Skip to content

Bump the docker group across 1 directory with 7 updates - #639

Merged
jeffwidman merged 1 commit into
mainfrom
dependabot/go_modules/docker-d9cce02857
Aug 10, 2026
Merged

Bump the docker group across 1 directory with 7 updates#639
jeffwidman merged 1 commit into
mainfrom
dependabot/go_modules/docker-d9cce02857

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the docker group with 4 updates in the / directory: github.com/docker/cli, github.com/moby/go-archive, github.com/docker/docker-credential-helpers and github.com/docker/go-connections.

Updates github.com/docker/cli from 29.3.0+incompatible to 29.7.2+incompatible

Commits
  • a7dcaa6 Merge pull request #7151 from vvoland/update-archive
  • 400b45f vendor: github.com/moby/go-archive v0.3.3
  • 38887ec Merge pull request #7145 from winklemad/fix-service-duplicate-removal-panic
  • 904aef7 Merge pull request #7147 from docker/dependabot/github_actions/docker-actions...
  • f08e60e build(deps): bump docker/docker-agent-action/.github/workflows/review-pr.yml
  • abfd891 Merge pull request #7149 from vvoland/update-docker
  • 519eb45 VERSION: 29.7.2
  • 8717af7 cli/command/service: fix panic when removing duplicate values
  • e9452d6 Merge pull request #7142 from thaJeztah/bump_go_archive_0.3.2
  • a6014a7 vendor: github.com/moby/go-archive v0.3.2
  • Additional commits viewable in compare view

Updates github.com/moby/go-archive from 0.2.0 to 0.3.3

Release notes

Sourced from github.com/moby/go-archive's releases.

v0.3.3

What's Changed

  • Fix a regression introduced in v0.3.0 that caused archive extraction to reject hardlinks with absolute targets, as produced by some image builders. Absolute hardlink targets are now resolved relative to the extraction root, while paths that escape the root remain rejected. moby/go-archive#100
  • Fix a regression introduced in v0.3.0 that caused archive extraction to fail when applying permissions to device nodes, including nodes on nodev filesystems and dev/ptmx. Device nodes are now referenced without opening the underlying device before applying their mode. moby/go-archive#103
  • Set close-on-exec on file descriptors used by the Linux permission fallback to prevent them from leaking into child processes. moby/go-archive#104

Full Changelog: moby/go-archive@v0.3.2...v0.3.3

v0.3.2

What's Changed

Fix a regression introduced in v0.3.0 that caused archive extraction to fail when paths traversed absolute symlinks inside the destination root, such as var/run -> /run. Absolute symlink targets are now resolved relative to the extraction root while relative symlink escapes remain rejected. moby/go-archive#93

Full Changelog: moby/go-archive@v0.3.1...v0.3.2

v0.3.1

Fixes

This patch release fixes a regression introduced in v0.2.1 where archive extraction could fail when an archive omitted explicit entries for parent directories. For example, extracting etc/dnf/ without a preceding etc/ entry could return mkdirat etc/dnf: no such file or directory.

This prevented affected images from being extracted. Archive extraction now creates implied parent directories for both file and directory entries.

What's Changed

Full Changelog: moby/go-archive@v0.3.0...v0.3.1

v0.3.0

Security

This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted tar archive could use links to cause extraction operations to create or overwrite files outside the intended destination directory.

The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the ApplyLayer helpers. Users should upgrade and avoid extracting untrusted archives with earlier versions.

What's Changed

... (truncated)

Commits
  • ae9e219 Merge pull request #104 from thaJeztah/use_O_CLOEXEC
  • 98ff1da archive: set close-on-exec for chmod fallback descriptors
  • 1e8dfbc Merge pull request #103 from thaJeztah/fix_chmod_fallback
  • e738eed archive: keep procfs file alive during fchmodat
  • 2d863f5 archive: preserve procfs access during chroot extraction
  • 89653ed archive: fix chmod fallback for device nodes on nodev mounts
  • f37d413 Merge pull request #106 from thaJeztah/fallback_no_read
  • 4ffc915 archive: test chmod fallback without read permission
  • 9af1c40 Merge pull request #105 from thaJeztah/test_chrooted_chmod_fallback
  • 3daca2a archive: test chmod fallback without procfs in chroot
  • Additional commits viewable in compare view

Updates github.com/docker/docker-credential-helpers from 0.9.5 to 0.9.8

Release notes

Sourced from github.com/docker/docker-credential-helpers's releases.

v0.9.8

What's Changed

  • update to go1.26.4
  • wincred: inline label, and append to existing
  • build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1
  • build(deps): bump crazy-max/.github/.github/workflows/zizmor.yml from 1.7.1 to 1.10.0
  • build(deps): bump docker/bake-action from 7.1.0 to 7.2.0
  • build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0
  • build(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0

Full Changelog: docker/docker-credential-helpers@v0.9.7...v0.9.8

v0.9.7

What's Changed

  • update to go1.26.3
  • ci: update zizmore action to v1.7.1

Full Changelog: docker/docker-credential-helpers@v0.9.6...v0.9.7

v0.9.6

What's Changed

  • update to go1.25.9
  • secretservice: allow building on openbsd
  • wincred: minor cleanups
  • Dockerfile: document build-args
  • Dockerfile: update golangci-lint to v2.11
  • Dockerfile: update xx to v1.9.0
  • ci: set default permissions and timeouts
  • ci: update actions
  • ci: pin actions by sha
  • ci: add zizmor workflow

Full Changelog: docker/docker-credential-helpers@v0.9.5...v0.9.6

Commits
  • 4f6bc8a Merge pull request #433 from thaJeztah/wincred_inline
  • b0820e3 Merge pull request #441 from docker/dependabot/github_actions/actions/checkou...
  • f84e991 Merge pull request #445 from thaJeztah/bump_go_1.26.4
  • 65d1391 update to go1.26.4
  • d21de35 Merge pull request #444 from docker/dependabot/github_actions/crazy-max/dot-g...
  • c6ca626 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • 1d2dd3d Merge pull request #440 from docker/dependabot/github_actions/docker/setup-qe...
  • 3a54b5c Merge pull request #439 from docker/dependabot/github_actions/docker/bake-act...
  • b68f2ec Merge pull request #438 from docker/dependabot/github_actions/docker/setup-bu...
  • 6107240 build(deps): bump crazy-max/.github/.github/workflows/zizmor.yml
  • Additional commits viewable in compare view

Updates github.com/docker/go-connections from 0.6.0 to 0.8.1

Commits
  • 9c9e2db Merge pull request #167 from thaJeztah/fix_illumos
  • de1f4dc sockets: fix compilation on illumos
  • 4a7495e ci: add cross-build target
  • 754f906 Merge pull request #158 from thaJeztah/no_umask
  • 20f47a1 sockets: read somaxconn from system instead of SOMAXCONN
  • e195e2a sockets: set socket permissions without umask hack
  • 32c72ec Merge pull request #162 from thaJeztah/abstract_sockets
  • f3526e5 sockets: improve abstract Unix socket handling
  • fd93b41 Merge pull request #163 from thaJeztah/rm_log
  • d0c7559 sockets: update more tests to use tempSocketPath utility
  • Additional commits viewable in compare view

Updates github.com/moby/patternmatcher from 0.6.0 to 0.6.1

Release notes

Sourced from github.com/moby/patternmatcher's releases.

v0.6.1

What's Changed

Full Changelog: moby/patternmatcher@v0.6.0...v0.6.1

Commits
  • 5a6d842 Merge pull request #9 from thaJeztah/fix_panic
  • e5d80c7 fix panic / nil pointer dereference on invalid patterns
  • 7f236f5 Merge pull request #8 from thaJeztah/update_ci
  • a95e09c ci: update actions and test against "oldest", "oldstable" and "stable"
  • See full diff in compare view

Updates github.com/moby/sys/sequential from 0.6.0 to 0.7.0

Release notes

Sourced from github.com/moby/sys/sequential's releases.

signal/v0.7.0

What's Changed

Full Changelog: moby/sys@signal/v0.6.0...signal/v0.7.0

mountinfo v0.7.0

What's Changed

sequential v0.7.0

What's Changed

  • update minimum go version to 1.24
  • use os.OpenFile with O_FILE_FLAG_SEQUENTIAL_SCAN on Go 1.26+

Full Changelog: moby/sys@sequential/v0.6.0...sequential/v0.7.0

mountinfo v0.6.2

What's Changed

New Contributors

Full Changelog: moby/sys@mountinfo/v0.6.1...mountinfo/v0.6.2

mountinfo v0.6.1

What's Changed

New Contributors

Full Changelog: moby/sys@mountinfo/v0.6.0...mountinfo/v0.6.1

Commits
  • b8d8fab Merge pull request #105 from kolyshkin/fix-mac-ci
  • b128335 Makefile: rm .SHELLFLAGS, add set -e
  • d4611de Merge pull request #103 from kolyshkin/mount-bump-mountinfo-0.6
  • e1c5b38 mount: bump mountinfo to v0.6.0
  • d01e595 Merge pull request #100 from kolyshkin/mounted-fast
  • 5d09d69 mountinfo: add TestMountedRoot
  • 303f101 mountinfo: add tests for MountedFast
  • 9742587 mountinfo: TestMountedBy: rm exp
  • 3494465 mountinfo: mounted_linux_test: nits
  • 88ece65 mountinfo: add MountedFast
  • Additional commits viewable in compare view

Updates github.com/moby/sys/user from 0.4.0 to 0.4.1

Release notes

Sourced from github.com/moby/sys/user's releases.

mountinfo v0.4.1

Fixes and improvements:

  • Fix PrefixFilter() being too greedy (#61)
  • TestMountedBy*: add missing pre-checks (ce8f425e79a74602c4055fb1776f38043d56827b)
  • Documentation improvements (#52)

user/v0.4.1

What's Changed

  • user: prevent possible DoS via unbounded parsing of user and group database files in CVE-2026-61801 / GHSA-mjcv-p78q-w5fw. This fixes a similar issue as CVE-2026-47262 in containerd.
  • user: prevent falling back to looking up numeric usernames and improve handling of numeric user/group to prevent looking up numeric values as usernames. This fixes a similar issue as CVE-2026-46680 in containerd. moby/sys#221
  • user: bump Go to 1.18, modernize moby/sys#198
  • user: make code a bit more DRY moby/sys#225
  • user: test cleanups moby/sys#226

Full Changelog: moby/sys@user/v0.4.0...user/v0.4.1

Commits
  • 85a71bb Merge commit from fork
  • 2c56c3d user: limit line length in ParseGroupFilter
  • bba2f13 user: limit reads from user database files
  • ee79b0e Merge pull request #221 from thaJeztah/limit_uidgid
  • 6eb9f15 user: GetAdditionalGroups: treat numeric group arguments as GIDs only
  • c66bd2d user: prevent falling back to looking up numeric usernames
  • c873359 Merge pull request #226 from thaJeztah/user_test_cleanups
  • f41a5ef Merge pull request #225 from thaJeztah/user_dry
  • 5c2e8a0 user: add test-cases for maxID (math.MaxInt32)
  • e001aea user: use sub-tests
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 26, 2026
@dependabot
dependabot Bot requested review from a team as code owners July 26, 2026 16:02
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 26, 2026
@jeffwidman

jeffwidman commented Aug 7, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Aug 7, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@dependabot
Bump the docker group across 1 directory with 7 updates
d944a98 
Bumps the docker group with 4 updates in the / directory: [github.com/docker/cli](https://github.com/docker/cli), [github.com/moby/go-archive](https://github.com/moby/go-archive), [github.com/docker/docker-credential-helpers](https://github.com/docker/docker-credential-helpers) and [github.com/docker/go-connections](https://github.com/docker/go-connections).


Updates `github.com/docker/cli` from 29.3.0+incompatible to 29.7.2+incompatible
- [Commits](docker/cli@v29.3.0...v29.7.2)

Updates `github.com/moby/go-archive` from 0.2.0 to 0.3.3
- [Release notes](https://github.com/moby/go-archive/releases)
- [Changelog](https://github.com/moby/go-archive/blob/main/changes_test.go)
- [Commits](moby/go-archive@v0.2.0...v0.3.3)

Updates `github.com/docker/docker-credential-helpers` from 0.9.5 to 0.9.8
- [Release notes](https://github.com/docker/docker-credential-helpers/releases)
- [Commits](docker/docker-credential-helpers@v0.9.5...v0.9.8)

Updates `github.com/docker/go-connections` from 0.6.0 to 0.8.1
- [Commits](docker/go-connections@v0.6.0...v0.8.1)

Updates `github.com/moby/patternmatcher` from 0.6.0 to 0.6.1
- [Release notes](https://github.com/moby/patternmatcher/releases)
- [Commits](moby/patternmatcher@v0.6.0...v0.6.1)

Updates `github.com/moby/sys/sequential` from 0.6.0 to 0.7.0
- [Release notes](https://github.com/moby/sys/releases)
- [Commits](moby/sys@signal/v0.6.0...signal/v0.7.0)

Updates `github.com/moby/sys/user` from 0.4.0 to 0.4.1
- [Release notes](https://github.com/moby/sys/releases)
- [Commits](moby/sys@user/v0.4.0...user/v0.4.1)

---
updated-dependencies:
- dependency-name: github.com/docker/cli
  dependency-version: 29.6.2+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker
- dependency-name: github.com/docker/docker-credential-helpers
  dependency-version: 0.9.8
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: docker
- dependency-name: github.com/docker/go-connections
  dependency-version: 0.8.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: docker
- dependency-name: github.com/moby/go-archive
  dependency-version: 0.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker
- dependency-name: github.com/moby/patternmatcher
  dependency-version: 0.6.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: docker
- dependency-name: github.com/moby/sys/sequential
  dependency-version: 0.7.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: docker
- dependency-name: github.com/moby/sys/user
  dependency-version: 0.4.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: docker
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/docker-d9cce02857 branch from 4edddcc to d944a98 Compare August 9, 2026 16:02
@jeffwidman
jeffwidman added this pull request to the merge queue Aug 10, 2026
Merged via the queue into main with commit 79d1822 Aug 10, 2026
105 checks passed
@jeffwidman
jeffwidman deleted the dependabot/go_modules/docker-d9cce02857 branch August 10, 2026 04:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jeffwidman jeffwidman jeffwidman approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jeffwidman