Skip to content

build(deps): bump the go-dependencies group across 1 directory with 9 updates - #2673

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-bc036262d9
Open

build(deps): bump the go-dependencies group across 1 directory with 9 updates#2673
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-bc036262d9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 6 updates in the / directory:

Package From To
github.com/chainguard-dev/kaniko 1.25.16 1.25.18
github.com/docker/cli 29.4.3+incompatible 29.7.2+incompatible
github.com/google/go-containerregistry 0.21.5 0.21.9
github.com/moby/go-archive 0.2.0 0.3.3
golang.org/x/crypto 0.54.0 0.55.0
golang.org/x/mod 0.38.0 0.40.0

Updates github.com/chainguard-dev/kaniko from 1.25.16 to 1.25.18

Release notes

Sourced from github.com/chainguard-dev/kaniko's releases.

v1.25.18

What's Changed

Full Changelog: chainguard-forks/kaniko@v1.25.17...v1.25.18

v1.25.17

What's Changed

Full Changelog: chainguard-forks/kaniko@v1.25.16...v1.25.17

Commits
  • 570480c chore(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#467)
  • c96cc53 chore(deps): bump golang from 3aff665 to 2005724 in /deploy (#469)
  • dfbdb7d chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#468)
  • c8370a1 chore(deps): bump debian from 7b140f3 to abd67ff in /deploy (#465)
  • 852c0e9 chore(deps): bump step-security/harden-runner in the actions group (#466)
  • 2363af0 chore(deps): bump zizmorcore/zizmor-action in the actions group (#462)
  • 973b3d1 chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#463)
  • 7e42229 chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.7 to 1.43.2 (#447)
  • 32a624a chore(deps): bump golang from 32c0e6e to 3aff665 in /deploy (#451)
  • 2777448 chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/storage/azblob (#448)
  • Additional commits viewable in compare view

Updates github.com/docker/cli from 29.4.3+incompatible to 29.7.2+incompatible

Commits
  • a7dcaa6 Merge pull request #7151 from vvoland/update-archive
  • 400b45f vendor: github.com/moby/go-archive v0.3.3
  • 38887ec Merge pull request #7145 from winklemad/fix-service-duplicate-removal-panic
  • 904aef7 Merge pull request #7147 from docker/dependabot/github_actions/docker-actions...
  • f08e60e build(deps): bump docker/docker-agent-action/.github/workflows/review-pr.yml
  • abfd891 Merge pull request #7149 from vvoland/update-docker
  • 519eb45 VERSION: 29.7.2
  • 8717af7 cli/command/service: fix panic when removing duplicate values
  • e9452d6 Merge pull request #7142 from thaJeztah/bump_go_archive_0.3.2
  • a6014a7 vendor: github.com/moby/go-archive v0.3.2
  • Additional commits viewable in compare view

Updates github.com/google/go-containerregistry from 0.21.5 to 0.21.9

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.21.9

What's Changed

Full Changelog: google/go-containerregistry@v0.21.8...v0.21.9

v0.21.8

The artifacts attached to this release are missing SLSA provenance, see #2390.

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.21.7...v0.21.8

v0.21.7

What's Changed

... (truncated)

Commits
  • 7b32099 build(deps): bump the actions group with 3 updates (#2398)
  • 2a4447d fix: remove '.' from unsafe path prefixes (#2400)
  • 43cc3e8 fix: prevent data race on scope refreshes within remote.writer (#2396)
  • 7775aab actions: pin slsa generator version following linter exception (#2395)
  • 2ea098f Bump go version to 1.26.5 (#2388)
  • ec2e586 actions: reformat ALL actions (#2386)
  • ab819b6 actions: fix unformatted action (#2385)
  • eed9a20 actions: update actions to be pinned by hash (#2384)
  • 8a97709 build(deps): bump github.com/moby/moby/client (#2380)
  • d04bf7d tarball: use correct file extension for zstd/uncompressed (#2382)
  • Additional commits viewable in compare view

Updates github.com/moby/go-archive from 0.2.0 to 0.3.3

Release notes

Sourced from github.com/moby/go-archive's releases.

v0.3.3

What's Changed

  • Fix a regression introduced in v0.3.0 that caused archive extraction to reject hardlinks with absolute targets, as produced by some image builders. Absolute hardlink targets are now resolved relative to the extraction root, while paths that escape the root remain rejected. moby/go-archive#100
  • Fix a regression introduced in v0.3.0 that caused archive extraction to fail when applying permissions to device nodes, including nodes on nodev filesystems and dev/ptmx. Device nodes are now referenced without opening the underlying device before applying their mode. moby/go-archive#103
  • Set close-on-exec on file descriptors used by the Linux permission fallback to prevent them from leaking into child processes. moby/go-archive#104

Full Changelog: moby/go-archive@v0.3.2...v0.3.3

v0.3.2

What's Changed

Fix a regression introduced in v0.3.0 that caused archive extraction to fail when paths traversed absolute symlinks inside the destination root, such as var/run -> /run. Absolute symlink targets are now resolved relative to the extraction root while relative symlink escapes remain rejected. moby/go-archive#93

Full Changelog: moby/go-archive@v0.3.1...v0.3.2

v0.3.1

Fixes

This patch release fixes a regression introduced in v0.2.1 where archive extraction could fail when an archive omitted explicit entries for parent directories. For example, extracting etc/dnf/ without a preceding etc/ entry could return mkdirat etc/dnf: no such file or directory.

This prevented affected images from being extracted. Archive extraction now creates implied parent directories for both file and directory entries.

What's Changed

Full Changelog: moby/go-archive@v0.3.0...v0.3.1

v0.3.0

Security

This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted tar archive could use links to cause extraction operations to create or overwrite files outside the intended destination directory.

The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the ApplyLayer helpers. Users should upgrade and avoid extracting untrusted archives with earlier versions.

What's Changed

... (truncated)

Commits
  • ae9e219 Merge pull request #104 from thaJeztah/use_O_CLOEXEC
  • 98ff1da archive: set close-on-exec for chmod fallback descriptors
  • 1e8dfbc Merge pull request #103 from thaJeztah/fix_chmod_fallback
  • e738eed archive: keep procfs file alive during fchmodat
  • 2d863f5 archive: preserve procfs access during chroot extraction
  • 89653ed archive: fix chmod fallback for device nodes on nodev mounts
  • f37d413 Merge pull request #106 from thaJeztah/fallback_no_read
  • 4ffc915 archive: test chmod fallback without read permission
  • 9af1c40 Merge pull request #105 from thaJeztah/test_chrooted_chmod_fallback
  • 3daca2a archive: test chmod fallback without procfs in chroot
  • Additional commits viewable in compare view

Updates github.com/moby/moby/api from 1.54.2 to 1.55.0

Release notes

Sourced from github.com/moby/moby/api's releases.

api/v1.55.0

1.55.0

Changelog

  • POST /containers/{id}/update now supports per-device blkio resource settingss. moby/moby#52651
  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
  • docs: clarify swarm join required fields. moby/moby#52763

api/v1.55.0-rc.1

1.55.0-rc.1

Changelog

  • POST /containers/{id}/update now supports per-device blkio resource settingss. moby/moby#52651
  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
  • docs: clarify swarm join required fields. moby/moby#52763
Commits
  • b6c53c2 Merge pull request #52773 from vvoland/c8d-amd64-variants
  • 01115e8 Merge pull request #52906 from vvoland/fix-TestContainerWithConflictingNoneNe...
  • b36296f Merge pull request #52913 from thaJeztah/windows_does_stats
  • a81aa78 TestContainerWithConflictingNoneNetwork: Extend Windows timeout
  • 908a35a Merge pull request #52914 from thaJeztah/no_stderr
  • 04d33b5 Merge pull request #52912 from thaJeztah/cleanup_GenerateRandomAlphaOnlyString
  • 3b2f557 Merge pull request #52722 from notandruu/integration/migrate-TestInspectAPIIm...
  • 62b3aae Merge pull request #52901 from vvoland/c8d-imageusage
  • 11d3342 integration-cli: un-skip stats tests on Windows
  • a47b1b2 Merge pull request #52891 from smerkviladze/attestations-clearer-blob-missing...
  • Additional commits viewable in compare view

Updates github.com/moby/moby/client from 0.4.1 to 0.5.1

Release notes

Sourced from github.com/moby/moby/client's releases.

client/v0.5.1

0.5.1

Changelog

  • client/pkg/jsonmessage: Display: fix godoc link. moby/moby#53070
  • client: ServiceCreate, ServiceUpdate: fix duplicate and 'unkown' platforms. moby/moby#53012
  • client: ServiceInspect, ContainerCommit: omit optional query args if not set. moby/moby#53010
  • golangci-lint: enable perfsprint linter. moby/moby#53016

client/0.5.0

0.5.0

Changelog

  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

client/v0.5.0-rc.1

0.5.0-rc.1

Changelog

  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
Changelog

Sourced from github.com/moby/moby/client's changelog.

0.5.1 (2013-07-30)

  • API: Docker client now sets useragent (RFC 2616)
  • Runtime: Add ps args to docker top
  • Runtime: Add support for container ID files (pidfile like)
  • Runtime: Add container=lxc in default env
  • Runtime: Support networkless containers with docker run -n and docker -d -b=none
  • API: Add /events endpoint
  • Builder: ADD command now understands URLs
  • Builder: CmdAdd and CmdEnv now respect Dockerfile-set ENV variables
  • Hack: Simplify unit tests with helpers
  • Hack: Improve docker.upstart event
  • Hack: Add coverage testing into docker-ci
  • Runtime: Stdout/stderr logs are now stored in the same file as JSON
  • Runtime: Allocate a /16 IP range by default, with fallback to /24. Try 12 ranges instead of 3.
  • Runtime: Change .dockercfg format to json and support multiple auth remote
  • Runtime: Do not override volumes from config
  • Runtime: Fix issue with EXPOSE override
  • Builder: Create directories with 755 instead of 700 within ADD instruction

0.5.0 (2013-07-17)

  • Runtime: List all processes running inside a container with 'docker top'
  • Runtime: Host directories can be mounted as volumes with 'docker run -v'
  • Runtime: Containers can expose public UDP ports (eg, '-p 123/udp')
  • Runtime: Optionally specify an exact public port (eg. '-p 80:4500')
  • Registry: New image naming scheme inspired by Go packaging convention allows arbitrary combinations of registries
  • Builder: ENTRYPOINT instruction sets a default binary entry point to a container
  • Builder: VOLUME instruction marks a part of the container as persistent data
  • Builder: 'docker build' displays the full output of a build by default
  • Runtime: 'docker login' supports additional options
  • Runtime: Dont save a container's hostname when committing an image.
  • Registry: Fix issues when uploading images to a private registry

0.4.8 (2013-07-01)

  • Builder: New build operation ENTRYPOINT adds an executable entry point to the container.
  • Runtime: Fix a bug which caused 'docker run -d' to no longer print the container ID.
  • Tests: Fix issues in the test suite

0.4.7 (2013-06-28)

  • Registry: easier push/pull to a custom registry
  • Remote API: the progress bar updates faster when downloading and uploading large files
  • Remote API: fix a bug in the optional unix socket transport
  • Runtime: improve detection of kernel version
  • Runtime: host directories can be mounted as volumes with 'docker run -b'
  • Runtime: fix an issue when only attaching to stdin
  • Runtime: use 'tar --numeric-owner' to avoid uid mismatch across multiple hosts
  • Hack: improve test suite and dev environment
  • Hack: remove dependency on unit tests on 'os/user'
  • Documentation: add terminology section

0.4.6 (2013-06-22)

... (truncated)

Commits

Updates golang.org/x/crypto from 0.54.0 to 0.55.0

Commits
  • f44d03d go.mod: update golang.org/x dependencies
  • 5ed4944 crypto/internal/poly1305: provide optimised assembly for riscv64
  • b07833c ssh: return window credit for discarded extended data
  • d701c51 acme: fix nil pointer dereference in pebble test error reporting
  • 999d053 ssh: fix parsing of GSSAPI payloads offering multiple mechanisms
  • 90f76b8 ssh: reject certificate signature keys before recursing
  • b53964a ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs
  • 626e40f ssh: drain stderr on forwarded TCP and Unix channels
  • 31914c6 x509roots/fallback: update bundle
  • f2135b8 all: clean up minor issues found by staticcheck
  • Additional commits viewable in compare view

Updates golang.org/x/mod from 0.38.0 to 0.40.0

Commits
  • d3398d0 go.mod: update golang.org/x dependencies
  • 57549bf sumdb: ignore unrelated hashes in Lookup
  • 96f62ae sumdb/tlog: fix TileHashReader authentication bypass
  • 13be902 go.mod: update golang.org/x dependencies
  • See full diff in compare view

Updates golang.org/x/text from 0.40.0 to 0.41.0

Commits
  • acdba66 go.mod: update golang.org/x dependencies
  • 02aa981 secure/precis: fix short destination buffer handling in Nickname profile
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the go-dependencies group across 1 directory with 9…
73cae23 
… updates

Bumps the go-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/chainguard-dev/kaniko](https://github.com/chainguard-dev/kaniko) | `1.25.16` | `1.25.18` |
| [github.com/docker/cli](https://github.com/docker/cli) | `29.4.3+incompatible` | `29.7.2+incompatible` |
| [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.21.5` | `0.21.9` |
| [github.com/moby/go-archive](https://github.com/moby/go-archive) | `0.2.0` | `0.3.3` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.54.0` | `0.55.0` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.38.0` | `0.40.0` |



Updates `github.com/chainguard-dev/kaniko` from 1.25.16 to 1.25.18
- [Release notes](https://github.com/chainguard-dev/kaniko/releases)
- [Changelog](https://github.com/chainguard-forks/kaniko/blob/main/CHANGELOG.md)
- [Commits](chainguard-forks/kaniko@v1.25.16...v1.25.18)

Updates `github.com/docker/cli` from 29.4.3+incompatible to 29.7.2+incompatible
- [Commits](docker/cli@v29.4.3...v29.7.2)

Updates `github.com/google/go-containerregistry` from 0.21.5 to 0.21.9
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.21.5...v0.21.9)

Updates `github.com/moby/go-archive` from 0.2.0 to 0.3.3
- [Release notes](https://github.com/moby/go-archive/releases)
- [Changelog](https://github.com/moby/go-archive/blob/main/changes_test.go)
- [Commits](moby/go-archive@v0.2.0...v0.3.3)

Updates `github.com/moby/moby/api` from 1.54.2 to 1.55.0
- [Release notes](https://github.com/moby/moby/releases)
- [Commits](moby/moby@api/v1.54.2...api/v1.55.0)

Updates `github.com/moby/moby/client` from 0.4.1 to 0.5.1
- [Release notes](https://github.com/moby/moby/releases)
- [Changelog](https://github.com/moby/moby/blob/v0.5.1/CHANGELOG.md)
- [Commits](moby/moby@v0.4.1...v0.5.1)

Updates `golang.org/x/crypto` from 0.54.0 to 0.55.0
- [Commits](golang/crypto@v0.54.0...v0.55.0)

Updates `golang.org/x/mod` from 0.38.0 to 0.40.0
- [Commits](golang/mod@v0.38.0...v0.40.0)

Updates `golang.org/x/text` from 0.40.0 to 0.41.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.40.0...v0.41.0)

---
updated-dependencies:
- dependency-name: github.com/chainguard-dev/kaniko
  dependency-version: 1.25.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/docker/cli
  dependency-version: 29.7.2+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.21.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/moby/go-archive
  dependency-version: 0.3.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/moby/moby/api
  dependency-version: 1.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/moby/moby/client
  dependency-version: 0.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/mod
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code type/chore Issue that requests non-user facing changes. labels Aug 17, 2026
@dependabot
dependabot Bot requested review from a team as code owners August 17, 2026 22:13
@dependabot dependabot Bot added type/chore Issue that requests non-user facing changes. dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Aug 17, 2026
@github-actions github-actions Bot added this to the 0.41.0 milestone Aug 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code type/chore Issue that requests non-user facing changes.

Projects

None yet

Milestone

0.41.0

Development

Successfully merging this pull request may close these issues.

0 participants