Sourced from github.com/docker/docker's releases.
v24.0.9
24.0.9
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Security
This release contains security fixes for the following CVEs affecting Docker Engine and its components.
CVE Component Fix version Severity CVE-2024-21626 runc 1.1.12 High, CVSS 8.6 CVE-2024-24557 Docker Engine 24.0.9 Medium, CVSS 6.9 Important ⚠️
Note that this release of Docker Engine doesn't include fixes for the following known vulnerabilities in BuildKit:
To address these vulnerabilities, upgrade to Docker Engine v25.0.2.
For more information about the security issues addressed in this release, and the unaddressed vulnerabilities in BuildKit, refer to the blog post. For details about each vulnerability, see the relevant security advisory:
Packaging updates
- Upgrade runc to v1.1.12. moby/moby#47269
- Upgrade containerd to v1.7.13 (static binaries only). moby/moby#47280
v24.0.8
24.0.8
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
- Live restore: Containers with auto remove (
docker run --rm) are no longer forcibly removed on engine restart. moby/moby#46857
... (truncated)
fca702d
Merge pull request from GHSA-xw73-rw38-6vjcf78a772
Merge pull request #47281
from thaJeztah/24.0_backport_bump_containerd_binary...61afffe
Merge pull request #47270
from thaJeztah/24.0_backport_bump_runc_binary_1.1.12b38e74c
Merge pull request #47276
from thaJeztah/24.0_backport_bump_runc_1.1.12dac5663
update containerd binary to v1.7.1320e1af3
vendor: github.com/opencontainers/runc v1.1.12858919d
update runc binary to v1.1.12141ad39
Merge pull request #47266
from vvoland/ci-fix-makeps1-templatefail-24db968c6
hack/make.ps1: Fix go list pattern61c51fb
Merge pull request #47221
from vvoland/pkg-pools-close-noop-24c48da13
http2: fix TestServerContinuationFlood flakes762b58d
http2: fix tipos in commentba87210
http2: close connections when receiving too many headersebc8168
all: fix some typos3678185
http2: make TestCanonicalHeaderCacheGrowth faster448c44f
http2: remove clientTesterc7877ac
http2: convert the remaining clientTester tests to testClientConnd8870b0
http2: use synthetic time in TestIdleConnTimeoutd73acff
http2: only set up deadline when Server.IdleTimeout is positive89f602b
http2: validate client/outgoing trailersSourced from ws's releases.
7.5.10
Bug fixes
- Backported e55e5106 to the 7.x release line (22c28763).
7.5.9
Bug fixes
- Backported bc8bd34e to the 7.x release line (0435e6e1).
7.5.8
Bug fixes
- Backported 0fdcc0af to the 7.x release line (2758ed35).
- Backported d68ba9e1 to the 7.x release line (dc1781bc).
7.5.7
Bug fixes
- Backported 6946f5fe to the 7.x release line (1f72e2e1).
7.5.6
Bug fixes
- Backported b8186dd1 to the 7.x release line (73dec34b).
- Backported ed2b8039 to the 7.x release line (22a26afb).
7.5.5
Bug fixes
- Backported ec9377ca to the 7.x release line (0e274acd).
7.5.4
Bug fixes
- Backported 6a72da3e to the 7.x release line (76087fbf).
- Backported 869c9892 to the 7.x release line (27997933).
7.5.3
Bug fixes
- The
WebSocketServerconstructor now throws an error if more than one of thenoServer,server, andportoptions are specefied (66e58d27).- Fixed a bug where a
'close'event was emitted by aWebSocketServerbefore the internal HTTP/S server was actually closed (5a587304).- Fixed a bug that allowed WebSocket connections to be established after
WebSocketServer.prototype.close()was called (772236a1).
d962d70
[dist] 7.5.1022c2876
[security] Fix crash when the Upgrade header cannot be read (#2231)8a78f87
[dist] 7.5.90435e6e
[security] Fix same host check for ws+unix: redirects4271f07
[dist] 7.5.8dc1781b
[security] Drop sensitive headers when following insecure redirects2758ed3
[fix] Abort the handshake if the Upgrade header is invalida370613
[dist] 7.5.71f72e2e
[security] Drop sensitive headers when following redirects (#2013)8ecd890
[dist] 7.5.63bbf4a6
tiff: Validate palette indices when parsing palette-color images6c5fa46
go.mod: update golang.org/x dependencies55c4ab6
go.mod: update golang.org/x dependencies0057a93
tiff: fix function name in comment9e190ae
webp: disallow multiple VP8X chunks445ab0e
go.mod: update golang.org/x dependencies240a51a
font/sfnt: support early version 0 OS/2 tablesc20bbc3
draw: simplify some calls to fmt.Fprintf491771c
draw: merge draw_go117.go into draw.go4aa0222
go.mod: update go directive to 1.18Sourced from rexml's releases.
REXML 3.3.2 - 2024-07-16
Improvements
Improved parse performance.
- GH-160
- Patch by NAITOH Jun.
Improved parse performance.
Added support for raising a parse exception when an XML has extra content after the root element.
- GH-161
- Patch by NAITOH Jun.
Added support for raising a parse exception when an XML declaration exists in wrong position.
- GH-162
- Patch by NAITOH Jun.
Removed needless a space after XML declaration in pretty print mode.
- GH-164
- Patch by NAITOH Jun.
Stopped to emit
:textevent after the root element.
- GH-167
- Patch by NAITOH Jun.
Fixes
- Fixed a bug that SAX2 parser doesn't expand predefined entities for
characterscallback.
- GH-168
- Patch by NAITOH Jun.
Thanks
NAITOH Jun
Watson
... (truncated)
Sourced from rexml's changelog.
3.3.2 - 2024-07-16 {#version-3-3-2}
Improvements
Improved parse performance.
- GH-160
- Patch by NAITOH Jun.
Improved parse performance.
Added support for raising a parse exception when an XML has extra content after the root element.
- GH-161
- Patch by NAITOH Jun.
Added support for raising a parse exception when an XML declaration exists in wrong position.
- GH-162
- Patch by NAITOH Jun.
Removed needless a space after XML declaration in pretty print mode.
- GH-164
- Patch by NAITOH Jun.
Stopped to emit
:textevent after the root element.
- GH-167
- Patch by NAITOH Jun.
Fixes
- Fixed a bug that SAX2 parser doesn't expand predefined entities for
characterscallback.
- GH-168
- Patch by NAITOH Jun.
Thanks
NAITOH Jun
Watson
... (truncated)
2b285ac
Add 3.3.2 entry0e33d3a
test: improve linear performance test names910e5a2
Fix performance issue caused by using repeated >
characters inside `<xml><!...1f1e6e9
Fix ReDoS by using repeated space characters inside `<!DOCTYPE name
[<!ATTLIS...1cc1d9a
Suppress have_root not initialized warnings on Ruby < 367efb59
Fix performance issue caused by using repeated >
characters inside `<!DOCTY...a79ac8b
Fix performance issue caused by using repeated >
characters inside `<!DOCTY...c33ea49
Fix performance issue caused by using repeated >
characters after ` <!DOCTY...9f1415a
Fix performance issue caused by using repeated >
characters inside `CDATA [...c1b64c1
Fix performance issue caused by using repeated >
characters inside comments...Sourced from github.com/docker/docker's releases.
v25.0.6
25.0.6
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
- docker/cli, 25.0.6 milestone
- moby/moby, 25.0.6 milestone
- Deprecated and removed features, see Deprecated Features.
- Changes to the Engine API, see API version history.
Security
This release contains a fix for CVE-2024-41110 / GHSA-v23v-6jw2-98fq that impacted setups using authorization plugins (AuthZ) for access control.
Bug fixes and enhancements
- [25.0] remove erroneous
platformfrom imageconfigOCI descriptor indocker saveoutput. moby/moby#47695- [25.0 backport] Fix a nil dereference when getting image history for images having layers without the
Createdvalue set. moby/moby#47759- [25.0 backport] apparmor: Allow confined runc to kill containers. moby/moby#47830
- [25.0 backport] Fix an issue where rapidly promoting a Swarm node after another node was demoted could cause the promoted node to fail its promotion. moby/moby#47869
- [25.0 backport] don't depend on containerd platform.Parse to return a typed error. moby/moby#47890
- [25.0 backport] builder/mobyexporter: Add missing nil check moby/moby#47987
Packaging updates
- Update AWS SDK Go v2 to v1.24.1 for AWS CloudWatch logging driver. moby/moby#47724
- Update Go runtime to 1.21.12, which contains security fixes for CVE-2024-24791 moby/moby#48146
- Update Containerd (static binaries only) to v1.7.20. moby/moby#48199
Full Changelog: https://github.com/moby/moby/compare/v25.0.5...v25.0.6
v25.0.5
25.0.5
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
- docker/cli, 25.0.5 milestone
- moby/moby, 25.0.5 milestone
- Deprecated and removed features, see Deprecated Features.
- Changes to the Engine API, see API version history.
Security
This release contains a security fix for CVE-2024-29018, a potential data exfiltration from 'internal' networks via authoritative DNS servers.
Bug fixes and enhancements
CVE-2024-29018: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. moby/moby#47589
plugin: fix mounting /etc/hosts when running in UserNS. moby/moby#47588
rootless: fix
open /etc/docker/plugins: permission denied. moby/moby#47587Fix multiple parallel
docker buildruns leaking disk space. moby/moby#47527
... (truncated)
b08a51f
Merge pull request #48231
from austinvazquez/backport-vendor-otel-v0.46.1-to-...d151b0f
vendor: OTEL v0.46.1 / v1.21.0c6ba9a5
Merge pull request #48225
from austinvazquez/backport-workflow-artifact-reten...4673a3c
Merge pull request #48227
from austinvazquez/backport-backport-branch-check-t...30f8908
github/ci: Check if backport is opened against the expected branch7454d6a
ci: update workflow artifacts retention65cc597
Merge commit from forkb722836
Merge pull request #48199
from austinvazquez/update-containerd-binary-to-1.7.20e8ecb9c
update containerd binary to v1.7.20e6cae1f
update containerd binary to v1.7.19