forgejo/runner
Watch
49
112
Fork
You've already forked runner
 111
Code Issues 49 Pull requests 14 Releases 98 Packages 1 Activity Actions

Update module github.com/docker/cli to v29 [SECURITY] #1584

Closed
viceice-bot wants to merge 1 commit from renovate/go-github.com-docker-cli-vulnerability into main
pull from: renovate/go-github.com-docker-cli-vulnerability
merge into: forgejo:main
Conversation 4 Commits 1 Files changed 2 +24 -16
viceice-bot commented 2026-07-02 07:03:31 +00:00
Member

This PR contains the following updates:

Package Change Age Confidence
github.com/docker/cli v28.5.2+incompatible → v29.2.0+incompatible age confidence

Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

BIT-docker-cli-2025-15558 / CVE-2025-15558 / GHSA-p436-gjf2-799p / GO-2026-4610

More information

Details

Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

docker/cli (github.com/docker/cli)

v29.2.0+incompatible

Compare Source

v29.1.5+incompatible

Compare Source

v29.1.4+incompatible

Compare Source

v29.1.3+incompatible

Compare Source

v29.1.2+incompatible

Compare Source

v29.1.1+incompatible

Compare Source

v29.1.0+incompatible

Compare Source

v29.0.4+incompatible

Compare Source

v29.0.3+incompatible

Compare Source

v29.0.2+incompatible

Compare Source

v29.0.1+incompatible

Compare Source

v29.0.0+incompatible

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • Between 12:00 AM and 03:59 AM (* 0-3 * * *)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v28.5.2+incompatible` → `v29.2.0+incompatible` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fdocker%2fcli/v29.2.0+incompatible?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fdocker%2fcli/v28.5.2+incompatible/v29.2.0+incompatible?slim=true) | --- ### Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli BIT-docker-cli-2025-15558 / [CVE-2025-15558](https://nvd.nist.gov/vuln/detail/CVE-2025-15558) / [GHSA-p436-gjf2-799p](https://github.com/advisories/GHSA-p436-gjf2-799p) / [GO-2026-4610](https://pkg.go.dev/vuln/GO-2026-4610) <details> <summary>More information</summary> #### Details Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli #### Severity Unknown #### References - [https://github.com/docker/cli/security/advisories/GHSA-p436-gjf2-799p](https://github.com/docker/cli/security/advisories/GHSA-p436-gjf2-799p) - [https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7fa](https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7fa) - [https://github.com/docker/cli/pull/6713](https://github.com/docker/cli/pull/6713) - [https://github.com/docker/compose/pull/12300](https://github.com/docker/compose/pull/12300) - [https://docs.docker.com/desktop/release-notes](https://docs.docker.com/desktop/release-notes) - [https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304](https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-4610) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.2.0+incompatible`](https://github.com/docker/cli/compare/v29.1.5...v29.2.0) [Compare Source](https://github.com/docker/cli/compare/v29.1.5...v29.2.0) ### [`v29.1.5+incompatible`](https://github.com/docker/cli/compare/v29.1.4...v29.1.5) [Compare Source](https://github.com/docker/cli/compare/v29.1.4...v29.1.5) ### [`v29.1.4+incompatible`](https://github.com/docker/cli/compare/v29.1.3...v29.1.4) [Compare Source](https://github.com/docker/cli/compare/v29.1.3...v29.1.4) ### [`v29.1.3+incompatible`](https://github.com/docker/cli/compare/v29.1.2...v29.1.3) [Compare Source](https://github.com/docker/cli/compare/v29.1.2...v29.1.3) ### [`v29.1.2+incompatible`](https://github.com/docker/cli/compare/v29.1.1...v29.1.2) [Compare Source](https://github.com/docker/cli/compare/v29.1.1...v29.1.2) ### [`v29.1.1+incompatible`](https://github.com/docker/cli/compare/v29.1.0...v29.1.1) [Compare Source](https://github.com/docker/cli/compare/v29.1.0...v29.1.1) ### [`v29.1.0+incompatible`](https://github.com/docker/cli/compare/v29.0.4...v29.1.0) [Compare Source](https://github.com/docker/cli/compare/v29.0.4...v29.1.0) ### [`v29.0.4+incompatible`](https://github.com/docker/cli/compare/v29.0.3...v29.0.4) [Compare Source](https://github.com/docker/cli/compare/v29.0.3...v29.0.4) ### [`v29.0.3+incompatible`](https://github.com/docker/cli/compare/v29.0.2...v29.0.3) [Compare Source](https://github.com/docker/cli/compare/v29.0.2...v29.0.3) ### [`v29.0.2+incompatible`](https://github.com/docker/cli/compare/v29.0.1...v29.0.2) [Compare Source](https://github.com/docker/cli/compare/v29.0.1...v29.0.2) ### [`v29.0.1+incompatible`](https://github.com/docker/cli/compare/v29.0.0...v29.0.1) [Compare Source](https://github.com/docker/cli/compare/v29.0.0...v29.0.1) ### [`v29.0.0+incompatible`](https://github.com/docker/cli/compare/v28.5.2...v29.0.0) [Compare Source](https://github.com/docker/cli/compare/v28.5.2...v29.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDYuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI0Ni4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJLaW5kL0RlcGVuZGVuY3lVcGRhdGUiLCJydW4tZW5kLXRvLWVuZC10ZXN0cyJdfQ==-->
Update module github.com/docker/cli to v29 [SECURITY]
Some checks failed
issue-labels / release-notes (pull_request_target) Has been skipped
Details
cascade / debug (pull_request_target) Has been skipped
Details
test-multi-platform / Build Forgejo Runner (pull_request) Has been skipped
Details
test-multi-platform / Build unsupported platforms (pull_request) Has been skipped
Details
test-multi-platform / runner exec tests (pull_request) Has been skipped
Details
test-multi-platform / Run integration tests with Docker (docker-latest) (pull_request) Has been skipped
Details
test-multi-platform / Run integration tests with Docker (docker-stable) (pull_request) Has been skipped
Details
test-multi-platform / Run integration tests with Podman (pull_request) Has been skipped
Details
test-multi-platform / validate mocks (pull_request) Has been skipped
Details
test-multi-platform / validate pre-commit-hooks file (pull_request) Has been skipped
Details
checks / validate pre-commit-hooks file (pull_request) Successful in 51s
Details
checks / validate mocks (pull_request) Successful in 52s
Details
checks / Build Forgejo Runner (pull_request) Failing after 1m0s
Details
Integration tests for the release process / release-simulation (pull_request) Failing after 4m56s
Details
checks / Build unsupported platforms (pull_request) Has been skipped
Details
checks / runner exec tests (pull_request) Has been skipped
Details
checks / Run integration tests with Docker (docker-latest) (pull_request) Has been skipped
Details
checks / Run integration tests with Docker (docker-stable) (pull_request) Has been skipped
Details
checks / Run integration tests with Podman (pull_request) Has been skipped
Details
test-multi-platform / arm64 (pull_request) Has been skipped
Details
cascade / end-to-end (pull_request_target) Successful in 7s
Details
cascade / forgejo (pull_request_target) Successful in 2m23s
Details
b270215d9d
viceice-bot commented 2026-07-02 07:03:32 +00:00
Author
Member

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Details:

Package Change
github.com/docker/go-connections v0.6.0 -> v0.7.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 -> v0.60.0
### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - 2 additional dependencies were updated Details: | **Package** | **Change** | | :-------------------------------------------------------------- | :--------------------- | | `github.com/docker/go-connections` | `v0.6.0` -> `v0.7.0` | | `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` | `v0.46.1` -> `v0.60.0` |
cascading-pr commented 2026-07-02 07:03:49 +00:00
Contributor

cascading-pr updated at actions/setup-forgejo#1017

cascading-pr updated at https://code.forgejo.org/actions/setup-forgejo/pulls/1017
viceice commented 2026-07-07 10:52:16 +00:00
Owner

closing in favor of #1547

closing in favor of #1547
viceice closed this pull request 2026-07-07 10:52:16 +00:00
viceice-bot commented 2026-07-07 10:52:38 +00:00
Author
Member

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 29.x releases. But if you manually upgrade to 29.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

### Renovate Ignore Notification Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for *any* future `29.x` releases. But if you manually upgrade to `29.x` then Renovate will re-enable `minor` and `patch` updates automatically. If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.
Some checks are pending
issue-labels / release-notes (pull_request_target) Has been skipped
Details
cascade / debug (pull_request_target) Has been skipped
Required
Details
test-multi-platform / Build Forgejo Runner (pull_request) Has been skipped
Details
test-multi-platform / Build unsupported platforms (pull_request) Has been skipped
Details
test-multi-platform / runner exec tests (pull_request) Has been skipped
Details
test-multi-platform / Run integration tests with Docker (docker-latest) (pull_request) Has been skipped
Details
test-multi-platform / Run integration tests with Docker (docker-stable) (pull_request) Has been skipped
Details
test-multi-platform / Run integration tests with Podman (pull_request) Has been skipped
Details
test-multi-platform / validate mocks (pull_request) Has been skipped
Details
test-multi-platform / validate pre-commit-hooks file (pull_request) Has been skipped
Details
checks / validate pre-commit-hooks file (pull_request) Successful in 51s
Details
checks / validate mocks (pull_request) Successful in 52s
Details
checks / Build Forgejo Runner (pull_request) Failing after 1m0s
Required
Details
Integration tests for the release process / release-simulation (pull_request) Failing after 4m56s
Details
checks / Build unsupported platforms (pull_request) Has been skipped
Details
checks / runner exec tests (pull_request) Has been skipped
Details
checks / Run integration tests with Docker (docker-latest) (pull_request) Has been skipped
Required
Details
checks / Run integration tests with Docker (docker-stable) (pull_request) Has been skipped
Required
Details
checks / Run integration tests with Podman (pull_request) Has been skipped
Required
Details
test-multi-platform / arm64 (pull_request) Has been skipped
Details
cascade / end-to-end (pull_request_target) Successful in 7s
Required
Details
cascade / forgejo (pull_request_target) Successful in 2m23s
Required
Details
checks / Run exec tests *
Required

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
forgejo/Reviewers
Labels
Clear labels   
FreeBSD

   
Kind/Breaking
Breaking change that won't be backward compatible

  
Kind/Bug
Something is not working

  
Kind/Chore
It is no fun but it needs to be done, this is a chore.

  
Kind/DependencyUpdate
for pull requests that are created by renovate when updating a dependency

  
Kind/Documentation
Documentation changes

  
Kind/Enhancement
Improve existing functionality

  
Kind/Feature
New functionality

  
Kind/Security
This is security issue

  
Kind/Testing
Issue or pull request related to testing

  
Priority
Critical
 The priority is critical

  
Priority
High
 The priority is high

  
Priority
Low
 The priority is low

  
Priority
Medium
 The priority is medium

  
Reviewed
Confirmed
 Issue has been confirmed

  
Reviewed
Duplicate
 This issue or pull request already exists

  
Reviewed
Invalid
 Invalid issue

  
Reviewed
Won't Fix
 This issue won't be fixed

  
Status
Abandoned
 Somebody has started to work on this but abandoned work

  
Status
Blocked
 Something is blocking this issue or pull request

  
Status
Need More Info
 Feedback is required to reproduce issue or to continue work

  
Windows
Windows ports is an independent project, see https://github.com/Crown0815/Forgejo-runner-windows-builder

  
linux-powerpc64le
powerpc64le

  
linux-riscv64

   
linux-s390x

   
run-end-to-end-tests
Run https://code.forgejo.org/forgejo/end-to-end with a runner compiled from this pull request

  
run-forgejo-tests
Run https://codeberg.org/forgejo/forgejo tests importing the runner from this pull request

  
run-multi-platform-tests
Label a PR for automatic execution of test suite on arm64 architecture.

No labels
FreeBSD
Kind/Breaking
Kind/Bug
Kind/Chore
Kind/DependencyUpdate
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
Windows
linux-powerpc64le
linux-riscv64
linux-s390x
run-end-to-end-tests
run-forgejo-tests
run-multi-platform-tests
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
forgejo/runner!1584
No description provided.