deps(docker): bump docker/docker v28.2.2 → v28.5.2 (GHSA-x4rx-4gw3-53p4, medium) - #2175
Merged
HongmingWang-Rabbit merged 1 commit intoApr 27, 2026
Merged
Conversation
Closes the medium-severity dependabot alert #7 on workspace-server's docker pin: "Moby firewalld reload makes published container ports accessible from remote hosts" — fixed in v28.3.3, pulling v28.5.2 (latest in the v28 line). Patch+minor bump within the v28 train; no client-API breaks (workspace-server only uses docker.Client for container exec / inspect, all stable since v20+). Verification: full workspace-server test suite passes (18/18 packages clean). Build clean. Out of scope: - Alerts #10 and #11 (the AuthZ bypass + plugin-priv off-by-one) require v29.3.1, which is not yet published to the Go module proxy (latest published is v28.5.2). They'll close in a follow-up PR once v29 lands as a Go module. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
requested a review
from hongmingwang-moleculeai
as a code owner
April 27, 2026 13:27
HongmingWang-Rabbit
enabled auto-merge
April 27, 2026 13:27
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Jun 12, 2026
core#2175 RCA established that A2A message delivery preserves the FULL
body on every agent-facing path — the long-believed "A2A truncation" was
a MISDIAGNOSIS. Only human-facing DISPLAY previews are capped (activity
title 80 runes, broadcast 120, delegation summary 80, canvas
response_preview 200 bytes).
Add a regression guard so a future change can't silently reintroduce real
truncation on the delivery paths:
- TestDequeueNext_PreservesFullBody_NoTruncation: the drain/read path
(DequeueNext → body::text) must return the enqueued body byte-for-byte
for a body well over the 200-byte largest preview cap.
- TestToolCheckTaskStatus_ReturnsFullResponseBody_NoTruncation: the
check_task_status agent-facing path (extractA2AText over the full
response_body) must surface the complete response text.
- TestExtractA2AText_FullBodyNoCap: focused extractor guard, both A2A
response shapes, no length cap.
Bodies are >200 chars so any display cap wired into a delivery path fails
loudly. sqlmock style matching sibling a2a_queue/mcp_tools tests; CI's
real-PG arm additionally exercises the live body::text round-trip.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Jun 12, 2026
… silent truncation' (#2176) from test/2175-a2a-full-body-delivery-guard into main
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes dependabot alert #7 (medium): Moby firewalld reload makes published container ports accessible from remote hosts (GHSA-x4rx-4gw3-53p4).
Change
Patch+minor bump within the v28 train. workspace-server only uses
docker.Clientfor container exec / inspect, all stable since v20+.Verification
go build ./...cleango test ./...passes across all 18 workspace-server packagesgo.sumshrunk by 32 lines (transitive cleanup fromgo mod tidy)Out of scope
Alerts #10 and #11 (AuthZ bypass + plugin-priv off-by-one) require v29.3.1+, which is not yet published to the Go module proxy —
go list -m -versions github.com/docker/dockershows v28.5.2 as the latest. Those will close in a follow-up PR once docker tags v29 as a Go module.🤖 Generated with Claude Code