The Go test cache does not recheck files outside the module root, so
editing only openapi.yaml or swagger.yaml could reuse a cached
TestCheckedInSwagger result and miss a stale projection in a
persistent development container.
Pass -count=1 to disable caching.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Move application/x-tar from the Content-type header parameter to the
POST /build request body's content map alongside
application/octet-stream. This matches the content type sent by the Go
client and lets OpenAPI consumers discover both supported body media
types.
Regenerate Swagger with both media types in consumes.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Add a Go converter in a separate tooling module and reintroduce
swagger.yaml as generated Swagger 2.0 output. Preserve schema property
order, examples, and generator extensions, and reject unsupported
constructs. Use the union of response media types for Swagger's
operation-wide produces lists.
Leave historical versioned specifications and generated Go models
unchanged.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Move reusable schemas into components and describe request bodies and
response media types using OpenAPI 3.2 with the OpenAPI 3.1 schema
dialect. Preserve schema property order, reference annotations,
examples, custom formats, and Go generator extensions.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Keep the contents unchanged so Git can follow the hand-maintained
specification across the rename. Convert the document and reintroduce
swagger.yaml as generated compatibility output in subsequent commits.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
These releases include 1 security fix following the security policy:
- crypto/x509: mitigation for security concerns with a specific Certificate Authority
We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.
Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.
We highly recommend immediately upgrading to this release.
This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.
release notes: https://go.dev/doc/devel/release#go1.26.10
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Replace the rapid-based property test for plugin capability IDs
with a table-driven test and Go's built-in fuzzing support.
Preserve the comparison against the historical JSON parser to
catch compatibility regressions, and add explicit test cases for
the supported serialization formats and invalid inputs.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These releases include 15 security fixes following the security policy:
- net/http: HTTP/2 server crash due to HPACK encoder race
HTTP/2 servers could end up crashing due to inadvertently
modifying its HPACK encoder concurrently. This happens because the
server modifies the HPACK encoder from two goroutines without
synchronization: one uses the encoder to encode a HEADERS frame as part
of a response sent to a client and the other modifies the encoder's
table size when handling a SETTINGS frame containing
SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can
repeatedly send a request while changing the header table size to crash
the server.
Fix this issue by not applying SETTINGS_HEADER_TABLE_SIZE immediately.
Instead, buffer any SETTINGS_HEADER_TABLE_SIZE received, and only apply
the new value prior to the next time the server writes a frame.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-97032 and Go issue https://go.dev/issue/81867.
- net/http: HTTP/2 server memory exhaustion due to Trailer headers
When "Trailer" headers are sent by a client, the HTTP server internally
uses the header values to populate the Request.Trailer map passed to the
server handler. Because Request.Trailer is a map, each entry incurs
memory overhead. For HTTP/2 servers, a malicious client can exploit this
by sending a "Trailer" header that declares a large number of fields,
causing the server to allocate a disproportionate amount of memory while
bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits.
This exploit is not applicable for HTTP/1 servers, which do not support
multiplexing a large number of requests over one TCP connection, and
whose Server.MaxHeaderBytes are calculated differently.
Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits are now
applied towards the trailer fields declared in "Trailer" headers.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-78659 and Go issue https://go.dev/issue/81857.
- crypto/tls: reject malformed ECH outer extension references
Multiple ECH outer extension references are not
permitted under RFC 9849; previously, a client
could send a well-crafted packet that could
trigger memory exhaustion in the server process
by specifying multiple references.
We now reject these as malformed and curb the
memory amplification vector as a result.
This is CVE-2026-97031 and Go issue https://go.dev/issue/81855.
- cmd/go: checksum bypass for golang.org/fips140
Previously, a user operating inside of a malicious
Go project that defines a bogus golang.org/fips140
and operates a malicious GOMODPROXY the user chooses
to connect to can serve an arbitrary module in its
place.
We now unpack the trusted ziphash for the bundled
golang.org/fips140 module and construct its entry
in the GOMODCACHE such that it can be verified by
the toolchain.
This is CVE-2026-94444 and Go issue https://go.dev/issue/81833.
- cmd/go: checksum database bypass for golang.org/toolchain
Previously, a user operating inside of a malicious
Go project that defines a bogus golang.org/toolchain
go.sum entry and operates a malicious GOMODPROXY the
user chooses to use can bypass the intended checksum.
We now ensure that golang.org/toolchain always goes
to the network for the canonical checksum.
This is CVE-2026-94447 and Go issue https://go.dev/issue/81834.
- html/template: reset context tracking on consecutive template expressions
When a JavaScript template literal contains
consecutive expressions, the context tracking
state was not properly reset upon entering a
new expression.
We now ensure that template-literal expression
entries correctly reset context variables so all
subsequent regular expression literals are
accurately recognized and escaped.
This is CVE-2026-94448 and Go issue https://go.dev/issue/81821.
- html/template: recognize yield as regexp preceder keyword
A trusted template author may have previously
written a valid template wherein the use of
the yield keyword would not be correctly
escaped.
We now ensure that valid keyword uses are
escaped and non-keyword uses are not escaped.
This is CVE-2026-97030 and Go issue https://go.dev/issue/81823.
- net/textproto, mime/multipart: memory limit bypass when parsing MIME headers
Parsing a multipart form could bypass memory limits and read an
arbitrarily long line into memory when the remaining limit at the
start of a part was less than 400 bytes.
Multipart form memory limits are now properly enforced in this situation.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-94440 and Go issue https://go.dev/issue/81741.
- net/http: HTTP/1 client connection desynchronization after CONNECT rejection
When http.Transport sends an HTTP/1 CONNECT request with a non-empty
Request.Body, it writes the body directly to the connection without
framing after the request headers. If the server rejects the CONNECT
request with a non-2xx keep-alive response, Transport returns the
connection to the idle pool. Because CONNECT requests do not have a
request body, the server may interpret the trailing body bytes as a
subsequent pipelined HTTP/1.1 request on the connection, leaving the
pooled connection desynchronized and causing the next caller that reuses
it to read the response to the injected request. In reverse proxies
(including httputil.ReverseProxy) that forward CONNECT requests through
a shared Transport, this can lead to cross-user response poisoning.
The HTTP/1 transport now closes a connection after sending a CONNECT
request, regardless of the response status.
In addition, ReverseProxy now rejects incoming CONNECT requests
with a 405 Method Not Allowed response. ReverseProxy has never handled
CONNECT requests in a useful fashion (it does not convert the
connection into a bidirectional tunnel), so we do not expect this
change to negatively affect any current users.
Thanks to Xclow3n (Rajat Raghav) for reporting this issue.
This is CVE-2026-56866 and Go issue https://go.dev/issue/81740.
- net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response
When an HTTP server handler sent a 2xx response to an HTTP/1 CONNECT request
and returned without hijacking the connection, the server improperly continued
to read and serve requests from the connection. Since a 2xx response to an
HTTP/1 CONNECT converts the connection into a tunnel, the server should not
treat the connection as continuing to contain HTTP.
The impact of this misbehavior is mostly limited to potential request smuggling,
where an intermediate proxy considers the data on the connection to be tunneled
and the server considers it to be HTTP.
The HTTP/1 server now always closes a connection after responding to a CONNECT
request, regardless of the response status.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-94439 and Go issue https://go.dev/issue/81744.
- net/http: excessive CPU consumption from repeated initial window changes
A malicious HTTP/2 peer could cause excessive CPU consumption in the
client or server by opening a large number of streams and then sending
many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
The HTTP/2 client and server now efficiently handle changes to the
initial window size (O(1) rather than O(number of streams)).
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-78669 and Go issue https://go.dev/issue/81742.
- net/http: HTTP/2 transport accepts malformed framing-related headers
Historically, we have been rather lax about malformed framing-related
headers in our HTTP/2 implementation, as they cannot interfere with
HTTP/2 framing. However, this makes it possible for our HTTP/2
implementation to forward responses containing such headers to an HTTP/1
client when acting as a reverse proxy. If the HTTP/1 client also does
not behave strictly enough, this can result in response smuggling.
We now delete malformed framing-related headers when received by our
HTTP/2 transport, so they will not be forwarded to a potentially
vulnerable HTTP/1 client.
Thanks to TJ Barton for reporting this issue.
This is CVE-2026-78660 and Go issue https://go.dev/issue/81115.
- os: Root.Mkdir(All) can follow junctions out of the root on Windows
On Windows, when the target of Root.Mkdir or Root.MkdirAll was a junction
pointing to an empty location, the operation would create a directory at
the junction target even when that target was located outside the root.
This only applies to operations where the last path component is a
junction (path/to/junction, but not path/junction/target).
Root.Mkdir and Root.MkdirAll now correctly avoid resolving junctions.
Thanks to Daniele Ballarini for reporting this issue.
This is CVE-2026-56857 and Go issue https://go.dev/issue/81739.
- net/http: lack of limit on size of parsed Range headers
When parsing a Range header containing a large number of small ranges,
FileServer(FS), ServeContent, and ServeFile(FS) could consume an excessive
amount of CPU.
These functions now ignore Range headers containing more than 200 ranges.
The limit is controlled by the new httpservecontentmaxranges=
GODEBUG setting. Setting GODEBUG=httpservecontentmaxranges=0
disables the limit.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-78667 and Go issue https://go.dev/issue/81858.
- net/http: double flow control refund on HTTP/2 server streams
The HTTP/2 server could refund connection-level flow control twice for the same data:
Once when a client resets a stream (refunding data for any sent-but-unread portion
of the stream), and again when a request handler reads the buffered data.
A malicious client could exploit this to bypass the configured connection-level
flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still
limited by the concurrent stream limit and stream-level flow control.
The HTTP/2 server now waits to refund connection-level flow control for reset
streams until after the request handler is complete.
Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/) for reporting this issue.
This is CVE-2026-78663 and Go issue https://go.dev/issue/81743.
release notes: https://go.dev/doc/devel/release#go1.26.9
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
the versioned api docs have the same indentation errors as
swagger.yaml. spec compliant parsers like js-yaml or libfyaml fail to
parse all of them.
flow collections that span lines are converted from flow style to
block style. continuation lines of multi-line double-quoted strings
are indented deeper than their key. the parsed data does not change.
Signed-off-by: Florian Stellbrink <flo@stellbr.ink>
this file had bad indentation before. this was crashing when attempting
to parse it in spec compliant parsers like js-yaml or libfyaml.
as per spec https://yaml.org/spec/1.2.2/#823-block-nodes:
> Flow nodes must be indented by at least one more space than the parent
> block collection.
since we still run yamllint the indentation could not be fixed since
it asserts the wrong indentation. instead the collections are converted
from flow style to block style.
Signed-off-by: Florian Stellbrink <flo@stellbr.ink>
yamllint does not report invalid indentation.
libfyaml passes the yaml test suite and catches these issues.
not replacing yamllint to preserve existing style rules.
Signed-off-by: Florian Stellbrink <flo@stellbr.ink>
go-swagger accepts unquoted response status codes in the Swagger 2.0
definition.
OpenAPI 3.x explicitly requires these keys to be quoted for JSON/YAML
compatibility, since YAML otherwise parses them as integers.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Disable the whole validators section and add an extra condition for
serializers; this allows for easier comparing with the upstream template.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `UnpackedSize` field was added in 050afe1e1a,
which originally had it as a top-level field, but later moved it to
`Size.Unpacked`.
This caused issues with current (v3.6) versions of go-swagger, which added
validation for this;
2026/09/22 12:33:56 reading config from /go/src/github.com/moby/moby/api/swagger-gen.yaml
2026/09/22 12:33:56 validating spec /go/src/github.com/moby/moby/api/swagger.yaml
The swagger spec at "/go/src/github.com/moby/moby/api/swagger.yaml" is invalid against the swagger specification 2.0. See errors :
- "UnpackedSize" is present in required but not defined as property in schema "ImageManifestSummary.ImageData"
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `UnpackedSize` field was added in 050afe1e1a,
which originally had it as a top-level field, but later moved it to
`Size.Unpacked`.
This caused issues with current (v3.6) versions of go-swagger, which added
validation for this;
2026/09/22 12:33:56 reading config from /go/src/github.com/moby/moby/api/swagger-gen.yaml
2026/09/22 12:33:56 validating spec /go/src/github.com/moby/moby/api/swagger.yaml
The swagger spec at "/go/src/github.com/moby/moby/api/swagger.yaml" is invalid against the swagger specification 2.0. See errors :
- "UnpackedSize" is present in required but not defined as property in schema "ImageManifestSummary.ImageData"
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The model validator changed into a temporary directory, but the
generator derived its output directory from its script location and
still wrote into the source tree.
Accept an optional API-directory argument and pass the temporary
module directory during validation.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
RemoteManagers declared an array with default: null, which does not
conform to the property's type. This response field does not need a
schema default.
Remove the default while retaining x-nullable and the existing Go
model representation. Generated Go models are unchanged.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Declare application/json for endpoints with JSON error responses instead
of advertising text/plain or inheriting the global response media types.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The changes, platforms, and names array parameters were documented
with Swagger's implicit CSV encoding. The image handlers read repeated
query keys instead, so clients generated from the specification could
send multiple values as one value.
Set collectionFormat to multi and clarify the parameter descriptions.
This documents existing daemon behavior without changing the API.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Keep the archived Swagger specifications consistent with the current
API specification and the Go struct field name.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Add HostConfig.Umask and pass it to the OCI process spec for container
entrypoints, exec processes, and healthchecks.
Preserve the configured umask when exec user resolution reconstructs the
OCI User value, so runtimes receive it in the per-exec process spec.
Keep the field aligned with OCI's uint32 representation - raw JSON
clients need to use 18 for octal 0022 for example.
Co-authored-by: Youfu Zhang <zhangyoufu@gmail.com>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Add support for filtering containers by annotation on
GET /containers/json, similar to the existing label filter:
`annotation=key` matches containers carrying the annotation key,
and `annotation=key=value` also matches its value.
Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
Mend Renovate