fix(deps): update all non-major dependencies by renovate[bot] · Pull Request #66 · pilat/devbox

renovate · 2026-11-02T01:29:40Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/docker/cli	`v29.9.2+incompatible` → `v29.9.3+incompatible`
github.com/docker/compose/v5	`v5.6.1` → `v5.7.1`
golang.org/x/net	`v0.61.0` → `v0.62.0`
golang.org/x/term	`v0.47.0` → `v0.48.0`

Release Notes

docker/cli (github.com/docker/cli)

`v29.9.3+incompatible`

Compare Source

docker/compose (github.com/docker/compose/v5)

`v5.7.1`

Compare Source

What's Changed

Fixes 🐛

fix(oci): verify the manifests fetched against their digest, and take only complete cache entries by @ndeloof in #14490
fix(oci): keep the cache of extracted projects consistent on interruption and concurrent access by @ndeloof in #14462
fix(git): check a commit out aside, and keep the cache of remote resources in a directory for each kind by @ndeloof in #14475
fix(compose): report network and volume progress once, on their own row by @glours in #14467
fix(config): warn about ignored uid/gid/mode at creation, not at load by @ndeloof in #14299
fix(down): preserve images outside selected services by @Aghayenoor in #14458
fix(events): treat io.EOF as a normal end of a bounded stream by @Bruce848647703 in #14444

Internal 🔧

refactor(compose): move logs and attach to internal/logstream by @ndeloof in #14407
refactor(compose): move images and image pruning to internal/images by @ndeloof in #14406
refactor(compose): move the dependency graph to internal/depgraph by @ndeloof in #14410
test(compose): lock the behaviors of the start path now carried by the plan engine by @ndeloof in #14403
test(e2e): migrate the first legacy icmd tests to scenarios by @ndeloof in #14414
Fix monitor test fixture type by @glours in #14455
ci: install the e2e engine with docker/setup-docker-action by @glours in #14456

Bumps

Update to go1.27.4 by @vvoland in #14489
update Go to 1.27 by @thaJeztah in #14486
update to golangci-lint v2.15.0 (compatible with go1.27) by @thaJeztah in #14487
build(deps): bump go.yaml.in/yaml/v4 to v4.0.0 by @ndeloof in #14468
build(deps): bump google.golang.org/grpc from 1.84.0 to 1.85.0 by @dependabot[bot] in #14445
build(deps): bump github.com/docker/cli from 29.9.2+incompatible to 29.9.3+incompatible by @dependabot[bot] in #14451

New Contributors

@Bruce848647703 made their first contribution in #14444
@Aghayenoor made their first contribution in #14458

Full Changelog: docker/compose@v5.7.0...v5.7.1

`v5.7.0`

Compare Source

What's Changed

ℹ️ Heads-up for users of Compose as a library: Up now runs its Create and Start phases as a single plan over a single daemon snapshot, for up -d (#14290) and interactive up (#14305), as scale, watch rebuilds and start already do (#14291, #14296). The CLI behaves as before. If you call api.Compose.Up from your own program:

Up now validates its options first, with the same rules as the CLI flags: UpOptions.Validate() returns an *api.IncompatibleOptionsError (errors.Is(err, api.ErrIncompatibleOptions)) for Start.Wait combined with Start.Attach, and for a detached Up (no Start.Attach) combined with OnExit, ExitCodeFrom or Watch. Those combinations used to be silently ignored (#14306).

Up works on the project it is given and ignores StartOptions.Project.

The daemon is not observed again between the two phases: a container that exits after the plan is built is not started again, and one removed in between makes its start fail instead of being skipped. A planning error of the Start phase now fails before any container is created.

A foreground Up now gives a use_api_socket service its /run/secrets/docker/config.json, as up -d does, and shows the output of pre_start hooks.

The keyboard menu of an interactive up is no longer built by the library: set NavigationMenu: true and pass an implementation with compose.WithNavigationMenu(...), otherwise no menu is displayed and a warning says so (#14324).

Other changes to the library surface in this release: DownOptions.Images is now an api.ImagePruneMode (untyped constants still compile, a string variable needs a conversion) and an invalid value is rejected before Down removes anything (#14149); compose.ServiceHash, compose.NetworkHash and compose.VolumeHash are no longer exported, the helpers having moved to an internal package (#14405); api.Compose is now assembled from six smaller interfaces, with the same method set (#14322); PushOptions.IgnoreMissing is added.

✨ Improvements

Execution plan

Feat: detached up runs on a single plan by @ndeloof in #14290
Feat(up): interactive up runs on a single plan by @ndeloof in #14305
Feat: scale and watch rebuild use the unified plan by @ndeloof in #14291
Feat: compose start builds a start-only plan by @ndeloof in #14296

Commands

Feat(run): --no-recreate reuses existing dependencies as-is by @ndeloof in #14144
Feat(push): add --ignore-missing to skip images not available locally by @glours in #14341
Feat(push): deprecate --ignore-push-failures in favor of --ignore-missing by @glours in #14354
Feat(stats): add --all-projects and --aggregate flags by @glours in #14337
Feat(network): let a service opt out of its name as a network alias by @glours in #14342
Pass --parallel limit to bake as --jobs by @maxproske in #14352

Other

Feat: support the umask service attribute by @ndeloof in #14367
Use the Docker Desktop Hub session for Docker Hub registry credentials by @Benehiko in #14295

🐛 Fixes

Fix(bridge): reject --dry-run on bridge commands by @glours in #14307
Fix(up): don't report a cancelled or expired wait on an optional dependency as skipped by @ndeloof in #14309
Fix(logs): relay each line of a restarted container exactly once by @ndeloof in #14314
Fix(bake): grant permissions for configured build inputs by @crazy-max in #14325
Fix(watch): skip sync+exec triggers on bind-mounted paths by @glours in #14328
Fix: pre_start hooks receive the service env_file and environment by @ndeloof in #14293
Fix: keep the image pull of compose run inside the run progress block by @ndeloof in #14294
Fix: do not execute providers and models in dry-run mode by @glours in #14334
Fix(build): read bake's stderr to the end before waiting for it by @ndeloof in #14335
Fix(executor): a wait node holds no --parallel slot while it polls by @ndeloof in #14303
Fix(pre_start): capture a hook's output by opening its log stream once started by @ndeloof in #14353
Fix(run): keep a recreated dependency's anonymous volumes by @htoyoda18 in #14358
Fix(watch): ignore .git at any depth inside the watched path by @htoyoda18 in #14363
Fix(executor): report the services a failed start interrupts by @ndeloof in #14376
Fix(monitor): subscribe to events since before the initial listing by @ndeloof in #14304
Fix(compose): skip the lowered-environment allocation in envResolverWithCase by @TDnorthgarden in #14390
Fix(projectloader): unescape service names in unsupported attribute warnings by @Huang-404-Q in #14380
Fix(down): keep a volume the project does not own on down -v by @htoyoda18 in #14374
Fix(start): give a started use_api_socket service its config file by @ndeloof in #14393
Fix(up): honor -t when an attached up stops the application by @htoyoda18 in #14395
Fix(up): check a depends_on condition before the first poll tick by @htoyoda18 in #14385
Fix(watch): recognize bind-mounted paths starting with two dots by @ahbaqdadi in #14425
Fix(use_api_socket): harden the credentials handed to the service by @ndeloof in #14402

🔧 Internal

Executor: run start-phase operations (epic #14081, lot 1) by @ndeloof in #14274
Api: DownOptions.Images becomes a typed ImagePruneMode, validated upfront by @ndeloof in #14149
Api: reject incompatible Up options with a typed error by @ndeloof in #14306
Refactor: split create() into preparePlan + execute by @ndeloof in #14289
Refactor(executor): let a caller drive the create and start phases itself by @ndeloof in #14302
Refactor(api): split Compose into focused interfaces by @ndeloof in #14322
Refactor(compose): move mutable package-level state into composeService by @ndeloof in #14323
Refactor(up): inject the navigation menu instead of importing cmd/formatter by @ndeloof in #14324
Refactor: extract inspect and projectloader from pkg/compose into internal packages by @ndeloof in #14331
Refactor: move the provider relay and plugin execution to internal/relay and internal/provider by @ndeloof in #14333
Refactor(executor): hand the hook-log listener to runStart only by @ndeloof in #14392
Refactor: move exec, cp, export and commit to internal/containerops by @ndeloof in #14397
Refactor: move the config-hash helpers to internal/confighash by @ndeloof in #14405
Refactor: add internal/concurrency for the bounded errgroup helpers by @ndeloof in #14422
Refactor: remove the helpers duplicated across pkg/compose and the internal packages by @ndeloof in #14424
Docs(compose): drop the comments that still describe the deleted imperative start path by @ndeloof in #14398
Docs(compose): correct what the startMx comment says about #12846 by @ndeloof in #14399
Refactor(compose): drop the timeout parameter of waitDependencies by @ndeloof in #14400
Refactor(compose): move the dependency wait helpers to their own file by @ndeloof in #14401
Ci: run unit tests with -race, pin test tooling, add a ci-ok aggregate check by @ndeloof in #14321
Go.mod: keep go patch version at lowest possible by @thaJeztah in #14347
Build(lint): bump golangci-lint to v2.15.0 and fix its new findings by @ndeloof in #14418
Test(e2e): lock the behavior of the foreground up by @ndeloof in #14300
Test(formatter): keep escape sequences out of the go test output by @htoyoda18 in #14351
Docs: remove broken CONTRIBUTING.md link by @DaneHarrison in #14251

⚙️ Dependencies

Build(deps): golang.org/x/net v0.60.0 (security) by @thaJeztah in #14316
Chore(deps): bump github.com/containerd/containerd/v2 v2.4.2 (security) by @thaJeztah in #14339
Update to go1.26.9 (security) by @thaJeztah in #14315
Update to go1.26.10 (security) by @thaJeztah in #14366
Build(deps): bump github.com/mattn/go-shellwords from 1.0.15 to 1.0.16 by @dependabot[bot] in #14320
Build(deps): bump github.com/docker/cli from 29.8.2+incompatible to 29.9.0+incompatible by @dependabot[bot] in #14319
Build(deps): bump github.com/moby/moby/client from 0.6.1 to 0.6.2 by @dependabot[bot] in #14318
Build(deps): bump github.com/docker/secrets-engine/x from 0.8.2 to 0.8.3 by @dependabot[bot] in #14301
Build(deps): bump secrets-engine client to v0.2.0 by @Benehiko in #14327
Build(deps): bump secrets-engine/client to v0.2.2 by @Benehiko in #14361
Build(deps): bump github.com/Microsoft/go-winio from 0.6.3-0.20251027160822-ad3df93bed29 to 0.6.3 by @dependabot[bot] in #14330
Build(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0 by @dependabot[bot] in #14329
Build(deps): bump github.com/mattn/go-runewidth from 0.0.30 to 0.0.31 by @dependabot[bot] in #14348
Build(deps): bump github.com/docker/cli from 29.9.0+incompatible to 29.9.1+incompatible by @dependabot[bot] in #14349
Build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #14343
Build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #14344
Build(deps): bump github/codeql-action/upload-sarif from 4.38.2 to 4.38.3 by @dependabot[bot] in #14350
Build(deps): bump golang.org/x/sys from 0.48.0 to 0.49.0 by @dependabot[bot] in #14338
Build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 by @dependabot[bot] in #14360
Build(deps): bump docker/bake-action from 7.4.0 to 7.5.0 in the docker-actions group by @dependabot[bot] in #14371
Build(deps): bump github.com/docker/cli from 29.9.1+incompatible to 29.9.2+incompatible by @dependabot[bot] in #14369
Build(deps): bump github.com/Microsoft/go-winio from 0.6.3 to 0.6.4 by @dependabot[bot] in #14368
Build(deps): bump the docker-actions group with 2 updates by @dependabot[bot] in #14389
Build(deps): bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0 by @dependabot[bot] in #14377
Build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.18.0 to 1.18.1 in the docker-actions group by @dependabot[bot] in #14415
Build(deps): bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 by @dependabot[bot] in #14416

New Contributors

@Benehiko made their first contribution in #14295
@DaneHarrison made their first contribution in #14251
@TDnorthgarden made their first contribution in #14390
@Huang-404-Q made their first contribution in #14380
@ahbaqdadi made their first contribution in #14425

Full Changelog: docker/compose@v5.6.1...v5.7.0

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2026-11-02T01:29:47Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: pilat/devbox
Branch: main
File: .coderabbit.yaml
Commit: 0177e6d
Layers: Repository YAML
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 44409b13-8364-41db-8700-30d87460c3f2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

renovate · 2026-11-10T21:43:58Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

3 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=24 hours

Details:

Package	Change
`go.yaml.in/yaml/v4`	`v4.0.0-rc.6` -> `v4.0.0`
`golang.org/x/sys`	`v0.49.0` -> `v0.50.0`
`google.golang.org/grpc`	`v1.84.0` -> `v1.85.0`

renovate Bot force-pushed the renovate/all-minor-patch branch from c48adaa to c441f34 Compare November 3, 2026 20:07

renovate Bot changed the title ~~fix(deps): update module golang.org/x/net to v0.62.0~~ fix(deps): update all non-major dependencies Nov 3, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 7610655 to 7294b7c Compare November 10, 2026 21:43

fix(deps): update all non-major dependencies

3f02e5b

renovate Bot force-pushed the renovate/all-minor-patch branch from 7294b7c to 3f02e5b Compare November 12, 2026 09:12

Navigation Menu

Repository navigation

fix(deps): update all non-major dependencies - #66

fix(deps): update all non-major dependencies#66
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Nov 2, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Nov 2, 2026 •

edited

Loading

Review skipped

Uh oh!

renovate Bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v29.9.3+incompatible

v5.7.1

What's Changed

Fixes 🐛

Internal 🔧

Bumps

New Contributors

v5.7.0

What's Changed

✨ Improvements

🐛 Fixes

🔧 Internal

⚙️ Dependencies

New Contributors

Configuration

Uh oh!

coderabbitai Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

renovate Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Nov 2, 2026 •

edited

Loading

`v29.9.3+incompatible`

`v5.7.1`

`v5.7.0`

coderabbitai Bot commented Nov 2, 2026 •

edited

Loading

renovate Bot commented Nov 10, 2026 •

edited

Loading