dilim/moby
1
0 Fork 0
mirror of https://github.com/moby/moby.git synced 2026-11-06 05:17:30 +00:00
Code Issues Packages Projects Releases Wiki Activity
59,422 Commits 19 Branches 618 Tags
master
Commit Graph
4034 Commits
Author SHA1 Message Date
Paweł Gronowski b0e1abe292 Merge pull request #54132 from tonistiigi/update-buildkit-v0.35-rc1 
vendor: update buildkit v0.35.0-rc1
 2026-11-05 20:00:00 +01:00
Sebastiaan van Stijn ff420d2ede vendor: golang.org/x/sys f5cb0306ac0e (fix for go1.27) 
includes a fix for https://go.dev/issue/82324

full diff: https://github.com/golang/sys/compare/v0.49.0...f5cb0306ac0e4b93b83ddd53c36d6693af3214e3

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-05 17:32:58 +01:00
Tonis Tiigi 72e79221cb vendor: update buildkit v0.35.0-rc1 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-11-04 17:19:12 -08:00
Mend Renovate 2d2bb11ba2 fix(deps): update module github.com/aws/smithy-go to v1.28.8 
Signed-off-by: Mend Renovate <bot@renovateapp.com>
 2026-11-04 16:12:17 +00:00
Sebastiaan van Stijn 1f98bfc847 Merge pull request #54100 from renovate-bot/renovate/aws-sdk-go-v2-monorepo 
fix(deps): update aws-sdk-go-v2 monorepo
 2026-11-04 17:02:26 +01:00
Sebastiaan van Stijn 7d66540389 vendor: cloud.google.com/go/auth v0.24.1 
use a tagged release

- fix(auth): return empty tls.Certificate on secureconnect helper failure

full diff: https://github.com/googleapis/google-cloud-go/compare/dbc26066f70a...auth/v0.24.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-03 22:48:29 +01:00
Paweł Gronowski 4788efb563 vendor: github.com/moby/swarmkit/v2 v2.1.3 
full diff: https://github.com/moby/swarmkit/compare/49925db4331f...v2.1.3

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-11-03 21:11:37 +01:00
Sebastiaan van Stijn 16de272a08 vendor: go.yaml.in/yaml/v2 v2.4.5 
v2: Fix YAML unmarshaler validation bypass

Quoted null and tilde scalars bypass UnmarshalYAML, allowing invalid
values to escape application-defined validation. In applications
accepting configuration from less-trusted sources, this can lead to
denial of service or shared configuration corruption.

Require implicit scalar resolution before treating untagged scalars
as null. Add regression tests covering custom validation, both quote
styles, explicit tags, and actual null values.

full diff: https://github.com/yaml/go-yaml/compare/v2.4.4...v2.4.5

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-03 15:40:42 +01:00
Paweł Gronowski 0c86697d0b Merge pull request #54106 from crazy-max/buildkit-0.34.2 
vendor: update buildkit to v0.34.2
 2026-11-03 15:00:36 +01:00
Paweł Gronowski 9eb10da37f Merge pull request #54101 from thaJeztah/bump_yaml 
vendor: go.yaml.in/yaml/v3 v3.0.6
 2026-11-03 14:49:47 +01:00
Mend Renovate 8713fb081d fix(deps): update aws-sdk-go-v2 monorepo 
Signed-off-by: Mend Renovate <bot@renovateapp.com>
 2026-11-03 13:33:31 +00:00
CrazyMax b29d4222a3 vendor: update fsutil to e075fd9305eb 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-11-03 13:51:47 +01:00
CrazyMax 0f7dd638fd vendor: update buildkit to v0.34.2 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-11-03 13:18:28 +01:00
Sebastiaan van Stijn 40e5168df6 vendor: go.yaml.in/yaml/v3 v3.0.6 
resolve: hint-class literal merge-key string "<<" so it's quoted on encode

full diff: https://github.com/yaml/go-yaml/compare/v3.0.5...v3.0.6

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-11-03 09:18:30 +01:00
Mend Renovate 54372359af fix(deps): update github.com/moby/swarmkit/v2 digest to 49925db 
Signed-off-by: Mend Renovate <bot@renovateapp.com>
 2026-11-02 18:24:45 +00:00
Sebastiaan van Stijn f7886407b2 Merge pull request #54093 from vvoland/update-profiles 
vendor: github.com/moby/profiles/apparmor & seccomp v0.3.0
 2026-11-02 19:12:58 +01:00
Sebastiaan van Stijn 8c4b229c2b Merge pull request #54084 from renovate-bot/renovate/cloud.google.com-go-logging-1.x 
fix(deps): update module cloud.google.com/go/logging to v1.21.1
 2026-11-02 18:34:03 +01:00
Paweł Gronowski 1f4db24e32 Merge pull request #53947 from vvoland/ext-containerstate 
Initial ContainerState extension point
 2026-11-02 17:52:22 +01:00
Paweł Gronowski 9d58f27ab0 vendor: github.com/moby/profiles/seccomp v0.3.0 
- Remove obsolete socket families from the default socket-domain
  allowlist, including DECnet and the families denied by the AppArmor
  update.
- Update the generated JSON profile to match the revised allowlist.
- Correct the architecture-map keys from `loong64` to `loongarch64` and
  from `mipsle` to `mipsel`.

full diff: https://github.com/moby/profiles/compare/seccomp/v0.2.4...seccomp/v0.3.0
release notes: https://github.com/moby/profiles/releases/tag/seccomp/v0.3.0

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-11-02 17:08:40 +01:00
Paweł Gronowski 07dd4e3c66 vendor: github.com/moby/profiles/apparmor v0.3.0 
- Escape embedded quotes in profile declarations.
- Escape AppArmor pattern metacharacters in signal and ptrace peer
  selectors so profile names are matched literally rather than
  interpreted as patterns.
- Preserve the special `unconfined` selector when the daemon is not
  confined.
- Explicitly deny obsolete socket families, including AX.25, IPX,
  AppleTalk, NET/ROM, ROSE, Econet, ATM SVC, IrDA, WANPIPE, ISDN, and
  CAIF.

full diff: https://github.com/moby/profiles/compare/apparmor/v0.2.2...apparmor/v0.3.0
release notes: https://github.com/moby/profiles/releases/tag/apparmor/v0.3.0

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-11-02 17:08:35 +01:00
Mend Renovate 940c82b168 fix(deps): update module cloud.google.com/go/logging to v1.21.1 
Signed-off-by: Mend Renovate <bot@renovateapp.com>
 2026-10-31 22:31:12 +00:00
Mend Renovate 08a76489b5 fix(deps): update aws-sdk-go-v2 monorepo 
Signed-off-by: Mend Renovate <bot@renovateapp.com>
 2026-10-30 18:59:22 +00:00
Paweł Gronowski abe7d7abe5 api/types/network: Deep-copy endpoint MAC addresses 
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-10-30 18:00:11 +01:00
Sebastiaan van Stijn f37bdcea9a Merge pull request #54061 from renovate-bot/renovate/github.com-tonistiigi-fsutil-digest 
fix(deps): update github.com/tonistiigi/fsutil digest to ca65610
 2026-10-29 23:11:29 +01:00
Sebastiaan van Stijn 0bb082ee9a Merge pull request #54062 from renovate-bot/renovate/github.com-moby-sys-mountinfo-0.x 
fix(deps): update module github.com/moby/sys/mountinfo to v0.7.3
 2026-10-29 22:40:42 +01:00
Sebastiaan van Stijn 77b5c8a84e Merge pull request #54052 from bercedev/fix/hijack-end-otel-span 
client: end the otelhttp span after a successful hijack
 2026-10-29 20:50:10 +01:00
Mend Renovate 575edf4d84 fix(deps): update module github.com/moby/sys/mountinfo to v0.7.3 
Signed-off-by: Mend Renovate <bot@renovateapp.com>
 2026-10-29 15:22:26 +00:00
Mend Renovate dcc4842f23 fix(deps): update github.com/tonistiigi/fsutil digest to ca65610 
Signed-off-by: Mend Renovate <bot@renovateapp.com>
 2026-10-29 15:20:57 +00:00
berce 7dcd61b4a8 client: end the otelhttp span after a successful hijack 
setupHijackConn only closed the response body when the upgrade failed.
otelhttp ends its client span when the body is closed, so the span of
every successful ContainerAttach, ContainerExecAttach and DialHijack
call was never ended. A 101 response has no body, so closing it does not
touch the hijacked connection.

Signed-off-by: berce <75228263+bercedev@users.noreply.github.com>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-10-29 11:29:10 +01:00
Sebastiaan van Stijn 8e8a8a5756 vendor: github.com/klauspost/compress v1.20.2 
includes a fix for CVE-2026-116591 / [GHSA-fpmh-frq8-7rj8]

full diff: https://github.com/klauspost/compress/compare/v1.20.1...v1.20.2

[GHSA-fpmh-frq8-7rj8]: https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-28 23:19:28 +01:00
Paweł Gronowski dda2877a6c Add an extension point for watching container state 
Jobs extensions need to know when a container finishes so they can
record the outcome of a run.

Add org.mobyproject.extension.container.state.v0.
Its Wait call returns once the container reaches a requested status,
and Watch streams every status change until the container is removed.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-10-28 15:56:21 +01:00
Paweł Gronowski a7580523ff Merge pull request #54044 from vvoland/update-xnet 
vendor: golang.org/x/net v0.62.0
 2026-10-28 12:57:09 +01:00
Akihiro Suda fca4feda32 Merge pull request #54035 from vvoland/fix-grpc 
vendor: google.golang.org/grpc v1.85.0
 2026-10-28 07:54:21 +09:00
Paweł Gronowski 58131010ed vendor: golang.org/x/net v0.62.0 
full diff: https://github.com/golang/net/compare/v0.61.0...v0.62.0

This release addresss the following security issues:

- html: avoid quadratic complexity when coalescing text nodes

    When coalescing adjacent text nodes in addText and fosterParent,
    appending to an existing TextNode's Data via string concatenation
    (n.Data += text) reallocated and copied the accumulated string on every
    token. Inputs containing many short text runs separated by ignored end
    tags (such as "a") caused O(n^2) allocations and byte copies.

    Accumulate coalesced text in per-node byte slices during parsing and
    materialize Data strings once at the end of parse.

    Thanks to Markus Magnuson for reporting this issue.

    This is CVE-2026-78661 and Go issue https://go.dev/issue/82224.

- html: check all ancestor namespace transitions when rendering raw text

    In childTextNodesAreLiteral, walking up the tree previously stopped at
    the nearest foreign ancestor once an HTML integration point was found.
    However, that integration point may itself be a descendant of an element
    that was foster-parented into a foreign namespace (such as or
    fostered under ), causing a parser to resolve the
    subtree in a different foreign namespace upon re-parsing the rendered
    output.

    Continue walking the full ancestor chain and verify that every
    transition from a non-empty namespace occurs at an HTML integration
    point before emitting literal text.

    Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276) for reporting this issue.

    This is CVE-2026-97045 and Go issue https://go.dev/issue/82622.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-10-27 21:32:26 +01:00
Paweł Gronowski 9d3170875d Merge pull request #53749 from thaJeztah/bump_msgp 
vendor: github.com/tinylib/msgp v1.4.0
 2026-10-27 21:17:46 +01:00
Paweł Gronowski 204ac6dcae vendor: google.golang.org/grpc v1.85.0 
full diff: https://github.com/grpc/grpc-go/compare/v1.84.0...v1.85.0

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-10-27 14:04:33 +01:00
Mend Renovate 929f3c2edc fix(deps): update module github.com/containerd/nri to v0.12.5 
Signed-off-by: Mend Renovate <bot@renovateapp.com>
 2026-10-26 19:16:39 +00:00
Paweł Gronowski 12fdfe2cfc Merge pull request #54028 from renovate-bot/renovate/cloud.google.com-go-logging-1.x 
fix(deps): update module cloud.google.com/go/logging to v1.21.0
 2026-10-26 14:12:53 +01:00
Sebastiaan van Stijn a2356c9a79 Merge pull request #54025 from renovate-bot/renovate/github.com-moby-policy-helpers-digest 
fix(deps): update github.com/moby/policy-helpers digest to 485a1be
 2026-10-26 12:42:53 +01:00
Mend Renovate 3c35396b63 fix(deps): update module cloud.google.com/go/logging to v1.21.0 
Signed-off-by: Mend Renovate <bot@renovateapp.com>
 2026-10-26 10:24:15 +00:00
Mend Renovate 48020a4b59 fix(deps): update github.com/moby/policy-helpers digest to 485a1be 
Signed-off-by: Mend Renovate <bot@renovateapp.com>
 2026-10-25 16:41:11 +00:00
Mend Renovate fd0717a2ed fix(deps): update module github.com/aws/smithy-go to v1.28.6 
Signed-off-by: Mend Renovate <bot@renovateapp.com>
 2026-10-24 21:05:05 +00:00
Sebastiaan van Stijn b711d21792 Merge pull request #54003 from vvoland/update-ext 
vendor: github.com/moby/extensions d2819d88bcbe
 2026-10-22 11:41:14 +02:00
Paweł Gronowski 987cc3d314 vendor: github.com/moby/extensions d2819d88bcbe 
full diff: https://github.com/moby/extensions/compare/e4c23d866037...d2819d88bcbe

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-10-21 20:57:10 +02:00
Paweł Gronowski ff225faca0 Merge pull request #53973 from renovate-bot/renovate/github.com-mdlayher-socket-0.x 
fix(deps): update module github.com/mdlayher/socket to v0.8.0
 2026-10-21 20:35:34 +02:00
Sebastiaan van Stijn c6a7c109b6 vendor: github.com/moby/buildkit v0.34.1 
no code-changes in vendor; this was a binary-release only,
rebuilt with go1.26.10;

release notes: https://github.com/moby/buildkit/releases/tag/v0.34.1
full diff: https://github.com/moby/buildkit/compare/v0.34.0...v0.34.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-21 00:22:09 +02:00
Mend Renovate 85f030dbec fix(deps): update module github.com/mdlayher/socket to v0.8.0 
Signed-off-by: Mend Renovate <bot@renovateapp.com>
 2026-10-20 10:12:46 +00:00
Sebastiaan van Stijn 5d8d3c6ae3 Merge pull request #53969 from renovate-bot/renovate/github.com-godbus-dbus-v5-5.x 
fix(deps): update module github.com/godbus/dbus/v5 to v5.2.4
 2026-10-20 00:59:43 +02:00
Sebastiaan van Stijn 87bcd0486d Merge pull request #53980 from thaJeztah/api_remove_rapid 
api/types/plugin: replace rapid with standard Go fuzzing
 2026-10-19 22:57:39 +02:00
Sebastiaan van Stijn d3c51c66da api/types/plugin: replace rapid with standard Go fuzzing 
Replace the rapid-based property test for plugin capability IDs
with a table-driven test and Go's built-in fuzzing support.

Preserve the comparison against the historical JSON parser to
catch compatibility regressions, and add explicit test cases for
the supported serialization formats and invalid inputs.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-10-19 22:33:32 +02:00