João Salavisa
767cc89e6c
github.com/docker/docker is frozen at v28.5.2 — moby publishes v29+ under
github.com/moby/moby/v2, with the API client split out into the standalone
github.com/moby/moby/client and github.com/moby/moby/api modules. That leaves
five Dependabot alerts on the old module path with no reachable fix version:
CVE-2026-42306 high docker cp bind mount redirection <= 28.5.2
CVE-2026-41567 high PUT /containers/{id}/archive <= 28.5.2
CVE-2026-41568 medium docker cp symlink swap <= 28.5.2
CVE-2026-34040 high AuthZ plugin bypass < 29.3.1
CVE-2026-33997 medium plugin privilege off-by-one < 29.3.1
All five are daemon-side defects, and we only ever imported the client. Moving
to the split client module drops the daemon source out of the module graph
entirely, so these alerts resolve and future daemon advisories will not flag us
at all. It also trims six transitive dependencies.
The new client takes an options struct per call and returns a result struct, so
this is a mechanical rewrite of the wrapper. Behavioural notes:
- Ports moved from docker/go-connections/nat to moby/api/types/network, where
Port is opaque and PortBinding.HostIP is a netip.Addr. buildDockerPortBindings
now returns an error for out-of-range ports and unparseable host IPs instead
of handing the daemon a malformed request. An empty HostIP still maps to the
zero address, preserving "publish on all interfaces".
- DiskUsage needs Verbose to get per-image and per-container records; the
aggregate LayersSize is now Images.TotalSize.
- BuildCachePrune no longer takes KeepStorage — the client derives the legacy
keep-storage parameter from ReservedSpace for daemons on API <= 1.47.
- ImagesPrune is now ImagePrune.
- Container state and health are typed string enums, and InspectResponse.Config
and .State are pointers, so inspect mapping guards for nil.
Also corrects the RUSTSEC-2024-0429 note in the cargo-audit ignore list. It
claimed the advisory resolves once Tauri moves to webkit2gtk-4.1, but Tauri v2
is already on those bindings and still resolves glib to 0.18.5; the real
blocker is that gtk3-rs is archived. Backport submitted upstream.
Co-authored-by: Kandev Agent <agent@kandev.dev>
123 lines
5.3 KiB
Modula-2
123 lines
5.3 KiB
Modula-2
module github.com/kandev/kandev
|
|
|
|
go 1.26.0
|
|
|
|
require (
|
|
github.com/UserExistsError/conpty v0.1.4
|
|
github.com/bmatcuk/doublestar/v4 v4.10.0
|
|
github.com/coder/acp-go-sdk v0.13.5
|
|
github.com/creack/pty v1.1.24
|
|
github.com/gin-gonic/gin v1.9.1
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gorilla/websocket v1.5.3
|
|
github.com/hashicorp/go-plugin v1.8.0
|
|
github.com/jackc/pgx/v5 v5.9.2
|
|
github.com/jmoiron/sqlx v1.4.0
|
|
github.com/kevinburke/ssh_config v1.6.0
|
|
github.com/mark3labs/mcp-go v0.43.2
|
|
github.com/mattn/go-sqlite3 v1.14.33
|
|
github.com/moby/moby/api v1.55.0
|
|
github.com/moby/moby/client v0.5.0
|
|
github.com/nats-io/nats.go v1.31.0
|
|
github.com/pkg/sftp v1.13.10
|
|
github.com/spf13/viper v1.16.0
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/superfly/sprites-go v0.0.0-20260206213632-8176adff485b
|
|
github.com/tuzig/vt10x v0.0.0-20231206072048-370e51642bf7
|
|
github.com/yuin/goldmark v1.7.13
|
|
go.opentelemetry.io/otel v1.43.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0
|
|
go.opentelemetry.io/otel/sdk v1.43.0
|
|
go.opentelemetry.io/otel/trace v1.43.0
|
|
go.uber.org/goleak v1.3.0
|
|
go.uber.org/zap v1.26.0
|
|
golang.org/x/crypto v0.52.0
|
|
golang.org/x/net v0.55.0
|
|
golang.org/x/sync v0.20.0
|
|
golang.org/x/sys v0.45.0
|
|
google.golang.org/grpc v1.82.1
|
|
google.golang.org/protobuf v1.36.11
|
|
gopkg.in/natefinch/lumberjack.v2 v2.2.1
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
)
|
|
|
|
require (
|
|
github.com/Masterminds/semver/v3 v3.2.1 // indirect
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
github.com/bahlo/generic-list-go v0.2.0 // indirect
|
|
github.com/buger/jsonparser v1.1.2 // indirect
|
|
github.com/bytedance/sonic v1.9.1 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
|
|
github.com/containerd/errdefs v1.0.0 // indirect
|
|
github.com/containerd/errdefs/pkg v0.3.0 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/distribution/reference v0.6.0 // indirect
|
|
github.com/docker/go-connections v0.7.0 // indirect
|
|
github.com/docker/go-units v0.5.0 // indirect
|
|
github.com/fatih/color v1.13.0 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/fsnotify/fsnotify v1.6.0 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.2 // indirect
|
|
github.com/gin-contrib/sse v0.1.0 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-playground/validator/v10 v10.14.0 // indirect
|
|
github.com/goccy/go-json v0.10.2 // indirect
|
|
github.com/golang/protobuf v1.5.4 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
|
|
github.com/hashicorp/go-hclog v1.6.3 // indirect
|
|
github.com/hashicorp/hcl v1.0.0 // indirect
|
|
github.com/hashicorp/yamux v0.1.2 // indirect
|
|
github.com/invopop/jsonschema v0.13.0 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/klauspost/compress v1.17.0 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.2.4 // indirect
|
|
github.com/kr/fs v0.1.0 // indirect
|
|
github.com/leodido/go-urn v1.2.4 // indirect
|
|
github.com/magiconair/properties v1.8.7 // indirect
|
|
github.com/mailru/easyjson v0.7.7 // indirect
|
|
github.com/mattn/go-colorable v0.1.12 // indirect
|
|
github.com/mattn/go-isatty v0.0.19 // indirect
|
|
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
|
github.com/moby/docker-image-spec v1.3.1 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/nats-io/nkeys v0.4.6 // indirect
|
|
github.com/nats-io/nuid v1.0.1 // indirect
|
|
github.com/oklog/run v1.1.0 // indirect
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
|
github.com/opencontainers/image-spec v1.1.1 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.0.8 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/spf13/afero v1.9.5 // indirect
|
|
github.com/spf13/cast v1.7.1 // indirect
|
|
github.com/spf13/jwalterweatherman v1.1.0 // indirect
|
|
github.com/spf13/pflag v1.0.5 // indirect
|
|
github.com/subosito/gotenv v1.4.2 // indirect
|
|
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
|
github.com/ugorji/go/codec v1.2.11 // indirect
|
|
github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
|
|
github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.43.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
|
|
go.uber.org/multierr v1.10.0 // indirect
|
|
golang.org/x/arch v0.3.0 // indirect
|
|
golang.org/x/term v0.43.0 // indirect
|
|
golang.org/x/text v0.37.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
|
|
gopkg.in/ini.v1 v1.67.0 // indirect
|
|
)
|
|
|
|
replace github.com/coder/acp-go-sdk => github.com/kdlbs/acp-go-sdk v0.13.6-0.20260625174839-e37105a28386
|