chore(deps): update module github.com/docker/cli to v29 [security]#560
Conversation
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (2)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #560 +/- ##
==========================================
+ Coverage 28.76% 28.81% +0.04%
==========================================
Files 175 175
Lines 7063 7063
==========================================
+ Hits 2032 2035 +3
+ Misses 4913 4911 -2
+ Partials 118 117 -1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
2 participants
This PR contains the following updates:
v28.0.4+incompatible->v29.2.0+incompatibleGitHub Vulnerability Alerts
CVE-2025-15558
This issue affects Docker CLI through 29.1.5
Impact
Docker CLI for Windows searches for plugin binaries in
C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if thedockerCLI is executed as a privileged user.This issue affects Docker CLI through v29.1.5 (fixed in v29.2.0). It impacts Windows binaries acting as a CLI plugin manager via the
github.com/docker/cli/cli-plugins/managerpackage, which is consumed by downstream projects such as Docker Compose.Docker Compose became affected starting in v2.31.0, when it incorporated the relevant CLI plugin manager code (see https://github.com/docker/compose/pull/12300), and is fixed in v5.1.0.
This issue does not impact non-Windows binaries or projects that do not use the plugin manager code.
Patches
Fixed version starts with 29.2.0
This issue was fixed in docker/cli@1375933 (https://github.com/docker/cli/pull/6713), which removed
%PROGRAMDATA%\Docker\cli-pluginsfrom the list of paths used for plugin-discovery on Windows.Workarounds
None
Resources
Credits
Nitesh Surana (niteshsurana.com) of Trend Research of TrendAI
Release Notes
docker/cli (github.com/docker/cli)
v29.2.0+incompatibleCompare Source
v29.1.5+incompatibleCompare Source
v29.1.4+incompatibleCompare Source
v29.1.3+incompatibleCompare Source
v29.1.2+incompatibleCompare Source
v29.1.1+incompatibleCompare Source
v29.1.0+incompatibleCompare Source
v29.0.4+incompatibleCompare Source
v29.0.3+incompatibleCompare Source
v29.0.2+incompatibleCompare Source
v29.0.1+incompatibleCompare Source
v29.0.0+incompatibleCompare Source
v28.5.2+incompatibleCompare Source
v28.5.1+incompatibleCompare Source
v28.5.0+incompatibleCompare Source
v28.4.0+incompatibleCompare Source
v28.3.3+incompatibleCompare Source
v28.3.2+incompatibleCompare Source
v28.3.1+incompatibleCompare Source
v28.3.0+incompatibleCompare Source
v28.2.2+incompatibleCompare Source
v28.2.1+incompatibleCompare Source
v28.2.0+incompatibleCompare Source
v28.1.1+incompatibleCompare Source
v28.1.0+incompatibleCompare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.