Skip to content

Bump the go_modules group across 2 directories with 3 updates - #64

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go_modules-34f6ccbf39
Open

Bump the go_modules group across 2 directories with 3 updates#64
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go_modules-34f6ccbf39

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the go_modules group with 3 updates in the / directory: github.com/docker/cli, github.com/moby/sys/user and github.com/opencontainers/runc.
Bumps the go_modules group with 3 updates in the /e2e directory: github.com/docker/cli, github.com/moby/sys/user and github.com/opencontainers/runc.

Updates github.com/docker/cli from 27.4.1+incompatible to 29.2.0+incompatible

Commits
  • 0b9d198 Merge pull request #6764 from vvoland/update-docker
  • 9c9ec73 vendor: github.com/moby/moby/client v0.2.2
  • bab3e81 vendor: github.com/moby/moby/api v1.53.0
  • 2e64fc1 Merge pull request #6367 from thaJeztah/template_slicejoin
  • 1f2ba2a Merge pull request #6760 from thaJeztah/container_create_fix_error
  • e34a342 templates: make "join" work with non-string slices and map values
  • a86356d Merge pull request #6763 from thaJeztah/bump_mapstructure
  • 771660a vendor: github.com/go-viper/mapstructure/v2 v2.5.0
  • 9cff36b Merge pull request #6762 from thaJeztah/bump_x_deps
  • 08ed2bc cli/command/container: make injecting config.json failures a warning
  • Additional commits viewable in compare view

Updates github.com/moby/sys/user from 0.3.0 to 0.4.1

Release notes

Sourced from github.com/moby/sys/user's releases.

mountinfo v0.4.1

Fixes and improvements:

  • Fix PrefixFilter() being too greedy (#61)
  • TestMountedBy*: add missing pre-checks (ce8f425e79a74602c4055fb1776f38043d56827b)
  • Documentation improvements (#52)

user/v0.4.1

What's Changed

Full Changelog: moby/sys@user/v0.4.0...user/v0.4.1

mountinfo v0.4.0

Breaking changes:

  • PidMountInfo is now deprecated and will be removed before v1.0; users should switch to GetMountsFromReader (#47)

Fixes and improvements:

  • run filter after all fields are parsed (#50)
  • correct handling errors from bufio.Scan
  • documentation formatting fixes (#48)

Thanks to:

  • Aleksa Sarai

capability v0.4.0

Added

  • New separate API for ambient ([GetAmbient], [SetAmbient], [ResetAmbient]) and bound ([GetBound], [DropBound]) capabilities, modelled after libcap. (#176)

Fixed

  • [Apply] now returns an error if called for non-zero pid. Before this change, it could silently change some capabilities of the current process, instead of the one identified by the pid. (#168, #174)
  • Fixed tests that change capabilities to be run in a separate process. (#173)
  • Other improvements in tests. (#169, #170)

Changed

  • Use raw syscalls (which are slightly faster). (#176)
  • Most tests are now limited to testing the public API of the package. (#162)
  • Simplify parsing /proc/pid/status, add a test case. (#162)
  • Optimize the number of syscall to set ambient capabilities in Apply by clearing them first; add a test case. (#163, #164)
  • Better documentation for [Apply], [NewFile], [NewFile2], [NewPid], [NewPid2]. (#175)

... (truncated)

Commits
  • 85a71bb Merge commit from fork
  • 2c56c3d user: limit line length in ParseGroupFilter
  • bba2f13 user: limit reads from user database files
  • ee79b0e Merge pull request #221 from thaJeztah/limit_uidgid
  • 6eb9f15 user: GetAdditionalGroups: treat numeric group arguments as GIDs only
  • c66bd2d user: prevent falling back to looking up numeric usernames
  • c873359 Merge pull request #226 from thaJeztah/user_test_cleanups
  • f41a5ef Merge pull request #225 from thaJeztah/user_dry
  • 5c2e8a0 user: add test-cases for maxID (math.MaxInt32)
  • e001aea user: use sub-tests
  • Additional commits viewable in compare view

Updates github.com/opencontainers/runc from 1.2.3 to 1.3.6

Release notes

Sourced from github.com/opencontainers/runc's releases.

runc 1.3.6 -- "On no account should you allow a Vogon to read poetry at you."

This is the sixth patch release of the 1.3.z series of runc. Among some performance improvements and bugfixes, it includes a fix for a low-severity vulnerability (CVE-2026-41579) and users are encouraged to update. As it was a low-severity vulnerability and it was reported by multiple people, we decided to release it publicly with NO EMBARGO.

Security

This release includes a fix for the following low-severity security issue:

  • CVE-2026-41579 allowed a malicious image with a /dev symlink to have limited write access to the host filesystem in ways that our analysis indicates was too limited to be problematic in practice. This bug was very similar to those fixed in CVE-2025-31133, CVE-2025-52565, CVE-2025-31133 and was simply missed at the time when we hardened the rootfs preparation code. We have conducted a deeper audit and not found any other problematic cases.

    This patchset required backports for #5190 and #5285, which were primarily code reorganisations that were already backported to runc 1.4 and 1.5.

Fixed

Changed

  • When masking directories with maskPaths, runc will now re-use a single tmpfs instance (which is not writable) to reduce the number tmpfs superblocks that need to be reaped when containers die (in particular, Kubernetes applies masks to per-CPU sysfs directories which get expensive quickly). (#5275, #5281)

Static Linking Notices

The runc binary distributed with this release are statically linked with the following GNU LGPL-2.1 licensed libraries, with runc acting as a "work that uses the Library":

... (truncated)

Changelog

Sourced from github.com/opencontainers/runc's changelog.

[1.3.6] - 2026-06-13

On no account should you allow a Vogon to read poetry at you.

Security

This release includes a fix for the following low-severity security issue:

  • CVE-2026-41579 allowed a malicious image with a /dev symlink to have limited write access to the host filesystem in ways that our analysis indicates was too limited to be problematic in practice. This bug was very similar to those fixed in [CVE-2025-31133][], [CVE-2025-52565][], [CVE-2025-31133][] and was simply missed at the time when we hardened the rootfs preparation code. We have conducted a deeper audit and not found any other problematic cases.

    This patchset required backports for #5190 and #5285, which were primarily code reorganisations that were already backported to runc 1.4 and 1.5.

Fixed

Changed

  • When masking directories with maskPaths, runc will now reuse a single tmpfs instance (which is not writable) to reduce the number tmpfs superblocks that need to be reaped when containers die (in particular, Kubernetes applies masks to per-CPU sysfs directories which get expensive quickly). (#5275, #5281)

[1.5.0-rc.2] - 2026-04-02

いざやいざや、見に行かん

[!NOTE] runc v1.5.0-rc.2 includes all of the patches backported to runc v1.4.2.

Fixed

  • Building with libpathrs for systems that use non-GNU awk, e.g. Debian. (#5196, #5194)

Added

  • Installation notes for libpathrs. (#5199, #5195)
  • Support for specs.LinuxSeccompFlagWaitKillableRecv. (#5183, #5172)
  • When building runc, RUNC_BUILDTAGS make or shell environment variable can

... (truncated)

Commits
  • 491b69b VERSION: release v1.3.6
  • d934454 merge CVE-2026-41579 fixes into release-1.3
  • 9432ad3 rootfs: make cgroupv1 subsystem symlinks fd-based
  • a8e53f2 rootfs: make /dev initialisation code fd-based
  • 78c50d4 rootfs: switch createDevices argument order
  • 083e21e libct: use preopened rootfs more
  • 42cfcbe Pre-open container root directory
  • 2e9b6a8 libct: minor refactor in mountToRootfs
  • edf5328 libct: mountCgroupV1: address TODO
  • 3661a9d integration: add some tests for bind mount through dangling symlinks
  • Additional commits viewable in compare view

Updates github.com/docker/cli from 27.4.1+incompatible to 29.2.0+incompatible

Commits
  • 0b9d198 Merge pull request #6764 from vvoland/update-docker
  • 9c9ec73 vendor: github.com/moby/moby/client v0.2.2
  • bab3e81 vendor: github.com/moby/moby/api v1.53.0
  • 2e64fc1 Merge pull request #6367 from thaJeztah/template_slicejoin
  • 1f2ba2a Merge pull request #6760 from thaJeztah/container_create_fix_error
  • e34a342 templates: make "join" work with non-string slices and map values
  • a86356d Merge pull request #6763 from thaJeztah/bump_mapstructure
  • 771660a vendor: github.com/go-viper/mapstructure/v2 v2.5.0
  • 9cff36b Merge pull request #6762 from thaJeztah/bump_x_deps
  • 08ed2bc cli/command/container: make injecting config.json failures a warning
  • Additional commits viewable in compare view

Updates github.com/moby/sys/user from 0.3.0 to 0.4.1

Release notes

Sourced from github.com/moby/sys/user's releases.

mountinfo v0.4.1

Fixes and improvements:

  • Fix PrefixFilter() being too greedy (#61)
  • TestMountedBy*: add missing pre-checks (ce8f425e79a74602c4055fb1776f38043d56827b)
  • Documentation improvements (#52)

user/v0.4.1

What's Changed

Full Changelog: moby/sys@user/v0.4.0...user/v0.4.1

mountinfo v0.4.0

Breaking changes:

  • PidMountInfo is now deprecated and will be removed before v1.0; users should switch to GetMountsFromReader (#47)

Fixes and improvements:

  • run filter after all fields are parsed (#50)
  • correct handling errors from bufio.Scan
  • documentation formatting fixes (#48)

Thanks to:

  • Aleksa Sarai

capability v0.4.0

Added

  • New separate API for ambient ([GetAmbient], [SetAmbient], [ResetAmbient]) and bound ([GetBound], [DropBound]) capabilities, modelled after libcap. (#176)

Fixed

  • [Apply] now returns an error if called for non-zero pid. Before this change, it could silently change some capabilities of the current process, instead of the one identified by the pid. (#168, #174)
  • Fixed tests that change capabilities to be run in a separate process. (#173)
  • Other improvements in tests. (#169, #170)

Changed

  • Use raw syscalls (which are slightly faster). (#176)
  • Most tests are now limited to testing the public API of the package. (#162)
  • Simplify parsing /proc/pid/status, add a test case. (#162)
  • Optimize the number of syscall to set ambient capabilities in Apply by clearing them first; add a test case. (#163, #164)
  • Better documentation for [Apply], [NewFile], [NewFile2], [NewPid], [NewPid2]. (#175)

... (truncated)

Commits
  • 85a71bb Merge commit from fork
  • 2c56c3d user: limit line length in ParseGroupFilter
  • bba2f13 user: limit reads from user database files
  • ee79b0e Merge pull request #221 from thaJeztah/limit_uidgid
  • 6eb9f15 user: GetAdditionalGroups: treat numeric group arguments as GIDs only
  • c66bd2d user: prevent falling back to looking up numeric usernames
  • c873359 Merge pull request #226 from thaJeztah/user_test_cleanups
  • f41a5ef Merge pull request #225 from thaJeztah/user_dry
  • 5c2e8a0 user: add test-cases for maxID (math.MaxInt32)
  • e001aea user: use sub-tests
  • Additional commits viewable in compare view

Updates github.com/opencontainers/runc from 1.2.3 to 1.3.6

Release notes

Sourced from github.com/opencontainers/runc's releases.

runc 1.3.6 -- "On no account should you allow a Vogon to read poetry at you."

This is the sixth patch release of the 1.3.z series of runc. Among some performance improvements and bugfixes, it includes a fix for a low-severity vulnerability (CVE-2026-41579) and users are encouraged to update. As it was a low-severity vulnerability and it was reported by multiple people, we decided to release it publicly with NO EMBARGO.

Security

This release includes a fix for the following low-severity security issue:

  • CVE-2026-41579 allowed a malicious image with a /dev symlink to have limited write access to the host filesystem in ways that our analysis indicates was too limited to be problematic in practice. This bug was very similar to those fixed in CVE-2025-31133, CVE-2025-52565, CVE-2025-31133 and was simply missed at the time when we hardened the rootfs preparation code. We have conducted a deeper audit and not found any other problematic cases.

    This patchset required backports for #5190 and #5285, which were primarily code reorganisations that were already backported to runc 1.4 and 1.5.

Fixed

Changed

  • When masking directories with maskPaths, runc will now re-use a single tmpfs instance (which is not writable) to reduce the number tmpfs superblocks that need to be reaped when containers die (in particular, Kubernetes applies masks to per-CPU sysfs directories which get expensive quickly). (#5275, #5281)

Static Linking Notices

The runc binary distributed with this release are statically linked with the following GNU LGPL-2.1 licensed libraries, with runc acting as a "work that uses the Library":

... (truncated)

Changelog

Sourced from github.com/opencontainers/runc's changelog.

[1.3.6] - 2026-06-13

On no account should you allow a Vogon to read poetry at you.

Security

This release includes a fix for the following low-severity security issue:

  • CVE-2026-41579 allowed a malicious image with a /dev symlink to have limited write access to the host filesystem in ways that our analysis indicates was too limited to be problematic in practice. This bug was very similar to those fixed in [CVE-2025-31133][], [CVE-2025-52565][], [CVE-2025-31133][] and was simply missed at the time when we hardened the rootfs preparation code. We have conducted a deeper audit and not found any other problematic cases.

    This patchset required backports for #5190 and #5285, which were primarily code reorganisations that were already backported to runc 1.4 and 1.5.

Fixed

Changed

  • When masking directories with maskPaths, runc will now reuse a single tmpfs instance (which is not writable) to reduce the number tmpfs superblocks that need to be reaped when containers die (in particular, Kubernetes applies masks to per-CPU sysfs directories which get expensive quickly). (#5275, #5281)

[1.5.0-rc.2] - 2026-04-02

いざやいざや、見に行かん

[!NOTE] runc v1.5.0-rc.2 includes all of the patches backported to runc v1.4.2.

Fixed

  • Building with libpathrs for systems that use non-GNU awk, e.g. Debian. (#5196, #5194)

Added

  • Installation notes for libpathrs. (#5199, #5195)
  • Support for specs.LinuxSeccompFlagWaitKillableRecv. (#5183, #5172)
  • When building runc, RUNC_BUILDTAGS make or shell environment variable can

... (truncated)

Commits
  • 491b69b VERSION: release v1.3.6
  • d934454 merge CVE-2026-41579 fixes into release-1.3
  • 9432ad3 rootfs: make cgroupv1 subsystem symlinks fd-based
  • a8e53f2 rootfs: make /dev initialisation code fd-based
  • 78c50d4 rootfs: switch createDevices argument order
  • 083e21e libct: use preopened rootfs more
  • 42cfcbe Pre-open container root directory
  • 2e9b6a8 libct: minor refactor in mountToRootfs
  • edf5328 libct: mountCgroupV1: address TODO
  • 3661a9d integration: add some tests for bind mount through dangling symlinks
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the go_modules group across 2 directories with 3 updates
7e87016 
Bumps the go_modules group with 3 updates in the / directory: [github.com/docker/cli](https://github.com/docker/cli), [github.com/moby/sys/user](https://github.com/moby/sys) and [github.com/opencontainers/runc](https://github.com/opencontainers/runc).
Bumps the go_modules group with 3 updates in the /e2e directory: [github.com/docker/cli](https://github.com/docker/cli), [github.com/moby/sys/user](https://github.com/moby/sys) and [github.com/opencontainers/runc](https://github.com/opencontainers/runc).


Updates `github.com/docker/cli` from 27.4.1+incompatible to 29.2.0+incompatible
- [Commits](docker/cli@v27.4.1...v29.2.0)

Updates `github.com/moby/sys/user` from 0.3.0 to 0.4.1
- [Release notes](https://github.com/moby/sys/releases)
- [Commits](moby/sys@user/v0.3.0...user/v0.4.1)

Updates `github.com/opencontainers/runc` from 1.2.3 to 1.3.6
- [Release notes](https://github.com/opencontainers/runc/releases)
- [Changelog](https://github.com/opencontainers/runc/blob/main/CHANGELOG.md)
- [Commits](opencontainers/runc@v1.2.3...v1.3.6)

Updates `github.com/docker/cli` from 27.4.1+incompatible to 29.2.0+incompatible
- [Commits](docker/cli@v27.4.1...v29.2.0)

Updates `github.com/moby/sys/user` from 0.3.0 to 0.4.1
- [Release notes](https://github.com/moby/sys/releases)
- [Commits](moby/sys@user/v0.3.0...user/v0.4.1)

Updates `github.com/opencontainers/runc` from 1.2.3 to 1.3.6
- [Release notes](https://github.com/opencontainers/runc/releases)
- [Changelog](https://github.com/opencontainers/runc/blob/main/CHANGELOG.md)
- [Commits](opencontainers/runc@v1.2.3...v1.3.6)

---
updated-dependencies:
- dependency-name: github.com/docker/cli
  dependency-version: 29.2.0+incompatible
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/moby/sys/user
  dependency-version: 0.4.1
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/opencontainers/runc
  dependency-version: 1.3.6
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/docker/cli
  dependency-version: 29.2.0+incompatible
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/moby/sys/user
  dependency-version: 0.4.1
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/opencontainers/runc
  dependency-version: 1.3.6
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants