build(deps): bump github.com/docker/cli from 24.0.7+incompatible to 29.2.0+incompatible - #572
Conversation
Bumps [github.com/docker/cli](https://github.com/docker/cli) from 24.0.7+incompatible to 29.2.0+incompatible. - [Commits](docker/cli@v24.0.7...v29.2.0) --- updated-dependencies: - dependency-name: github.com/docker/cli dependency-version: 29.2.0+incompatible dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 39e460e. Configure here.
| github.com/distribution/reference v0.6.0 | ||
| github.com/docker/buildx v0.10.3 | ||
| github.com/docker/cli v24.0.7+incompatible | ||
| github.com/docker/cli v29.2.0+incompatible |
There was a problem hiding this comment.
Incompatible docker/cli and docker skew
High Severity
Bumping github.com/docker/cli to v29 while leaving github.com/docker/docker at v24 (and buildx at 0.10.3) mixes two client stacks. Cli v29’s command.Cli is built on moby/moby/client/api, but this repo and vendored buildx still call dockerCli.Client() and related APIs as docker/docker types, so plugin init, bake/build client wiring, and TLS bootstrap in pkg/docker can fail at link time or misbehave at runtime.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 39e460e. Configure here.
There was a problem hiding this comment.
Risk: high. Left a non-blocking comment; human review is needed and no reviewers were assigned. Cursor Bugbot reported an unresolved high-severity docker/cli vs docker version-skew finding, and the Bugbot check did not complete successfully.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Bumps github.com/docker/cli from 24.0.7+incompatible to 29.2.0+incompatible.
Commits
0b9d198Merge pull request #6764 from vvoland/update-docker9c9ec73vendor: github.com/moby/moby/client v0.2.2bab3e81vendor: github.com/moby/moby/api v1.53.02e64fc1Merge pull request #6367 from thaJeztah/template_slicejoin1f2ba2aMerge pull request #6760 from thaJeztah/container_create_fix_errore34a342templates: make "join" work with non-string slices and map valuesa86356dMerge pull request #6763 from thaJeztah/bump_mapstructure771660avendor: github.com/go-viper/mapstructure/v2 v2.5.09cff36bMerge pull request #6762 from thaJeztah/bump_x_deps08ed2bccli/command/container: make injecting config.json failures a warningDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
High Risk
Major jump of docker/cli (24 → 29) used for Docker plugin/CLI integration can break plugin APIs and daemon compatibility despite no source changes.
Overview
Dependabot upgrades
github.com/docker/clifrom24.0.7+incompatibleto29.2.0+incompatible. There are no application source changes.The bump also refreshes related modules (
distribution/reference,go-connections,image-spec, OpenTelemetry, gRPC, golang.org/x/*) and drops older notary/prometheus-style transitives in favor of newer Moby client/API packages.docker/cliis imported for Docker plugin and CLI plumbing (cli-plugins,cli/command, config).github.com/docker/dockerstays on the existing v24 replace. Review plugin compatibility and the existingDOCKER_API_VERSION=1.44pin.Reviewed by Cursor Bugbot for commit 39e460e. Bugbot is set up for automated code reviews on this repo. Configure here.