containerd/log v0.2.0
|
|
github.com/containerd/platforms v1.0.0-rc.5
|
|
github.com/creack/pty v1.1.24
|
|
github.com/distribution/reference v0.6.0
|
|
github.com/docker/cli-docs-tool v0.11.0
|
|
github.com/docker/distribution v2.8.3+incompatible
|
|
github.com/docker/docker-credential-helpers v0.9.9
|
|
github.com/docker/go-connections v0.8.2
|
|
github.com/docker/go-units v0.5.0
|
|
github.com/fvbommel/sortorder v1.2.1
|
|
github.com/go-jose/go-jose/v4 v4.1.7
|
|
github.com/go-viper/mapstructure/v2 v2.5.0
|
|
github.com/gogo/protobuf v1.3.2
|
|
github.com/google/go-cmp v0.7.0
|
|
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
|
|
github.com/google/uuid v1.6.0
|
|
github.com/mattn/go-runewidth v0.0.31
|
|
github.com/moby/go-archive v0.3.3
|
|
github.com/moby/moby/api v1.56.1
|
|
github.com/moby/moby/client v0.6.2
|
|
github.com/moby/patternmatcher v0.6.1
|
|
github.com/moby/swarmkit/v2 v2.1.2
|
|
github.com/moby/sys/atomicwriter v0.1.0
|
|
github.com/moby/sys/capability v0.4.0
|
|
github.com/moby/sys/sequential v0.7.0
|
|
github.com/moby/sys/signal v0.7.1
|
|
github.com/moby/sys/symlink v0.3.0
|
|
github.com/moby/term v0.5.2
|
|
github.com/morikuni/aec v1.1.0
|
|
github.com/opencontainers/go-digest v1.0.0
|
|
github.com/opencontainers/image-spec v1.1.1
|
|
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
|
|
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
|
|
github.com/sirupsen/logrus v1.10.2
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/pflag v1.0.10
|
|
github.com/tonistiigi/go-rosetta v0.0.0-20220804170347-3f4430f2d346
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0
|
|
go.opentelemetry.io/otel v1.46.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0
|
|
go.opentelemetry.io/otel/metric v1.46.0
|
|
go.opentelemetry.io/otel/sdk v1.46.0
|
|
go.opentelemetry.io/otel/sdk/metric v1.46.0
|
|
go.opentelemetry.io/otel/trace v1.46.0
|
|
go.yaml.in/yaml/v3 v3.0.6
|
|
golang.org/x/sync v0.24.0
|
|
golang.org/x/sys v0.49.0
|
|
golang.org/x/term v0.47.0
|
|
golang.org/x/text v0.43.0
|
|
gotest.tools/v3 v3.5.2
|
|
tags.cncf.io/container-device-interface v1.1.1
|
|
)
|
|
|
|
require (
|
|
github.com/Azure/go-ansiterm v0.0.0-20261006220739-8c912ac31dd4 // indirect
|
|
github.com/Microsoft/go-winio v0.6.3 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
|
|
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
|
|
github.com/docker/go-events v0.1.0 // indirect
|
|
github.com/docker/go-metrics v0.1.0 // indirect
|
|
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
|
|
github.com/felixge/httpsnoop v1.1.0 // indirect
|
|
github.com/go-logr/logr v1.4.4 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/golang/protobuf v1.5.4 // indirect
|
|
github.com/gorilla/mux v1.8.1 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/klauspost/compress v1.20.1 // indirect
|
|
github.com/moby/docker-image-spec v1.3.1 // indirect
|
|
github.com/moby/sys/user v0.4.1 // indirect
|
|
github.com/moby/sys/userns v0.2.1 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/prometheus/client_golang v1.22.0 // indirect
|
|
github.com/prometheus/client_model v0.6.1 // indirect
|
|
github.com/prometheus/common v0.62.0 // indirect
|
|
github.com/prometheus/procfs v0.15.1 // indirect
|
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
|
go.etcd.io/raft/v3 v3.6.0 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
|
|
golang.org/x/mod v0.42.0 // indirect
|
|
golang.org/x/net v0.62.0 // indirect
|
|
golang.org/x/time v0.16.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260825221802-da73d73af1c5 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 // indirect
|
|
google.golang.org/grpc v1.83.2 // indirect
|
|
google.golang.org/protobuf v1.36.12 // indirect
|
|
)
|