chore(deps): update module github.com/docker/cli to v29 [security]#135
chore(deps): update module github.com/docker/cli to v29 [security]#135
Conversation
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis pull request updates indirect Go module requirements in Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 173: The go.mod now contains a transitive, non-canonical YAML import
(go.yaml.in/yaml/v3 v3.0.4) introduced via
github.com/docker/cli/cli/compose/loader (pulled by
github.com/ory/dockertest/v3) which causes a mismatch with the direct
gopkg.in/yaml.v3 v3.0.1; resolve this by either updating or pinning the
docker/cli dependency (or dockertest) to a version that uses the canonical
gopkg.in/yaml.v3 import, or add a replace directive in go.mod to unify
go.yaml.in/yaml/v3 to gopkg.in/yaml.v3 at the desired version so both import
paths resolve to the same yaml v3.x module.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 74360a1c-1739-4200-a1f5-3f25df1846da
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
NumaryBot
force-pushed
the
renovate/major-security
branch
from
5bba068 to
a982204
Compare
2 participants
This PR contains the following updates:
v27.3.1+incompatible->v29.2.0+incompatibleDocker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli
BIT-docker-cli-2025-15558 / CVE-2025-15558 / GHSA-p436-gjf2-799p / GO-2026-4610
More information
Details
Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Release Notes
docker/cli (github.com/docker/cli)
v29.2.0+incompatibleCompare Source
v29.1.5+incompatibleCompare Source
v29.1.4+incompatibleCompare Source
v29.1.3+incompatibleCompare Source
v29.1.2+incompatibleCompare Source
v29.1.1+incompatibleCompare Source
v29.1.0+incompatibleCompare Source
v29.0.4+incompatibleCompare Source
v29.0.3+incompatibleCompare Source
v29.0.2+incompatibleCompare Source
v29.0.1+incompatibleCompare Source
v29.0.0+incompatibleCompare Source
v28.5.2+incompatibleCompare Source
v28.5.1+incompatibleCompare Source
v28.5.0+incompatibleCompare Source
v28.4.0+incompatibleCompare Source
v28.3.3+incompatibleCompare Source
v28.3.2+incompatibleCompare Source
v28.3.1+incompatibleCompare Source
v28.3.0+incompatibleCompare Source
v28.2.2+incompatibleCompare Source
v28.2.1+incompatibleCompare Source
v28.2.0+incompatibleCompare Source
v28.1.1+incompatibleCompare Source
v28.1.0+incompatibleCompare Source
v28.0.4+incompatibleCompare Source
v28.0.3+incompatibleCompare Source
v28.0.2+incompatibleCompare Source
v28.0.1+incompatibleCompare Source
v28.0.0+incompatibleCompare Source
v27.5.1+incompatibleCompare Source
v27.5.0+incompatibleCompare Source
v27.4.1+incompatibleCompare Source
v27.4.0+incompatibleCompare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.