Fix/4.0/deps update#1099
Merged
jorgemoralespou merged 4 commits intoJul 14, 2026
Merged
Conversation
…/moby/moby/client and github.com/moby/moby/api modules. The legacy module is frozen at v28.5.2 with open security advisories against it (CVE-2026-41567, CVE-2026-42306 and earlier) and no fixed release, the fixes only exist in the re-versioned moby modules, so migrating is the only way to remediate. The new client negotiates the daemon API version at connect time (1.40-1.55), so the previous requirement to keep the pinned client version in lockstep with Docker Desktop no longer applies.
…ocker workshop deploy compose file generation. The v1 module line is no longer maintained and v2 is the parser the docker compose v5 library builds on, preparing for its later adoption. In v2 a project's services are a map keyed by service name, extra hosts map each host to a list of addresses, and the compose file is serialized through the project's own MarshalYAML so the output stays compose spec compliant.
….66.0, vendir to 0.46.0 and ytt to 0.55.1. imgpkg and ytt now require Go 1.26.3, so the client-programs module and the workspace move to that as their minimum; the CLI Dockerfile tracks the floating golang:1.26 image and CI reads the version from go.mod, so neither needs changing.
The go.work bump to 1.26.3 broke installer-operator CI: setup-go reads its toolchain from installer/operator/go.mod, which still declared 1.26.0, and GOTOOLCHAIN=local forbids the auto-upgrade the workspace requires. Align both workspace modules with go.work and prune stale go.work.sum entries left over from the dependency updates.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update carvel and docker dependencies to get rid of CVEs