Repository navigation
chore(deps): update golang docker tag to v1.26.2 - #7
Merged
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/golang-1.x
branch
from
April 19, 2026 10:15
ebc0949 to
47f1b3d
Compare
renovate
Bot
force-pushed
the
renovate/golang-1.x
branch
from
April 19, 2026 21:01
47f1b3d to
28ee290
Compare
…sponse test The handler emits printable ASCII bytes 32-125 (space included), so when the last iteration's last byte was 0x20, strings.TrimSpace stripped it and the length assertion saw 9 bytes instead of 10. Trim only the trailing newline. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
fclairamb
added a commit
that referenced
this pull request
Sep 14, 2026
Three bumps close every open Dependabot alert on the repo. - kin-openapi 0.142.0 -> 0.144.0 (alerts #6 critical, #7 medium): ValidationHandler.Load() fail-open auth bypass via the default NoopAuthenticationFunc, and an unauthenticated nil-pointer panic in openapi3filter when validating a `content` parameter whose media type carries no schema. Indirect, pulled by oapi-codegen. - goxmldsig 1.4.0 -> 1.6.0 (alert #1 high): loop-variable capture in validateSignature let a crafted document bypass signature validation. Indirect, pulled by crewjam/saml. - github.com/docker/docker -> github.com/moby/moby/{client,api} (alerts #2, #3, #4, #5): docker/docker stopped publishing Go modules at v28.5.2 — Docker 29 split the Go client into github.com/moby/moby/client and the API types into github.com/moby/moby/api. There is no patched v28, so the only way off the vulnerable module is the migration. The moby migration is mechanical but not a pure import rewrite, because the split client reshaped its call signatures: - every call takes an options struct and returns a result struct (ContainerInspect/List/Start/Remove/Logs, CopyTo/FromContainer, ImagePull, Ping); - InspectResponse is flat — the ContainerJSONBase embedding is gone; - Summary.State is container.ContainerState and Health.Status is container.HealthStatus, both typed strings now; - container.Port is container.PortSummary; - port sets/maps moved to the network package with a real Port type (network.MustParsePort) and netip.Addr host IPs, replacing docker/go-connections/nat — which drops to indirect; - EndpointSettings.Gateway is a netip.Addr, not a string. Behaviour is unchanged for the docker check and container discovery. The one compatibility note: the split client's floor is Docker API 1.40 (Docker 19.03, 2019), up from 1.24. API-version negotiation still runs, so Podman and older-but-supported daemons are unaffected. go mod tidy also promotes chromedp/cdproto to a direct requirement — it is directly imported by internal/checkers/checkbrowser and was mislabeled indirect. Verified: make lint-back, go vet ./... , go vet -tags slowtests ./... , and the full `make test` suite all green; oapi-codegen still builds against kin-openapi 0.144.0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
fclairamb
added a commit
that referenced
this pull request
Sep 14, 2026
Three bumps close every open Dependabot alert on the repo. - kin-openapi 0.142.0 -> 0.144.0 (alerts #6 critical, #7 medium): ValidationHandler.Load() fail-open auth bypass via the default NoopAuthenticationFunc, and an unauthenticated nil-pointer panic in openapi3filter when validating a `content` parameter whose media type carries no schema. Indirect, pulled by oapi-codegen. - goxmldsig 1.4.0 -> 1.6.0 (alert #1 high): loop-variable capture in validateSignature let a crafted document bypass signature validation. Indirect, pulled by crewjam/saml. - github.com/docker/docker -> github.com/moby/moby/{client,api} (alerts #2, #3, #4, #5): docker/docker stopped publishing Go modules at v28.5.2 — Docker 29 split the Go client into github.com/moby/moby/client and the API types into github.com/moby/moby/api. There is no patched v28, so the only way off the vulnerable module is the migration. The moby migration is mechanical but not a pure import rewrite, because the split client reshaped its call signatures: - every call takes an options struct and returns a result struct (ContainerInspect/List/Start/Remove/Logs, CopyTo/FromContainer, ImagePull, Ping); - InspectResponse is flat — the ContainerJSONBase embedding is gone; - Summary.State is container.ContainerState and Health.Status is container.HealthStatus, both typed strings now; - container.Port is container.PortSummary; - port sets/maps moved to the network package with a real Port type (network.MustParsePort) and netip.Addr host IPs, replacing docker/go-connections/nat — which drops to indirect; - EndpointSettings.Gateway is a netip.Addr, not a string. Behaviour is unchanged for the docker check and container discovery. The one compatibility note: the split client's floor is Docker API 1.40 (Docker 19.03, 2019), up from 1.24. API-version negotiation still runs, so Podman and older-but-supported daemons are unaffected. go mod tidy also promotes chromedp/cdproto to a direct requirement — it is directly imported by internal/checkers/checkbrowser and was mislabeled indirect. Verified: make lint-back, go vet ./... , go vet -tags slowtests ./... , and the full `make test` suite all green; oapi-codegen still builds against kin-openapi 0.144.0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.26.1-trixie→1.26.2-trixie1.26.1-trixie→1.26.2-trixieConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.