Skip to content

chore(deps): update dependency alexellis/arkade to v0.11.86#19524

Merged
github-actions[bot] merged 1 commit into
mainfrom
renovate/alexellis-arkade-0.11.x
Mar 6, 2026
Merged

chore(deps): update dependency alexellis/arkade to v0.11.86#19524
github-actions[bot] merged 1 commit into
mainfrom
renovate/alexellis-arkade-0.11.x

Conversation

@uniget-bot
Copy link
Copy Markdown

This PR contains the following updates:

Package Update Change
alexellis/arkade patch 0.11.850.11.86

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

alexellis/arkade (alexellis/arkade)

v0.11.86: Quick shortcut for superterm

Compare Source

Changelog for 0.11.86:

Commits
c64d57a Quick shortcut for superterm by @​alexellis

Changes: alexellis/arkade@0.11.85...0.11.86

Generated by Derek


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

Copy link
Copy Markdown

@nicholasdille-bot nicholasdille-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auto-approved because label type/renovate is present.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 6, 2026

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/arkade:0.11.86

📦 Image Reference ghcr.io/uniget-org/tools/arkade:0.11.86
digestsha256:3be56e47e8e2514c2733446ecb2b2b10c105caa8c2e27154f1cabf57cf7a4226
vulnerabilitiescritical: 0 high: 1 medium: 0 low: 0
platformlinux/amd64
size5.1 MB
packages41
critical: 0 high: 1 medium: 0 low: 0 github.com/docker/cli 29.0.3+incompatible (golang)

pkg:golang/github.com/docker/cli@29.0.3+incompatible

high 7.0: CVE--2025--15558 Uncontrolled Search Path Element

Affected range>=19.03.0
<29.2.0
Fixed version29.2.0
CVSS Score7
CVSS VectorCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description

This issue affects Docker CLI through 29.1.5

Impact

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user.

This issue affects Docker CLI through v29.1.5 (fixed in v29.2.0). It impacts Windows binaries acting as a CLI plugin manager via the github.com/docker/cli/cli-plugins/manager package, which is consumed by downstream projects such as Docker Compose.

Docker Compose became affected starting in v2.31.0, when it incorporated the relevant CLI plugin manager code (see docker/compose#12300), and is fixed in v5.1.0.

This issue does not impact non-Windows binaries or projects that do not use the plugin manager code.

Patches

Fixed version starts with 29.2.0

This issue was fixed in docker/cli@1375933 (docker/cli#6713), which removed %PROGRAMDATA%\Docker\cli-plugins from the list of paths used for plugin-discovery on Windows.

Workarounds

None

Resources

Credits

Nitesh Surana (niteshsurana.com) of Trend Research of TrendAI

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 6, 2026

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 6, 2026

@github-actions github-actions Bot merged commit 200b8c3 into main Mar 6, 2026
9 of 10 checks passed
@github-actions github-actions Bot deleted the renovate/alexellis-arkade-0.11.x branch March 6, 2026 02:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment