Repository navigation
engine: rootfs 29.9.0-2, built with Go 1.26.9 - #536
Merged
Merged
Conversation
moby builds docker-v29.9.0 with Go 1.26.9, which fixes five stdlib CVEs in dockerd (four HTTP/2 DoS, one Windows junction escape). Our GO_VERSION was pinned at the go.mod floor (1.26.8), so rootfs 29.9.0-1 -- verified by reading the go version out of its dockerd -- does not have them. GO_VERSION 1.26.9, ROOTFS_REVISION 2. Checksums are empty until rootfs-v29.9.0-2 is published; the default-engine tests skip on the PR.
…nd verify the built dockerd
Verified by hashing the downloaded tarballs against the published .sha256 assets; dockerd, containerd and buildkitd in the tarball report go1.26.9.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
moby builds docker-v29.9.0 with Go 1.26.9, whose runtime update is the release's headline security fix (CVE-2026-97032, -78659, -78663, -78669: HTTP/2 DoS in dockerd; CVE-2026-56857: Windows junction). We pinned
GO_VERSIONat moby's go.mod floor (1.26.8), sorootfs-v29.9.0-1does not have them: I readgo1.26.8out of thedockerdin its published tarball.GO_VERSION=1.26.9(golang:1.26.9-alpine/bookworm both exist),ROOTFS_REVISION=2rootfs-v29.9.0-2, checksums empty until published (default-engine tests skip on the PR, by design)-1stays published (assets are immutable)GO_VERSION(separate stream)Process gap, to fix in docs/bumping-upstream.md: step 2 checks the Go floor only. It should also compare against the Go version moby's own Dockerfile builds with.