chore(deps): bump the go-modules-cli group across 1 directory with 8 updates

[dependabot]

Bumps the go-modules-cli group with 4 updates in the /cmd/cli directory: github.com/charmbracelet/glamour, github.com/docker/cli, github.com/docker/cli-docs-tool and github.com/docker/docker.

Updates github.com/charmbracelet/glamour from 0.10.0 to 1.0.0

Commits

• 69661fd chore(deps): bump actions/checkout from 5 to 6 in the all group (#491)
• 0af1a2d chore(deps): bump the all group with 2 updates (#482)
• a9ec019 chore(deps): bump github.com/charmbracelet/x/ansi in the all group (#477)
• 7a4cf0c ci: sync dependabot config (#476)
• 49c8248 chore(deps): bump the all group with 2 updates (#472)
• c1ce505 chore(deps): bump actions/setup-go from 5 to 6 in the all group (#471)
• f9c650c ci: sync dependabot config (#470)
• e3c481b chore(deps): bump actions/checkout from 4 to 5 (#469)
• 7209389 chore(deps): bump golang.org/x/term from 0.33.0 to 0.34.0 (#468)
• f447e14 chore(deps): bump github.com/charmbracelet/x/ansi from 0.9.3 to 0.10.1 (#467)
• Additional commits viewable in compare view

Updates github.com/docker/cli from 28.3.0+incompatible to 29.3.0+incompatible

Commits

• 5927d80 Merge pull request #6844 from vvoland/update-docker
• 206fc8c vendor: github.com/moby/moby/client v0.3.0
• 874a8df vendor: github.com/moby/moby/api v1.54.0
• 964a6d2 Merge pull request #6792 from vvoland/bind-create
• 210147d Merge pull request #6843 from docker/dependabot/github_actions/docker/setup-b...
• 847f547 Merge pull request #6842 from docker/dependabot/github_actions/docker/login-a...
• 668b367 build(deps): bump docker/setup-buildx-action from 3 to 4
• 30a2ace build(deps): bump docker/login-action from 3 to 4
• 32aa575 docs/service: Document bind-create-src
• c747cff container/opts: Add bind-create-src mount option
• Additional commits viewable in compare view

Updates github.com/docker/cli-docs-tool from 0.10.0 to 0.11.0

Release notes

Sourced from github.com/docker/cli-docs-tool's releases.

v0.11.0

What's Changed

• build(deps): bump actions/checkout from 4 to 5 docker/cli-docs-tool#67
• build(deps): bump actions/setup-go from 5 to 6 docker/cli-docs-tool#68
• build(deps): bump actions/checkout from 5 to 6 docker/cli-docs-tool#70
• build(deps): bump actions/upload-artifact from 4 to 5 docker/cli-docs-tool#69
• update github.com/spf13/cobra v1.10.2, switch to go.yaml.in/yaml/v3 docker/cli-docs-tool#71
• build(deps): bump github.com/cpuguy83/go-md2man/v2 to v2.0.7 docker/cli-docs-tool#74
• Dockerfile: update github.com/google/addlicense to v1.2.0, golangci-lint to v2.7.1, tonistiigi/xx to v1.9.0 docker/cli-docs-tool#73
• example: update dependencies docker/cli-docs-tool#72

Full Changelog: docker/cli-docs-tool@v0.10.0...v0.11.0

Commits

• bf00773 Merge pull request #72 from thaJeztah/bump_example
• 6770aad example: update dependencies
• 6b9343f Merge pull request #73 from thaJeztah/bump_tools
• b37b96c Merge pull request #74 from thaJeztah/bump_md2man
• 619a182 Dockerfile: update tonistiigi/xx to v1.9.0
• 839c480 go.mod: update github.com/cpuguy83/go-md2man/v2 to v2.0.7
• 441abe9 Dockerfile: update golangci-lint to v2.7.1
• add3d76 Dockerfile: update github.com/google/addlicense to v1.2.0
• a348444 Merge pull request #71 from thaJeztah/bump_cobra_yaml
• f73782d update github.com/spf13/cobra v1.10.2, switch to go.yaml.in/yaml/v3
• Additional commits viewable in compare view

Updates github.com/docker/docker from 28.3.3+incompatible to 28.5.2+incompatible

Release notes

Sourced from github.com/docker/docker's releases.

v28.5.2

28.5.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

• docker/cli, 28.5.2 milestone
• moby/moby, 28.5.2 milestone

[!CAUTION] This release contains fixes for three high-severity security vulnerabilities in runc:

• CVE-2025-31133
• CVE-2025-52565
• CVE-2025-52881

All three vulnerabilities ultimately allow (through different methods) for full container breakouts by bypassing runc's restrictions for writing to arbitrary /proc files.

Packaging updates

• Update runc to v1.3.3. moby/moby#51394

Bug fixes and enhancements

• dockerd-rootless.sh: if slirp4netns is not installed, try using pasta (passt). moby/moby#51162
• Update Go runtime to 1.24.9. moby/moby#51387, docker/cli#6613

Deprecations

• Go-SDK: cli/command/image/build: deprecate DefaultDockerfileName, DetectArchiveReader, WriteTempDockerfile, ResolveAndValidateContextPath. These utilities were only used internally and will be removed in the next release. docker/cli#6610
• Go-SDK: cli/command/image/build: deprecate IsArchive utility. docker/cli#6560
• Go-SDK: opts: deprecate ValidateMACAddress. docker/cli#6560
• Go-SDK: opts: deprecate ListOpts.Delete(). docker/cli#6560

v28.5.1

28.5.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

• docker/cli, 28.5.1 milestone
• moby/moby, 28.5.1 milestone
• Deprecated and removed features, see Deprecated Features.
• Changes to the Engine API, see API version history.

Bug fixes and enhancements

• Update BuildKit to v0.25.1. moby/moby#51137
• Update Go runtime to 1.24.8. moby/moby#51133, docker/cli#6541

Deprecations

• api/types/image: InspectResponse: deprecate Parent and DockerVersion fields. moby/moby#51105
• api/types/plugin: deprecate Config.DockerVersion field. moby/moby#51110

... (truncated)

Commits

• 89c5e8f Merge pull request #51396 from thaJeztah/28.x_backport_api_docs
• 9b93878 Merge pull request #51395 from thaJeztah/28.x_backport_rootless_reject
• 6178456 Merge pull request #51398 from vvoland/51397-28.x
• 0cae4e5 vendor: github.com/moby/buildkit v0.25.2
• 33cc06f Merge pull request #51394 from vvoland/51393-28.x
• d525277 api/docs: remove BuildCache.Parent field for API v1.42 and up
• 2fbc51b dockerd-rootless.sh: reject DOCKERD_ROOTLESS_ROOTLESSKIT_NET=host
• bd98008 integration-cli: Adjust nofile limits
• 1967515 Dockerfile: update runc binary to v1.3.3
• 4489660 Merge pull request #51387 from thaJeztah/28.x_bump_go
• Additional commits viewable in compare view

Updates github.com/mattn/go-runewidth from 0.0.16 to 0.0.17

Commits

• 94c0db1 Merge pull request #85 from mattn/fix-windows-terminal
• 76bca58 fix comment
• 74c2b32 add trick for Windows Terminal
• d62f699 Merge pull request #81 from mattn/fix-build
• 239943a fix benchmark code
• See full diff in compare view

Updates github.com/spf13/cobra from 1.10.1 to 1.10.2

Release notes

Sourced from github.com/spf13/cobra's releases.

v1.10.2

🔧 Dependencies

• chore: Migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 by @​dims in spf13/cobra#2336 - the gopkg.in/yaml.v3 package has been deprecated for some time: this should significantly cleanup dependency/supply-chains for consumers of spf13/cobra

📈 CI/CD

• Fix linter and allow CI to pass by @​marckhouzam in spf13/cobra#2327
• fix: actions/setup-go v6 by @​jpmcb in spf13/cobra#2337

🔥✍🏼 Docs

• Add documentation for repeated flags functionality by @​rvergis in spf13/cobra#2316

🍂 Refactors

• refactor: replace several vars with consts by @​htoyoda18 in spf13/cobra#2328
• refactor: change minUsagePadding from var to const by @​ssam18 in spf13/cobra#2325

🤗 New Contributors

• @​rvergis made their first contribution in spf13/cobra#2316
• @​htoyoda18 made their first contribution in spf13/cobra#2328
• @​ssam18 made their first contribution in spf13/cobra#2325
• @​dims made their first contribution in spf13/cobra#2336

Full Changelog: spf13/cobra@v1.10.1...v1.10.2

Thank you to our amazing contributors!!!!! 🐍 🚀

Commits

• 88b30ab chore: Migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 (#2336)
• 346d408 fix: actions/setup-go v6 (#2337)
• fc81d20 refactor: change minUsagePadding from var to const (#2325)
• 117698a refactor: replace several vars with consts (#2328)
• e2dd29d Add documentation for repeated flags functionality (#2316)
• 0629892 Fix linter (#2327)
• See full diff in compare view

Updates github.com/spf13/pflag from 1.0.9 to 1.0.10

Release notes

Sourced from github.com/spf13/pflag's releases.

v1.0.10

What's Changed

• fix deprecation comment for (FlagSet.)ParseErrorsWhitelist by @​thaJeztah in spf13/pflag#447
• remove uses of errors.Is, which requires go1.13, move go1.16/go1.21 tests to separate file by @​thaJeztah in spf13/pflag#448

New Contributors

• @​thaJeztah made their first contribution in spf13/pflag#447

Full Changelog: spf13/pflag@v1.0.9...v1.0.10

Commits

• 0491e57 Merge pull request #448 from thaJeztah/fix_go_version
• 72abab1 Merge pull request #447 from thaJeztah/fix_deprecation_comment
• 7e4dfb1 Test on Go 1.12
• 18a9d17 move Func, BoolFunc, tests as they require go1.21
• c5b9e98 remove uses of errors.Is, which requires go1.13
• 45a4873 fix deprecation comment for (FlagSet.)ParseErrorsWhitelist
• See full diff in compare view

Updates go.opentelemetry.io/otel from 1.37.0 to 1.42.0

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

• Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)
• Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (#7924)

Changed

• TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (#7856)

Fixed

• Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (#7931)
• Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (#7964)
• Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (#7834)

Removed

• Drop support for [Go 1.24]. (#7984)

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

This release is the last to support [Go 1.24]. The next release will require at least [Go 1.25].

Added

• Support testing of [Go 1.26]. (#7902)

Fixed

• Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#7880)
• Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7914)
• Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#7914)
• Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7914)

[1.40.0/0.62.0/0.16.0] 2026-02-02

Added

• Add AlwaysRecord sampler in go.opentelemetry.io/otel/sdk/trace. (#7724)
• Add Enabled method to all synchronous instrument interfaces (Float64Counter, Float64UpDownCounter, Float64Histogram, Float64Gauge, Int64Counter, Int64UpDownCounter, Int64Histogram, Int64Gauge,) in go.opentelemetry.io/otel/metric. This stabilizes the synchronous instrument enabled feature, allowing users to check if an instrument will process measurements before performing computationally expensive operations. (#7763)
• Add go.opentelemetry.io/otel/semconv/v1.39.0 package. The package contains semantic conventions from the v1.39.0 version of the OpenTelemetry Semantic Conventions.

... (truncated)

Commits

• a3941ff Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 (#8006)
• 6059c47 chore(deps): update golang.org/x/telemetry digest to e526e8a (#8010)
• 44c7edf chore(deps): update module github.com/mgechev/revive to v1.15.0 (#8009)
• de5fb3a fix(deps): update module google.golang.org/grpc to v1.79.2 (#8007)
• 0b82ded chore(deps): update codspeedhq/action action to v4.11.1 (#8001)
• aa3660f chore(deps): update github/codeql-action action to v4.32.6 (#8004)
• 9be8c92 chore(deps): update dependency codespell to v2.4.2 (#8003)
• c9d2015 log: add error field to Record and make SDK to emit exception attributes (#7924)
• fdd1320 TracerProvider ForceFlush() Error Fix (#7856)
• 78f9904 chore(deps): update golang.org/x/telemetry digest to 18da590 (#8000)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions