Sourced from github.com/docker/docker's releases.
v26.1.5
26.1.5
Security
This release contains a fix for CVE-2024-41110 / GHSA-v23v-6jw2-98fq that impacted setups using authorization plugins (AuthZ) for access control. No other changes are included in this release, and this release is otherwise identical for users not using AuthZ plugins.
Full Changelog: https://github.com/moby/moby/compare/v26.1.4...v26.1.5
411e817
Merge commit from fork9cc85ea
If url includes scheme, urlPath will drop hostname, which would not
match the...820cab9
Authz plugin security fixes for 0-length content and path
validation6bc4906
Merge pull request #48123
from vvoland/v26.1-481206fbdce4
update to go1.21.12f533464
Merge pull request #47986
from vvoland/v26.1-47985c1d4587
builder/mobyexporter: Add missing nil checkd642804
Merge pull request #47940
from thaJeztah/26.1_backport_api_remove_container_c...daba246
docs: api: image inspect: remove Container and ContainerConfigSourced from github.com/go-git/go-git/v5's releases.
v5.13.1
What's Changed
- build: bump github.com/go-git/go-billy/v5 from 5.6.0 to 5.6.1 by
@dependabot
in go-git/go-git#1327- build: bump github.com/elazarl/goproxy from 1.2.1 to 1.2.2 by
@dependabot
in go-git/go-git#1329- build: bump github.com/elazarl/goproxy from 1.2.2 to 1.2.3 by
@dependabot
in go-git/go-git#1340- Revert "plumbing: transport/ssh, Add support for SSH
@cert-authority
." by@pjbgf
in #1346Full Changelog: https://github.com/go-git/go-git/compare/v5.13.0...v5.13.1
v5.13.0
What's Changed
- build: bump github.com/go-git/go-git/v5 from 5.11.0 to 5.12.0 in /cli/go-git by
@dependabot
in go-git/go-git#1065- build: bump golang.org/x/net from 0.22.0 to 0.23.0 by
@dependabot
in go-git/go-git#1068- build: bump golang.org/x/net from 0.23.0 to 0.24.0 by
@dependabot
in go-git/go-git#1071- Properly support skipping of non-mandatory extensions by
@codablock
in go-git/go-git#1066- git: Refine some codes in test and non-test. by
@onee-only
in go-git/go-git#1077- plumbing: protocol/packp, client-side filter capability support by
@edigaryev
in go-git/go-git#1000- build: bump golang.org/x/net from 0.22.0 to 0.23.0 in /cli/go-git by
@dependabot
in go-git/go-git#1078- plumbing: fix sideband demux on flush by
@aymanbagabas
in go-git/go-git#1084- storage: dotgit, head reference usually comes first by
@aymanbagabas
in go-git/go-git#1085- build: bump golang.org/x/text from 0.14.0 to 0.15.0 by
@dependabot
in go-git/go-git#1091- build: bump golang.org/x/crypto from 0.22.0 to 0.23.0 by
@dependabot
in go-git/go-git#1094- build: bump golang.org/x/net from 0.24.0 to 0.25.0 by
@dependabot
in go-git/go-git#1093- git: Added an example for Repository.Branches by
@johnmatthiggins
in go-git/go-git#1088- git: worktree_commit, Modify checking empty commit. Fixes #723 by
@onee-only
in go-git/go-git#1050- plumbing: transport/http, Wrap http errors to return reason. Fixes #1097 by
@ggambetti
in go-git/go-git#1100- build: bump golang.org/x/sys from 0.20.0 to 0.21.0 by
@dependabot
in go-git/go-git#1106- build: bump golang.org/x/text from 0.15.0 to 0.16.0 by
@dependabot
in go-git/go-git#1107- Bumps Go versions and go-billy by
@pjbgf
in go-git/go-git#1056- _examples: Fixed a dead link COMPATIBILITY.md by
@gecko655
in go-git/go-git#1109- build: bump github.com/jessevdk/go-flags from 1.5.0 to 1.6.1 in /cli/go-git by
@dependabot
in go-git/go-git#1115- build: bump github.com/elazarl/goproxy from v0.0.0-20230808193330-2592e75ae04a to v0.0.0-20240618083138-03be62527ccb by
@hbelmiro
in go-git/go-git#1124- build: bump golang.org/x/net from 0.25.0 to 0.26.0 by
@dependabot
in go-git/go-git#1104- Add option approximating
git clean -x
flag. by@msuozzo
in go-git/go-git#995- Revert "Add option approximating
git clean -x
flag." by@pjbgf
in go-git/go-git#1129- Fix reference updated concurrently error for the filesystem storer by
@Javier-varez
in go-git/go-git#1116- build: bump golang.org/x/net from 0.26.0 to 0.27.0 by
@dependabot
in go-git/go-git#1134- utils: merkletrie, Align error message with upstream by
@pjbgf
in go-git/go-git#1142- plumbing: transport/file, Change paths to absolute by
@pjbgf
in go-git/go-git#1141- plumbing: gitignore, Fix loading of ignored .gitignore files. by
@Achilleshiel
in go-git/go-git#1114- build: bump github.com/skeema/knownhosts from 1.2.2 to 1.3.0 by
@dependabot
in go-git/go-git#1147- plumbing: transport/ssh, Add support for SSH
@cert-authority
. by@Javier-varez
in go-git/go-git#1157- build: run example tests during CI workflow by
@crazybolillo
in go-git/go-git#1030- storage: filesystem, Fix object cache not working due to uninitialised objects being put into cache by
@SatelliteMind
in go-git/go-git#1138- git: Fix fetching missing commits by
@AriehSchneier
in go-git/go-git#1032- plumbing: format/packfile, remove duplicate checks in findMatch() by
@edigaryev
in go-git/go-git#1152- git: worktree, Fix file reported as
Untracked
while it is committed by@rodrigocam
in go-git/go-git#1023- build: bump golang.org/x/sys from 0.22.0 to 0.23.0 by
@dependabot
in go-git/go-git#1160- plumbing: filemode, Remove check for setting size of .git/index file by
@nicholasSUSE
in go-git/go-git#1159- build: bump golang.org/x/net from 0.27.0 to 0.28.0 by
@dependabot
in go-git/go-git#1163
... (truncated)
b6bc0c0
Merge pull request #1346
from go-git/revert-1157-ja/knownHostsDb42f9d6b
Revert "plumbing: transport/ssh, Add support for SSH @cert-authority
."88c7471
Merge pull request #1340
from go-git/dependabot/go_modules/github.com/elazarl...2fae180
build: bump github.com/elazarl/goproxy from 1.2.2 to 1.2.3a0dfb09
Merge pull request #1329
from go-git/dependabot/go_modules/github.com/elazarl...05ae621
Merge pull request #1327
from go-git/dependabot/go_modules/github.com/go-git/...b0d72b3
build: bump github.com/elazarl/goproxy from 1.2.1 to 1.2.2b77b83a
build: bump github.com/go-git/go-billy/v5 from 5.6.0 to 5.6.194bd4af
Merge pull request #1261
from BeChris/issue6808b7f5ba
Merge pull request #1262
from go-git/dependabot/go_modules/github.com/elazarl...Sourced from github.com/golang-jwt/jwt/v4's releases.
v4.5.1
Security
Unclear documentation of the error behavior in
ParseWithClaims
in <= 4.5.0 could lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned byParseWithClaims
return both error codes. If users only check for thejwt.ErrTokenExpired
usingerror.Is
, they will ignore the embeddedjwt.ErrTokenSignatureInvalid
and thus potentially accept invalid tokens.This issue was documented in https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-vh33-7x7r and fixed in this release.
Note:
v5
was not affected by this issue. So upgrading to this release version is also recommended.What's Changed
- Back-ported error-handling logic in
ParseWithClaims
fromv5
branch. This fixes https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-vh33-7x7r.Full Changelog: https://github.com/golang-jwt/jwt/compare/v4.5.0...v4.5.1
7b1c1c0
Merge commit from forkb4f1988
ssh: make the public key cache a 1-entry FIFO cache7042ebc
openpgp/clearsign: just use rand.Reader in tests3e90321
go.mod: update golang.org/x dependencies8c4e668
x509roots/fallback: update bundle6018723
go.mod: update golang.org/x dependencies71ed71b
README: don't recommend go get750a45f
sha3: add MarshalBinary, AppendBinary, and UnmarshalBinary36b1725
sha3: avoid trailing permutation80ea76e
sha3: fix padding for long cSHAKE parametersc17aa50
sha3: avoid buffer copydfc720d
go.mod: update golang.org/x dependencies8e66b04
html: use strings.EqualFold instead of lowering ourselvesb935f7b
html: avoid endless loop on error token9af49ef
route: remove unused sizeof* consts6705db9
quic: clean up crypto streams when dropping packet protection keys4ef7588
quic: handle ACK frame in packet which drops number space552d8ac
Revert "route: change from syscall to x/sys/unix"13a7c01
Revert "route: remove unused sizeof* consts on freebsd"285e1cf
go.mod: update golang.org/x dependenciesd0a1049
route: remove unused sizeof* consts on freebsd