docker-credential-helpers

mirror of https://github.com/docker/docker-credential-helpers.git synced 2026-06-28 15:21:29 +05:30

Author	SHA1	Message	Date
Paweł Gronowski	ed71c9e95d	Merge pull request #425 from thaJeztah/bump_xx Dockerfile: update xx to v1.9.0	2026-04-17 17:47:17 +02:00
Paweł Gronowski	8af787bb3e	Merge pull request #424 from thaJeztah/bump_go update to Go 1.25.9	2026-04-17 17:47:10 +02:00
Paweł Gronowski	8b34acde14	Merge pull request #426 from thaJeztah/bump_golangci Dockerfile: update golangci-lint to v2.11	2026-04-17 17:47:07 +02:00
Sebastiaan van Stijn	815dddf301	Dockerfile: update xx to v1.9.0 full diff: https://github.com/tonistiigi/xx/compare/v1.7.0...v1.9.0 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>	2026-04-17 15:52:06 +02:00
Sebastiaan van Stijn	1be1c1e190	update to Go 1.25.9 go1.25.9 (released 2026-04-07) includes security fixes to the go command, the compiler, and the archive/tar, crypto/tls, crypto/x509, html/template, and os packages, as well as bug fixes to the go command, the compiler, and the runtime. See the Go 1.25.9 milestone on our issue tracker for details. - https://github.com/golang/go/issues?q=milestone%3AGo1.25.9+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.25.8...go1.25.9 From the security announce: We have just released Go versions 1.26.2 and 1.25.9, minor point releases. These releases include 10 security fixes following the security policy: - os: Root.Chmod can follow symlinks out of the root on Linux On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod could operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation. On Linux, Root.Chmod now uses the fchmodat2 syscall when available, and an workaround using /proc/self/fd otherwise. Thanks to Uuganbayar Lkhamsuren for reporting this issue. This is CVE-2026-32282 and Go issue https://go.dev/issue/78293. - html/template: JS template literal context incorrectly tracked Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities. This only affects templates that use template actions within JS template literals. This is CVE-2026-32289 and Go issue https://go.dev/issue/78331. - crypto/x509: excluded DNS constraints not properly applied to wildcard domains When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. For example, if a certificate contains the DNS name "*.example.com" and the excluded DNS name "EXAMPLE.COM", the constraint will not be applied. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool. This issue only affects Go 1.26. Thank you to Riyas from Saintgits College of Engineering, k1rnt, @1seal for reporting this issue. This is CVE-2026-33810 and Go issue https://go.dev/issue/78332. - cmd/compile: no-op interface conversion bypasses overlap checking Previously, the compiler failed to unwrap pointers contained within a no-op interface conversion leading to an incorrect determination of a non-overlapping move. To prevent unsafe move operations, the compiler will now unwrap all such conversions before considering a move non-overlapping. Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue. This is CVE-2026-27144 and Go issue https://go.dev/issue/78371. - cmd/compile: possible memory corruption after bound check elimination Previously, slices and arrays accessed using induction variables were sometimes incorrectly proved in-bound. If the induction variable used for indexing were to overflow or underflow, it could allow access to memory beyond the scope of the original slice or array. To prevent this behavior, the compiler ensures that any mutated induction variable that overflows/underflows with respect to its loop condition is not used for bound check elimination. Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue. This is CVE-2026-27143 and Go issue https://go.dev/issue/78333. - archive/tar: unbounded allocation when parsing old format GNU sparse map tar.Reader could allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format. We now limit both the number of old GNU sparse map extension blocks, and the total number of sparse file entries, regardless of encoding. Thanks to Colin Walters (wal...@verbum.org) who initially reported this issue. Thanks also to Uuganbayar Lkhamsuren (https://github.com/uug4na) and Jakub Ciolek who additionally reported this issue. This is CVE-2026-32288 and Go issue https://go.dev/issue/78301. - crypto/tls: multiple key update handshake messages can cause connection to deadlock If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3. Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue. This is CVE-2026-32283 and Go issue https://go.dev/issue/78334. - cmd/go: trust layer bypass when using cgo and SWIG A well-crafted SWIG source file could take advantage of a file-naming convention used inside the trust boundary of the cgo compiler. Doing so could result in arbitrary code execution during build time. SWIG files are disallowed from using this convention. Thank you to Juho Forsén of Mattermost for reporting this issue. This is CVE-2026-27140 and Go issue https://go.dev/issue/78335. - crypto/x509: unexpected work during chain building During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls. Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue. This is CVE-2026-32280 and Go issue https://go.dev/issue/78282. - crypto/x509: inefficient policy validation Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool. Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue. This is CVE-2026-32281 and Go issue https://go.dev/issue/78281. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>	2026-04-17 15:51:51 +02:00
Sebastiaan van Stijn	73bc2ff95d	Dockerfile: update golangci-lint to v2.11 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>	2026-04-17 15:51:34 +02:00

3 changed files with 5 additions and 5 deletions

									
										.github/workflows/build.yml
									
		+1
		-1
	
												View File
												
					@@ -18,7 +18,7 @@ on:

					env:

					env:

					  DESTDIR: ./bin

					  DESTDIR: ./bin

					  GO_VERSION: 1.25.8

					  GO_VERSION: 1.25.9

					jobs:

					jobs:

					  validate:

					  validate:

									
										Dockerfile
									
		+3
		-3
	
												View File
												
					@@ -2,7 +2,7 @@

					# GO_VERSION sets the version of the golang base image to use.

					# GO_VERSION sets the version of the golang base image to use.

					# It must be a valid tag in the docker.io/library/golang image repository.

					# It must be a valid tag in the docker.io/library/golang image repository.

					ARG GO_VERSION=1.25.8

					ARG GO_VERSION=1.25.9

					# BASE_DEBIAN_DISTRO sets the golang base image debian variant to use.

					# BASE_DEBIAN_DISTRO sets the golang base image debian variant to use.

					# It must be a valid variant in the docker.io/library/golang image repository.

					# It must be a valid variant in the docker.io/library/golang image repository.

					@@ -10,7 +10,7 @@ ARG BASE_DEBIAN_DISTRO=bookworm

					# XX_VERSION sets the version of the xx utility to use.

					# XX_VERSION sets the version of the xx utility to use.

					# It must be a valid tag in the docker.io/tonistiigi/xx image repository.

					# It must be a valid tag in the docker.io/tonistiigi/xx image repository.

					ARG XX_VERSION=1.7.0

					ARG XX_VERSION=1.9.0

					# OSXCROSS_VERSION sets the MacOSX cross toolchain to use.

					# OSXCROSS_VERSION sets the MacOSX cross toolchain to use.

					# It must be a valid tag in the docker.io/crazymax/osxcross image repository.

					# It must be a valid tag in the docker.io/crazymax/osxcross image repository.

					@@ -18,7 +18,7 @@ ARG OSXCROSS_VERSION=11.3-r8-debian

					# GOLANGCI_LINT_VERSION sets the version of the golangci-lint image to use.

					# GOLANGCI_LINT_VERSION sets the version of the golangci-lint image to use.

					# It must be a valid tag in the docker.io/golangci/golangci-lint image repository.

					# It must be a valid tag in the docker.io/golangci/golangci-lint image repository.

					ARG GOLANGCI_LINT_VERSION=v2.8

					ARG GOLANGCI_LINT_VERSION=v2.11

					# PACKAGE sets the package name to print in the "--version" output.

					# PACKAGE sets the package name to print in the "--version" output.

					# It sets the "github.com/docker/docker-credential-helpers/credentials.Package

					# It sets the "github.com/docker/docker-credential-helpers/credentials.Package

									
										deb/Dockerfile
									
		+1
		-1
	
												View File
												
					@@ -2,7 +2,7 @@

					# GO_VERSION sets the version of the golang base image to use.

					# GO_VERSION sets the version of the golang base image to use.

					# It must be a valid tag in the docker.io/library/golang image repository.

					# It must be a valid tag in the docker.io/library/golang image repository.

					ARG GO_VERSION=1.25.8

					ARG GO_VERSION=1.25.9

					# BASE_DEBIAN_DISTRO sets the golang base image debian variant to use.

					# BASE_DEBIAN_DISTRO sets the golang base image debian variant to use.

					# It must be a valid variant in the docker.io/library/golang image repository.

					# It must be a valid variant in the docker.io/library/golang image repository.

Compare commits

6 Commits

ae9f7a436a .. ed71c9e95d

Compare commits

6 Commits ae9f7a436a .. ed71c9e95d

6 Commits

ae9f7a436a .. ed71c9e95d