Skip to content

build(deps): bump the go-dependencies group with 8 updates - #2645

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-930f169fc6
Closed

build(deps): bump the go-dependencies group with 8 updates#2645
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-930f169fc6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 8 updates:

Package From To
github.com/chainguard-dev/kaniko 1.25.15 1.25.16
github.com/docker/cli 29.4.3+incompatible 29.6.1+incompatible
github.com/gdamore/tcell/v2 2.13.9 2.13.10
github.com/google/go-containerregistry 0.21.5 0.21.7
github.com/moby/moby/api 1.54.2 1.55.0
github.com/moby/moby/client 0.4.1 0.5.0
github.com/onsi/gomega 1.40.0 1.42.1
golang.org/x/mod 0.36.0 0.37.0

Updates github.com/chainguard-dev/kaniko from 1.25.15 to 1.25.16

Release notes

Sourced from github.com/chainguard-dev/kaniko's releases.

v1.25.16

What's Changed

New Contributors

Full Changelog: chainguard-forks/kaniko@v1.25.15...v1.25.16

Commits
  • df8f307 fix(util): store symlink targets verbatim during tar extraction (#440)
  • ada0293 chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#436)
  • 411bf48 chore(deps): bump github.com/containerd/containerd/v2 (#437)
  • 1fd5347 chore(deps): bump golang from 87a41d2 to 792443b in /deploy (#434)
  • 6893369 chore(deps): bump golang from 11fd8f7 to 87a41d2 in /deploy (#432)
  • f41fece chore(deps): bump debian from 0104b33 to 96e378d in /deploy (#433)
  • 02725ef chore(deps): bump golang from 68cb6d6 to 11fd8f7 in /deploy (#431)
  • 22bc5c0 chore(deps): bump golang from 2d6c802 to 68cb6d6 in /deploy (#428)
  • bff87cc chore(deps): bump actions/checkout in the actions group (#429)
  • ab22755 chore(deps): bump docker/setup-qemu-action in the actions group (#425)
  • Additional commits viewable in compare view

Updates github.com/docker/cli from 29.4.3+incompatible to 29.6.1+incompatible

Commits
  • 8900f1d Merge pull request #7074 from thaJeztah/version
  • 22b8f13 Merge pull request #7069 from docker-agent/auto/migrate-to-docker-agent-action
  • d9c59c9 version 29.6.1
  • 6430751 Merge pull request #7073 from thaJeztah/bump_moby_user
  • 8fda97b vendor: github.com/moby/sys/user v0.4.1
  • f9dc4e4 chore: bump docker-agent-action to v2.0.1
  • f8a2d2b Merge pull request #7070 from docker/dependabot/github_actions/actions/checko...
  • 7eb15d3 build(deps): bump actions/checkout from 6.0.3 to 7.0.0
  • 033b0ff Merge pull request #7063 from docker/dependabot/github_actions/crazy-max/dot-...
  • 317bfd1 Merge pull request #7067 from docker/dependabot/github_actions/docker/cagent-...
  • Additional commits viewable in compare view

Updates github.com/gdamore/tcell/v2 from 2.13.9 to 2.13.10

Commits
  • 7c37ddd revert: "refactor(simscreen): reuse drawCell encode buffers"
  • 6d9f5cf refactor(cell): hoist string(r) out of Fill loop
  • c42ac3b refactor(simscreen): reuse drawCell encode buffers
  • 520446f test: add SimulationScreen benchmarks
  • 0424b95 fix: possible panic in getConsoleInput if no event returned
  • 11d6323 fix: backport OSC 8 sanitizer to v2
  • See full diff in compare view

Updates github.com/google/go-containerregistry from 0.21.5 to 0.21.7

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.21.7

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.21.6...v0.21.7

v0.21.6

What's Changed

... (truncated)

Commits
  • c68d899 Bump go version to 1.26.4 (#2350)
  • da61d86 transport: do not re-attach bearer token after cross-host redirect (#2349)
  • 09fe1e5 fix(tarball): normalize paths when matching files (#2334)
  • 5baa399 build(deps): bump the go-deps group across 3 directories with 4 updates (#2348)
  • 97a8a17 fix(transport): apply refreshed bearer token after cross-host redirect (#2337)
  • e963497 internal/gzip: fix goroutine leak in ReadCloserLevel (#2347)
  • 02649ea fix: prevent SSRF in google.List() pagination (#2332)
  • 7204b40 build(deps): bump the actions group across 1 directory with 2 updates (#2344)
  • 4cfaa93 build(deps): bump the go-deps group across 1 directory with 2 updates (#2343)
  • 6849394 pkg/registry: export RedirectError (#2177)
  • Additional commits viewable in compare view

Updates github.com/moby/moby/api from 1.54.2 to 1.55.0

Release notes

Sourced from github.com/moby/moby/api's releases.

api/v1.55.0

1.55.0

Changelog

  • POST /containers/{id}/update now supports per-device blkio resource settingss. moby/moby#52651
  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
  • docs: clarify swarm join required fields. moby/moby#52763

api/v1.55.0-rc.1

1.55.0-rc.1

Changelog

  • POST /containers/{id}/update now supports per-device blkio resource settingss. moby/moby#52651
  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
  • docs: clarify swarm join required fields. moby/moby#52763
Commits
  • b6c53c2 Merge pull request #52773 from vvoland/c8d-amd64-variants
  • 01115e8 Merge pull request #52906 from vvoland/fix-TestContainerWithConflictingNoneNe...
  • b36296f Merge pull request #52913 from thaJeztah/windows_does_stats
  • a81aa78 TestContainerWithConflictingNoneNetwork: Extend Windows timeout
  • 908a35a Merge pull request #52914 from thaJeztah/no_stderr
  • 04d33b5 Merge pull request #52912 from thaJeztah/cleanup_GenerateRandomAlphaOnlyString
  • 3b2f557 Merge pull request #52722 from notandruu/integration/migrate-TestInspectAPIIm...
  • 62b3aae Merge pull request #52901 from vvoland/c8d-imageusage
  • 11d3342 integration-cli: un-skip stats tests on Windows
  • a47b1b2 Merge pull request #52891 from smerkviladze/attestations-clearer-blob-missing...
  • Additional commits viewable in compare view

Updates github.com/moby/moby/client from 0.4.1 to 0.5.0

Release notes

Sourced from github.com/moby/moby/client's releases.

client/0.5.0

0.5.0

Changelog

  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

client/v0.5.0-rc.1

0.5.0-rc.1

Changelog

  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
Changelog

Sourced from github.com/moby/moby/client's changelog.

0.5.0 (2013-07-17)

  • Runtime: List all processes running inside a container with 'docker top'
  • Runtime: Host directories can be mounted as volumes with 'docker run -v'
  • Runtime: Containers can expose public UDP ports (eg, '-p 123/udp')
  • Runtime: Optionally specify an exact public port (eg. '-p 80:4500')
  • Registry: New image naming scheme inspired by Go packaging convention allows arbitrary combinations of registries
  • Builder: ENTRYPOINT instruction sets a default binary entry point to a container
  • Builder: VOLUME instruction marks a part of the container as persistent data
  • Builder: 'docker build' displays the full output of a build by default
  • Runtime: 'docker login' supports additional options
  • Runtime: Dont save a container's hostname when committing an image.
  • Registry: Fix issues when uploading images to a private registry

0.4.8 (2013-07-01)

  • Builder: New build operation ENTRYPOINT adds an executable entry point to the container.
  • Runtime: Fix a bug which caused 'docker run -d' to no longer print the container ID.
  • Tests: Fix issues in the test suite

0.4.7 (2013-06-28)

  • Registry: easier push/pull to a custom registry
  • Remote API: the progress bar updates faster when downloading and uploading large files
  • Remote API: fix a bug in the optional unix socket transport
  • Runtime: improve detection of kernel version
  • Runtime: host directories can be mounted as volumes with 'docker run -b'
  • Runtime: fix an issue when only attaching to stdin
  • Runtime: use 'tar --numeric-owner' to avoid uid mismatch across multiple hosts
  • Hack: improve test suite and dev environment
  • Hack: remove dependency on unit tests on 'os/user'
  • Documentation: add terminology section

0.4.6 (2013-06-22)

  • Runtime: fix a bug which caused creation of empty images (and volumes) to crash.

0.4.5 (2013-06-21)

  • Builder: 'docker build git://URL' fetches and builds a remote git repository
  • Runtime: 'docker ps -s' optionally prints container size
  • Tests: Improved and simplified
  • Runtime: fix a regression introduced in 0.4.3 which caused the logs command to fail.
  • Builder: fix a regression when using ADD with single regular file.

0.4.4 (2013-06-19)

  • Builder: fix a regression introduced in 0.4.3 which caused builds to fail on new clients.

0.4.3 (2013-06-19)

  • Builder: ADD of a local file will detect tar archives and unpack them
  • Runtime: Remove bsdtar dependency
  • Runtime: Add unix socket and multiple -H support
  • Runtime: Prevent rm of running containers
  • Runtime: Use go1.1 cookiejar
  • Builder: ADD improvements: use tar for copy + automatically unpack local archives

... (truncated)

Commits
  • 51f6c4a Merge pull request #1227 from dotcloud/bump_0.5.0
  • f4eaec3 Merge pull request #1226 from metalivedev/easydockerfile
  • b083418 change -b -> -v and add udp example
  • 5794857 Merge pull request #1169 from crosbymichael/buildfile-tests
  • e7f3f6f Add unit tests for buildfile config instructions
  • aa56714 Make dockerfile docs easier to find. Clean up formatting.
  • f8dfd0a Merge pull request #1225 from dotcloud/hotfix_docker_rmi
  • 3dbf9c6 Merge pull request #1219 from metalivedev/docs-repoupdate
  • de563a3 Merge pull request #1194 from crosbymichael/build-verbose
  • 9cf2b41 change rm usage in docs
  • Additional commits viewable in compare view

Updates github.com/onsi/gomega from 1.40.0 to 1.42.1

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.42.1

1.42.1

Bump Dependencies

v1.42.0

1.42.0

Add a set of Claude skill as a marketplace plugin

v1.41.0

No release notes provided.

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.42.1

Bump Dependencies

1.42.0

Add a set of Claude skill as a marketplace plugin

1.41.0

Features

Add BeASlice and BeAnArray matchers

Fixes

Object formatting now detects pointer cycles to avoid runaway formatting output.

Commits

Updates golang.org/x/mod from 0.36.0 to 0.37.0

Commits
  • deb1dfc go.mod: update golang.org/x dependencies
  • 087f651 modfile: use slices.Backward
  • 343ee60 x/mod: allow for aggressively conslidating requires
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the go-dependencies group with 8 updates
4af8c93 
Bumps the go-dependencies group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/chainguard-dev/kaniko](https://github.com/chainguard-dev/kaniko) | `1.25.15` | `1.25.16` |
| [github.com/docker/cli](https://github.com/docker/cli) | `29.4.3+incompatible` | `29.6.1+incompatible` |
| [github.com/gdamore/tcell/v2](https://github.com/gdamore/tcell) | `2.13.9` | `2.13.10` |
| [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.21.5` | `0.21.7` |
| [github.com/moby/moby/api](https://github.com/moby/moby) | `1.54.2` | `1.55.0` |
| [github.com/moby/moby/client](https://github.com/moby/moby) | `0.4.1` | `0.5.0` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.40.0` | `1.42.1` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.36.0` | `0.37.0` |


Updates `github.com/chainguard-dev/kaniko` from 1.25.15 to 1.25.16
- [Release notes](https://github.com/chainguard-dev/kaniko/releases)
- [Changelog](https://github.com/chainguard-forks/kaniko/blob/main/CHANGELOG.md)
- [Commits](chainguard-forks/kaniko@v1.25.15...v1.25.16)

Updates `github.com/docker/cli` from 29.4.3+incompatible to 29.6.1+incompatible
- [Commits](docker/cli@v29.4.3...v29.6.1)

Updates `github.com/gdamore/tcell/v2` from 2.13.9 to 2.13.10
- [Release notes](https://github.com/gdamore/tcell/releases)
- [Changelog](https://github.com/gdamore/tcell/blob/main/CHANGESv3.md)
- [Commits](gdamore/tcell@v2.13.9...v2.13.10)

Updates `github.com/google/go-containerregistry` from 0.21.5 to 0.21.7
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.21.5...v0.21.7)

Updates `github.com/moby/moby/api` from 1.54.2 to 1.55.0
- [Release notes](https://github.com/moby/moby/releases)
- [Commits](moby/moby@api/v1.54.2...api/v1.55.0)

Updates `github.com/moby/moby/client` from 0.4.1 to 0.5.0
- [Release notes](https://github.com/moby/moby/releases)
- [Changelog](https://github.com/moby/moby/blob/v0.5.0/CHANGELOG.md)
- [Commits](moby/moby@v0.4.1...v0.5.0)

Updates `github.com/onsi/gomega` from 1.40.0 to 1.42.1
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.40.0...v1.42.1)

Updates `golang.org/x/mod` from 0.36.0 to 0.37.0
- [Commits](golang/mod@v0.36.0...v0.37.0)

---
updated-dependencies:
- dependency-name: github.com/chainguard-dev/kaniko
  dependency-version: 1.25.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/docker/cli
  dependency-version: 29.6.1+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/gdamore/tcell/v2
  dependency-version: 2.13.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.21.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/moby/moby/api
  dependency-version: 1.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/moby/moby/client
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.42.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/mod
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code type/chore Issue that requests non-user facing changes. labels Jun 29, 2026
@dependabot
dependabot Bot requested review from a team as code owners June 29, 2026 22:13
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jun 29, 2026
@github-actions github-actions Bot added this to the 0.41.0 milestone Jun 29, 2026
@jjbustamante jjbustamante mentioned this pull request Jun 30, 2026
Merged
2 tasks
@jjbustamante

jjbustamante commented Jun 30, 2026

Copy link
Copy Markdown
Member

I've pulled the safe subset of this group out into #2647 — kaniko 1.25.16, tcell 2.13.10, gomega 1.42.1, and x/mod 0.37.0 — which update without touching the image stack and keep acceptance green.

Holding the rest here: moby/moby/api 1.55.0, moby/moby/client 0.5.0, and go-containerregistry 0.21.7 are what break this PR's CI — the rebase/daemon/* suite fails with could not find base layer in image and manifest annotate fails. imgutil still pins moby/moby/client v0.2.2 / api v1.52.1 / go-containerregistry v0.20.6 even on its main tip, so pack can't move ahead until imgutil ships against the newer moby client. docker/cli 29.4.3 already satisfies GO-2026-4610, so its bump buys no fixable CVE and stays with the docker hold too.

Leaving this open until imgutil catches up.

@jjbustamante jjbustamante mentioned this pull request Jun 30, 2026
Open
@jjbustamante

jjbustamante commented Jun 30, 2026

Copy link
Copy Markdown
Member

Filed the upstream tracking issue for the bump we're blocked on: buildpacks/imgutil#307. Once imgutil ships against moby/moby/client v0.5.x / api v1.55.x and go-containerregistry v0.21.x, we can take the held bumps here.

@dependabot @github

dependabot Bot commented on behalf of github Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 6, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/go-dependencies-930f169fc6 branch July 6, 2026 22:13
jjbustamante added a commit that referenced this pull request Jul 9, 2026
@jjbustamante @claude
build(deps): bump safe go-dependencies (kaniko, tcell, gomega, x/mod) (…
a469ae3 
…#2647)

Splits the safe subset out of the grouped dependabot bump in #2645.

These four direct deps update without disturbing the docker/moby image
stack, so they keep acceptance green:

  - github.com/chainguard-dev/kaniko  v1.25.15 -> v1.25.16
  - github.com/gdamore/tcell/v2       v2.13.9  -> v2.13.10
  - github.com/onsi/gomega            v1.40.0  -> v1.42.1
  - golang.org/x/mod                  v0.36.0  -> v0.37.0

The moby/moby/{api,client}, go-containerregistry, and docker/cli bumps
from #2645 are intentionally held: imgutil still pins moby/moby/client
v0.2.2 / api v1.52.1 / go-containerregistry v0.20.6 even on its main tip,
so forcing pack ahead breaks the daemon rebase ("could not find base
layer in image") and manifest annotate acceptance suites.

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@jjbustamante jjbustamante mentioned this pull request Jul 13, 2026
Merged
2 tasks
@jjbustamante jjbustamante removed this from the 0.41.0 milestone Jul 13, 2026
@jjbustamante jjbustamante mentioned this pull request Jul 13, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code type/chore Issue that requests non-user facing changes.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jjbustamante