Skip to content

deps: bump the moby group across 1 directory with 2 updates - #100

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/moby-39e2cf7910
Closed

deps: bump the moby group across 1 directory with 2 updates#100
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/moby-39e2cf7910

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the moby group with 2 updates in the / directory: github.com/moby/moby/api and github.com/moby/moby/client.

Updates github.com/moby/moby/api from 1.54.2 to 1.55.0

Release notes

Sourced from github.com/moby/moby/api's releases.

api/v1.55.0

1.55.0

Changelog

  • POST /containers/{id}/update now supports per-device blkio resource settingss. moby/moby#52651
  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
  • docs: clarify swarm join required fields. moby/moby#52763

api/v1.55.0-rc.1

1.55.0-rc.1

Changelog

  • POST /containers/{id}/update now supports per-device blkio resource settingss. moby/moby#52651
  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
  • docs: clarify swarm join required fields. moby/moby#52763
Commits
  • b6c53c2 Merge pull request #52773 from vvoland/c8d-amd64-variants
  • 01115e8 Merge pull request #52906 from vvoland/fix-TestContainerWithConflictingNoneNe...
  • b36296f Merge pull request #52913 from thaJeztah/windows_does_stats
  • a81aa78 TestContainerWithConflictingNoneNetwork: Extend Windows timeout
  • 908a35a Merge pull request #52914 from thaJeztah/no_stderr
  • 04d33b5 Merge pull request #52912 from thaJeztah/cleanup_GenerateRandomAlphaOnlyString
  • 3b2f557 Merge pull request #52722 from notandruu/integration/migrate-TestInspectAPIIm...
  • 62b3aae Merge pull request #52901 from vvoland/c8d-imageusage
  • 11d3342 integration-cli: un-skip stats tests on Windows
  • a47b1b2 Merge pull request #52891 from smerkviladze/attestations-clearer-blob-missing...
  • Additional commits viewable in compare view

Updates github.com/moby/moby/client from 0.4.1 to 0.5.1

Release notes

Sourced from github.com/moby/moby/client's releases.

client/v0.5.1

0.5.1

Changelog

  • client/pkg/jsonmessage: Display: fix godoc link. moby/moby#53070
  • client: ServiceCreate, ServiceUpdate: fix duplicate and 'unkown' platforms. moby/moby#53012
  • client: ServiceInspect, ContainerCommit: omit optional query args if not set. moby/moby#53010
  • golangci-lint: enable perfsprint linter. moby/moby#53016

client/0.5.0

0.5.0

Changelog

  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

client/v0.5.0-rc.1

0.5.0-rc.1

Changelog

  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
Changelog

Sourced from github.com/moby/moby/client's changelog.

0.5.1 (2013-07-30)

  • API: Docker client now sets useragent (RFC 2616)
  • Runtime: Add ps args to docker top
  • Runtime: Add support for container ID files (pidfile like)
  • Runtime: Add container=lxc in default env
  • Runtime: Support networkless containers with docker run -n and docker -d -b=none
  • API: Add /events endpoint
  • Builder: ADD command now understands URLs
  • Builder: CmdAdd and CmdEnv now respect Dockerfile-set ENV variables
  • Hack: Simplify unit tests with helpers
  • Hack: Improve docker.upstart event
  • Hack: Add coverage testing into docker-ci
  • Runtime: Stdout/stderr logs are now stored in the same file as JSON
  • Runtime: Allocate a /16 IP range by default, with fallback to /24. Try 12 ranges instead of 3.
  • Runtime: Change .dockercfg format to json and support multiple auth remote
  • Runtime: Do not override volumes from config
  • Runtime: Fix issue with EXPOSE override
  • Builder: Create directories with 755 instead of 700 within ADD instruction

0.5.0 (2013-07-17)

  • Runtime: List all processes running inside a container with 'docker top'
  • Runtime: Host directories can be mounted as volumes with 'docker run -v'
  • Runtime: Containers can expose public UDP ports (eg, '-p 123/udp')
  • Runtime: Optionally specify an exact public port (eg. '-p 80:4500')
  • Registry: New image naming scheme inspired by Go packaging convention allows arbitrary combinations of registries
  • Builder: ENTRYPOINT instruction sets a default binary entry point to a container
  • Builder: VOLUME instruction marks a part of the container as persistent data
  • Builder: 'docker build' displays the full output of a build by default
  • Runtime: 'docker login' supports additional options
  • Runtime: Dont save a container's hostname when committing an image.
  • Registry: Fix issues when uploading images to a private registry

0.4.8 (2013-07-01)

  • Builder: New build operation ENTRYPOINT adds an executable entry point to the container.
  • Runtime: Fix a bug which caused 'docker run -d' to no longer print the container ID.
  • Tests: Fix issues in the test suite

0.4.7 (2013-06-28)

  • Registry: easier push/pull to a custom registry
  • Remote API: the progress bar updates faster when downloading and uploading large files
  • Remote API: fix a bug in the optional unix socket transport
  • Runtime: improve detection of kernel version
  • Runtime: host directories can be mounted as volumes with 'docker run -b'
  • Runtime: fix an issue when only attaching to stdin
  • Runtime: use 'tar --numeric-owner' to avoid uid mismatch across multiple hosts
  • Hack: improve test suite and dev environment
  • Hack: remove dependency on unit tests on 'os/user'
  • Documentation: add terminology section

0.4.6 (2013-06-22)

... (truncated)

Commits

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jun 22, 2026
@dependabot dependabot Bot changed the title deps: Bump the moby group with 2 updates deps: Bump the moby group across 1 directory with 2 updates Jun 24, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/moby-39e2cf7910 branch 2 times, most recently from 092f751 to 76bddc8 Compare June 29, 2026 06:14
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/moby-39e2cf7910 branch from 76bddc8 to 1558087 Compare August 24, 2026 06:10
@dependabot
deps: bump the moby group across 1 directory with 2 updates
ef09f41 
Bumps the moby group with 2 updates in the / directory: [github.com/moby/moby/api](https://github.com/moby/moby) and [github.com/moby/moby/client](https://github.com/moby/moby).


Updates `github.com/moby/moby/api` from 1.54.2 to 1.55.0
- [Release notes](https://github.com/moby/moby/releases)
- [Commits](moby/moby@api/v1.54.2...api/v1.55.0)

Updates `github.com/moby/moby/client` from 0.4.1 to 0.5.1
- [Release notes](https://github.com/moby/moby/releases)
- [Changelog](https://github.com/moby/moby/blob/v0.5.1/CHANGELOG.md)
- [Commits](moby/moby@v0.4.1...v0.5.1)

---
updated-dependencies:
- dependency-name: github.com/moby/moby/api
  dependency-version: 1.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: moby
- dependency-name: github.com/moby/moby/client
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: moby
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title deps: Bump the moby group across 1 directory with 2 updates deps: bump the moby group across 1 directory with 2 updates Aug 31, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/moby-39e2cf7910 branch from 1558087 to ef09f41 Compare August 31, 2026 06:12
dap-code-review-by-crunchloop[bot]
dap-code-review-by-crunchloop Bot reviewed Aug 31, 2026
View reviewed changes

@dap-code-review-by-crunchloop dap-code-review-by-crunchloop Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review — head ef09f41

Reviewed head ef09f41 after fetching origin and checking it out detached (the normal gh pr checkout 100 attempt could not establish tracking for the Dependabot ref; the detached checkout matched the requested head). The range is one commit and two changed files: go.mod and go.sum.

Applied .dap/review/engineering.md from directives base 7103d81 and CONTRIBUTING.md from that same base. The referenced PRD.md is absent at that base. Since this is a dependency-only bump, I checked every repository caller of github.com/moby/moby/api and github.com/moby/moby/client and read the relevant Docker runtime implementations, then compared the old and new Moby module sources for the APIs used here. Existing calls and option/result types remain compatible; the client’s only relevant behavioral changes are API-version maximum negotiation and the addition of the unused attestations API, neither of which breaks these callers. No verified findings.

Covered D10/D11 and repository R7/R8 compatibility concerns for the changed dependencies, including API negotiation, build/pull, container lifecycle, exec, inspect/logging, network, volume, and image calls. D1-D9, D12-D14 were not materially touched by this two-file dependency update and were skipped. Tests were not executed per review policy.

Verdict

CLEAN — this round found nothing.

dap-code-review-by-crunchloop[bot]
dap-code-review-by-crunchloop Bot approved these changes Aug 31, 2026
View reviewed changes

@dap-code-review-by-crunchloop dap-code-review-by-crunchloop Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No open findings on ef09f41.

Approved by DAP code review. The DAP Code Review check run remains the verdict of record; this approval is a projection of it for branch protection, and is dismissed if a finding reopens or a later head is not clean.

@bilby91 bilby91 mentioned this pull request Sep 1, 2026
Merged
bilby91 added a commit that referenced this pull request Sep 1, 2026
@bilby91 @claude
deps: bump the pending Go module and GitHub Actions updates (#129)
eb4c0c8 
* deps: bump the pending Go module updates

Folds the six open dependabot module bumps into one change, taking the
latest release of each rather than the version each PR was cut against:

- compose-spec/compose-go/v2 2.11.0 -> 2.14.0 (#112)
- google/go-containerregistry 0.21.7 -> 0.22.0 (#113 asked for 0.21.9)
- moby/moby/api 1.54.2 -> 1.55.0, moby/moby/client 0.4.1 -> 0.5.1 (#100)
- golang.org/x/term 0.43.0 -> 0.45.0 (#110)
- google.golang.org/protobuf 1.36.11 -> 1.36.12 (#114)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* ci: bump the pending GitHub Actions updates

All four are majors whose breaking changes are the Node 24 runtime
default and an ESM migration; the workflows pass no inputs that the
majors removed, and no workflow uses pull_request_target or
workflow_run, which is the trigger pair actions/checkout v7 newly
refuses to check out fork PRs for.

- actions/checkout v6 (ci.yml) and v4 (devcontainer-*.yml) -> v7 (#99)
- actions/setup-go v6 -> v7 (#111)
- docker/login-action v3 -> v4 (#96)
- docker/setup-buildx-action v3 -> v4 (#95)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(compose): refuse the compose lifecycle hooks on the native path

compose-go 2.14 adds ServiceConfig.PreStart, so `pre_start` — which
2.11 rejected at schema validation — now loads cleanly. The native
orchestrator creates the service container directly and has no
ephemeral init-container step, so it dropped the hook silently; and
because the hooks are part of the ServiceConfig that ConfigHash
covers, editing a hook that never ran read as a config change and
stopped and removed the running container, destroying its writable
layer.

Refused in Plan.Validate via the existing §2.2 unsupported-field
mechanism, before any infrastructure side effect. stripForHash drops
the three fields as well: the refusal already makes them unreachable
there, but a recreation is unrecoverable, so no field the orchestrator
does not execute should be able to trigger one if the refusal moves or
a caller reaches ConfigHash directly.

post_start and pre_stop parsed cleanly under 2.11 and had the same
defect, so all three are refused rather than just the one the bump
introduced. The shell-out backend is untouched — it delegates to
`docker compose`, which implements the hooks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(compose): refuse unsupported fields before building anything

The §2.2 refusal ran only inside Orchestrator.Up, which the engine
reaches after prepareComposeServiceImage, layerFeatures and
buildComposeSidecarImages. A native project using a refused field
therefore paid for the primary image and every sidecar build, and
left those images tagged, before being told the engine will not run
it.

Plan.Validate already documents itself as side-effect-free and safe
to call before any backend interaction, so the fix is to call it
where that matters: straight after compose.Load. The orchestrator's
own validation stays as the authoritative one.

Native backend only. The shell-out path hands the project to
`docker compose`, which implements hooks and other fields the native
orchestrator refuses, so validating there would reject projects that
work today.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: bilby91 <2201079+bilby91@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@bilby91

bilby91 commented Sep 1, 2026

Copy link
Copy Markdown
Member

Superseded by #129, which folded every open dependency bump into one change. This PR was cut against a main that still had the Podman backend, the Apple Containers backend and the per-backend capability gating, so it needed a rebase and its green CI was measuring a tree that no longer exists.

moby/moby/api is on 1.55.0 and moby/moby/client on 0.5.1 as of #129 — the versions this PR asked for.

@dependabot close

@bilby91 bilby91 closed this Sep 1, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/go_modules/moby-39e2cf7910 branch September 1, 2026 16:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@dap-code-review-by-crunchloop dap-code-review-by-crunchloop[bot] dap-code-review-by-crunchloop[bot] approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bilby91