all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe5f:e21e
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 356bc6e1-eddb-4385-b241-ede9ed340fc6
        host_id: d2c528664e1bd332192bb574345deb0c6c7158061222e4a6c036b5ef
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe5f:e21e
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.0.109
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.113
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe5f:e21e
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job python-black explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#54>'
      - '<Job python-black explicit: None implied: None source: osism/release/.zuul.yaml@main#2>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: bbba6d51ddca498fa38f67e4424b673d
      build_refs:
      - branch: main
        change: '1807'
        change_message: "chore(deps): update dependency moby/moby to v28\n\nThis PR
          contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
          [moby/moby](https://redirect.github.com/moby/moby) | major | `5:27.5.1`
          -> `v28.1.1` |\n| [moby/moby](https://redirect.github.com/moby/moby) | major
          | `27.5.1` -> `28.1.1` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>moby/moby
          (moby/moby)</summary>\n\n### [`v28.1.1`](https://redirect.github.com/moby/moby/releases/tag/v28.1.1)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.1.0...v28.1.1)\n\n#####
          28.1.1\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.1.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.1)\n-
          \  [moby/moby, 28.1.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.1)\n\n#####
          Bug fixes and enhancements\n\n-   Fix `dockerd-rootless-setuptool.sh` incorrectly
          reporting missing `iptables`. [moby/moby#49833](https://redirect.github.com/moby/moby/pull/49833)\n-
          \  containerd image store: Fix a potential daemon crash when using `docker
          load` with archives containing zero-size tar headers. [moby/moby#49837](https://redirect.github.com/moby/moby/pull/49837)\n\n#####
          Packaging updates\n\n-   Update Buildx to [v0.23.0](https://redirect.github.com/docker/buildx/releases/tag/v0.23.0).
          [docker/docker-ce-packaging#1185](https://redirect.github.com/docker/docker-ce-packaging/pull/1185)\n-
          \  Update Compose to [v2.35.1](https://redirect.github.com/docker/compose/releases/tag/v2.35.1).
          [docker/docker-ce-packaging#1188](https://redirect.github.com/docker/docker-ce-packaging/pull/1188)\n\n#####
          Networking\n\n-   Add a warning to a container's `/etc/resolv.conf` when
          no upstream DNS servers were found. [moby/moby#49827](https://redirect.github.com/moby/moby/pull/49827)\n\n###
          [`v28.1.0`](https://redirect.github.com/moby/moby/releases/tag/v28.1.0)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.4...v28.1.0)\n\n#####
          28.1.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.1.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
          \  [moby/moby, 28.1.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
          \  Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.1.0/docs/api/version-history.md).\n\n#####
          New\n\n-   Add `docker bake` sub-command as alias for `docker buildx bake`.
          [docker/cli#5947](https://redirect.github.com/docker/cli/pull/5947)\n-   Experimental:
          add a new `--use-api-socket` flag on `docker run` and `docker create` to
          enable access to Docker socket from inside a container and to share credentials
          from the host with the container. [docker/cli#5858](https://redirect.github.com/docker/cli/pull/5858)\n-
          \  `docker image inspect` now supports a `--platform` flag to inspect a
          specific platform of a multi-platform image. [docker/cli#5934](https://redirect.github.com/docker/cli/pull/5934)\n\n#####
          Bug fixes and enhancements\n\n-   Add CLI shell-completion for context names.
          [docker/cli#6016](https://redirect.github.com/docker/cli/pull/6016)\n-   Fix
          `docker images --tree` not including non-container images content size in
          the total image content size. [docker/cli#6000](https://redirect.github.com/docker/cli/pull/6000)\n-
          \  Fix `docker load` not preserving replaced images. [moby/moby#49650](https://redirect.github.com/moby/moby/pull/49650)\n-
          \  Fix `docker login` hints when logging in to a custom registry. [docker/cli#6015](https://redirect.github.com/docker/cli/pull/6015)\n-
          \  Fix `docker stats` not working properly on machines with high CPU core
          count. [moby/moby#49734](https://redirect.github.com/moby/moby/pull/49734)\n-
          \  Fix a regression causing `docker pull/push` to fail when interacting
          with a private repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n-
          \  Fix an issue preventing rootless Docker setup on a host with no `ip_tables`
          kernel module. [moby/moby#49727](https://redirect.github.com/moby/moby/pull/49727)\n-
          \  Fix an issue that could lead to unwanted iptables rules being restored
          and never deleted following a firewalld reload. [moby/moby#49728](https://redirect.github.com/moby/moby/pull/49728)\n-
          \  Improve CLI completion of `docker service scale`. [docker/cli#5968](https://redirect.github.com/docker/cli/pull/5968)\n-
          \  `docker images --tree` now hides both untagged and dangling images by
          default. [docker/cli#5924](https://redirect.github.com/docker/cli/pull/5924)\n-
          \  `docker system info` will provide an exit code if a connection cannot
          be established to the Docker daemon. [docker/cli#5918](https://redirect.github.com/docker/cli/pull/5918)\n-
          \  containerd image store: Fix `image tag` event not being emitted when
          building with BuildKit. [moby/moby#49678](https://redirect.github.com/moby/moby/pull/49678)\n-
          \  containerd image store: Improve `docker push/pull` handling of remote
          registry errors. [moby/moby#49770](https://redirect.github.com/moby/moby/pull/49770)\n-
          \  containerd image store: Show pull progress for non-layer image blobs.
          [moby/moby#49746](https://redirect.github.com/moby/moby/pull/49746)\n\n#####
          Packaging updates\n\n-   Add Debian \"Trixie\" packages. [docker/docker-ce-packaging#1181](https://redirect.github.com/docker/docker-ce-packaging/pull/1181)\n-
          \  Add Fedora 42 packages. [docker/containerd-packaging#418](https://redirect.github.com/docker/containerd-packaging/pull/418),
          [docker/docker-ce-packaging#1169](https://redirect.github.com/docker/docker-ce-packaging/pull/1169)\n-
          \  Add Ubuntu 25.04 \"Plucky Puffin\" packages. [docker/containerd-packaging#419](https://redirect.github.com/docker/containerd-packaging/pull/419),
          [docker/docker-ce-packaging#1177](https://redirect.github.com/docker/docker-ce-packaging/pull/1177)\n-
          \  Update BuildKit to [v0.21.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.21.0).
          [moby/moby#49809](https://redirect.github.com/moby/moby/pull/49809)\n-   Update
          Compose to [v2.35.0](https://redirect.github.com/docker/compose/releases/tag/v2.35.0).
          [docker/docker-ce-packaging#1183](https://redirect.github.com/docker/docker-ce-packaging/pull/1183)\n-
          \  Update Go runtime to [1.23.8](https://go.dev/doc/devel/release#go1.23.8).
          [docker/cli#5986](https://redirect.github.com/docker/cli/pull/5986), [docker/docker-ce-packaging#1180](https://redirect.github.com/docker/docker-ce-packaging/pull/1180),
          [moby/moby#49737](https://redirect.github.com/moby/moby/pull/49737)\n\n#####
          Networking\n\n-   Fix a bug causing host port-mappings on Swarm containers
          to be duplicated on `docker ps` and `docker inspect`. [moby/moby#49724](https://redirect.github.com/moby/moby/pull/49724)\n-
          \  Fix an issue that caused container network attachment to fail with error
          \"Bridge port not forwarding\". [moby/moby#49705](https://redirect.github.com/moby/moby/pull/49705)\n-
          \  Fix an issue with removal of a `--link` from a container in the default
          bridge network. [moby/moby#49778](https://redirect.github.com/moby/moby/pull/49778)\n-
          \  Improve how network-endpoint relationships are tracked to reduce the
          chance of the \"has active endpoints\" error to be wrongfully returned.
          [moby/moby#49736](https://redirect.github.com/moby/moby/pull/49736)\n-   Improve
          the \"has active endpoints\" error message by including the name of endpoints
          still connected to the network being deleted. [moby/moby#49773](https://redirect.github.com/moby/moby/pull/49773)\n\n#####
          API\n\n-   Update API version to [v1.49](https://docs.docker.com/engine/api/v1.49/).
          [moby/moby#49718](https://redirect.github.com/moby/moby/pull/49718)\n-   `GET
          /image/{name}/json` now supports a `platform` parameter allowing to specify
          which platform variant of a multi-platform image to inspect. [moby/moby#49586](https://redirect.github.com/moby/moby/pull/49586)\n-
          \  `GET /info` now returns a `FirewallBackend` containing information about
          the daemon's firewalling configuration. [moby/moby#49761](https://redirect.github.com/moby/moby/pull/49761)\n\n#####
          Go SDK\n\n-   Update minimum required Go version to go1.23. [docker/cli#5868](https://redirect.github.com/docker/cli/pull/5868)\n-
          \  cli/command/context: remove temporary `ContextType` field from JSON output.
          [docker/cli#5981](https://redirect.github.com/docker/cli/pull/5981)\n-   client:
          Keep image references in canonical format where possible. [moby/moby#49609](https://redirect.github.com/moby/moby/pull/49609)\n\n#####
          Deprecations\n\n-   API: Deprecated `AllowNondistributableArtifactsCIDRs`
          and `AllowNondistributableArtifactsHostnames` fields in the `RegistryConfig`
          struct in the `GET /info` response are omitted in API v1.49. [moby/moby#49749](https://redirect.github.com/moby/moby/pull/49749)\n-
          \  API: Deprecated: The `ContainerdCommit.Expected`, `RuncCommit.Expected`,
          and `InitCommit.Expected` fields in the `GET /info` endpoint were deprecated
          in API v1.48, and are now omitted in API v1.49. [moby/moby#48556](https://redirect.github.com/moby/moby/pull/48556)\n-
          \  Go-SDK: cli/command/image: Deprecate `RunPull`: this function was only
          used internally and will be removed in the next release. [docker/cli#5975](https://redirect.github.com/docker/cli/pull/5975)\n-
          \  Go-SDK: cli/config/configfile: deprecate `ConfigFile.Experimental` field.
          Experimental CLI features are always enabled since version v20.10 and this
          field is no longer used. Use `ConfigFile.Features` instead for optional
          features. This field will be removed in a future release. [docker/cli#5977](https://redirect.github.com/docker/cli/pull/5977)\n-
          \  Go-SDK: deprecate `pkg/archive`, which was migrated to `github.com/moby/go-archive`.
          [moby/moby#49743](https://redirect.github.com/moby/moby/pull/49743)\n-   Go-SDK:
          deprecate `pkg/atomicwriter`, which was migrated to `github.com/moby/sys/atomicwriter`.
          [moby/moby#49748](https://redirect.github.com/moby/moby/pull/49748)\n-   Go-SDK:
          opts: remove deprecated `PortOpt`, `ConfigOpt`, `SecretOpt` aliases. [docker/cli#5953](https://redirect.github.com/docker/cli/pull/5953)\n-
          \  Go-SDK: registry: deprecate `APIEndpoint.Official` field. [moby/moby#49706](https://redirect.github.com/moby/moby/pull/49706)\n\n###
          [`v28.0.4`](https://redirect.github.com/moby/moby/releases/tag/v28.0.4)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.3...v28.0.4)\n\n#####
          28.0.4\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.4 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.4)\n-
          \  [moby/moby, 28.0.4 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.4)\n\n#####
          Bug fixes and enhancements\n\n-   Fix a regression causing `docker pull/push`
          to fail when interacting with a private repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n\n###
          [`v28.0.3`](https://redirect.github.com/moby/moby/releases/tag/v28.0.3)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.2...v28.0.3)\n\n#####
          28.0.3\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.3 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.3)\n-
          \  [moby/moby, 28.0.3 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.3)\n\n#####
          Bug fixes and enhancements\n\n-   Fix `docker run` truncating the `STDOUT`/`STDERR`
          prematurely when the container exits before the data is consumed. [docker/cli#5957](https://redirect.github.com/docker/cli/pull/5957)\n\n#####
          Packaging updates\n\n-   Update BuildKit to [v0.20.2](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.2).
          [moby/moby#49698](https://redirect.github.com/moby/moby/pull/49698)\n-   Update
          `runc` to [v1.2.6](https://redirect.github.com/opencontainers/runc/releases/tag/v1.2.6)
          (static packages only). [moby/moby#49682](https://redirect.github.com/moby/moby/pull/49682)\n-
          \  Update containerd to [v1.7.26](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.26).
          [docker/containerd-packaging#409](https://redirect.github.com/docker/containerd-packaging/pull/409)\n\n###
          [`v28.0.2`](https://redirect.github.com/moby/moby/releases/tag/v28.0.2)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.1...v28.0.2)\n\n#####
          28.0.2\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.2 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.2)\n-
          \  [moby/moby, 28.0.2 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.2)\n\n#####
          Bug fixes and enhancements\n\n-   Fix CLI-specific attributes (`docker.cli.*`)
          being unintentionally passed to downstream OTel services. [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n-
          \  Fix an issue where user-specified `OTEL_RESOURCE_ATTRIBUTES` were being
          overridden by CLI's internal telemetry attributes. The CLI now properly
          merges user-specified attributes with internal ones, allowing both to coexist.
          [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n-   Fix
          daemon failing to start on Windows when a container created before v28.0.0
          was present. [moby/moby#49626](https://redirect.github.com/moby/moby/pull/49626)\n-
          \  Fix possible error on `docker buildx prune` with the `--min-free-space`.
          [moby/moby#49623](https://redirect.github.com/moby/moby/pull/49623)\n-   Fix
          spurious `io: read/write on closed pipe` error in the daemon log when closing
          container. [moby/moby#49590](https://redirect.github.com/moby/moby/pull/49590)\n-
          \  Fix the Docker daemon failing too early if the containerd socket isn't
          immediately available. [moby/moby#49603](https://redirect.github.com/moby/moby/pull/49603)\n-
          \  Mask Linux thermal interrupt info in a container's `/proc` and `/sys`
          by default. [moby/moby#49560](https://redirect.github.com/moby/moby/pull/49560)\n-
          \  Update `contrib/check-config.sh` to check for more kernel modules related
          to iptables. [moby/moby#49622](https://redirect.github.com/moby/moby/pull/49622)\n-
          \  containerd image store: Fix integer overflow in User ID handling passed
          via `--user`. [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n-
          \  containerd image store: Fix spurious `reference for unknown type: application/vnd.in-toto+json`
          warning being logged to the daemon's log. [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n-
          \  containerd image store: Improve performance of `docker ps` when running
          large number of containers. [moby/moby#49365](https://redirect.github.com/moby/moby/pull/49365)\n\n#####
          Packaging updates\n\n-   Update BuildKit to [v0.20.1](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.1).
          [moby/moby#49587](https://redirect.github.com/moby/moby/pull/49587)\n-   Update
          Buildx to [v0.22.0](https://redirect.github.com/docker/buildx/releases/tag/v0.22.0).
          [docker/docker-ce-packaging#1175](https://redirect.github.com/docker/docker-ce-packaging/pull/1175)\n-
          \  Update Compose to [v2.34.0](https://redirect.github.com/docker/compose/releases/tag/v2.34.0).
          [docker/docker-ce-packaging#1172](https://redirect.github.com/docker/docker-ce-packaging/pull/1172)\n-
          \  Update Go runtime to [1.23.7](https://go.dev/doc/devel/release#go1.23.7).
          [docker/cli#5890](https://redirect.github.com/docker/cli/pull/5890), [docker/docker-ce-packaging#1171](https://redirect.github.com/docker/docker-ce-packaging/pull/1171),
          [moby/moby#49580](https://redirect.github.com/moby/moby/pull/49580)\n-   Update
          RootlessKit to [v2.3.4](https://redirect.github.com/rootless-containers/rootlesskit/releases/tag/v2.3.4).
          [moby/moby#49614](https://redirect.github.com/moby/moby/pull/49614)\n-   Update
          containerd (static binaries only) to [v1.7.27](https://www.github.com/containerd/containerd/releases/tag/v1.7.27).
          [moby/moby#49656](https://redirect.github.com/moby/moby/pull/49656)\n\n#####
          Networking\n\n-   Add environment variable `DOCKER_INSECURE_NO_IPTABLES_RAW=1`
          to allow Docker to run on systems where the Linux kernel can't provide `CONFIG_IP_NF_RAW`
          support. When enabled, Docker will not create rules in the iptables `raw`
          table. Warning: This is not recommended for production environments as it
          reduces security by allowing other hosts on the local network to route to
          ports published to host addresses, even when they are published to `127.0.0.1.`
          This option bypasses some of the security hardening introduced in Docker
          Engine 28.0.0. [moby/moby#49621](https://redirect.github.com/moby/moby/pull/49621)\n-
          \  Allow container startup when an endpoint is attached to a macvlan network
          where the parent interface is down. [moby/moby#49630](https://redirect.github.com/moby/moby/pull/49630)\n-
          \  Do not skip DNAT for packets originating in a gateway_mode=routed network.
          [moby/moby#49577](https://redirect.github.com/moby/moby/pull/49577)\n-   Fix
          a bug causing `docker ps` to inconsistently report dual-stack port mappings.
          [moby/moby#49657](https://redirect.github.com/moby/moby/pull/49657)\n-   Fix
          a bug that could cause `docker-proxy` to stop forwarding UDP datagrams to
          containers. [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n-
          \  Fix a bug that was causing `docker-proxy` to close UDP connections to
          containers eagerly and resulting in the source address to change needlessly.
          [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n\n#####
          Go SDK\n\n-   Move various types and consts from `cli-plugins/manager` to
          a separate package. [docker/cli#5902](https://redirect.github.com/docker/cli/pull/5902)\n-
          \  Update minimum required Go version to go1.23. [moby/moby#49541](https://redirect.github.com/moby/moby/pull/49541)\n-
          \  `cli/command`: Move `PrettyPrint` utility to `cli/command/formatter`.
          [docker/cli#5916](https://redirect.github.com/docker/cli/pull/5916)\n-   runconfig/errors:
          split `ErrConflictHostNetwork` into `ErrConflictConnectToHostNetwork` and
          `ErrConflictDisconnectFromHostNetwork`. [moby/moby#49605](https://redirect.github.com/moby/moby/pull/49605)\n\n#####
          Deprecations\n\n-   Go-SDK: Deprecate `cli-plugins/manager.ResourceAttributesEnvvar`
          constant. It was used internally, but holds the `OTEL_RESOURCE_ATTRIBUTES`
          name, which is part of the OpenTelemetry specification. Users of this constant
          should define their own. It will be removed in the next release. [docker/cli#5881](https://redirect.github.com/docker/cli/pull/5881)\n-
          \  Go-SDK: Deprecate `opts.PortOpt`, `opts.ConfigOpt` and `opts.SecretOpt`.
          These types were moved to the `opts/swarmopts` package. [docker/cli#5907](https://redirect.github.com/docker/cli/pull/5907)\n-
          \  Go-SDK: Remove `service/logs` package. [docker/cli#5910](https://redirect.github.com/docker/cli/pull/5910)\n-
          \  Go-SDK: `cli/command/image`: Deprecate `PushTrustedReference` and move
          to `cli/trust`. [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-
          \  Go-SDK: `cli/command/image`: Deprecate and internalize `TrustedPush`.
          [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-   Go-SDK:
          `cli/command`: deprecate `Cli.NotaryClient`: use [`trust.GetNotaryRepository`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/trust#GetNotaryRepository)
          instead. This method is no longer used and will be removed in the next release.
          [docker/cli#5885](https://redirect.github.com/docker/cli/pull/5885)\n-   Go-SDK:
          `cli/command`: deprecate `Cli.RegistryClient`. This method was only used
          internally and will be removed in the next release. Use [`client.NewRegistryClient`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/registry/client#NewRegistryClient)
          instead. [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889),
          [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889)\n-   Go-SDK:
          `registry`: Deprecate `RepositoryInfo.Official` field. [moby/moby#49567](https://redirect.github.com/moby/moby/pull/49567)\n-
          \  Go-SDK: `registry`: deprecate `HostCertsDir`: this function was only
          used internally and will be removed in the next release. [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n-
          \  Go-SDK: `registry`: deprecate `SetCertsDir`: the cert-directory is now
          automatically selected when running with RootlessKit, and should no longer
          be set manually. [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n\n###
          [`v28.0.1`](https://redirect.github.com/moby/moby/releases/tag/v28.0.1)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.0...v28.0.1)\n\n#####
          28.0.1\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.1)\n-
          \  [moby/moby, 28.0.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.1)\n\n#####
          Networking\n\n-   Remove dependency on kernel modules `ip_set`, `ip_set_hash_net`
          and `netfilter_xt_set`.\n    -   The dependency was introduced in release
          28.0.0 but proved too disruptive. The iptables rules using these modules
          have been replaced. [moby/moby#49530](https://redirect.github.com/moby/moby/pull/49530)\n-
          \  Allow daemon startup on a host with IPv6 disabled without requiring `--ip6tables=false`.
          [moby/moby#49525](https://redirect.github.com/moby/moby/pull/49525)\n-   Fix
          a bug that was causing containers with `--restart=always` and a published
          port already in use to restart in a tight loop. [moby/moby#49507](https://redirect.github.com/moby/moby/pull/49507)\n-
          \  Fix an issue with Swarm ingress, caused by incorrect ordering of iptables
          rules. [moby/moby#49538](https://redirect.github.com/moby/moby/pull/49538)\n-
          \  Fix creation of a swarm-scoped network from a `--config-only` network.
          [moby/moby#49521](https://redirect.github.com/moby/moby/pull/49521)\n-   Fix
          `docker network inspect` reporting an IPv6 gateway with CIDR suffix for
          a newly created network with no specific IPAM config, until a daemon restart.
          [moby/moby#49520](https://redirect.github.com/moby/moby/pull/49520)\n-   Improve
          the error reported when kernel modules `ip_set`, `ip_set_hash_net` and `netilter_xt_set`
          are not available. [moby/moby#49524](https://redirect.github.com/moby/moby/pull/49524)\n-
          \  Move most of Docker's iptables rules out of the filter-FORWARD chain,
          so that other applications are free to append rules that must follow Docker's
          rules. [moby/moby#49518](https://redirect.github.com/moby/moby/pull/49518)\n-
          \  Update `--help` output and man page lo state which options only apply
          to the default bridge network. [moby/moby#49522](https://redirect.github.com/moby/moby/pull/49522)\n\n#####
          Bug fixes and enhancements\n\n-   Fix `docker context create` always returning
          an error when using the `\"skip-tls-verify\"` option. [docker/cli#5850](https://redirect.github.com/docker/cli/pull/5850)\n-
          \  Fix shell completion suggesting IDs instead of names for services and
          nodes. [docker/cli#5848](https://redirect.github.com/docker/cli/pull/5848)\n-
          \  Fix unintentionally printing exit status to standard error output when
          `docker exec/run` returns a non-zero status. [docker/cli#5854](https://redirect.github.com/docker/cli/pull/5854)\n-
          \  Fix regression `protocol \"tcp\" is not supported by the RootlessKit
          port driver \"slirp4netns\"`. [moby/moby#49514](https://redirect.github.com/moby/moby/pull/49514)\n-
          \  containerd image store: Fix `docker inspect` not being able to show multi-platform
          images with missing layers for all platforms. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
          \  containerd image store: Fix `docker images --tree` reporting wrong content
          size. [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n-
          \  Fix compilation on i386 [moby/moby#49526](https://redirect.github.com/moby/moby/pull/49526)\n\n#####
          Packaging updates\n\n-   Update `github.com/go-jose/go-jose/v4` to v4.0.5
          to address. [GHSA-c6gw-w398-hv78](https://redirect.github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78)
          / [CVE-2025-27144](https://www.cve.org/CVERecord?id=CVE-2025-27144) [docker/cli#5867](https://redirect.github.com/docker/cli/pull/5867)\n-
          \  Update Buildx to [v0.21.1](https://redirect.github.com/docker/buildx/releases/tag/v0.21.1).
          [docker/docker-ce-packaging#1167](https://redirect.github.com/docker/docker-ce-packaging/pull/1167)\n-
          \  Update Compose to [v2.33.1](https://redirect.github.com/docker/compose/releases/tag/v2.33.1).
          [docker/docker-ce-packaging#1168](https://redirect.github.com/docker/docker-ce-packaging/pull/1168)\n\n#####
          API\n\n-   containerd image store: Fix `GET /images/json?manifests=1` not
          filling `Manifests` for index-only images. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
          \  containerd image store: Fix `GET /images/json and /images/<name>/json`
          `Size.Content` field including the size of content that's not available
          locally. [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n\n###
          [`v28.0.0`](https://redirect.github.com/moby/moby/releases/tag/v28.0.0)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v27.5.1...v28.0.0)\n\n#####
          28.0.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
          \  [moby/moby, 28.0.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
          \  Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.0.0/docs/deprecated.md).\n-
          \  Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.0.0/docs/api/version-history.md).\n\n#####
          New\n\n-   Add ability to mount an image inside a container via `--mount
          type=image`. [moby/moby#48798](https://redirect.github.com/moby/moby/pull/48798)\n
          \   -   You can also specify `--mount type=image,image-subpath=[subpath],...`
          option to mount a specific path from the image. [docker/cli#5755](https://redirect.github.com/docker/cli/pull/5755)\n-
          \  `docker images --tree` now shows metadata badges. [docker/cli#5744](https://redirect.github.com/docker/cli/pull/5744)\n-
          \  `docker load`, `docker save`, and `docker history` now support a `--platform`
          flag allowing you to choose a specific platform for single-platform operations
          on multi-platform images. [docker/cli#5331](https://redirect.github.com/docker/cli/pull/5331)\n-
          \  Add `OOMScoreAdj` to `docker service create` and `docker stack`. [docker/cli#5145](https://redirect.github.com/docker/cli/pull/5145)\n-
          \  `docker buildx prune` now supports `reserved-space`, `max-used-space`,
          `min-free-space` and `keep-bytes` filters. [moby/moby#48720](https://redirect.github.com/moby/moby/pull/48720)\n-
          \  Windows: Add support for running containerd as a child process of the
          daemon, instead of using a system-installed containerd. [moby/moby#47955](https://redirect.github.com/moby/moby/pull/47955)\n\n#####
          Networking\n\n-   The `docker-proxy` binary has been updated, older versions
          will not work with the updated `dockerd`. [moby/moby#48132](https://redirect.github.com/moby/moby/pull/48132)\n
          \   -   Close a window in which the userland proxy (`docker-proxy`) could
          accept TCP connections, that would then fail after `iptables` NAT rules
          were set up.\n    -   The executable `rootlesskit-docker-proxy` is no longer
          used, it has been removed from the build and distribution.\n-   DNS nameservers
          read from the host's `/etc/resolv.conf` are now always accessed from the
          host's network namespace. [moby/moby#48290](https://redirect.github.com/moby/moby/pull/48290)\n
          \   -   When the host's `/etc/resolv.conf` contains no nameservers and there
          are no `--dns` overrides, Google's DNS servers are no longer used, apart
          from by the default bridge network and in build containers.\n-   Container
          interfaces in bridge and macvlan networks now use randomly generated MAC
          addresses. [moby/moby#48808](https://redirect.github.com/moby/moby/pull/48808)\n
          \   -   Gratuitous ARP / Neighbour Advertisement messages will be sent when
          the interfaces are started so that, when IP addresses are reused, they're
          associated with the newly generated MAC address.\n    -   IPv6 addresses
          in the default bridge network are now IPAM-assigned, rather than being derived
          from the MAC address.\n-   The deprecated OCI `prestart` hook is now only
          used by build containers. For other containers, network interfaces are added
          to the network namespace after task creation is complete, before the container
          task is started. [moby/moby#47406](https://redirect.github.com/moby/moby/pull/47406)\n-
          \  Add a new `gw-priority` option to `docker run`, `docker container create`,
          and `docker network connect`. This option will be used by the Engine to
          determine which network provides the default gateway for a container. On
          `docker run`, this option is only available through the extended `--network`
          syntax. [docker/cli#5664](https://redirect.github.com/docker/cli/pull/5664)\n-
          \  Add a new netlabel `com.docker.network.endpoint.ifname` to customize
          the interface name used when connecting a container to a network. It's supported
          by all built-in network drivers on Linux. [moby/moby#49155](https://redirect.github.com/moby/moby/pull/49155)\n
          \   -   When a container is created with multiple networks specified, there's
          no guarantee on the order networks will be connected to the container. So,
          if a custom interface name uses the same prefix as the auto-generated names,
          for example `eth`, the container might fail to start.\n    -   The recommended
          practice is to use a different prefix, for example `en0`, or a numerical
          suffix high enough to never collide, for example `eth100`.\n    -   This
          label can be specified on `docker network connect` via the `--driver-opt`
          flag, for example `docker network connect --driver-opt=com.docker.network.endpoint.ifname=foobar
          \u2026`.\n    -   Or via the long-form `--network` flag on `docker run`,
          for example `docker run --network=name=bridge,driver-opt=com.docker.network.endpoint.ifname=foobar
          \u2026`\n-   If a custom network driver reports capability `GwAllocChecker`
          then, before a network is created, it will get a `GwAllocCheckerRequest`
          with the network's options. The custom driver may then reply that no gateway
          IP address should be allocated. [moby/moby#49372](https://redirect.github.com/moby/moby/pull/49372)\n\n#####
          Port publishing in bridge networks\n\n-   `dockerd` now requires `ipset`
          support in the Linux kernel. [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n
          \   -   The `iptables` and `ip6tables` rules used to implement port publishing
          and network isolation have been extensively modified. This enables some
          of the following functional changes, and is a first step in refactoring
          to enable native `nftables` support in a future release. [moby/moby#48815](https://redirect.github.com/moby/moby/issues/48815)\n
          \   -   If it becomes necessary to downgrade to an earlier version of the
          daemon, some manual cleanup of the new rules will be necessary. The simplest
          and surest approach is to reboot the host, or use `iptables -F` and `ip6tables
          -F` to flush all existing `iptables` rules from the `filter` table before
          starting the older version of the daemon. When that is not possible, run
          the following commands as root:\n        -   `iptables -D FORWARD -m set
          --match-set docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED
          -j ACCEPT; ip6tables -D FORWARD -m set --match-set docker-ext-bridges-v6
          dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT`\n        -   `iptables
          -D FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER; ip6tables
          -D FORWARD -m set --match-set docker-ext-bridges-v6 dst -j DOCKER`\n        -
          \  If you were previously running with the iptables filter-FORWARD policy
          set to `ACCEPT` and need to restore access to unpublished ports, also delete
          per-bridge-network rules from the `DOCKER` chains. For example, `iptables
          -D DOCKER ! -i docker0 -o docker0 -j DROP`.\n-   Fix a security issue that
          was allowing remote hosts to connect directly to a container on its published
          ports. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
          \  Fix a security issue that was allowing neighbor hosts to connect to ports
          mapped on a loopback address. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
          \  Fix an issue that prevented port publishing to link-local addresses.
          [moby/moby#48570](https://redirect.github.com/moby/moby/pull/48570)\n-   UDP
          ports published by a container are now reliably accessible by containers
          on other networks, via the host's public IP address. [moby/moby#48571](https://redirect.github.com/moby/moby/pull/48571)\n-
          \  Docker will now only set the `ip6tables` policy for the `FORWARD` chain
          in the `filter` table to `DROP` if it enables IP forwarding on the host
          itself (sysctls `net.ipv6.conf.all.forwarding` and `net.ipv6.conf.default.forwarding`).
          This is now aligned with existing IPv4 behaviour. [moby/moby#48594](https://redirect.github.com/moby/moby/pull/48594)\n
          \   -   If IPv6 forwarding is enabled on your host, but you were depending
          on Docker to set the ip6tables filter-FORWARD policy to `DROP`, you may
          need to update your host's configuration to make sure it is secure.\n-   Direct
          routed access to container ports that are not exposed using `p`/`-publish`
          is now blocked in the `DOCKER` iptables chain. [moby/moby#48724](https://redirect.github.com/moby/moby/pull/48724)\n
          \   -   If the default iptables filter-FORWARD policy was previously left
          at `ACCEPT` on your host, and direct routed access to a container's unpublished
          ports from a remote host is still required, options are:\n        -   Publish
          the ports you need.\n        -   Use the new `gateway_mode_ipv[46]=nat-unprotected`,
          described below.\n    -   Container ports published to host addresses will
          continue to be accessible via those host addresses, using NAT or the userland
          proxy.\n    -   Unpublished container ports continue to be directly accessible
          from the Docker host via the container's IP address.\n-   Networks created
          with `gateway_mode_ipv[46]=routed` are now accessible from other bridge
          networks running on the same Docker host, as well as from outside the host.
          [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n-   Bridge
          driver options `com.docker.network.bridge.gateway_mode_ipv4` and `com.docker.network.bridge.gateway_mode_ipv6`
          now accept mode `nat-unprotected`. [moby/moby#48597](https://redirect.github.com/moby/moby/pull/48597)\n
          \   -   `nat-unprotected` is similar to the default `nat` mode, but no per
          port/protocol rules are set up. This means any port on a container can be
          accessed by direct-routing from a remote host.\n-   Bridge driver options
          `com.docker.network.bridge.gateway_mode_ipv4` and `com.docker.network.bridge.gateway_mode_ipv6`
          now accept mode `isolated`, when the network is also `internal`. [moby/moby#49262](https://redirect.github.com/moby/moby/pull/49262)\n
          \   -   An address is normally assigned to the bridge device in an `internal`
          network. So, processes on the Docker host can access the network, and containers
          in the network can access host services listening on that bridge address
          (including services listening on \"any\" host address, `0.0.0.0` or `::`).\n
          \   -   An `internal` bridge network created with gateway mode `isolated`
          does not have an address on the Docker host.\n-   When a port mapping includes
          a host IP address or port number that cannot be used because NAT from the
          host is disabled using `--gateway_mode_ipv[46]`, container creation will
          no longer fail. The unused fields may be needed if the gateway endpoint
          changes when networks are connected or disconnected. A message about the
          unused fields will be logged. [moby/moby#48575](https://redirect.github.com/moby/moby/pull/48575)\n-
          \  Do not create iptables nat-POSTROUTING masquerade rules for a container's
          own published ports, when the userland proxy is enabled. [moby/moby#48854](https://redirect.github.com/moby/moby/pull/48854)\n\n#####
          IPv6\n\n-   Add `docker network create` option `--ipv4`. To disable IPv4
          address assignment for a network, use `docker network create --ipv4=false
          [...]`. [docker/cli#5599](https://redirect.github.com/docker/cli/pull/5599)\n-
          \  Daemon option `--ipv6` (`\"ipv6\": true` in `daemon.json`) can now be
          used without `fixed-cidr-v6`. [moby/moby#48319](https://redirect.github.com/moby/moby/pull/48319)\n-
          \  IPAM now handles subnets bigger than \"/64\". [moby/moby#49223](https://redirect.github.com/moby/moby/pull/49223)\n-
          \  Duplicate address detection (DAD) is now disabled for addresses assigned
          to the bridges belonging to bridge networks. [moby/moby#48609](https://redirect.github.com/moby/moby/pull/48609)\n-
          \  Modifications to `host-gateway`, for compatibility with IPv6-only networks.
          [moby/moby#48807](https://redirect.github.com/moby/moby/pull/48807)\n    -
          \  When special value `host-gateway` is used in an `--add-host` option in
          place of an address, it's replaced by an address on the Docker host to make
          it possible to refer to the host by name. The address used belongs to the
          default bridge (normally `docker0`). Until now it's always been an IPv4
          address, because all containers on bridge networks had IPv4 addresses.\n
          \   -   Now, if IPv6 is enabled on the default bridge network, `/etc/hosts`
          entries will be created for IPv4 and IPv6 addresses. So, a container that's
          only connected to IPv6-only networks can access the host by name.\n    -
          \  The `--host-gateway-ip` option overrides the address used to replace
          `host-gateway`. Two of these options are now allowed on the command line,
          for one IPv4 gateway and one IPv6.\n    -   In the `daemon.json` file, to
          provide two addresses, use `\"host-gateway-ips\"`. For example, `\"host-gateway-ips\":
          [\"192.0.2.1\", \"2001:db8::1111\"]`.\n\n##### Bug fixes and enhancements\n\n-
          \  Add IPv6 loopback address as an insecure registry by default. [moby/moby#48540](https://redirect.github.com/moby/moby/pull/48540)\n-
          \  Add support for Cobra-generated completion scripts for `dockerd`. [moby/moby#49339](https://redirect.github.com/moby/moby/pull/49339)\n-
          \  Fix DNS queries failing when containers are launched via `systemd` auto-start
          on boot [moby/moby#48812](https://redirect.github.com/moby/moby/pull/48812)\n-
          \  Fix Docker Swarm mode ignoring `volume.subpath` [docker/cli#5833](https://redirect.github.com/docker/cli/pull/5833)\n-
          \  Fix `docker export` continuing the export after the operation is canceled.
          [moby/moby#49265](https://redirect.github.com/moby/moby/pull/49265)\n-   Fix
          `docker export` not releasing the container's writable layer after a failure.
          [moby/moby#48517](https://redirect.github.com/moby/moby/pull/48517)\n-   Fix
          `docker images --tree` unnecessary truncating long image names when multiple
          names are available [docker/cli#5757](https://redirect.github.com/docker/cli/pull/5757)\n-
          \  Fix a bug where a container with a name matching another container's
          ID is not restored on daemon startup. [moby/moby#48669](https://redirect.github.com/moby/moby/pull/48669)\n-
          \  Fix an issue preventing some IPv6 addresses shown by `docker ps` to be
          properly bracketed [docker/cli#5468](https://redirect.github.com/docker/cli/pull/5468)\n-
          \  Fix bug preventing image pulls from being cancelled during `docker run`.
          [docker/cli#5645](https://redirect.github.com/docker/cli/pull/5645)\n-   Fix
          error-handling when running the daemon as a Windows service to prevent unclean
          exits. [moby/moby#48518](https://redirect.github.com/moby/moby/pull/48518)\n-
          \  Fix issue causing output of `docker run` to be inconsistent when using
          `--attach stdout` or `--attach stderr` versus `stdin`.  `docker run --attach
          stdin` now exits if the container exits. [docker/cli#5662](https://redirect.github.com/docker/cli/pull/5662)\n-
          \  Fix rootless Docker setup with `subid` backed by NSS modules. [moby/moby#49036](https://redirect.github.com/moby/moby/pull/49036)\n-
          \  Generated completion scripts from the CLI now show descriptions next
          to each command/flag suggestion. [docker/cli#5756](https://redirect.github.com/docker/cli/pull/5756)\n-
          \  IPv6 addresses shown by `docker ps` in port bindings are now bracketed
          [docker/cli#5363](https://redirect.github.com/docker/cli/pull/5363)\n-   Implement
          the ports validation method for Compose [docker/cli#5524](https://redirect.github.com/docker/cli/pull/5524)\n-
          \  Improve error-output for invalid flags on the command line. [docker/cli#5233](https://redirect.github.com/docker/cli/pull/5233)\n-
          \  Improve errors when failing to start a container using anther container's
          network namespace. [moby/moby#49367](https://redirect.github.com/moby/moby/pull/49367)\n-
          \  Improve handling of invalid API errors that could result in an empty
          error message being shown. [moby/moby#49373](https://redirect.github.com/moby/moby/pull/49373)\n-
          \  Improve output and consistency for unknown (sub)commands and invalid
          arguments [docker/cli#5234](https://redirect.github.com/docker/cli/pull/5234)\n-
          \  Improve validation of `exec-opts` in daemon configuration. [moby/moby#48979](https://redirect.github.com/moby/moby/pull/48979)\n-
          \  Update the handling of the `--gpus=0` flag to be consistent with the
          NVIDIA Container Runtime. [moby/moby#48482](https://redirect.github.com/moby/moby/pull/48482)\n-
          \  `client.ContainerCreate` now normalizes `CapAdd` and `CapDrop` fields
          in `HostConfig` to their canonical form. [moby/moby#48551](https://redirect.github.com/moby/moby/pull/48551)\n-
          \  `docker image save` now produces stable timestamps. [moby/moby#48611](https://redirect.github.com/moby/moby/pull/48611)\n-
          \  `docker inspect` now lets you inspect Swarm configs [docker/cli#5573](https://redirect.github.com/docker/cli/pull/5573)\n-
          \  containerd image store: Add support for `Extracting` layer status in
          `docker pull`. [moby/moby#49064](https://redirect.github.com/moby/moby/pull/49064)\n-
          \  containerd image store: Fix `commit`, `import`, and `build` not preserving
          a replaced image as a dangling image. [moby/moby#48316](https://redirect.github.com/moby/moby/pull/48316)\n-
          \  containerd image store: Make `docker load --platform` return an error
          when the requested platform isn't loaded. [moby/moby#48718](https://redirect.github.com/moby/moby/pull/48718)\n-
          \  Fix validation of `--link` option. [docker/cli#5739](https://redirect.github.com/docker/cli/pull/5739)\n-
          \  Add validation of network-diagnostic-port daemon configuration option.
          [moby/moby#49305](https://redirect.github.com/moby/moby/pull/49305)\n-   Unless
          explicitly configured, an IP address is no longer reserved for a gateway
          in cases where it is not required. Namely, \u201Cinternal\u201D bridge networks
          with option `com.docker.network.bridge.inhibit_ipv4`, `ipvlan` or `macvlan`
          networks with no parent interface, and L3 IPvlan modes. [moby/moby#49261](https://redirect.github.com/moby/moby/pull/49261)\n-
          \  If a custom network driver reports capability `GwAllocChecker` then,
          before a network is created, it will get a `GwAllocCheckerRequest` with
          the network's options. The custom driver may then reply that no gateway
          IP address should be allocated. [moby/moby#49372](https://redirect.github.com/moby/moby/pull/49372)\n-
          \  Fixed an issue that meant a container could not be attached to an L3
          IPvlan at the same time as other network types. [moby/moby#49130](https://redirect.github.com/moby/moby/pull/49130)\n-
          \  Remove the correct `/etc/hosts` entries when disconnecting a container
          from a network. [moby/moby#48857](https://redirect.github.com/moby/moby/pull/48857)\n-
          \  Fix duplicate network disconnect events. [moby/moby#48800](https://redirect.github.com/moby/moby/pull/48800)\n-
          \  Resolve issues related to changing `fixed-cidr` for `docker0`, and inferring
          configuration from a user-managed default bridge (`--bridge`). [moby/moby#48319](https://redirect.github.com/moby/moby/pull/48319)\n-
          \  Remove feature flag `windows-dns-proxy`, introduced in release 26.1.0
          to control forwarding to external DNS resolvers from Windows containers,
          to make `nslookup` work. It was enabled by default in release 27.0.0. [moby/moby#48738](https://redirect.github.com/moby/moby/pull/48738)\n-
          \  Remove an `iptables` mangle rule for checksumming SCTP. The rule can
          be re-enabled by setting `DOCKER_IPTABLES_SCTP_CHECKSUM=1` in the daemon's
          environment. This override will be removed in a future release. [moby/moby#48149](https://redirect.github.com/moby/moby/pull/48149)\n-
          \  Faster connection to bridge networks, in most cases. [moby/moby#49302](https://redirect.github.com/moby/moby/pull/49302)\n\n#####
          Packaging updates\n\n-   Update Go runtime to [1.23.6](https://go.dev/doc/devel/release#go1.23.6).
          [docker/cli#5795](https://redirect.github.com/docker/cli/pull/5795), [moby/moby#49393](https://redirect.github.com/moby/moby/pull/49393),
          [docker/docker-ce-packaging#1161](https://redirect.github.com/docker/docker-ce-packaging/pull/1161)\n-
          \  Update `runc` to [v1.2.5](https://redirect.github.com/opencontainers/runc/releases/tag/v1.2.5)
          (static binaries only). [moby/moby#49464](https://redirect.github.com/moby/moby/pull/49464)\n-
          \  Update containerd to [v1.7.25](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.25).
          [moby/moby#49252](https://redirect.github.com/moby/moby/pull/49252)\n-   Update
          BuildKit to [v0.20.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.0).
          [moby/moby#49495](https://redirect.github.com/moby/moby/pull/49495)\n-   Update
          Buildx to [v0.21.0](https://redirect.github.com/docker/buildx/releases/tag/v0.21.0).
          [docker/docker-ce-packaging#1166](https://redirect.github.com/docker/docker-ce-packaging/pull/1166)\n-
          \  Update Compose to [v2.32.4](https://redirect.github.com/docker/compose/releases/tag/v2.32.3).
          [docker/docker-ce-packaging#1143](https://redirect.github.com/docker/docker-ce-packaging/pull/1143)\n-
          \  The canonical source for the `dockerd(8)` man page has been moved back
          to the `moby/moby` repository itself. [moby/moby#48298](https://redirect.github.com/moby/moby/pull/48298)\n\n#####
          Go SDK\n\n-   Improve validation of empty object IDs. The client now returns
          an \"Invalid Parameter\" error when trying to use an empty ID or name. This
          changes the error returned by some \"Inspect\" functions from a \"Not found\"
          error to an \"Invalid Parameter\". [moby/moby#49381](https://redirect.github.com/moby/moby/pull/49381)\n-
          \  `Client.ImageBuild()` now omits default values from the API request's
          query string. [moby/moby#48651](https://redirect.github.com/moby/moby/pull/48651)\n-
          \  `api/types/container`: Merge `Stats` and `StatsResponse` [moby/moby#49287](https://redirect.github.com/moby/moby/pull/49287)\n-
          \  `client.WithVersion`: Strip v-prefix when setting API version [moby/moby#49352](https://redirect.github.com/moby/moby/pull/49352)\n-
          \  `client`: Add `WithTraceOptions` allowing to specify custom OTe1 trace
          options. [moby/moby#49415](https://redirect.github.com/moby/moby/pull/49415)\n-
          \  `client`: Add `HijackDialer` interface. [moby/moby#49388](https://redirect.github.com/moby/moby/pull/49388)\n-
          \  `client`: Add `SwarmManagementAPIClient` interface to describe all API
          client methods related to Swarm-specific objects. [moby/moby#49388](https://redirect.github.com/moby/moby/pull/49388)\n-
          \  `client`: Add `WithTraceOptions` allowing to specify custom OTel trace
          options. [moby/moby#49415](https://redirect.github.com/moby/moby/pull/49415)\n-
          \  `client`: `ImageHistory`, `ImageLoad` and `ImageSave` now use variadic
          functional options [moby/moby#49466](https://redirect.github.com/moby/moby/pull/49466)\n-
          \  `pkg/containerfs`: Move to internal [moby/moby#48097](https://redirect.github.com/moby/moby/pull/48097)\n-
          \  `pkg/reexec`: Can now be used on platforms other than Linux, Windows,
          macOS and FreeBSD [moby/moby#49118](https://redirect.github.com/moby/moby/pull/49118)\n-
          \  `api/types/container`: introduce `CommitResponse` type. This is currently
          an alias for `IDResponse`, but may become a distinct type in a future release.
          [moby/moby#49444](https://redirect.github.com/moby/moby/pull/49444)\n-   `api/types/container`:
          introduce `ExecCreateResponse` type. This is currently an alias for `IDResponse`,
          but may become a distinct type in a future release. [moby/moby#49444](https://redirect.github.com/moby/moby/pull/49444)\n\n#####
          API\n\n-   Update API version to [v1.48](https://docs.docker.com/engine/api/v1.48/)
          [moby/moby#48476](https://redirect.github.com/moby/moby/pull/48476)\n-   `GET
          /images/{name}/json` response now returns the `Manifests` field containing
          information about the sub-manifests contained in the image index. This includes
          things like platform-specific manifests and build attestations. [moby/moby#48264](https://redirect.github.com/moby/moby/pull/48264)\n-
          \  `POST /containers/create` now supports `Mount` of type `image` for mounting
          an image inside a container. [moby/moby#48798](https://redirect.github.com/moby/moby/pull/48798)\n-
          \  `GET /images/{name}/history` now supports a `platform` parameter (JSON
          encoded OCI Platform type) that lets you specify a platform to show the
          history of. [moby/moby#48295](https://redirect.github.com/moby/moby/pull/48295)\n-
          \  `POST /images/{name}/load` and `GET /images/{name}/get` now supports
          a `platform` parameter (JSON encoded OCI Platform type) that lets you specify
          a platform to load/save. Not passing this parameter results in loading/saving
          the full multi-platform image. [moby/moby#48295](https://redirect.github.com/moby/moby/pull/48295)\n-
          \  Improve errors for invalid width/height on container resize and exec
          resize [moby/moby#48679](https://redirect.github.com/moby/moby/pull/48679)\n-
          \  The `POST /containers/create` endpoint now includes a warning in the
          response when setting the container-wide `VolumeDriver` option in combination
          with volumes defined through `Mounts` because the `VolumeDriver` option
          has no effect on those volumes. This warning was previously generated by
          the CLI. [moby/moby#48789](https://redirect.github.com/moby/moby/pull/48789)\n-
          \  containerd image store: `GET /images/json` and `GET /images/{name}/json`
          responses now includes `Descriptor` field, which contains an OCI descriptor
          of the image target. The new field is only populated if the daemon provides
          a multi-platform image store. [moby/moby#48894](https://redirect.github.com/moby/moby/pull/48894)\n-
          \  containerd image store: `GET /containers/{name}/json` now returns an
          `ImageManifestDescriptor` field containing the OCI descriptor of the platform-specific
          image manifest of the image that was used to create the container. [moby/moby#48855](https://redirect.github.com/moby/moby/pull/48855)\n-
          \  Add debug endpoints (`GET /debug/vars`, `GET /debug/pprof/`, `GET /debug/pprof/cmdline`,
          `GET /debug/pprof/profile`, `GET /debug/pprof/symbol`, `GET /debug/pprof/trace`,
          `GET /debug/pprof/{name}`) are now also accessible through the versioned-API
          paths (`/v<API-version>/<endpoint>`). [moby/moby#49051](https://redirect.github.com/moby/moby/pull/49051)\n-
          \  Fix API returning a `500` status code instead of `400` for validation
          errors. [moby/moby#49217](https://redirect.github.com/moby/moby/pull/49217)\n-
          \  Fix status codes for archive endpoints `HEAD /containers/{name:.*}/archive`,
          `GET /containers/{name:.*}/archive`, `PUT /containers/{name:.*}/archive`
          returning a `500` status instead of a `400` status. [moby/moby#49219](https://redirect.github.com/moby/moby/pull/49219)\n-
          \  `POST /containers/create` now accepts a `writable-cgroups=true` option
          in `HostConfig.SecurityOpt` to mount the container's cgroups writable. This
          provides a more granular approach than `HostConfig.Privileged`. [moby/moby#48828](https://redirect.github.com/moby/moby/pull/48828)\n-
          \  `POST /build/prune` renames `keep-bytes` to `reserved-space` and now
          supports additional prune parameters `max-used-space` and `min-free-space`.
          [moby/moby#48720](https://redirect.github.com/moby/moby/pull/48720)\n-   `POST
          /networks/create` now has an `EnableIPv4` field. Setting it to `false` disables
          IPv4 IPAM for the network. [moby/moby#48271](https://redirect.github.com/moby/moby/pull/48271)\n
          \   -   `GET /networks/{id}` now returns an `EnableIPv4` field showing whether
          the network has IPv4 IPAM enabled. [moby/moby#48271](https://redirect.github.com/moby/moby/pull/48271)\n
          \   -   User-defined bridge networks require either IPv4 or IPv6 address
          assignment to be enabled. IPv4 cannot be disabled for the default bridge
          network (`docker0`). [moby/moby#48323](https://redirect.github.com/moby/moby/pull/48323)\n
          \   -   `macvlan` and `ipvlan` networks can be created with address assignment
          disabled for IPv4, IPv6, or both address families. [moby/moby#48299](https://redirect.github.com/moby/moby/pull/48299)\n
          \   -   IPv4 cannot be disabled for Windows or Swarm networks. [moby/moby#48278](https://redirect.github.com/moby/moby/pull/48278)\n-
          \  Add a way to specify which network should provide the default gateway
          for a container. [moby/moby#48936](https://redirect.github.com/moby/moby/pull/48936)\n
          \   -   `POST /networks/{id}/connect` and `POST /containers/create` now
          accept a `GwPriority` field in `EndpointsConfig`. This value is used to
          determine which network endpoint provides the default gateway for the container.
          The endpoint with the highest priority is selected. If multiple endpoints
          have the same priority, endpoints are sorted lexicographically by their
          network name, and the one that sorts first is picked. [moby/moby#48746](https://redirect.github.com/moby/moby/pull/48746)\n
          \   -   `GET /containers/json` now returns a `GwPriority` field in `NetworkSettings`
          for each network endpoint. The `GwPriority` field is used by the CLI\u2019s
          new `gw-priority` option for `docker run` and `docker network connect`.
          [moby/moby#48746](https://redirect.github.com/moby/moby/pull/48746)\n-   Settings
          for `eth0` in `--sysctl` options are no longer automatically migrated to
          the network endpoint. [moby/moby#48746](https://redirect.github.com/moby/moby/pull/48746)\n
          \   -   For example, in the Docker CLI, `docker run --network mynet --sysctl
          net.ipv4.conf.eth0.log_martians=1 ...` is rejected. Instead, you must use
          `docker run --network name=mynet,driver-opt=com.docker.network.endpoint.sysctls=net.ipv4.conf.IFNAME.log_martians=1
          ...`\n-   `GET /containers/json` now returns an `ImageManifestDescriptor`
          field matching the same field in `/containers/{name}/json`. This field is
          only populated if the daemon provides a multi-platform image store. [moby/moby#49407](https://redirect.github.com/moby/moby/pull/49407)\n\n#####
          Removed\n\n-   The Fluent logger option `fluentd-async-connect` has been
          deprecated in v20.10 and is now removed. [moby/moby#46114](https://redirect.github.com/moby/moby/pull/46114)\n-
          \  The `--time` option on `docker stop` and `docker restart` is deprecated
          and renamed to `--timeout`. [docker/cli#5485](https://redirect.github.com/docker/cli/pull/5485)\n-
          \  Go-SDK: `pkg/ioutils`: Remove `NewReaderErrWrapper` as it was never used.
          [moby/moby#49258](https://redirect.github.com/moby/moby/pull/49258)\n-   Go-SDK:
          `pkg/ioutils`: Remove deprecated `BytesPipe`, `NewBytesPipe`, `ErrClosed`,
          `WriteCounter`, `NewWriteCounter`, `NewReaderErrWrapper`, `NopFlusher`.
          [moby/moby#49245](https://redirect.github.com/moby/moby/pull/49245)\n-   Go-SDK:
          `pkg/ioutils`: Remove deprecated `NopWriter` and `NopWriteCloser`. [moby/moby#49256](https://redirect.github.com/moby/moby/pull/49256)\n-
          \  Go-SDK: `pkg/sysinfo`: Remove deprecated NumCPU. [moby/moby#49242](https://redirect.github.com/moby/moby/pull/49242)\n-
          \  Go-SDK: Remove `pkg/broadcaster`, as it was only used internally [moby/moby#49172](https://redirect.github.com/moby/moby/pull/49172)\n-
          \  Go-SDK: Remove deprecated `cli.Errors` type [docker/cli#5549](https://redirect.github.com/docker/cli/pull/5549)\n-
          \  Remove `pkg/ioutils.ReadCloserWrapper`, as it was only used in tests.
          [moby/moby#49237](https://redirect.github.com/moby/moby/pull/49237)\n-   Remove
          deprecated `api-cors-header` config parameter and the `dockerd` `--api-cors-header`
          option [moby/moby#48209](https://redirect.github.com/moby/moby/pull/48209)\n-
          \  Remove deprecated `APIEndpoint.Version` field, `APIVersion` type, and
          `APIVersion1` and `APIVersion2` consts. [moby/moby#49004](https://redirect.github.com/moby/moby/pull/49004)\n-
          \  Remove deprecated `api-cors-header` config parameter and the Docker daemon's
          `--api-cors-header` option. [docker/cli#5437](https://redirect.github.com/docker/cli/pull/5437)\n-
          \  Remove deprecated `pkg/directory` package [moby/moby#48779](https://redirect.github.com/moby/moby/pull/48779)\n-
          \  Remove deprecated `pkg/dmsg.Dmesg()` [moby/moby#48109](https://redirect.github.com/moby/moby/pull/48109)\n-
          \  Remove deprecated image/spec package, which was moved to a separate module
          (`github.com/moby/docker-image-spec`) [moby/moby#48460](https://redirect.github.com/moby/moby/pull/48460)\n-
          \  Remove migration code and errors for the deprecated `logentries` logging
          driver. [moby/moby#48891](https://redirect.github.com/moby/moby/pull/48891)\n-
          \  Remove support for deprecated external graph-driver plugins. [moby/moby#48072](https://redirect.github.com/moby/moby/pull/48072)\n-
          \  `api/types`: Remove deprecated `container.ContainerNode` and `ContainerJSONBase.Node`
          field. [moby/moby#48107](https://redirect.github.com/moby/moby/pull/48107)\n-
          \  `api/types`: Remove deprecated aliases: `ImagesPruneReport`, `VolumesPruneReport`,
          `NetworkCreateRequest`, `NetworkCreate`, `NetworkListOptions`, `NetworkCreateResponse`,
          `NetworkInspectOptions`, `NetworkConnect`, `NetworkDisconnect`, `EndpointResource`,
          `NetworkResource`, `NetworksPruneReport`, `ExecConfig`, `ExecStartCheck`,
          `ContainerExecInspect`, `ContainersPruneReport`, `ContainerPathStat`, `CopyToContainerOptions`,
          `ContainerStats`, `ImageSearchOptions`, `ImageImportSource`, `ImageLoadResponse`,
          `ContainerNode`. [moby/moby#48107](https://redirect.github.com/moby/moby/pull/48107)\n-
          \  `libnetwork/iptables`: Remove deprecated `IPV`, `Iptables`, `IP6Tables`
          and `Passthrough()`. [moby/moby#49121](https://redirect.github.com/moby/moby/pull/49121)\n-
          \  `pkg/archive`: Remove deprecated `CanonicalTarNameForPath`, `NewTempArchive`,
          `TempArchive` [moby/moby#48708](https://redirect.github.com/moby/moby/pull/48708)\n-
          \  `pkg/fileutils`: Remove deprecated `GetTotalUsedFds` [moby/moby#49210](https://redirect.github.com/moby/moby/pull/49210)\n-
          \  `pkg/ioutils`: Remove `OnEOFReader`, which was only used internally [moby/moby#49170](https://redirect.github.com/moby/moby/pull/49170)\n-
          \  `pkg/longpath`: Remove deprecated `Prefix` constant. [moby/moby#48779](https://redirect.github.com/moby/moby/pull/48779)\n-
          \  `pkg/stringid`: Remove deprecated `IsShortID` and  `ValidateID` functions
          [moby/moby#48705](https://redirect.github.com/moby/moby/pull/48705)\n-   `runconfig/opts`:
          Remove deprecated `ConvertKVStringsToMap` [moby/moby#48102](https://redirect.github.com/moby/moby/pull/48102)\n-
          \  `runconfig`: Remove deprecated `ContainerConfigWrapper`, `SetDefaultNetModeIfBlank`,
          `DefaultDaemonNetworkMode`, `IsPreDefinedNetwork` [moby/moby#48102](https://redirect.github.com/moby/moby/pull/48102)\n-
          \  `container`: Remove deprecated `ErrNameReserved`, `ErrNameNot\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: Branch creation - At any time
          (no schedule defined), Automerge - At any time (no schedule defined).\n\n\U0001F6A6
          **Automerge**: Disabled by config. Please merge this manually once you are
          satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you
          tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR
          and you won't be reminded about these updates again.\n\n---\n\n - [ ] <!--
          rebase-check -->If you want to rebase/retry this PR, check this box\n\n---\n\nThis
          PR was generated by [Mend Renovate](https://mend.io/renovate/). View the
          [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjM5LjI1Ny4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/release/pull/1807
        commit_id: 65478946b4201083b6ac113f5d0766422a4bd5b9
        patchset: 65478946b4201083b6ac113f5d0766422a4bd5b9
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      buildset: d72d331638934168b00e37f513280f6d
      buildset_refs:
      - branch: main
        change: '1807'
        change_message: "chore(deps): update dependency moby/moby to v28\n\nThis PR
          contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
          [moby/moby](https://redirect.github.com/moby/moby) | major | `5:27.5.1`
          -> `v28.1.1` |\n| [moby/moby](https://redirect.github.com/moby/moby) | major
          | `27.5.1` -> `28.1.1` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>moby/moby
          (moby/moby)</summary>\n\n### [`v28.1.1`](https://redirect.github.com/moby/moby/releases/tag/v28.1.1)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.1.0...v28.1.1)\n\n#####
          28.1.1\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.1.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.1)\n-
          \  [moby/moby, 28.1.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.1)\n\n#####
          Bug fixes and enhancements\n\n-   Fix `dockerd-rootless-setuptool.sh` incorrectly
          reporting missing `iptables`. [moby/moby#49833](https://redirect.github.com/moby/moby/pull/49833)\n-
          \  containerd image store: Fix a potential daemon crash when using `docker
          load` with archives containing zero-size tar headers. [moby/moby#49837](https://redirect.github.com/moby/moby/pull/49837)\n\n#####
          Packaging updates\n\n-   Update Buildx to [v0.23.0](https://redirect.github.com/docker/buildx/releases/tag/v0.23.0).
          [docker/docker-ce-packaging#1185](https://redirect.github.com/docker/docker-ce-packaging/pull/1185)\n-
          \  Update Compose to [v2.35.1](https://redirect.github.com/docker/compose/releases/tag/v2.35.1).
          [docker/docker-ce-packaging#1188](https://redirect.github.com/docker/docker-ce-packaging/pull/1188)\n\n#####
          Networking\n\n-   Add a warning to a container's `/etc/resolv.conf` when
          no upstream DNS servers were found. [moby/moby#49827](https://redirect.github.com/moby/moby/pull/49827)\n\n###
          [`v28.1.0`](https://redirect.github.com/moby/moby/releases/tag/v28.1.0)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.4...v28.1.0)\n\n#####
          28.1.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.1.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
          \  [moby/moby, 28.1.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
          \  Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.1.0/docs/api/version-history.md).\n\n#####
          New\n\n-   Add `docker bake` sub-command as alias for `docker buildx bake`.
          [docker/cli#5947](https://redirect.github.com/docker/cli/pull/5947)\n-   Experimental:
          add a new `--use-api-socket` flag on `docker run` and `docker create` to
          enable access to Docker socket from inside a container and to share credentials
          from the host with the container. [docker/cli#5858](https://redirect.github.com/docker/cli/pull/5858)\n-
          \  `docker image inspect` now supports a `--platform` flag to inspect a
          specific platform of a multi-platform image. [docker/cli#5934](https://redirect.github.com/docker/cli/pull/5934)\n\n#####
          Bug fixes and enhancements\n\n-   Add CLI shell-completion for context names.
          [docker/cli#6016](https://redirect.github.com/docker/cli/pull/6016)\n-   Fix
          `docker images --tree` not including non-container images content size in
          the total image content size. [docker/cli#6000](https://redirect.github.com/docker/cli/pull/6000)\n-
          \  Fix `docker load` not preserving replaced images. [moby/moby#49650](https://redirect.github.com/moby/moby/pull/49650)\n-
          \  Fix `docker login` hints when logging in to a custom registry. [docker/cli#6015](https://redirect.github.com/docker/cli/pull/6015)\n-
          \  Fix `docker stats` not working properly on machines with high CPU core
          count. [moby/moby#49734](https://redirect.github.com/moby/moby/pull/49734)\n-
          \  Fix a regression causing `docker pull/push` to fail when interacting
          with a private repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n-
          \  Fix an issue preventing rootless Docker setup on a host with no `ip_tables`
          kernel module. [moby/moby#49727](https://redirect.github.com/moby/moby/pull/49727)\n-
          \  Fix an issue that could lead to unwanted iptables rules being restored
          and never deleted following a firewalld reload. [moby/moby#49728](https://redirect.github.com/moby/moby/pull/49728)\n-
          \  Improve CLI completion of `docker service scale`. [docker/cli#5968](https://redirect.github.com/docker/cli/pull/5968)\n-
          \  `docker images --tree` now hides both untagged and dangling images by
          default. [docker/cli#5924](https://redirect.github.com/docker/cli/pull/5924)\n-
          \  `docker system info` will provide an exit code if a connection cannot
          be established to the Docker daemon. [docker/cli#5918](https://redirect.github.com/docker/cli/pull/5918)\n-
          \  containerd image store: Fix `image tag` event not being emitted when
          building with BuildKit. [moby/moby#49678](https://redirect.github.com/moby/moby/pull/49678)\n-
          \  containerd image store: Improve `docker push/pull` handling of remote
          registry errors. [moby/moby#49770](https://redirect.github.com/moby/moby/pull/49770)\n-
          \  containerd image store: Show pull progress for non-layer image blobs.
          [moby/moby#49746](https://redirect.github.com/moby/moby/pull/49746)\n\n#####
          Packaging updates\n\n-   Add Debian \"Trixie\" packages. [docker/docker-ce-packaging#1181](https://redirect.github.com/docker/docker-ce-packaging/pull/1181)\n-
          \  Add Fedora 42 packages. [docker/containerd-packaging#418](https://redirect.github.com/docker/containerd-packaging/pull/418),
          [docker/docker-ce-packaging#1169](https://redirect.github.com/docker/docker-ce-packaging/pull/1169)\n-
          \  Add Ubuntu 25.04 \"Plucky Puffin\" packages. [docker/containerd-packaging#419](https://redirect.github.com/docker/containerd-packaging/pull/419),
          [docker/docker-ce-packaging#1177](https://redirect.github.com/docker/docker-ce-packaging/pull/1177)\n-
          \  Update BuildKit to [v0.21.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.21.0).
          [moby/moby#49809](https://redirect.github.com/moby/moby/pull/49809)\n-   Update
          Compose to [v2.35.0](https://redirect.github.com/docker/compose/releases/tag/v2.35.0).
          [docker/docker-ce-packaging#1183](https://redirect.github.com/docker/docker-ce-packaging/pull/1183)\n-
          \  Update Go runtime to [1.23.8](https://go.dev/doc/devel/release#go1.23.8).
          [docker/cli#5986](https://redirect.github.com/docker/cli/pull/5986), [docker/docker-ce-packaging#1180](https://redirect.github.com/docker/docker-ce-packaging/pull/1180),
          [moby/moby#49737](https://redirect.github.com/moby/moby/pull/49737)\n\n#####
          Networking\n\n-   Fix a bug causing host port-mappings on Swarm containers
          to be duplicated on `docker ps` and `docker inspect`. [moby/moby#49724](https://redirect.github.com/moby/moby/pull/49724)\n-
          \  Fix an issue that caused container network attachment to fail with error
          \"Bridge port not forwarding\". [moby/moby#49705](https://redirect.github.com/moby/moby/pull/49705)\n-
          \  Fix an issue with removal of a `--link` from a container in the default
          bridge network. [moby/moby#49778](https://redirect.github.com/moby/moby/pull/49778)\n-
          \  Improve how network-endpoint relationships are tracked to reduce the
          chance of the \"has active endpoints\" error to be wrongfully returned.
          [moby/moby#49736](https://redirect.github.com/moby/moby/pull/49736)\n-   Improve
          the \"has active endpoints\" error message by including the name of endpoints
          still connected to the network being deleted. [moby/moby#49773](https://redirect.github.com/moby/moby/pull/49773)\n\n#####
          API\n\n-   Update API version to [v1.49](https://docs.docker.com/engine/api/v1.49/).
          [moby/moby#49718](https://redirect.github.com/moby/moby/pull/49718)\n-   `GET
          /image/{name}/json` now supports a `platform` parameter allowing to specify
          which platform variant of a multi-platform image to inspect. [moby/moby#49586](https://redirect.github.com/moby/moby/pull/49586)\n-
          \  `GET /info` now returns a `FirewallBackend` containing information about
          the daemon's firewalling configuration. [moby/moby#49761](https://redirect.github.com/moby/moby/pull/49761)\n\n#####
          Go SDK\n\n-   Update minimum required Go version to go1.23. [docker/cli#5868](https://redirect.github.com/docker/cli/pull/5868)\n-
          \  cli/command/context: remove temporary `ContextType` field from JSON output.
          [docker/cli#5981](https://redirect.github.com/docker/cli/pull/5981)\n-   client:
          Keep image references in canonical format where possible. [moby/moby#49609](https://redirect.github.com/moby/moby/pull/49609)\n\n#####
          Deprecations\n\n-   API: Deprecated `AllowNondistributableArtifactsCIDRs`
          and `AllowNondistributableArtifactsHostnames` fields in the `RegistryConfig`
          struct in the `GET /info` response are omitted in API v1.49. [moby/moby#49749](https://redirect.github.com/moby/moby/pull/49749)\n-
          \  API: Deprecated: The `ContainerdCommit.Expected`, `RuncCommit.Expected`,
          and `InitCommit.Expected` fields in the `GET /info` endpoint were deprecated
          in API v1.48, and are now omitted in API v1.49. [moby/moby#48556](https://redirect.github.com/moby/moby/pull/48556)\n-
          \  Go-SDK: cli/command/image: Deprecate `RunPull`: this function was only
          used internally and will be removed in the next release. [docker/cli#5975](https://redirect.github.com/docker/cli/pull/5975)\n-
          \  Go-SDK: cli/config/configfile: deprecate `ConfigFile.Experimental` field.
          Experimental CLI features are always enabled since version v20.10 and this
          field is no longer used. Use `ConfigFile.Features` instead for optional
          features. This field will be removed in a future release. [docker/cli#5977](https://redirect.github.com/docker/cli/pull/5977)\n-
          \  Go-SDK: deprecate `pkg/archive`, which was migrated to `github.com/moby/go-archive`.
          [moby/moby#49743](https://redirect.github.com/moby/moby/pull/49743)\n-   Go-SDK:
          deprecate `pkg/atomicwriter`, which was migrated to `github.com/moby/sys/atomicwriter`.
          [moby/moby#49748](https://redirect.github.com/moby/moby/pull/49748)\n-   Go-SDK:
          opts: remove deprecated `PortOpt`, `ConfigOpt`, `SecretOpt` aliases. [docker/cli#5953](https://redirect.github.com/docker/cli/pull/5953)\n-
          \  Go-SDK: registry: deprecate `APIEndpoint.Official` field. [moby/moby#49706](https://redirect.github.com/moby/moby/pull/49706)\n\n###
          [`v28.0.4`](https://redirect.github.com/moby/moby/releases/tag/v28.0.4)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.3...v28.0.4)\n\n#####
          28.0.4\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.4 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.4)\n-
          \  [moby/moby, 28.0.4 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.4)\n\n#####
          Bug fixes and enhancements\n\n-   Fix a regression causing `docker pull/push`
          to fail when interacting with a private repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n\n###
          [`v28.0.3`](https://redirect.github.com/moby/moby/releases/tag/v28.0.3)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.2...v28.0.3)\n\n#####
          28.0.3\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.3 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.3)\n-
          \  [moby/moby, 28.0.3 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.3)\n\n#####
          Bug fixes and enhancements\n\n-   Fix `docker run` truncating the `STDOUT`/`STDERR`
          prematurely when the container exits before the data is consumed. [docker/cli#5957](https://redirect.github.com/docker/cli/pull/5957)\n\n#####
          Packaging updates\n\n-   Update BuildKit to [v0.20.2](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.2).
          [moby/moby#49698](https://redirect.github.com/moby/moby/pull/49698)\n-   Update
          `runc` to [v1.2.6](https://redirect.github.com/opencontainers/runc/releases/tag/v1.2.6)
          (static packages only). [moby/moby#49682](https://redirect.github.com/moby/moby/pull/49682)\n-
          \  Update containerd to [v1.7.26](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.26).
          [docker/containerd-packaging#409](https://redirect.github.com/docker/containerd-packaging/pull/409)\n\n###
          [`v28.0.2`](https://redirect.github.com/moby/moby/releases/tag/v28.0.2)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.1...v28.0.2)\n\n#####
          28.0.2\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.2 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.2)\n-
          \  [moby/moby, 28.0.2 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.2)\n\n#####
          Bug fixes and enhancements\n\n-   Fix CLI-specific attributes (`docker.cli.*`)
          being unintentionally passed to downstream OTel services. [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n-
          \  Fix an issue where user-specified `OTEL_RESOURCE_ATTRIBUTES` were being
          overridden by CLI's internal telemetry attributes. The CLI now properly
          merges user-specified attributes with internal ones, allowing both to coexist.
          [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n-   Fix
          daemon failing to start on Windows when a container created before v28.0.0
          was present. [moby/moby#49626](https://redirect.github.com/moby/moby/pull/49626)\n-
          \  Fix possible error on `docker buildx prune` with the `--min-free-space`.
          [moby/moby#49623](https://redirect.github.com/moby/moby/pull/49623)\n-   Fix
          spurious `io: read/write on closed pipe` error in the daemon log when closing
          container. [moby/moby#49590](https://redirect.github.com/moby/moby/pull/49590)\n-
          \  Fix the Docker daemon failing too early if the containerd socket isn't
          immediately available. [moby/moby#49603](https://redirect.github.com/moby/moby/pull/49603)\n-
          \  Mask Linux thermal interrupt info in a container's `/proc` and `/sys`
          by default. [moby/moby#49560](https://redirect.github.com/moby/moby/pull/49560)\n-
          \  Update `contrib/check-config.sh` to check for more kernel modules related
          to iptables. [moby/moby#49622](https://redirect.github.com/moby/moby/pull/49622)\n-
          \  containerd image store: Fix integer overflow in User ID handling passed
          via `--user`. [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n-
          \  containerd image store: Fix spurious `reference for unknown type: application/vnd.in-toto+json`
          warning being logged to the daemon's log. [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n-
          \  containerd image store: Improve performance of `docker ps` when running
          large number of containers. [moby/moby#49365](https://redirect.github.com/moby/moby/pull/49365)\n\n#####
          Packaging updates\n\n-   Update BuildKit to [v0.20.1](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.1).
          [moby/moby#49587](https://redirect.github.com/moby/moby/pull/49587)\n-   Update
          Buildx to [v0.22.0](https://redirect.github.com/docker/buildx/releases/tag/v0.22.0).
          [docker/docker-ce-packaging#1175](https://redirect.github.com/docker/docker-ce-packaging/pull/1175)\n-
          \  Update Compose to [v2.34.0](https://redirect.github.com/docker/compose/releases/tag/v2.34.0).
          [docker/docker-ce-packaging#1172](https://redirect.github.com/docker/docker-ce-packaging/pull/1172)\n-
          \  Update Go runtime to [1.23.7](https://go.dev/doc/devel/release#go1.23.7).
          [docker/cli#5890](https://redirect.github.com/docker/cli/pull/5890), [docker/docker-ce-packaging#1171](https://redirect.github.com/docker/docker-ce-packaging/pull/1171),
          [moby/moby#49580](https://redirect.github.com/moby/moby/pull/49580)\n-   Update
          RootlessKit to [v2.3.4](https://redirect.github.com/rootless-containers/rootlesskit/releases/tag/v2.3.4).
          [moby/moby#49614](https://redirect.github.com/moby/moby/pull/49614)\n-   Update
          containerd (static binaries only) to [v1.7.27](https://www.github.com/containerd/containerd/releases/tag/v1.7.27).
          [moby/moby#49656](https://redirect.github.com/moby/moby/pull/49656)\n\n#####
          Networking\n\n-   Add environment variable `DOCKER_INSECURE_NO_IPTABLES_RAW=1`
          to allow Docker to run on systems where the Linux kernel can't provide `CONFIG_IP_NF_RAW`
          support. When enabled, Docker will not create rules in the iptables `raw`
          table. Warning: This is not recommended for production environments as it
          reduces security by allowing other hosts on the local network to route to
          ports published to host addresses, even when they are published to `127.0.0.1.`
          This option bypasses some of the security hardening introduced in Docker
          Engine 28.0.0. [moby/moby#49621](https://redirect.github.com/moby/moby/pull/49621)\n-
          \  Allow container startup when an endpoint is attached to a macvlan network
          where the parent interface is down. [moby/moby#49630](https://redirect.github.com/moby/moby/pull/49630)\n-
          \  Do not skip DNAT for packets originating in a gateway_mode=routed network.
          [moby/moby#49577](https://redirect.github.com/moby/moby/pull/49577)\n-   Fix
          a bug causing `docker ps` to inconsistently report dual-stack port mappings.
          [moby/moby#49657](https://redirect.github.com/moby/moby/pull/49657)\n-   Fix
          a bug that could cause `docker-proxy` to stop forwarding UDP datagrams to
          containers. [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n-
          \  Fix a bug that was causing `docker-proxy` to close UDP connections to
          containers eagerly and resulting in the source address to change needlessly.
          [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n\n#####
          Go SDK\n\n-   Move various types and consts from `cli-plugins/manager` to
          a separate package. [docker/cli#5902](https://redirect.github.com/docker/cli/pull/5902)\n-
          \  Update minimum required Go version to go1.23. [moby/moby#49541](https://redirect.github.com/moby/moby/pull/49541)\n-
          \  `cli/command`: Move `PrettyPrint` utility to `cli/command/formatter`.
          [docker/cli#5916](https://redirect.github.com/docker/cli/pull/5916)\n-   runconfig/errors:
          split `ErrConflictHostNetwork` into `ErrConflictConnectToHostNetwork` and
          `ErrConflictDisconnectFromHostNetwork`. [moby/moby#49605](https://redirect.github.com/moby/moby/pull/49605)\n\n#####
          Deprecations\n\n-   Go-SDK: Deprecate `cli-plugins/manager.ResourceAttributesEnvvar`
          constant. It was used internally, but holds the `OTEL_RESOURCE_ATTRIBUTES`
          name, which is part of the OpenTelemetry specification. Users of this constant
          should define their own. It will be removed in the next release. [docker/cli#5881](https://redirect.github.com/docker/cli/pull/5881)\n-
          \  Go-SDK: Deprecate `opts.PortOpt`, `opts.ConfigOpt` and `opts.SecretOpt`.
          These types were moved to the `opts/swarmopts` package. [docker/cli#5907](https://redirect.github.com/docker/cli/pull/5907)\n-
          \  Go-SDK: Remove `service/logs` package. [docker/cli#5910](https://redirect.github.com/docker/cli/pull/5910)\n-
          \  Go-SDK: `cli/command/image`: Deprecate `PushTrustedReference` and move
          to `cli/trust`. [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-
          \  Go-SDK: `cli/command/image`: Deprecate and internalize `TrustedPush`.
          [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-   Go-SDK:
          `cli/command`: deprecate `Cli.NotaryClient`: use [`trust.GetNotaryRepository`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/trust#GetNotaryRepository)
          instead. This method is no longer used and will be removed in the next release.
          [docker/cli#5885](https://redirect.github.com/docker/cli/pull/5885)\n-   Go-SDK:
          `cli/command`: deprecate `Cli.RegistryClient`. This method was only used
          internally and will be removed in the next release. Use [`client.NewRegistryClient`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/registry/client#NewRegistryClient)
          instead. [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889),
          [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889)\n-   Go-SDK:
          `registry`: Deprecate `RepositoryInfo.Official` field. [moby/moby#49567](https://redirect.github.com/moby/moby/pull/49567)\n-
          \  Go-SDK: `registry`: deprecate `HostCertsDir`: this function was only
          used internally and will be removed in the next release. [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n-
          \  Go-SDK: `registry`: deprecate `SetCertsDir`: the cert-directory is now
          automatically selected when running with RootlessKit, and should no longer
          be set manually. [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n\n###
          [`v28.0.1`](https://redirect.github.com/moby/moby/releases/tag/v28.0.1)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.0...v28.0.1)\n\n#####
          28.0.1\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.1)\n-
          \  [moby/moby, 28.0.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.1)\n\n#####
          Networking\n\n-   Remove dependency on kernel modules `ip_set`, `ip_set_hash_net`
          and `netfilter_xt_set`.\n    -   The dependency was introduced in release
          28.0.0 but proved too disruptive. The iptables rules using these modules
          have been replaced. [moby/moby#49530](https://redirect.github.com/moby/moby/pull/49530)\n-
          \  Allow daemon startup on a host with IPv6 disabled without requiring `--ip6tables=false`.
          [moby/moby#49525](https://redirect.github.com/moby/moby/pull/49525)\n-   Fix
          a bug that was causing containers with `--restart=always` and a published
          port already in use to restart in a tight loop. [moby/moby#49507](https://redirect.github.com/moby/moby/pull/49507)\n-
          \  Fix an issue with Swarm ingress, caused by incorrect ordering of iptables
          rules. [moby/moby#49538](https://redirect.github.com/moby/moby/pull/49538)\n-
          \  Fix creation of a swarm-scoped network from a `--config-only` network.
          [moby/moby#49521](https://redirect.github.com/moby/moby/pull/49521)\n-   Fix
          `docker network inspect` reporting an IPv6 gateway with CIDR suffix for
          a newly created network with no specific IPAM config, until a daemon restart.
          [moby/moby#49520](https://redirect.github.com/moby/moby/pull/49520)\n-   Improve
          the error reported when kernel modules `ip_set`, `ip_set_hash_net` and `netilter_xt_set`
          are not available. [moby/moby#49524](https://redirect.github.com/moby/moby/pull/49524)\n-
          \  Move most of Docker's iptables rules out of the filter-FORWARD chain,
          so that other applications are free to append rules that must follow Docker's
          rules. [moby/moby#49518](https://redirect.github.com/moby/moby/pull/49518)\n-
          \  Update `--help` output and man page lo state which options only apply
          to the default bridge network. [moby/moby#49522](https://redirect.github.com/moby/moby/pull/49522)\n\n#####
          Bug fixes and enhancements\n\n-   Fix `docker context create` always returning
          an error when using the `\"skip-tls-verify\"` option. [docker/cli#5850](https://redirect.github.com/docker/cli/pull/5850)\n-
          \  Fix shell completion suggesting IDs instead of names for services and
          nodes. [docker/cli#5848](https://redirect.github.com/docker/cli/pull/5848)\n-
          \  Fix unintentionally printing exit status to standard error output when
          `docker exec/run` returns a non-zero status. [docker/cli#5854](https://redirect.github.com/docker/cli/pull/5854)\n-
          \  Fix regression `protocol \"tcp\" is not supported by the RootlessKit
          port driver \"slirp4netns\"`. [moby/moby#49514](https://redirect.github.com/moby/moby/pull/49514)\n-
          \  containerd image store: Fix `docker inspect` not being able to show multi-platform
          images with missing layers for all platforms. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
          \  containerd image store: Fix `docker images --tree` reporting wrong content
          size. [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n-
          \  Fix compilation on i386 [moby/moby#49526](https://redirect.github.com/moby/moby/pull/49526)\n\n#####
          Packaging updates\n\n-   Update `github.com/go-jose/go-jose/v4` to v4.0.5
          to address. [GHSA-c6gw-w398-hv78](https://redirect.github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78)
          / [CVE-2025-27144](https://www.cve.org/CVERecord?id=CVE-2025-27144) [docker/cli#5867](https://redirect.github.com/docker/cli/pull/5867)\n-
          \  Update Buildx to [v0.21.1](https://redirect.github.com/docker/buildx/releases/tag/v0.21.1).
          [docker/docker-ce-packaging#1167](https://redirect.github.com/docker/docker-ce-packaging/pull/1167)\n-
          \  Update Compose to [v2.33.1](https://redirect.github.com/docker/compose/releases/tag/v2.33.1).
          [docker/docker-ce-packaging#1168](https://redirect.github.com/docker/docker-ce-packaging/pull/1168)\n\n#####
          API\n\n-   containerd image store: Fix `GET /images/json?manifests=1` not
          filling `Manifests` for index-only images. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
          \  containerd image store: Fix `GET /images/json and /images/<name>/json`
          `Size.Content` field including the size of content that's not available
          locally. [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n\n###
          [`v28.0.0`](https://redirect.github.com/moby/moby/releases/tag/v28.0.0)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v27.5.1...v28.0.0)\n\n#####
          28.0.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
          \  [moby/moby, 28.0.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
          \  Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.0.0/docs/deprecated.md).\n-
          \  Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.0.0/docs/api/version-history.md).\n\n#####
          New\n\n-   Add ability to mount an image inside a container via `--mount
          type=image`. [moby/moby#48798](https://redirect.github.com/moby/moby/pull/48798)\n
          \   -   You can also specify `--mount type=image,image-subpath=[subpath],...`
          option to mount a specific path from the image. [docker/cli#5755](https://redirect.github.com/docker/cli/pull/5755)\n-
          \  `docker images --tree` now shows metadata badges. [docker/cli#5744](https://redirect.github.com/docker/cli/pull/5744)\n-
          \  `docker load`, `docker save`, and `docker history` now support a `--platform`
          flag allowing you to choose a specific platform for single-platform operations
          on multi-platform images. [docker/cli#5331](https://redirect.github.com/docker/cli/pull/5331)\n-
          \  Add `OOMScoreAdj` to `docker service create` and `docker stack`. [docker/cli#5145](https://redirect.github.com/docker/cli/pull/5145)\n-
          \  `docker buildx prune` now supports `reserved-space`, `max-used-space`,
          `min-free-space` and `keep-bytes` filters. [moby/moby#48720](https://redirect.github.com/moby/moby/pull/48720)\n-
          \  Windows: Add support for running containerd as a child process of the
          daemon, instead of using a system-installed containerd. [moby/moby#47955](https://redirect.github.com/moby/moby/pull/47955)\n\n#####
          Networking\n\n-   The `docker-proxy` binary has been updated, older versions
          will not work with the updated `dockerd`. [moby/moby#48132](https://redirect.github.com/moby/moby/pull/48132)\n
          \   -   Close a window in which the userland proxy (`docker-proxy`) could
          accept TCP connections, that would then fail after `iptables` NAT rules
          were set up.\n    -   The executable `rootlesskit-docker-proxy` is no longer
          used, it has been removed from the build and distribution.\n-   DNS nameservers
          read from the host's `/etc/resolv.conf` are now always accessed from the
          host's network namespace. [moby/moby#48290](https://redirect.github.com/moby/moby/pull/48290)\n
          \   -   When the host's `/etc/resolv.conf` contains no nameservers and there
          are no `--dns` overrides, Google's DNS servers are no longer used, apart
          from by the default bridge network and in build containers.\n-   Container
          interfaces in bridge and macvlan networks now use randomly generated MAC
          addresses. [moby/moby#48808](https://redirect.github.com/moby/moby/pull/48808)\n
          \   -   Gratuitous ARP / Neighbour Advertisement messages will be sent when
          the interfaces are started so that, when IP addresses are reused, they're
          associated with the newly generated MAC address.\n    -   IPv6 addresses
          in the default bridge network are now IPAM-assigned, rather than being derived
          from the MAC address.\n-   The deprecated OCI `prestart` hook is now only
          used by build containers. For other containers, network interfaces are added
          to the network namespace after task creation is complete, before the container
          task is started. [moby/moby#47406](https://redirect.github.com/moby/moby/pull/47406)\n-
          \  Add a new `gw-priority` option to `docker run`, `docker container create`,
          and `docker network connect`. This option will be used by the Engine to
          determine which network provides the default gateway for a container. On
          `docker run`, this option is only available through the extended `--network`
          syntax. [docker/cli#5664](https://redirect.github.com/docker/cli/pull/5664)\n-
          \  Add a new netlabel `com.docker.network.endpoint.ifname` to customize
          the interface name used when connecting a container to a network. It's supported
          by all built-in network drivers on Linux. [moby/moby#49155](https://redirect.github.com/moby/moby/pull/49155)\n
          \   -   When a container is created with multiple networks specified, there's
          no guarantee on the order networks will be connected to the container. So,
          if a custom interface name uses the same prefix as the auto-generated names,
          for example `eth`, the container might fail to start.\n    -   The recommended
          practice is to use a different prefix, for example `en0`, or a numerical
          suffix high enough to never collide, for example `eth100`.\n    -   This
          label can be specified on `docker network connect` via the `--driver-opt`
          flag, for example `docker network connect --driver-opt=com.docker.network.endpoint.ifname=foobar
          \u2026`.\n    -   Or via the long-form `--network` flag on `docker run`,
          for example `docker run --network=name=bridge,driver-opt=com.docker.network.endpoint.ifname=foobar
          \u2026`\n-   If a custom network driver reports capability `GwAllocChecker`
          then, before a network is created, it will get a `GwAllocCheckerRequest`
          with the network's options. The custom driver may then reply that no gateway
          IP address should be allocated. [moby/moby#49372](https://redirect.github.com/moby/moby/pull/49372)\n\n#####
          Port publishing in bridge networks\n\n-   `dockerd` now requires `ipset`
          support in the Linux kernel. [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n
          \   -   The `iptables` and `ip6tables` rules used to implement port publishing
          and network isolation have been extensively modified. This enables some
          of the following functional changes, and is a first step in refactoring
          to enable native `nftables` support in a future release. [moby/moby#48815](https://redirect.github.com/moby/moby/issues/48815)\n
          \   -   If it becomes necessary to downgrade to an earlier version of the
          daemon, some manual cleanup of the new rules will be necessary. The simplest
          and surest approach is to reboot the host, or use `iptables -F` and `ip6tables
          -F` to flush all existing `iptables` rules from the `filter` table before
          starting the older version of the daemon. When that is not possible, run
          the following commands as root:\n        -   `iptables -D FORWARD -m set
          --match-set docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED
          -j ACCEPT; ip6tables -D FORWARD -m set --match-set docker-ext-bridges-v6
          dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT`\n        -   `iptables
          -D FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER; ip6tables
          -D FORWARD -m set --match-set docker-ext-bridges-v6 dst -j DOCKER`\n        -
          \  If you were previously running with the iptables filter-FORWARD policy
          set to `ACCEPT` and need to restore access to unpublished ports, also delete
          per-bridge-network rules from the `DOCKER` chains. For example, `iptables
          -D DOCKER ! -i docker0 -o docker0 -j DROP`.\n-   Fix a security issue that
          was allowing remote hosts to connect directly to a container on its published
          ports. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
          \  Fix a security issue that was allowing neighbor hosts to connect to ports
          mapped on a loopback address. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
          \  Fix an issue that prevented port publishing to link-local addresses.
          [moby/moby#48570](https://redirect.github.com/moby/moby/pull/48570)\n-   UDP
          ports published by a container are now reliably accessible by containers
          on other networks, via the host's public IP address. [moby/moby#48571](https://redirect.github.com/moby/moby/pull/48571)\n-
          \  Docker will now only set the `ip6tables` policy for the `FORWARD` chain
          in the `filter` table to `DROP` if it enables IP forwarding on the host
          itself (sysctls `net.ipv6.conf.all.forwarding` and `net.ipv6.conf.default.forwarding`).
          This is now aligned with existing IPv4 behaviour. [moby/moby#48594](https://redirect.github.com/moby/moby/pull/48594)\n
          \   -   If IPv6 forwarding is enabled on your host, but you were depending
          on Docker to set the ip6tables filter-FORWARD policy to `DROP`, you may
          need to update your host's configuration to make sure it is secure.\n-   Direct
          routed access to container ports that are not exposed using `p`/`-publish`
          is now blocked in the `DOCKER` iptables chain. [moby/moby#48724](https://redirect.github.com/moby/moby/pull/48724)\n
          \   -   If the default iptables filter-FORWARD policy was previously left
          at `ACCEPT` on your host, and direct routed access to a container's unpublished
          ports from a remote host is still required, options are:\n        -   Publish
          the ports you need.\n        -   Use the new `gateway_mode_ipv[46]=nat-unprotected`,
          described below.\n    -   Container ports published to host addresses will
          continue to be accessible via those host addresses, using NAT or the userland
          proxy.\n    -   Unpublished container ports continue to be directly accessible
          from the Docker host via the container's IP address.\n-   Networks created
          with `gateway_mode_ipv[46]=routed` are now accessible from other bridge
          networks running on the same Docker host, as well as from outside the host.
          [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n-   Bridge
          driver options `com.docker.network.bridge.gateway_mode_ipv4` and `com.docker.network.bridge.gateway_mode_ipv6`
          now accept mode `nat-unprotected`. [moby/moby#48597](https://redirect.github.com/moby/moby/pull/48597)\n
          \   -   `nat-unprotected` is similar to the default `nat` mode, but no per
          port/protocol rules are set up. This means any port on a container can be
          accessed by direct-routing from a remote host.\n-   Bridge driver options
          `com.docker.network.bridge.gateway_mode_ipv4` and `com.docker.network.bridge.gateway_mode_ipv6`
          now accept mode `isolated`, when the network is also `internal`. [moby/moby#49262](https://redirect.github.com/moby/moby/pull/49262)\n
          \   -   An address is normally assigned to the bridge device in an `internal`
          network. So, processes on the Docker host can access the network, and containers
          in the network can access host services listening on that bridge address
          (including services listening on \"any\" host address, `0.0.0.0` or `::`).\n
          \   -   An `internal` bridge network created with gateway mode `isolated`
          does not have an address on the Docker host.\n-   When a port mapping includes
          a host IP address or port number that cannot be used because NAT from the
          host is disabled using `--gateway_mode_ipv[46]`, container creation will
          no longer fail. The unused fields may be needed if the gateway endpoint
          changes when networks are connected or disconnected. A message about the
          unused fields will be logged. [moby/moby#48575](https://redirect.github.com/moby/moby/pull/48575)\n-
          \  Do not create iptables nat-POSTROUTING masquerade rules for a container's
          own published ports, when the userland proxy is enabled. [moby/moby#48854](https://redirect.github.com/moby/moby/pull/48854)\n\n#####
          IPv6\n\n-   Add `docker network create` option `--ipv4`. To disable IPv4
          address assignment for a network, use `docker network create --ipv4=false
          [...]`. [docker/cli#5599](https://redirect.github.com/docker/cli/pull/5599)\n-
          \  Daemon option `--ipv6` (`\"ipv6\": true` in `daemon.json`) can now be
          used without `fixed-cidr-v6`. [moby/moby#48319](https://redirect.github.com/moby/moby/pull/48319)\n-
          \  IPAM now handles subnets bigger than \"/64\". [moby/moby#49223](https://redirect.github.com/moby/moby/pull/49223)\n-
          \  Duplicate address detection (DAD) is now disabled for addresses assigned
          to the bridges belonging to bridge networks. [moby/moby#48609](https://redirect.github.com/moby/moby/pull/48609)\n-
          \  Modifications to `host-gateway`, for compatibility with IPv6-only networks.
          [moby/moby#48807](https://redirect.github.com/moby/moby/pull/48807)\n    -
          \  When special value `host-gateway` is used in an `--add-host` option in
          place of an address, it's replaced by an address on the Docker host to make
          it possible to refer to the host by name. The address used belongs to the
          default bridge (normally `docker0`). Until now it's always been an IPv4
          address, because all containers on bridge networks had IPv4 addresses.\n
          \   -   Now, if IPv6 is enabled on the default bridge network, `/etc/hosts`
          entries will be created for IPv4 and IPv6 addresses. So, a container that's
          only connected to IPv6-only networks can access the host by name.\n    -
          \  The `--host-gateway-ip` option overrides the address used to replace
          `host-gateway`. Two of these options are now allowed on the command line,
          for one IPv4 gateway and one IPv6.\n    -   In the `daemon.json` file, to
          provide two addresses, use `\"host-gateway-ips\"`. For example, `\"host-gateway-ips\":
          [\"192.0.2.1\", \"2001:db8::1111\"]`.\n\n##### Bug fixes and enhancements\n\n-
          \  Add IPv6 loopback address as an insecure registry by default. [moby/moby#48540](https://redirect.github.com/moby/moby/pull/48540)\n-
          \  Add support for Cobra-generated completion scripts for `dockerd`. [moby/moby#49339](https://redirect.github.com/moby/moby/pull/49339)\n-
          \  Fix DNS queries failing when containers are launched via `systemd` auto-start
          on boot [moby/moby#48812](https://redirect.github.com/moby/moby/pull/48812)\n-
          \  Fix Docker Swarm mode ignoring `volume.subpath` [docker/cli#5833](https://redirect.github.com/docker/cli/pull/5833)\n-
          \  Fix `docker export` continuing the export after the operation is canceled.
          [moby/moby#49265](https://redirect.github.com/moby/moby/pull/49265)\n-   Fix
          `docker export` not releasing the container's writable layer after a failure.
          [moby/moby#48517](https://redirect.github.com/moby/moby/pull/48517)\n-   Fix
          `docker images --tree` unnecessary truncating long image names when multiple
          names are available [docker/cli#5757](https://redirect.github.com/docker/cli/pull/5757)\n-
          \  Fix a bug where a container with a name matching another container's
          ID is not restored on daemon startup. [moby/moby#48669](https://redirect.github.com/moby/moby/pull/48669)\n-
          \  Fix an issue preventing some IPv6 addresses shown by `docker ps` to be
          properly bracketed [docker/cli#5468](https://redirect.github.com/docker/cli/pull/5468)\n-
          \  Fix bug preventing image pulls from being cancelled during `docker run`.
          [docker/cli#5645](https://redirect.github.com/docker/cli/pull/5645)\n-   Fix
          error-handling when running the daemon as a Windows service to prevent unclean
          exits. [moby/moby#48518](https://redirect.github.com/moby/moby/pull/48518)\n-
          \  Fix issue causing output of `docker run` to be inconsistent when using
          `--attach stdout` or `--attach stderr` versus `stdin`.  `docker run --attach
          stdin` now exits if the container exits. [docker/cli#5662](https://redirect.github.com/docker/cli/pull/5662)\n-
          \  Fix rootless Docker setup with `subid` backed by NSS modules. [moby/moby#49036](https://redirect.github.com/moby/moby/pull/49036)\n-
          \  Generated completion scripts from the CLI now show descriptions next
          to each command/flag suggestion. [docker/cli#5756](https://redirect.github.com/docker/cli/pull/5756)\n-
          \  IPv6 addresses shown by `docker ps` in port bindings are now bracketed
          [docker/cli#5363](https://redirect.github.com/docker/cli/pull/5363)\n-   Implement
          the ports validation method for Compose [docker/cli#5524](https://redirect.github.com/docker/cli/pull/5524)\n-
          \  Improve error-output for invalid flags on the command line. [docker/cli#5233](https://redirect.github.com/docker/cli/pull/5233)\n-
          \  Improve errors when failing to start a container using anther container's
          network namespace. [moby/moby#49367](https://redirect.github.com/moby/moby/pull/49367)\n-
          \  Improve handling of invalid API errors that could result in an empty
          error message being shown. [moby/moby#49373](https://redirect.github.com/moby/moby/pull/49373)\n-
          \  Improve output and consistency for unknown (sub)commands and invalid
          arguments [docker/cli#5234](https://redirect.github.com/docker/cli/pull/5234)\n-
          \  Improve validation of `exec-opts` in daemon configuration. [moby/moby#48979](https://redirect.github.com/moby/moby/pull/48979)\n-
          \  Update the handling of the `--gpus=0` flag to be consistent with the
          NVIDIA Container Runtime. [moby/moby#48482](https://redirect.github.com/moby/moby/pull/48482)\n-
          \  `client.ContainerCreate` now normalizes `CapAdd` and `CapDrop` fields
          in `HostConfig` to their canonical form. [moby/moby#48551](https://redirect.github.com/moby/moby/pull/48551)\n-
          \  `docker image save` now produces stable timestamps. [moby/moby#48611](https://redirect.github.com/moby/moby/pull/48611)\n-
          \  `docker inspect` now lets you inspect Swarm configs [docker/cli#5573](https://redirect.github.com/docker/cli/pull/5573)\n-
          \  containerd image store: Add support for `Extracting` layer status in
          `docker pull`. [moby/moby#49064](https://redirect.github.com/moby/moby/pull/49064)\n-
          \  containerd image store: Fix `commit`, `import`, and `build` not preserving
          a replaced image as a dangling image. [moby/moby#48316](https://redirect.github.com/moby/moby/pull/48316)\n-
          \  containerd image store: Make `docker load --platform` return an error
          when the requested platform isn't loaded. [moby/moby#48718](https://redirect.github.com/moby/moby/pull/48718)\n-
          \  Fix validation of `--link` option. [docker/cli#5739](https://redirect.github.com/docker/cli/pull/5739)\n-
          \  Add validation of network-diagnostic-port daemon configuration option.
          [moby/moby#49305](https://redirect.github.com/moby/moby/pull/49305)\n-   Unless
          explicitly configured, an IP address is no longer reserved for a gateway
          in cases where it is not required. Namely, \u201Cinternal\u201D bridge networks
          with option `com.docker.network.bridge.inhibit_ipv4`, `ipvlan` or `macvlan`
          networks with no parent interface, and L3 IPvlan modes. [moby/moby#49261](https://redirect.github.com/moby/moby/pull/49261)\n-
          \  If a custom network driver reports capability `GwAllocChecker` then,
          before a network is created, it will get a `GwAllocCheckerRequest` with
          the network's options. The custom driver may then reply that no gateway
          IP address should be allocated. [moby/moby#49372](https://redirect.github.com/moby/moby/pull/49372)\n-
          \  Fixed an issue that meant a container could not be attached to an L3
          IPvlan at the same time as other network types. [moby/moby#49130](https://redirect.github.com/moby/moby/pull/49130)\n-
          \  Remove the correct `/etc/hosts` entries when disconnecting a container
          from a network. [moby/moby#48857](https://redirect.github.com/moby/moby/pull/48857)\n-
          \  Fix duplicate network disconnect events. [moby/moby#48800](https://redirect.github.com/moby/moby/pull/48800)\n-
          \  Resolve issues related to changing `fixed-cidr` for `docker0`, and inferring
          configuration from a user-managed default bridge (`--bridge`). [moby/moby#48319](https://redirect.github.com/moby/moby/pull/48319)\n-
          \  Remove feature flag `windows-dns-proxy`, introduced in release 26.1.0
          to control forwarding to external DNS resolvers from Windows containers,
          to make `nslookup` work. It was enabled by default in release 27.0.0. [moby/moby#48738](https://redirect.github.com/moby/moby/pull/48738)\n-
          \  Remove an `iptables` mangle rule for checksumming SCTP. The rule can
          be re-enabled by setting `DOCKER_IPTABLES_SCTP_CHECKSUM=1` in the daemon's
          environment. This override will be removed in a future release. [moby/moby#48149](https://redirect.github.com/moby/moby/pull/48149)\n-
          \  Faster connection to bridge networks, in most cases. [moby/moby#49302](https://redirect.github.com/moby/moby/pull/49302)\n\n#####
          Packaging updates\n\n-   Update Go runtime to [1.23.6](https://go.dev/doc/devel/release#go1.23.6).
          [docker/cli#5795](https://redirect.github.com/docker/cli/pull/5795), [moby/moby#49393](https://redirect.github.com/moby/moby/pull/49393),
          [docker/docker-ce-packaging#1161](https://redirect.github.com/docker/docker-ce-packaging/pull/1161)\n-
          \  Update `runc` to [v1.2.5](https://redirect.github.com/opencontainers/runc/releases/tag/v1.2.5)
          (static binaries only). [moby/moby#49464](https://redirect.github.com/moby/moby/pull/49464)\n-
          \  Update containerd to [v1.7.25](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.25).
          [moby/moby#49252](https://redirect.github.com/moby/moby/pull/49252)\n-   Update
          BuildKit to [v0.20.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.0).
          [moby/moby#49495](https://redirect.github.com/moby/moby/pull/49495)\n-   Update
          Buildx to [v0.21.0](https://redirect.github.com/docker/buildx/releases/tag/v0.21.0).
          [docker/docker-ce-packaging#1166](https://redirect.github.com/docker/docker-ce-packaging/pull/1166)\n-
          \  Update Compose to [v2.32.4](https://redirect.github.com/docker/compose/releases/tag/v2.32.3).
          [docker/docker-ce-packaging#1143](https://redirect.github.com/docker/docker-ce-packaging/pull/1143)\n-
          \  The canonical source for the `dockerd(8)` man page has been moved back
          to the `moby/moby` repository itself. [moby/moby#48298](https://redirect.github.com/moby/moby/pull/48298)\n\n#####
          Go SDK\n\n-   Improve validation of empty object IDs. The client now returns
          an \"Invalid Parameter\" error when trying to use an empty ID or name. This
          changes the error returned by some \"Inspect\" functions from a \"Not found\"
          error to an \"Invalid Parameter\". [moby/moby#49381](https://redirect.github.com/moby/moby/pull/49381)\n-
          \  `Client.ImageBuild()` now omits default values from the API request's
          query string. [moby/moby#48651](https://redirect.github.com/moby/moby/pull/48651)\n-
          \  `api/types/container`: Merge `Stats` and `StatsResponse` [moby/moby#49287](https://redirect.github.com/moby/moby/pull/49287)\n-
          \  `client.WithVersion`: Strip v-prefix when setting API version [moby/moby#49352](https://redirect.github.com/moby/moby/pull/49352)\n-
          \  `client`: Add `WithTraceOptions` allowing to specify custom OTe1 trace
          options. [moby/moby#49415](https://redirect.github.com/moby/moby/pull/49415)\n-
          \  `client`: Add `HijackDialer` interface. [moby/moby#49388](https://redirect.github.com/moby/moby/pull/49388)\n-
          \  `client`: Add `SwarmManagementAPIClient` interface to describe all API
          client methods related to Swarm-specific objects. [moby/moby#49388](https://redirect.github.com/moby/moby/pull/49388)\n-
          \  `client`: Add `WithTraceOptions` allowing to specify custom OTel trace
          options. [moby/moby#49415](https://redirect.github.com/moby/moby/pull/49415)\n-
          \  `client`: `ImageHistory`, `ImageLoad` and `ImageSave` now use variadic
          functional options [moby/moby#49466](https://redirect.github.com/moby/moby/pull/49466)\n-
          \  `pkg/containerfs`: Move to internal [moby/moby#48097](https://redirect.github.com/moby/moby/pull/48097)\n-
          \  `pkg/reexec`: Can now be used on platforms other than Linux, Windows,
          macOS and FreeBSD [moby/moby#49118](https://redirect.github.com/moby/moby/pull/49118)\n-
          \  `api/types/container`: introduce `CommitResponse` type. This is currently
          an alias for `IDResponse`, but may become a distinct type in a future release.
          [moby/moby#49444](https://redirect.github.com/moby/moby/pull/49444)\n-   `api/types/container`:
          introduce `ExecCreateResponse` type. This is currently an alias for `IDResponse`,
          but may become a distinct type in a future release. [moby/moby#49444](https://redirect.github.com/moby/moby/pull/49444)\n\n#####
          API\n\n-   Update API version to [v1.48](https://docs.docker.com/engine/api/v1.48/)
          [moby/moby#48476](https://redirect.github.com/moby/moby/pull/48476)\n-   `GET
          /images/{name}/json` response now returns the `Manifests` field containing
          information about the sub-manifests contained in the image index. This includes
          things like platform-specific manifests and build attestations. [moby/moby#48264](https://redirect.github.com/moby/moby/pull/48264)\n-
          \  `POST /containers/create` now supports `Mount` of type `image` for mounting
          an image inside a container. [moby/moby#48798](https://redirect.github.com/moby/moby/pull/48798)\n-
          \  `GET /images/{name}/history` now supports a `platform` parameter (JSON
          encoded OCI Platform type) that lets you specify a platform to show the
          history of. [moby/moby#48295](https://redirect.github.com/moby/moby/pull/48295)\n-
          \  `POST /images/{name}/load` and `GET /images/{name}/get` now supports
          a `platform` parameter (JSON encoded OCI Platform type) that lets you specify
          a platform to load/save. Not passing this parameter results in loading/saving
          the full multi-platform image. [moby/moby#48295](https://redirect.github.com/moby/moby/pull/48295)\n-
          \  Improve errors for invalid width/height on container resize and exec
          resize [moby/moby#48679](https://redirect.github.com/moby/moby/pull/48679)\n-
          \  The `POST /containers/create` endpoint now includes a warning in the
          response when setting the container-wide `VolumeDriver` option in combination
          with volumes defined through `Mounts` because the `VolumeDriver` option
          has no effect on those volumes. This warning was previously generated by
          the CLI. [moby/moby#48789](https://redirect.github.com/moby/moby/pull/48789)\n-
          \  containerd image store: `GET /images/json` and `GET /images/{name}/json`
          responses now includes `Descriptor` field, which contains an OCI descriptor
          of the image target. The new field is only populated if the daemon provides
          a multi-platform image store. [moby/moby#48894](https://redirect.github.com/moby/moby/pull/48894)\n-
          \  containerd image store: `GET /containers/{name}/json` now returns an
          `ImageManifestDescriptor` field containing the OCI descriptor of the platform-specific
          image manifest of the image that was used to create the container. [moby/moby#48855](https://redirect.github.com/moby/moby/pull/48855)\n-
          \  Add debug endpoints (`GET /debug/vars`, `GET /debug/pprof/`, `GET /debug/pprof/cmdline`,
          `GET /debug/pprof/profile`, `GET /debug/pprof/symbol`, `GET /debug/pprof/trace`,
          `GET /debug/pprof/{name}`) are now also accessible through the versioned-API
          paths (`/v<API-version>/<endpoint>`). [moby/moby#49051](https://redirect.github.com/moby/moby/pull/49051)\n-
          \  Fix API returning a `500` status code instead of `400` for validation
          errors. [moby/moby#49217](https://redirect.github.com/moby/moby/pull/49217)\n-
          \  Fix status codes for archive endpoints `HEAD /containers/{name:.*}/archive`,
          `GET /containers/{name:.*}/archive`, `PUT /containers/{name:.*}/archive`
          returning a `500` status instead of a `400` status. [moby/moby#49219](https://redirect.github.com/moby/moby/pull/49219)\n-
          \  `POST /containers/create` now accepts a `writable-cgroups=true` option
          in `HostConfig.SecurityOpt` to mount the container's cgroups writable. This
          provides a more granular approach than `HostConfig.Privileged`. [moby/moby#48828](https://redirect.github.com/moby/moby/pull/48828)\n-
          \  `POST /build/prune` renames `keep-bytes` to `reserved-space` and now
          supports additional prune parameters `max-used-space` and `min-free-space`.
          [moby/moby#48720](https://redirect.github.com/moby/moby/pull/48720)\n-   `POST
          /networks/create` now has an `EnableIPv4` field. Setting it to `false` disables
          IPv4 IPAM for the network. [moby/moby#48271](https://redirect.github.com/moby/moby/pull/48271)\n
          \   -   `GET /networks/{id}` now returns an `EnableIPv4` field showing whether
          the network has IPv4 IPAM enabled. [moby/moby#48271](https://redirect.github.com/moby/moby/pull/48271)\n
          \   -   User-defined bridge networks require either IPv4 or IPv6 address
          assignment to be enabled. IPv4 cannot be disabled for the default bridge
          network (`docker0`). [moby/moby#48323](https://redirect.github.com/moby/moby/pull/48323)\n
          \   -   `macvlan` and `ipvlan` networks can be created with address assignment
          disabled for IPv4, IPv6, or both address families. [moby/moby#48299](https://redirect.github.com/moby/moby/pull/48299)\n
          \   -   IPv4 cannot be disabled for Windows or Swarm networks. [moby/moby#48278](https://redirect.github.com/moby/moby/pull/48278)\n-
          \  Add a way to specify which network should provide the default gateway
          for a container. [moby/moby#48936](https://redirect.github.com/moby/moby/pull/48936)\n
          \   -   `POST /networks/{id}/connect` and `POST /containers/create` now
          accept a `GwPriority` field in `EndpointsConfig`. This value is used to
          determine which network endpoint provides the default gateway for the container.
          The endpoint with the highest priority is selected. If multiple endpoints
          have the same priority, endpoints are sorted lexicographically by their
          network name, and the one that sorts first is picked. [moby/moby#48746](https://redirect.github.com/moby/moby/pull/48746)\n
          \   -   `GET /containers/json` now returns a `GwPriority` field in `NetworkSettings`
          for each network endpoint. The `GwPriority` field is used by the CLI\u2019s
          new `gw-priority` option for `docker run` and `docker network connect`.
          [moby/moby#48746](https://redirect.github.com/moby/moby/pull/48746)\n-   Settings
          for `eth0` in `--sysctl` options are no longer automatically migrated to
          the network endpoint. [moby/moby#48746](https://redirect.github.com/moby/moby/pull/48746)\n
          \   -   For example, in the Docker CLI, `docker run --network mynet --sysctl
          net.ipv4.conf.eth0.log_martians=1 ...` is rejected. Instead, you must use
          `docker run --network name=mynet,driver-opt=com.docker.network.endpoint.sysctls=net.ipv4.conf.IFNAME.log_martians=1
          ...`\n-   `GET /containers/json` now returns an `ImageManifestDescriptor`
          field matching the same field in `/containers/{name}/json`. This field is
          only populated if the daemon provides a multi-platform image store. [moby/moby#49407](https://redirect.github.com/moby/moby/pull/49407)\n\n#####
          Removed\n\n-   The Fluent logger option `fluentd-async-connect` has been
          deprecated in v20.10 and is now removed. [moby/moby#46114](https://redirect.github.com/moby/moby/pull/46114)\n-
          \  The `--time` option on `docker stop` and `docker restart` is deprecated
          and renamed to `--timeout`. [docker/cli#5485](https://redirect.github.com/docker/cli/pull/5485)\n-
          \  Go-SDK: `pkg/ioutils`: Remove `NewReaderErrWrapper` as it was never used.
          [moby/moby#49258](https://redirect.github.com/moby/moby/pull/49258)\n-   Go-SDK:
          `pkg/ioutils`: Remove deprecated `BytesPipe`, `NewBytesPipe`, `ErrClosed`,
          `WriteCounter`, `NewWriteCounter`, `NewReaderErrWrapper`, `NopFlusher`.
          [moby/moby#49245](https://redirect.github.com/moby/moby/pull/49245)\n-   Go-SDK:
          `pkg/ioutils`: Remove deprecated `NopWriter` and `NopWriteCloser`. [moby/moby#49256](https://redirect.github.com/moby/moby/pull/49256)\n-
          \  Go-SDK: `pkg/sysinfo`: Remove deprecated NumCPU. [moby/moby#49242](https://redirect.github.com/moby/moby/pull/49242)\n-
          \  Go-SDK: Remove `pkg/broadcaster`, as it was only used internally [moby/moby#49172](https://redirect.github.com/moby/moby/pull/49172)\n-
          \  Go-SDK: Remove deprecated `cli.Errors` type [docker/cli#5549](https://redirect.github.com/docker/cli/pull/5549)\n-
          \  Remove `pkg/ioutils.ReadCloserWrapper`, as it was only used in tests.
          [moby/moby#49237](https://redirect.github.com/moby/moby/pull/49237)\n-   Remove
          deprecated `api-cors-header` config parameter and the `dockerd` `--api-cors-header`
          option [moby/moby#48209](https://redirect.github.com/moby/moby/pull/48209)\n-
          \  Remove deprecated `APIEndpoint.Version` field, `APIVersion` type, and
          `APIVersion1` and `APIVersion2` consts. [moby/moby#49004](https://redirect.github.com/moby/moby/pull/49004)\n-
          \  Remove deprecated `api-cors-header` config parameter and the Docker daemon's
          `--api-cors-header` option. [docker/cli#5437](https://redirect.github.com/docker/cli/pull/5437)\n-
          \  Remove deprecated `pkg/directory` package [moby/moby#48779](https://redirect.github.com/moby/moby/pull/48779)\n-
          \  Remove deprecated `pkg/dmsg.Dmesg()` [moby/moby#48109](https://redirect.github.com/moby/moby/pull/48109)\n-
          \  Remove deprecated image/spec package, which was moved to a separate module
          (`github.com/moby/docker-image-spec`) [moby/moby#48460](https://redirect.github.com/moby/moby/pull/48460)\n-
          \  Remove migration code and errors for the deprecated `logentries` logging
          driver. [moby/moby#48891](https://redirect.github.com/moby/moby/pull/48891)\n-
          \  Remove support for deprecated external graph-driver plugins. [moby/moby#48072](https://redirect.github.com/moby/moby/pull/48072)\n-
          \  `api/types`: Remove deprecated `container.ContainerNode` and `ContainerJSONBase.Node`
          field. [moby/moby#48107](https://redirect.github.com/moby/moby/pull/48107)\n-
          \  `api/types`: Remove deprecated aliases: `ImagesPruneReport`, `VolumesPruneReport`,
          `NetworkCreateRequest`, `NetworkCreate`, `NetworkListOptions`, `NetworkCreateResponse`,
          `NetworkInspectOptions`, `NetworkConnect`, `NetworkDisconnect`, `EndpointResource`,
          `NetworkResource`, `NetworksPruneReport`, `ExecConfig`, `ExecStartCheck`,
          `ContainerExecInspect`, `ContainersPruneReport`, `ContainerPathStat`, `CopyToContainerOptions`,
          `ContainerStats`, `ImageSearchOptions`, `ImageImportSource`, `ImageLoadResponse`,
          `ContainerNode`. [moby/moby#48107](https://redirect.github.com/moby/moby/pull/48107)\n-
          \  `libnetwork/iptables`: Remove deprecated `IPV`, `Iptables`, `IP6Tables`
          and `Passthrough()`. [moby/moby#49121](https://redirect.github.com/moby/moby/pull/49121)\n-
          \  `pkg/archive`: Remove deprecated `CanonicalTarNameForPath`, `NewTempArchive`,
          `TempArchive` [moby/moby#48708](https://redirect.github.com/moby/moby/pull/48708)\n-
          \  `pkg/fileutils`: Remove deprecated `GetTotalUsedFds` [moby/moby#49210](https://redirect.github.com/moby/moby/pull/49210)\n-
          \  `pkg/ioutils`: Remove `OnEOFReader`, which was only used internally [moby/moby#49170](https://redirect.github.com/moby/moby/pull/49170)\n-
          \  `pkg/longpath`: Remove deprecated `Prefix` constant. [moby/moby#48779](https://redirect.github.com/moby/moby/pull/48779)\n-
          \  `pkg/stringid`: Remove deprecated `IsShortID` and  `ValidateID` functions
          [moby/moby#48705](https://redirect.github.com/moby/moby/pull/48705)\n-   `runconfig/opts`:
          Remove deprecated `ConvertKVStringsToMap` [moby/moby#48102](https://redirect.github.com/moby/moby/pull/48102)\n-
          \  `runconfig`: Remove deprecated `ContainerConfigWrapper`, `SetDefaultNetModeIfBlank`,
          `DefaultDaemonNetworkMode`, `IsPreDefinedNetwork` [moby/moby#48102](https://redirect.github.com/moby/moby/pull/48102)\n-
          \  `container`: Remove deprecated `ErrNameReserved`, `ErrNameNot\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: Branch creation - At any time
          (no schedule defined), Automerge - At any time (no schedule defined).\n\n\U0001F6A6
          **Automerge**: Disabled by config. Please merge this manually once you are
          satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you
          tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR
          and you won't be reminded about these updates again.\n\n---\n\n - [ ] <!--
          rebase-check -->If you want to rebase/retry this PR, check this box\n\n---\n\nThis
          PR was generated by [Mend Renovate](https://mend.io/renovate/). View the
          [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjM5LjI1Ny4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/release/pull/1807
        commit_id: 65478946b4201083b6ac113f5d0766422a4bd5b9
        patchset: 65478946b4201083b6ac113f5d0766422a4bd5b9
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      change: '1807'
      change_message: "chore(deps): update dependency moby/moby to v28\n\nThis PR
        contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
        [moby/moby](https://redirect.github.com/moby/moby) | major | `5:27.5.1` ->
        `v28.1.1` |\n| [moby/moby](https://redirect.github.com/moby/moby) | major
        | `27.5.1` -> `28.1.1` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>moby/moby
        (moby/moby)</summary>\n\n### [`v28.1.1`](https://redirect.github.com/moby/moby/releases/tag/v28.1.1)\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.1.0...v28.1.1)\n\n#####
        28.1.1\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n-   [docker/cli, 28.1.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.1)\n-
        \  [moby/moby, 28.1.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.1)\n\n#####
        Bug fixes and enhancements\n\n-   Fix `dockerd-rootless-setuptool.sh` incorrectly
        reporting missing `iptables`. [moby/moby#49833](https://redirect.github.com/moby/moby/pull/49833)\n-
        \  containerd image store: Fix a potential daemon crash when using `docker
        load` with archives containing zero-size tar headers. [moby/moby#49837](https://redirect.github.com/moby/moby/pull/49837)\n\n#####
        Packaging updates\n\n-   Update Buildx to [v0.23.0](https://redirect.github.com/docker/buildx/releases/tag/v0.23.0).
        [docker/docker-ce-packaging#1185](https://redirect.github.com/docker/docker-ce-packaging/pull/1185)\n-
        \  Update Compose to [v2.35.1](https://redirect.github.com/docker/compose/releases/tag/v2.35.1).
        [docker/docker-ce-packaging#1188](https://redirect.github.com/docker/docker-ce-packaging/pull/1188)\n\n#####
        Networking\n\n-   Add a warning to a container's `/etc/resolv.conf` when no
        upstream DNS servers were found. [moby/moby#49827](https://redirect.github.com/moby/moby/pull/49827)\n\n###
        [`v28.1.0`](https://redirect.github.com/moby/moby/releases/tag/v28.1.0)\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.0.4...v28.1.0)\n\n#####
        28.1.0\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n-   [docker/cli, 28.1.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
        \  [moby/moby, 28.1.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
        \  Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.1.0/docs/api/version-history.md).\n\n#####
        New\n\n-   Add `docker bake` sub-command as alias for `docker buildx bake`.
        [docker/cli#5947](https://redirect.github.com/docker/cli/pull/5947)\n-   Experimental:
        add a new `--use-api-socket` flag on `docker run` and `docker create` to enable
        access to Docker socket from inside a container and to share credentials from
        the host with the container. [docker/cli#5858](https://redirect.github.com/docker/cli/pull/5858)\n-
        \  `docker image inspect` now supports a `--platform` flag to inspect a specific
        platform of a multi-platform image. [docker/cli#5934](https://redirect.github.com/docker/cli/pull/5934)\n\n#####
        Bug fixes and enhancements\n\n-   Add CLI shell-completion for context names.
        [docker/cli#6016](https://redirect.github.com/docker/cli/pull/6016)\n-   Fix
        `docker images --tree` not including non-container images content size in
        the total image content size. [docker/cli#6000](https://redirect.github.com/docker/cli/pull/6000)\n-
        \  Fix `docker load` not preserving replaced images. [moby/moby#49650](https://redirect.github.com/moby/moby/pull/49650)\n-
        \  Fix `docker login` hints when logging in to a custom registry. [docker/cli#6015](https://redirect.github.com/docker/cli/pull/6015)\n-
        \  Fix `docker stats` not working properly on machines with high CPU core
        count. [moby/moby#49734](https://redirect.github.com/moby/moby/pull/49734)\n-
        \  Fix a regression causing `docker pull/push` to fail when interacting with
        a private repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n-
        \  Fix an issue preventing rootless Docker setup on a host with no `ip_tables`
        kernel module. [moby/moby#49727](https://redirect.github.com/moby/moby/pull/49727)\n-
        \  Fix an issue that could lead to unwanted iptables rules being restored
        and never deleted following a firewalld reload. [moby/moby#49728](https://redirect.github.com/moby/moby/pull/49728)\n-
        \  Improve CLI completion of `docker service scale`. [docker/cli#5968](https://redirect.github.com/docker/cli/pull/5968)\n-
        \  `docker images --tree` now hides both untagged and dangling images by default.
        [docker/cli#5924](https://redirect.github.com/docker/cli/pull/5924)\n-   `docker
        system info` will provide an exit code if a connection cannot be established
        to the Docker daemon. [docker/cli#5918](https://redirect.github.com/docker/cli/pull/5918)\n-
        \  containerd image store: Fix `image tag` event not being emitted when building
        with BuildKit. [moby/moby#49678](https://redirect.github.com/moby/moby/pull/49678)\n-
        \  containerd image store: Improve `docker push/pull` handling of remote registry
        errors. [moby/moby#49770](https://redirect.github.com/moby/moby/pull/49770)\n-
        \  containerd image store: Show pull progress for non-layer image blobs. [moby/moby#49746](https://redirect.github.com/moby/moby/pull/49746)\n\n#####
        Packaging updates\n\n-   Add Debian \"Trixie\" packages. [docker/docker-ce-packaging#1181](https://redirect.github.com/docker/docker-ce-packaging/pull/1181)\n-
        \  Add Fedora 42 packages. [docker/containerd-packaging#418](https://redirect.github.com/docker/containerd-packaging/pull/418),
        [docker/docker-ce-packaging#1169](https://redirect.github.com/docker/docker-ce-packaging/pull/1169)\n-
        \  Add Ubuntu 25.04 \"Plucky Puffin\" packages. [docker/containerd-packaging#419](https://redirect.github.com/docker/containerd-packaging/pull/419),
        [docker/docker-ce-packaging#1177](https://redirect.github.com/docker/docker-ce-packaging/pull/1177)\n-
        \  Update BuildKit to [v0.21.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.21.0).
        [moby/moby#49809](https://redirect.github.com/moby/moby/pull/49809)\n-   Update
        Compose to [v2.35.0](https://redirect.github.com/docker/compose/releases/tag/v2.35.0).
        [docker/docker-ce-packaging#1183](https://redirect.github.com/docker/docker-ce-packaging/pull/1183)\n-
        \  Update Go runtime to [1.23.8](https://go.dev/doc/devel/release#go1.23.8).
        [docker/cli#5986](https://redirect.github.com/docker/cli/pull/5986), [docker/docker-ce-packaging#1180](https://redirect.github.com/docker/docker-ce-packaging/pull/1180),
        [moby/moby#49737](https://redirect.github.com/moby/moby/pull/49737)\n\n#####
        Networking\n\n-   Fix a bug causing host port-mappings on Swarm containers
        to be duplicated on `docker ps` and `docker inspect`. [moby/moby#49724](https://redirect.github.com/moby/moby/pull/49724)\n-
        \  Fix an issue that caused container network attachment to fail with error
        \"Bridge port not forwarding\". [moby/moby#49705](https://redirect.github.com/moby/moby/pull/49705)\n-
        \  Fix an issue with removal of a `--link` from a container in the default
        bridge network. [moby/moby#49778](https://redirect.github.com/moby/moby/pull/49778)\n-
        \  Improve how network-endpoint relationships are tracked to reduce the chance
        of the \"has active endpoints\" error to be wrongfully returned. [moby/moby#49736](https://redirect.github.com/moby/moby/pull/49736)\n-
        \  Improve the \"has active endpoints\" error message by including the name
        of endpoints still connected to the network being deleted. [moby/moby#49773](https://redirect.github.com/moby/moby/pull/49773)\n\n#####
        API\n\n-   Update API version to [v1.49](https://docs.docker.com/engine/api/v1.49/).
        [moby/moby#49718](https://redirect.github.com/moby/moby/pull/49718)\n-   `GET
        /image/{name}/json` now supports a `platform` parameter allowing to specify
        which platform variant of a multi-platform image to inspect. [moby/moby#49586](https://redirect.github.com/moby/moby/pull/49586)\n-
        \  `GET /info` now returns a `FirewallBackend` containing information about
        the daemon's firewalling configuration. [moby/moby#49761](https://redirect.github.com/moby/moby/pull/49761)\n\n#####
        Go SDK\n\n-   Update minimum required Go version to go1.23. [docker/cli#5868](https://redirect.github.com/docker/cli/pull/5868)\n-
        \  cli/command/context: remove temporary `ContextType` field from JSON output.
        [docker/cli#5981](https://redirect.github.com/docker/cli/pull/5981)\n-   client:
        Keep image references in canonical format where possible. [moby/moby#49609](https://redirect.github.com/moby/moby/pull/49609)\n\n#####
        Deprecations\n\n-   API: Deprecated `AllowNondistributableArtifactsCIDRs`
        and `AllowNondistributableArtifactsHostnames` fields in the `RegistryConfig`
        struct in the `GET /info` response are omitted in API v1.49. [moby/moby#49749](https://redirect.github.com/moby/moby/pull/49749)\n-
        \  API: Deprecated: The `ContainerdCommit.Expected`, `RuncCommit.Expected`,
        and `InitCommit.Expected` fields in the `GET /info` endpoint were deprecated
        in API v1.48, and are now omitted in API v1.49. [moby/moby#48556](https://redirect.github.com/moby/moby/pull/48556)\n-
        \  Go-SDK: cli/command/image: Deprecate `RunPull`: this function was only
        used internally and will be removed in the next release. [docker/cli#5975](https://redirect.github.com/docker/cli/pull/5975)\n-
        \  Go-SDK: cli/config/configfile: deprecate `ConfigFile.Experimental` field.
        Experimental CLI features are always enabled since version v20.10 and this
        field is no longer used. Use `ConfigFile.Features` instead for optional features.
        This field will be removed in a future release. [docker/cli#5977](https://redirect.github.com/docker/cli/pull/5977)\n-
        \  Go-SDK: deprecate `pkg/archive`, which was migrated to `github.com/moby/go-archive`.
        [moby/moby#49743](https://redirect.github.com/moby/moby/pull/49743)\n-   Go-SDK:
        deprecate `pkg/atomicwriter`, which was migrated to `github.com/moby/sys/atomicwriter`.
        [moby/moby#49748](https://redirect.github.com/moby/moby/pull/49748)\n-   Go-SDK:
        opts: remove deprecated `PortOpt`, `ConfigOpt`, `SecretOpt` aliases. [docker/cli#5953](https://redirect.github.com/docker/cli/pull/5953)\n-
        \  Go-SDK: registry: deprecate `APIEndpoint.Official` field. [moby/moby#49706](https://redirect.github.com/moby/moby/pull/49706)\n\n###
        [`v28.0.4`](https://redirect.github.com/moby/moby/releases/tag/v28.0.4)\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.0.3...v28.0.4)\n\n#####
        28.0.4\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.4 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.4)\n-
        \  [moby/moby, 28.0.4 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.4)\n\n#####
        Bug fixes and enhancements\n\n-   Fix a regression causing `docker pull/push`
        to fail when interacting with a private repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n\n###
        [`v28.0.3`](https://redirect.github.com/moby/moby/releases/tag/v28.0.3)\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.0.2...v28.0.3)\n\n#####
        28.0.3\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.3 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.3)\n-
        \  [moby/moby, 28.0.3 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.3)\n\n#####
        Bug fixes and enhancements\n\n-   Fix `docker run` truncating the `STDOUT`/`STDERR`
        prematurely when the container exits before the data is consumed. [docker/cli#5957](https://redirect.github.com/docker/cli/pull/5957)\n\n#####
        Packaging updates\n\n-   Update BuildKit to [v0.20.2](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.2).
        [moby/moby#49698](https://redirect.github.com/moby/moby/pull/49698)\n-   Update
        `runc` to [v1.2.6](https://redirect.github.com/opencontainers/runc/releases/tag/v1.2.6)
        (static packages only). [moby/moby#49682](https://redirect.github.com/moby/moby/pull/49682)\n-
        \  Update containerd to [v1.7.26](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.26).
        [docker/containerd-packaging#409](https://redirect.github.com/docker/containerd-packaging/pull/409)\n\n###
        [`v28.0.2`](https://redirect.github.com/moby/moby/releases/tag/v28.0.2)\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.0.1...v28.0.2)\n\n#####
        28.0.2\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.2 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.2)\n-
        \  [moby/moby, 28.0.2 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.2)\n\n#####
        Bug fixes and enhancements\n\n-   Fix CLI-specific attributes (`docker.cli.*`)
        being unintentionally passed to downstream OTel services. [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n-
        \  Fix an issue where user-specified `OTEL_RESOURCE_ATTRIBUTES` were being
        overridden by CLI's internal telemetry attributes. The CLI now properly merges
        user-specified attributes with internal ones, allowing both to coexist. [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n-
        \  Fix daemon failing to start on Windows when a container created before
        v28.0.0 was present. [moby/moby#49626](https://redirect.github.com/moby/moby/pull/49626)\n-
        \  Fix possible error on `docker buildx prune` with the `--min-free-space`.
        [moby/moby#49623](https://redirect.github.com/moby/moby/pull/49623)\n-   Fix
        spurious `io: read/write on closed pipe` error in the daemon log when closing
        container. [moby/moby#49590](https://redirect.github.com/moby/moby/pull/49590)\n-
        \  Fix the Docker daemon failing too early if the containerd socket isn't
        immediately available. [moby/moby#49603](https://redirect.github.com/moby/moby/pull/49603)\n-
        \  Mask Linux thermal interrupt info in a container's `/proc` and `/sys` by
        default. [moby/moby#49560](https://redirect.github.com/moby/moby/pull/49560)\n-
        \  Update `contrib/check-config.sh` to check for more kernel modules related
        to iptables. [moby/moby#49622](https://redirect.github.com/moby/moby/pull/49622)\n-
        \  containerd image store: Fix integer overflow in User ID handling passed
        via `--user`. [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n-
        \  containerd image store: Fix spurious `reference for unknown type: application/vnd.in-toto+json`
        warning being logged to the daemon's log. [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n-
        \  containerd image store: Improve performance of `docker ps` when running
        large number of containers. [moby/moby#49365](https://redirect.github.com/moby/moby/pull/49365)\n\n#####
        Packaging updates\n\n-   Update BuildKit to [v0.20.1](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.1).
        [moby/moby#49587](https://redirect.github.com/moby/moby/pull/49587)\n-   Update
        Buildx to [v0.22.0](https://redirect.github.com/docker/buildx/releases/tag/v0.22.0).
        [docker/docker-ce-packaging#1175](https://redirect.github.com/docker/docker-ce-packaging/pull/1175)\n-
        \  Update Compose to [v2.34.0](https://redirect.github.com/docker/compose/releases/tag/v2.34.0).
        [docker/docker-ce-packaging#1172](https://redirect.github.com/docker/docker-ce-packaging/pull/1172)\n-
        \  Update Go runtime to [1.23.7](https://go.dev/doc/devel/release#go1.23.7).
        [docker/cli#5890](https://redirect.github.com/docker/cli/pull/5890), [docker/docker-ce-packaging#1171](https://redirect.github.com/docker/docker-ce-packaging/pull/1171),
        [moby/moby#49580](https://redirect.github.com/moby/moby/pull/49580)\n-   Update
        RootlessKit to [v2.3.4](https://redirect.github.com/rootless-containers/rootlesskit/releases/tag/v2.3.4).
        [moby/moby#49614](https://redirect.github.com/moby/moby/pull/49614)\n-   Update
        containerd (static binaries only) to [v1.7.27](https://www.github.com/containerd/containerd/releases/tag/v1.7.27).
        [moby/moby#49656](https://redirect.github.com/moby/moby/pull/49656)\n\n#####
        Networking\n\n-   Add environment variable `DOCKER_INSECURE_NO_IPTABLES_RAW=1`
        to allow Docker to run on systems where the Linux kernel can't provide `CONFIG_IP_NF_RAW`
        support. When enabled, Docker will not create rules in the iptables `raw`
        table. Warning: This is not recommended for production environments as it
        reduces security by allowing other hosts on the local network to route to
        ports published to host addresses, even when they are published to `127.0.0.1.`
        This option bypasses some of the security hardening introduced in Docker Engine
        28.0.0. [moby/moby#49621](https://redirect.github.com/moby/moby/pull/49621)\n-
        \  Allow container startup when an endpoint is attached to a macvlan network
        where the parent interface is down. [moby/moby#49630](https://redirect.github.com/moby/moby/pull/49630)\n-
        \  Do not skip DNAT for packets originating in a gateway_mode=routed network.
        [moby/moby#49577](https://redirect.github.com/moby/moby/pull/49577)\n-   Fix
        a bug causing `docker ps` to inconsistently report dual-stack port mappings.
        [moby/moby#49657](https://redirect.github.com/moby/moby/pull/49657)\n-   Fix
        a bug that could cause `docker-proxy` to stop forwarding UDP datagrams to
        containers. [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n-
        \  Fix a bug that was causing `docker-proxy` to close UDP connections to containers
        eagerly and resulting in the source address to change needlessly. [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n\n#####
        Go SDK\n\n-   Move various types and consts from `cli-plugins/manager` to
        a separate package. [docker/cli#5902](https://redirect.github.com/docker/cli/pull/5902)\n-
        \  Update minimum required Go version to go1.23. [moby/moby#49541](https://redirect.github.com/moby/moby/pull/49541)\n-
        \  `cli/command`: Move `PrettyPrint` utility to `cli/command/formatter`. [docker/cli#5916](https://redirect.github.com/docker/cli/pull/5916)\n-
        \  runconfig/errors: split `ErrConflictHostNetwork` into `ErrConflictConnectToHostNetwork`
        and `ErrConflictDisconnectFromHostNetwork`. [moby/moby#49605](https://redirect.github.com/moby/moby/pull/49605)\n\n#####
        Deprecations\n\n-   Go-SDK: Deprecate `cli-plugins/manager.ResourceAttributesEnvvar`
        constant. It was used internally, but holds the `OTEL_RESOURCE_ATTRIBUTES`
        name, which is part of the OpenTelemetry specification. Users of this constant
        should define their own. It will be removed in the next release. [docker/cli#5881](https://redirect.github.com/docker/cli/pull/5881)\n-
        \  Go-SDK: Deprecate `opts.PortOpt`, `opts.ConfigOpt` and `opts.SecretOpt`.
        These types were moved to the `opts/swarmopts` package. [docker/cli#5907](https://redirect.github.com/docker/cli/pull/5907)\n-
        \  Go-SDK: Remove `service/logs` package. [docker/cli#5910](https://redirect.github.com/docker/cli/pull/5910)\n-
        \  Go-SDK: `cli/command/image`: Deprecate `PushTrustedReference` and move
        to `cli/trust`. [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-
        \  Go-SDK: `cli/command/image`: Deprecate and internalize `TrustedPush`. [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-
        \  Go-SDK: `cli/command`: deprecate `Cli.NotaryClient`: use [`trust.GetNotaryRepository`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/trust#GetNotaryRepository)
        instead. This method is no longer used and will be removed in the next release.
        [docker/cli#5885](https://redirect.github.com/docker/cli/pull/5885)\n-   Go-SDK:
        `cli/command`: deprecate `Cli.RegistryClient`. This method was only used internally
        and will be removed in the next release. Use [`client.NewRegistryClient`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/registry/client#NewRegistryClient)
        instead. [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889),
        [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889)\n-   Go-SDK:
        `registry`: Deprecate `RepositoryInfo.Official` field. [moby/moby#49567](https://redirect.github.com/moby/moby/pull/49567)\n-
        \  Go-SDK: `registry`: deprecate `HostCertsDir`: this function was only used
        internally and will be removed in the next release. [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n-
        \  Go-SDK: `registry`: deprecate `SetCertsDir`: the cert-directory is now
        automatically selected when running with RootlessKit, and should no longer
        be set manually. [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n\n###
        [`v28.0.1`](https://redirect.github.com/moby/moby/releases/tag/v28.0.1)\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.0.0...v28.0.1)\n\n#####
        28.0.1\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.1)\n-
        \  [moby/moby, 28.0.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.1)\n\n#####
        Networking\n\n-   Remove dependency on kernel modules `ip_set`, `ip_set_hash_net`
        and `netfilter_xt_set`.\n    -   The dependency was introduced in release
        28.0.0 but proved too disruptive. The iptables rules using these modules have
        been replaced. [moby/moby#49530](https://redirect.github.com/moby/moby/pull/49530)\n-
        \  Allow daemon startup on a host with IPv6 disabled without requiring `--ip6tables=false`.
        [moby/moby#49525](https://redirect.github.com/moby/moby/pull/49525)\n-   Fix
        a bug that was causing containers with `--restart=always` and a published
        port already in use to restart in a tight loop. [moby/moby#49507](https://redirect.github.com/moby/moby/pull/49507)\n-
        \  Fix an issue with Swarm ingress, caused by incorrect ordering of iptables
        rules. [moby/moby#49538](https://redirect.github.com/moby/moby/pull/49538)\n-
        \  Fix creation of a swarm-scoped network from a `--config-only` network.
        [moby/moby#49521](https://redirect.github.com/moby/moby/pull/49521)\n-   Fix
        `docker network inspect` reporting an IPv6 gateway with CIDR suffix for a
        newly created network with no specific IPAM config, until a daemon restart.
        [moby/moby#49520](https://redirect.github.com/moby/moby/pull/49520)\n-   Improve
        the error reported when kernel modules `ip_set`, `ip_set_hash_net` and `netilter_xt_set`
        are not available. [moby/moby#49524](https://redirect.github.com/moby/moby/pull/49524)\n-
        \  Move most of Docker's iptables rules out of the filter-FORWARD chain, so
        that other applications are free to append rules that must follow Docker's
        rules. [moby/moby#49518](https://redirect.github.com/moby/moby/pull/49518)\n-
        \  Update `--help` output and man page lo state which options only apply to
        the default bridge network. [moby/moby#49522](https://redirect.github.com/moby/moby/pull/49522)\n\n#####
        Bug fixes and enhancements\n\n-   Fix `docker context create` always returning
        an error when using the `\"skip-tls-verify\"` option. [docker/cli#5850](https://redirect.github.com/docker/cli/pull/5850)\n-
        \  Fix shell completion suggesting IDs instead of names for services and nodes.
        [docker/cli#5848](https://redirect.github.com/docker/cli/pull/5848)\n-   Fix
        unintentionally printing exit status to standard error output when `docker
        exec/run` returns a non-zero status. [docker/cli#5854](https://redirect.github.com/docker/cli/pull/5854)\n-
        \  Fix regression `protocol \"tcp\" is not supported by the RootlessKit port
        driver \"slirp4netns\"`. [moby/moby#49514](https://redirect.github.com/moby/moby/pull/49514)\n-
        \  containerd image store: Fix `docker inspect` not being able to show multi-platform
        images with missing layers for all platforms. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
        \  containerd image store: Fix `docker images --tree` reporting wrong content
        size. [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n-
        \  Fix compilation on i386 [moby/moby#49526](https://redirect.github.com/moby/moby/pull/49526)\n\n#####
        Packaging updates\n\n-   Update `github.com/go-jose/go-jose/v4` to v4.0.5
        to address. [GHSA-c6gw-w398-hv78](https://redirect.github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78)
        / [CVE-2025-27144](https://www.cve.org/CVERecord?id=CVE-2025-27144) [docker/cli#5867](https://redirect.github.com/docker/cli/pull/5867)\n-
        \  Update Buildx to [v0.21.1](https://redirect.github.com/docker/buildx/releases/tag/v0.21.1).
        [docker/docker-ce-packaging#1167](https://redirect.github.com/docker/docker-ce-packaging/pull/1167)\n-
        \  Update Compose to [v2.33.1](https://redirect.github.com/docker/compose/releases/tag/v2.33.1).
        [docker/docker-ce-packaging#1168](https://redirect.github.com/docker/docker-ce-packaging/pull/1168)\n\n#####
        API\n\n-   containerd image store: Fix `GET /images/json?manifests=1` not
        filling `Manifests` for index-only images. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
        \  containerd image store: Fix `GET /images/json and /images/<name>/json`
        `Size.Content` field including the size of content that's not available locally.
        [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n\n###
        [`v28.0.0`](https://redirect.github.com/moby/moby/releases/tag/v28.0.0)\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v27.5.1...v28.0.0)\n\n#####
        28.0.0\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
        \  [moby/moby, 28.0.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
        \  Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.0.0/docs/deprecated.md).\n-
        \  Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.0.0/docs/api/version-history.md).\n\n#####
        New\n\n-   Add ability to mount an image inside a container via `--mount type=image`.
        [moby/moby#48798](https://redirect.github.com/moby/moby/pull/48798)\n    -
        \  You can also specify `--mount type=image,image-subpath=[subpath],...` option
        to mount a specific path from the image. [docker/cli#5755](https://redirect.github.com/docker/cli/pull/5755)\n-
        \  `docker images --tree` now shows metadata badges. [docker/cli#5744](https://redirect.github.com/docker/cli/pull/5744)\n-
        \  `docker load`, `docker save`, and `docker history` now support a `--platform`
        flag allowing you to choose a specific platform for single-platform operations
        on multi-platform images. [docker/cli#5331](https://redirect.github.com/docker/cli/pull/5331)\n-
        \  Add `OOMScoreAdj` to `docker service create` and `docker stack`. [docker/cli#5145](https://redirect.github.com/docker/cli/pull/5145)\n-
        \  `docker buildx prune` now supports `reserved-space`, `max-used-space`,
        `min-free-space` and `keep-bytes` filters. [moby/moby#48720](https://redirect.github.com/moby/moby/pull/48720)\n-
        \  Windows: Add support for running containerd as a child process of the daemon,
        instead of using a system-installed containerd. [moby/moby#47955](https://redirect.github.com/moby/moby/pull/47955)\n\n#####
        Networking\n\n-   The `docker-proxy` binary has been updated, older versions
        will not work with the updated `dockerd`. [moby/moby#48132](https://redirect.github.com/moby/moby/pull/48132)\n
        \   -   Close a window in which the userland proxy (`docker-proxy`) could
        accept TCP connections, that would then fail after `iptables` NAT rules were
        set up.\n    -   The executable `rootlesskit-docker-proxy` is no longer used,
        it has been removed from the build and distribution.\n-   DNS nameservers
        read from the host's `/etc/resolv.conf` are now always accessed from the host's
        network namespace. [moby/moby#48290](https://redirect.github.com/moby/moby/pull/48290)\n
        \   -   When the host's `/etc/resolv.conf` contains no nameservers and there
        are no `--dns` overrides, Google's DNS servers are no longer used, apart from
        by the default bridge network and in build containers.\n-   Container interfaces
        in bridge and macvlan networks now use randomly generated MAC addresses. [moby/moby#48808](https://redirect.github.com/moby/moby/pull/48808)\n
        \   -   Gratuitous ARP / Neighbour Advertisement messages will be sent when
        the interfaces are started so that, when IP addresses are reused, they're
        associated with the newly generated MAC address.\n    -   IPv6 addresses in
        the default bridge network are now IPAM-assigned, rather than being derived
        from the MAC address.\n-   The deprecated OCI `prestart` hook is now only
        used by build containers. For other containers, network interfaces are added
        to the network namespace after task creation is complete, before the container
        task is started. [moby/moby#47406](https://redirect.github.com/moby/moby/pull/47406)\n-
        \  Add a new `gw-priority` option to `docker run`, `docker container create`,
        and `docker network connect`. This option will be used by the Engine to determine
        which network provides the default gateway for a container. On `docker run`,
        this option is only available through the extended `--network` syntax. [docker/cli#5664](https://redirect.github.com/docker/cli/pull/5664)\n-
        \  Add a new netlabel `com.docker.network.endpoint.ifname` to customize the
        interface name used when connecting a container to a network. It's supported
        by all built-in network drivers on Linux. [moby/moby#49155](https://redirect.github.com/moby/moby/pull/49155)\n
        \   -   When a container is created with multiple networks specified, there's
        no guarantee on the order networks will be connected to the container. So,
        if a custom interface name uses the same prefix as the auto-generated names,
        for example `eth`, the container might fail to start.\n    -   The recommended
        practice is to use a different prefix, for example `en0`, or a numerical suffix
        high enough to never collide, for example `eth100`.\n    -   This label can
        be specified on `docker network connect` via the `--driver-opt` flag, for
        example `docker network connect --driver-opt=com.docker.network.endpoint.ifname=foobar
        \u2026`.\n    -   Or via the long-form `--network` flag on `docker run`, for
        example `docker run --network=name=bridge,driver-opt=com.docker.network.endpoint.ifname=foobar
        \u2026`\n-   If a custom network driver reports capability `GwAllocChecker`
        then, before a network is created, it will get a `GwAllocCheckerRequest` with
        the network's options. The custom driver may then reply that no gateway IP
        address should be allocated. [moby/moby#49372](https://redirect.github.com/moby/moby/pull/49372)\n\n#####
        Port publishing in bridge networks\n\n-   `dockerd` now requires `ipset` support
        in the Linux kernel. [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n
        \   -   The `iptables` and `ip6tables` rules used to implement port publishing
        and network isolation have been extensively modified. This enables some of
        the following functional changes, and is a first step in refactoring to enable
        native `nftables` support in a future release. [moby/moby#48815](https://redirect.github.com/moby/moby/issues/48815)\n
        \   -   If it becomes necessary to downgrade to an earlier version of the
        daemon, some manual cleanup of the new rules will be necessary. The simplest
        and surest approach is to reboot the host, or use `iptables -F` and `ip6tables
        -F` to flush all existing `iptables` rules from the `filter` table before
        starting the older version of the daemon. When that is not possible, run the
        following commands as root:\n        -   `iptables -D FORWARD -m set --match-set
        docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT;
        ip6tables -D FORWARD -m set --match-set docker-ext-bridges-v6 dst -m conntrack
        --ctstate RELATED,ESTABLISHED -j ACCEPT`\n        -   `iptables -D FORWARD
        -m set --match-set docker-ext-bridges-v4 dst -j DOCKER; ip6tables -D FORWARD
        -m set --match-set docker-ext-bridges-v6 dst -j DOCKER`\n        -   If you
        were previously running with the iptables filter-FORWARD policy set to `ACCEPT`
        and need to restore access to unpublished ports, also delete per-bridge-network
        rules from the `DOCKER` chains. For example, `iptables -D DOCKER ! -i docker0
        -o docker0 -j DROP`.\n-   Fix a security issue that was allowing remote hosts
        to connect directly to a container on its published ports. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
        \  Fix a security issue that was allowing neighbor hosts to connect to ports
        mapped on a loopback address. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
        \  Fix an issue that prevented port publishing to link-local addresses. [moby/moby#48570](https://redirect.github.com/moby/moby/pull/48570)\n-
        \  UDP ports published by a container are now reliably accessible by containers
        on other networks, via the host's public IP address. [moby/moby#48571](https://redirect.github.com/moby/moby/pull/48571)\n-
        \  Docker will now only set the `ip6tables` policy for the `FORWARD` chain
        in the `filter` table to `DROP` if it enables IP forwarding on the host itself
        (sysctls `net.ipv6.conf.all.forwarding` and `net.ipv6.conf.default.forwarding`).
        This is now aligned with existing IPv4 behaviour. [moby/moby#48594](https://redirect.github.com/moby/moby/pull/48594)\n
        \   -   If IPv6 forwarding is enabled on your host, but you were depending
        on Docker to set the ip6tables filter-FORWARD policy to `DROP`, you may need
        to update your host's configuration to make sure it is secure.\n-   Direct
        routed access to container ports that are not exposed using `p`/`-publish`
        is now blocked in the `DOCKER` iptables chain. [moby/moby#48724](https://redirect.github.com/moby/moby/pull/48724)\n
        \   -   If the default iptables filter-FORWARD policy was previously left
        at `ACCEPT` on your host, and direct routed access to a container's unpublished
        ports from a remote host is still required, options are:\n        -   Publish
        the ports you need.\n        -   Use the new `gateway_mode_ipv[46]=nat-unprotected`,
        described below.\n    -   Container ports published to host addresses will
        continue to be accessible via those host addresses, using NAT or the userland
        proxy.\n    -   Unpublished container ports continue to be directly accessible
        from the Docker host via the container's IP address.\n-   Networks created
        with `gateway_mode_ipv[46]=routed` are now accessible from other bridge networks
        running on the same Docker host, as well as from outside the host. [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n-
        \  Bridge driver options `com.docker.network.bridge.gateway_mode_ipv4` and
        `com.docker.network.bridge.gateway_mode_ipv6` now accept mode `nat-unprotected`.
        [moby/moby#48597](https://redirect.github.com/moby/moby/pull/48597)\n    -
        \  `nat-unprotected` is similar to the default `nat` mode, but no per port/protocol
        rules are set up. This means any port on a container can be accessed by direct-routing
        from a remote host.\n-   Bridge driver options `com.docker.network.bridge.gateway_mode_ipv4`
        and `com.docker.network.bridge.gateway_mode_ipv6` now accept mode `isolated`,
        when the network is also `internal`. [moby/moby#49262](https://redirect.github.com/moby/moby/pull/49262)\n
        \   -   An address is normally assigned to the bridge device in an `internal`
        network. So, processes on the Docker host can access the network, and containers
        in the network can access host services listening on that bridge address (including
        services listening on \"any\" host address, `0.0.0.0` or `::`).\n    -   An
        `internal` bridge network created with gateway mode `isolated` does not have
        an address on the Docker host.\n-   When a port mapping includes a host IP
        address or port number that cannot be used because NAT from the host is disabled
        using `--gateway_mode_ipv[46]`, container creation will no longer fail. The
        unused fields may be needed if the gateway endpoint changes when networks
        are connected or disconnected. A message about the unused fields will be logged.
        [moby/moby#48575](https://redirect.github.com/moby/moby/pull/48575)\n-   Do
        not create iptables nat-POSTROUTING masquerade rules for a container's own
        published ports, when the userland proxy is enabled. [moby/moby#48854](https://redirect.github.com/moby/moby/pull/48854)\n\n#####
        IPv6\n\n-   Add `docker network create` option `--ipv4`. To disable IPv4 address
        assignment for a network, use `docker network create --ipv4=false [...]`.
        [docker/cli#5599](https://redirect.github.com/docker/cli/pull/5599)\n-   Daemon
        option `--ipv6` (`\"ipv6\": true` in `daemon.json`) can now be used without
        `fixed-cidr-v6`. [moby/moby#48319](https://redirect.github.com/moby/moby/pull/48319)\n-
        \  IPAM now handles subnets bigger than \"/64\". [moby/moby#49223](https://redirect.github.com/moby/moby/pull/49223)\n-
        \  Duplicate address detection (DAD) is now disabled for addresses assigned
        to the bridges belonging to bridge networks. [moby/moby#48609](https://redirect.github.com/moby/moby/pull/48609)\n-
        \  Modifications to `host-gateway`, for compatibility with IPv6-only networks.
        [moby/moby#48807](https://redirect.github.com/moby/moby/pull/48807)\n    -
        \  When special value `host-gateway` is used in an `--add-host` option in
        place of an address, it's replaced by an address on the Docker host to make
        it possible to refer to the host by name. The address used belongs to the
        default bridge (normally `docker0`). Until now it's always been an IPv4 address,
        because all containers on bridge networks had IPv4 addresses.\n    -   Now,
        if IPv6 is enabled on the default bridge network, `/etc/hosts` entries will
        be created for IPv4 and IPv6 addresses. So, a container that's only connected
        to IPv6-only networks can access the host by name.\n    -   The `--host-gateway-ip`
        option overrides the address used to replace `host-gateway`. Two of these
        options are now allowed on the command line, for one IPv4 gateway and one
        IPv6.\n    -   In the `daemon.json` file, to provide two addresses, use `\"host-gateway-ips\"`.
        For example, `\"host-gateway-ips\": [\"192.0.2.1\", \"2001:db8::1111\"]`.\n\n#####
        Bug fixes and enhancements\n\n-   Add IPv6 loopback address as an insecure
        registry by default. [moby/moby#48540](https://redirect.github.com/moby/moby/pull/48540)\n-
        \  Add support for Cobra-generated completion scripts for `dockerd`. [moby/moby#49339](https://redirect.github.com/moby/moby/pull/49339)\n-
        \  Fix DNS queries failing when containers are launched via `systemd` auto-start
        on boot [moby/moby#48812](https://redirect.github.com/moby/moby/pull/48812)\n-
        \  Fix Docker Swarm mode ignoring `volume.subpath` [docker/cli#5833](https://redirect.github.com/docker/cli/pull/5833)\n-
        \  Fix `docker export` continuing the export after the operation is canceled.
        [moby/moby#49265](https://redirect.github.com/moby/moby/pull/49265)\n-   Fix
        `docker export` not releasing the container's writable layer after a failure.
        [moby/moby#48517](https://redirect.github.com/moby/moby/pull/48517)\n-   Fix
        `docker images --tree` unnecessary truncating long image names when multiple
        names are available [docker/cli#5757](https://redirect.github.com/docker/cli/pull/5757)\n-
        \  Fix a bug where a container with a name matching another container's ID
        is not restored on daemon startup. [moby/moby#48669](https://redirect.github.com/moby/moby/pull/48669)\n-
        \  Fix an issue preventing some IPv6 addresses shown by `docker ps` to be
        properly bracketed [docker/cli#5468](https://redirect.github.com/docker/cli/pull/5468)\n-
        \  Fix bug preventing image pulls from being cancelled during `docker run`.
        [docker/cli#5645](https://redirect.github.com/docker/cli/pull/5645)\n-   Fix
        error-handling when running the daemon as a Windows service to prevent unclean
        exits. [moby/moby#48518](https://redirect.github.com/moby/moby/pull/48518)\n-
        \  Fix issue causing output of `docker run` to be inconsistent when using
        `--attach stdout` or `--attach stderr` versus `stdin`.  `docker run --attach
        stdin` now exits if the container exits. [docker/cli#5662](https://redirect.github.com/docker/cli/pull/5662)\n-
        \  Fix rootless Docker setup with `subid` backed by NSS modules. [moby/moby#49036](https://redirect.github.com/moby/moby/pull/49036)\n-
        \  Generated completion scripts from the CLI now show descriptions next to
        each command/flag suggestion. [docker/cli#5756](https://redirect.github.com/docker/cli/pull/5756)\n-
        \  IPv6 addresses shown by `docker ps` in port bindings are now bracketed
        [docker/cli#5363](https://redirect.github.com/docker/cli/pull/5363)\n-   Implement
        the ports validation method for Compose [docker/cli#5524](https://redirect.github.com/docker/cli/pull/5524)\n-
        \  Improve error-output for invalid flags on the command line. [docker/cli#5233](https://redirect.github.com/docker/cli/pull/5233)\n-
        \  Improve errors when failing to start a container using anther container's
        network namespace. [moby/moby#49367](https://redirect.github.com/moby/moby/pull/49367)\n-
        \  Improve handling of invalid API errors that could result in an empty error
        message being shown. [moby/moby#49373](https://redirect.github.com/moby/moby/pull/49373)\n-
        \  Improve output and consistency for unknown (sub)commands and invalid arguments
        [docker/cli#5234](https://redirect.github.com/docker/cli/pull/5234)\n-   Improve
        validation of `exec-opts` in daemon configuration. [moby/moby#48979](https://redirect.github.com/moby/moby/pull/48979)\n-
        \  Update the handling of the `--gpus=0` flag to be consistent with the NVIDIA
        Container Runtime. [moby/moby#48482](https://redirect.github.com/moby/moby/pull/48482)\n-
        \  `client.ContainerCreate` now normalizes `CapAdd` and `CapDrop` fields in
        `HostConfig` to their canonical form. [moby/moby#48551](https://redirect.github.com/moby/moby/pull/48551)\n-
        \  `docker image save` now produces stable timestamps. [moby/moby#48611](https://redirect.github.com/moby/moby/pull/48611)\n-
        \  `docker inspect` now lets you inspect Swarm configs [docker/cli#5573](https://redirect.github.com/docker/cli/pull/5573)\n-
        \  containerd image store: Add support for `Extracting` layer status in `docker
        pull`. [moby/moby#49064](https://redirect.github.com/moby/moby/pull/49064)\n-
        \  containerd image store: Fix `commit`, `import`, and `build` not preserving
        a replaced image as a dangling image. [moby/moby#48316](https://redirect.github.com/moby/moby/pull/48316)\n-
        \  containerd image store: Make `docker load --platform` return an error when
        the requested platform isn't loaded. [moby/moby#48718](https://redirect.github.com/moby/moby/pull/48718)\n-
        \  Fix validation of `--link` option. [docker/cli#5739](https://redirect.github.com/docker/cli/pull/5739)\n-
        \  Add validation of network-diagnostic-port daemon configuration option.
        [moby/moby#49305](https://redirect.github.com/moby/moby/pull/49305)\n-   Unless
        explicitly configured, an IP address is no longer reserved for a gateway in
        cases where it is not required. Namely, \u201Cinternal\u201D bridge networks
        with option `com.docker.network.bridge.inhibit_ipv4`, `ipvlan` or `macvlan`
        networks with no parent interface, and L3 IPvlan modes. [moby/moby#49261](https://redirect.github.com/moby/moby/pull/49261)\n-
        \  If a custom network driver reports capability `GwAllocChecker` then, before
        a network is created, it will get a `GwAllocCheckerRequest` with the network's
        options. The custom driver may then reply that no gateway IP address should
        be allocated. [moby/moby#49372](https://redirect.github.com/moby/moby/pull/49372)\n-
        \  Fixed an issue that meant a container could not be attached to an L3 IPvlan
        at the same time as other network types. [moby/moby#49130](https://redirect.github.com/moby/moby/pull/49130)\n-
        \  Remove the correct `/etc/hosts` entries when disconnecting a container
        from a network. [moby/moby#48857](https://redirect.github.com/moby/moby/pull/48857)\n-
        \  Fix duplicate network disconnect events. [moby/moby#48800](https://redirect.github.com/moby/moby/pull/48800)\n-
        \  Resolve issues related to changing `fixed-cidr` for `docker0`, and inferring
        configuration from a user-managed default bridge (`--bridge`). [moby/moby#48319](https://redirect.github.com/moby/moby/pull/48319)\n-
        \  Remove feature flag `windows-dns-proxy`, introduced in release 26.1.0 to
        control forwarding to external DNS resolvers from Windows containers, to make
        `nslookup` work. It was enabled by default in release 27.0.0. [moby/moby#48738](https://redirect.github.com/moby/moby/pull/48738)\n-
        \  Remove an `iptables` mangle rule for checksumming SCTP. The rule can be
        re-enabled by setting `DOCKER_IPTABLES_SCTP_CHECKSUM=1` in the daemon's environment.
        This override will be removed in a future release. [moby/moby#48149](https://redirect.github.com/moby/moby/pull/48149)\n-
        \  Faster connection to bridge networks, in most cases. [moby/moby#49302](https://redirect.github.com/moby/moby/pull/49302)\n\n#####
        Packaging updates\n\n-   Update Go runtime to [1.23.6](https://go.dev/doc/devel/release#go1.23.6).
        [docker/cli#5795](https://redirect.github.com/docker/cli/pull/5795), [moby/moby#49393](https://redirect.github.com/moby/moby/pull/49393),
        [docker/docker-ce-packaging#1161](https://redirect.github.com/docker/docker-ce-packaging/pull/1161)\n-
        \  Update `runc` to [v1.2.5](https://redirect.github.com/opencontainers/runc/releases/tag/v1.2.5)
        (static binaries only). [moby/moby#49464](https://redirect.github.com/moby/moby/pull/49464)\n-
        \  Update containerd to [v1.7.25](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.25).
        [moby/moby#49252](https://redirect.github.com/moby/moby/pull/49252)\n-   Update
        BuildKit to [v0.20.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.0).
        [moby/moby#49495](https://redirect.github.com/moby/moby/pull/49495)\n-   Update
        Buildx to [v0.21.0](https://redirect.github.com/docker/buildx/releases/tag/v0.21.0).
        [docker/docker-ce-packaging#1166](https://redirect.github.com/docker/docker-ce-packaging/pull/1166)\n-
        \  Update Compose to [v2.32.4](https://redirect.github.com/docker/compose/releases/tag/v2.32.3).
        [docker/docker-ce-packaging#1143](https://redirect.github.com/docker/docker-ce-packaging/pull/1143)\n-
        \  The canonical source for the `dockerd(8)` man page has been moved back
        to the `moby/moby` repository itself. [moby/moby#48298](https://redirect.github.com/moby/moby/pull/48298)\n\n#####
        Go SDK\n\n-   Improve validation of empty object IDs. The client now returns
        an \"Invalid Parameter\" error when trying to use an empty ID or name. This
        changes the error returned by some \"Inspect\" functions from a \"Not found\"
        error to an \"Invalid Parameter\". [moby/moby#49381](https://redirect.github.com/moby/moby/pull/49381)\n-
        \  `Client.ImageBuild()` now omits default values from the API request's query
        string. [moby/moby#48651](https://redirect.github.com/moby/moby/pull/48651)\n-
        \  `api/types/container`: Merge `Stats` and `StatsResponse` [moby/moby#49287](https://redirect.github.com/moby/moby/pull/49287)\n-
        \  `client.WithVersion`: Strip v-prefix when setting API version [moby/moby#49352](https://redirect.github.com/moby/moby/pull/49352)\n-
        \  `client`: Add `WithTraceOptions` allowing to specify custom OTe1 trace
        options. [moby/moby#49415](https://redirect.github.com/moby/moby/pull/49415)\n-
        \  `client`: Add `HijackDialer` interface. [moby/moby#49388](https://redirect.github.com/moby/moby/pull/49388)\n-
        \  `client`: Add `SwarmManagementAPIClient` interface to describe all API
        client methods related to Swarm-specific objects. [moby/moby#49388](https://redirect.github.com/moby/moby/pull/49388)\n-
        \  `client`: Add `WithTraceOptions` allowing to specify custom OTel trace
        options. [moby/moby#49415](https://redirect.github.com/moby/moby/pull/49415)\n-
        \  `client`: `ImageHistory`, `ImageLoad` and `ImageSave` now use variadic
        functional options [moby/moby#49466](https://redirect.github.com/moby/moby/pull/49466)\n-
        \  `pkg/containerfs`: Move to internal [moby/moby#48097](https://redirect.github.com/moby/moby/pull/48097)\n-
        \  `pkg/reexec`: Can now be used on platforms other than Linux, Windows, macOS
        and FreeBSD [moby/moby#49118](https://redirect.github.com/moby/moby/pull/49118)\n-
        \  `api/types/container`: introduce `CommitResponse` type. This is currently
        an alias for `IDResponse`, but may become a distinct type in a future release.
        [moby/moby#49444](https://redirect.github.com/moby/moby/pull/49444)\n-   `api/types/container`:
        introduce `ExecCreateResponse` type. This is currently an alias for `IDResponse`,
        but may become a distinct type in a future release. [moby/moby#49444](https://redirect.github.com/moby/moby/pull/49444)\n\n#####
        API\n\n-   Update API version to [v1.48](https://docs.docker.com/engine/api/v1.48/)
        [moby/moby#48476](https://redirect.github.com/moby/moby/pull/48476)\n-   `GET
        /images/{name}/json` response now returns the `Manifests` field containing
        information about the sub-manifests contained in the image index. This includes
        things like platform-specific manifests and build attestations. [moby/moby#48264](https://redirect.github.com/moby/moby/pull/48264)\n-
        \  `POST /containers/create` now supports `Mount` of type `image` for mounting
        an image inside a container. [moby/moby#48798](https://redirect.github.com/moby/moby/pull/48798)\n-
        \  `GET /images/{name}/history` now supports a `platform` parameter (JSON
        encoded OCI Platform type) that lets you specify a platform to show the history
        of. [moby/moby#48295](https://redirect.github.com/moby/moby/pull/48295)\n-
        \  `POST /images/{name}/load` and `GET /images/{name}/get` now supports a
        `platform` parameter (JSON encoded OCI Platform type) that lets you specify
        a platform to load/save. Not passing this parameter results in loading/saving
        the full multi-platform image. [moby/moby#48295](https://redirect.github.com/moby/moby/pull/48295)\n-
        \  Improve errors for invalid width/height on container resize and exec resize
        [moby/moby#48679](https://redirect.github.com/moby/moby/pull/48679)\n-   The
        `POST /containers/create` endpoint now includes a warning in the response
        when setting the container-wide `VolumeDriver` option in combination with
        volumes defined through `Mounts` because the `VolumeDriver` option has no
        effect on those volumes. This warning was previously generated by the CLI.
        [moby/moby#48789](https://redirect.github.com/moby/moby/pull/48789)\n-   containerd
        image store: `GET /images/json` and `GET /images/{name}/json` responses now
        includes `Descriptor` field, which contains an OCI descriptor of the image
        target. The new field is only populated if the daemon provides a multi-platform
        image store. [moby/moby#48894](https://redirect.github.com/moby/moby/pull/48894)\n-
        \  containerd image store: `GET /containers/{name}/json` now returns an `ImageManifestDescriptor`
        field containing the OCI descriptor of the platform-specific image manifest
        of the image that was used to create the container. [moby/moby#48855](https://redirect.github.com/moby/moby/pull/48855)\n-
        \  Add debug endpoints (`GET /debug/vars`, `GET /debug/pprof/`, `GET /debug/pprof/cmdline`,
        `GET /debug/pprof/profile`, `GET /debug/pprof/symbol`, `GET /debug/pprof/trace`,
        `GET /debug/pprof/{name}`) are now also accessible through the versioned-API
        paths (`/v<API-version>/<endpoint>`). [moby/moby#49051](https://redirect.github.com/moby/moby/pull/49051)\n-
        \  Fix API returning a `500` status code instead of `400` for validation errors.
        [moby/moby#49217](https://redirect.github.com/moby/moby/pull/49217)\n-   Fix
        status codes for archive endpoints `HEAD /containers/{name:.*}/archive`, `GET
        /containers/{name:.*}/archive`, `PUT /containers/{name:.*}/archive` returning
        a `500` status instead of a `400` status. [moby/moby#49219](https://redirect.github.com/moby/moby/pull/49219)\n-
        \  `POST /containers/create` now accepts a `writable-cgroups=true` option
        in `HostConfig.SecurityOpt` to mount the container's cgroups writable. This
        provides a more granular approach than `HostConfig.Privileged`. [moby/moby#48828](https://redirect.github.com/moby/moby/pull/48828)\n-
        \  `POST /build/prune` renames `keep-bytes` to `reserved-space` and now supports
        additional prune parameters `max-used-space` and `min-free-space`. [moby/moby#48720](https://redirect.github.com/moby/moby/pull/48720)\n-
        \  `POST /networks/create` now has an `EnableIPv4` field. Setting it to `false`
        disables IPv4 IPAM for the network. [moby/moby#48271](https://redirect.github.com/moby/moby/pull/48271)\n
        \   -   `GET /networks/{id}` now returns an `EnableIPv4` field showing whether
        the network has IPv4 IPAM enabled. [moby/moby#48271](https://redirect.github.com/moby/moby/pull/48271)\n
        \   -   User-defined bridge networks require either IPv4 or IPv6 address assignment
        to be enabled. IPv4 cannot be disabled for the default bridge network (`docker0`).
        [moby/moby#48323](https://redirect.github.com/moby/moby/pull/48323)\n    -
        \  `macvlan` and `ipvlan` networks can be created with address assignment
        disabled for IPv4, IPv6, or both address families. [moby/moby#48299](https://redirect.github.com/moby/moby/pull/48299)\n
        \   -   IPv4 cannot be disabled for Windows or Swarm networks. [moby/moby#48278](https://redirect.github.com/moby/moby/pull/48278)\n-
        \  Add a way to specify which network should provide the default gateway for
        a container. [moby/moby#48936](https://redirect.github.com/moby/moby/pull/48936)\n
        \   -   `POST /networks/{id}/connect` and `POST /containers/create` now accept
        a `GwPriority` field in `EndpointsConfig`. This value is used to determine
        which network endpoint provides the default gateway for the container. The
        endpoint with the highest priority is selected. If multiple endpoints have
        the same priority, endpoints are sorted lexicographically by their network
        name, and the one that sorts first is picked. [moby/moby#48746](https://redirect.github.com/moby/moby/pull/48746)\n
        \   -   `GET /containers/json` now returns a `GwPriority` field in `NetworkSettings`
        for each network endpoint. The `GwPriority` field is used by the CLI\u2019s
        new `gw-priority` option for `docker run` and `docker network connect`. [moby/moby#48746](https://redirect.github.com/moby/moby/pull/48746)\n-
        \  Settings for `eth0` in `--sysctl` options are no longer automatically migrated
        to the network endpoint. [moby/moby#48746](https://redirect.github.com/moby/moby/pull/48746)\n
        \   -   For example, in the Docker CLI, `docker run --network mynet --sysctl
        net.ipv4.conf.eth0.log_martians=1 ...` is rejected. Instead, you must use
        `docker run --network name=mynet,driver-opt=com.docker.network.endpoint.sysctls=net.ipv4.conf.IFNAME.log_martians=1
        ...`\n-   `GET /containers/json` now returns an `ImageManifestDescriptor`
        field matching the same field in `/containers/{name}/json`. This field is
        only populated if the daemon provides a multi-platform image store. [moby/moby#49407](https://redirect.github.com/moby/moby/pull/49407)\n\n#####
        Removed\n\n-   The Fluent logger option `fluentd-async-connect` has been deprecated
        in v20.10 and is now removed. [moby/moby#46114](https://redirect.github.com/moby/moby/pull/46114)\n-
        \  The `--time` option on `docker stop` and `docker restart` is deprecated
        and renamed to `--timeout`. [docker/cli#5485](https://redirect.github.com/docker/cli/pull/5485)\n-
        \  Go-SDK: `pkg/ioutils`: Remove `NewReaderErrWrapper` as it was never used.
        [moby/moby#49258](https://redirect.github.com/moby/moby/pull/49258)\n-   Go-SDK:
        `pkg/ioutils`: Remove deprecated `BytesPipe`, `NewBytesPipe`, `ErrClosed`,
        `WriteCounter`, `NewWriteCounter`, `NewReaderErrWrapper`, `NopFlusher`. [moby/moby#49245](https://redirect.github.com/moby/moby/pull/49245)\n-
        \  Go-SDK: `pkg/ioutils`: Remove deprecated `NopWriter` and `NopWriteCloser`.
        [moby/moby#49256](https://redirect.github.com/moby/moby/pull/49256)\n-   Go-SDK:
        `pkg/sysinfo`: Remove deprecated NumCPU. [moby/moby#49242](https://redirect.github.com/moby/moby/pull/49242)\n-
        \  Go-SDK: Remove `pkg/broadcaster`, as it was only used internally [moby/moby#49172](https://redirect.github.com/moby/moby/pull/49172)\n-
        \  Go-SDK: Remove deprecated `cli.Errors` type [docker/cli#5549](https://redirect.github.com/docker/cli/pull/5549)\n-
        \  Remove `pkg/ioutils.ReadCloserWrapper`, as it was only used in tests. [moby/moby#49237](https://redirect.github.com/moby/moby/pull/49237)\n-
        \  Remove deprecated `api-cors-header` config parameter and the `dockerd`
        `--api-cors-header` option [moby/moby#48209](https://redirect.github.com/moby/moby/pull/48209)\n-
        \  Remove deprecated `APIEndpoint.Version` field, `APIVersion` type, and `APIVersion1`
        and `APIVersion2` consts. [moby/moby#49004](https://redirect.github.com/moby/moby/pull/49004)\n-
        \  Remove deprecated `api-cors-header` config parameter and the Docker daemon's
        `--api-cors-header` option. [docker/cli#5437](https://redirect.github.com/docker/cli/pull/5437)\n-
        \  Remove deprecated `pkg/directory` package [moby/moby#48779](https://redirect.github.com/moby/moby/pull/48779)\n-
        \  Remove deprecated `pkg/dmsg.Dmesg()` [moby/moby#48109](https://redirect.github.com/moby/moby/pull/48109)\n-
        \  Remove deprecated image/spec package, which was moved to a separate module
        (`github.com/moby/docker-image-spec`) [moby/moby#48460](https://redirect.github.com/moby/moby/pull/48460)\n-
        \  Remove migration code and errors for the deprecated `logentries` logging
        driver. [moby/moby#48891](https://redirect.github.com/moby/moby/pull/48891)\n-
        \  Remove support for deprecated external graph-driver plugins. [moby/moby#48072](https://redirect.github.com/moby/moby/pull/48072)\n-
        \  `api/types`: Remove deprecated `container.ContainerNode` and `ContainerJSONBase.Node`
        field. [moby/moby#48107](https://redirect.github.com/moby/moby/pull/48107)\n-
        \  `api/types`: Remove deprecated aliases: `ImagesPruneReport`, `VolumesPruneReport`,
        `NetworkCreateRequest`, `NetworkCreate`, `NetworkListOptions`, `NetworkCreateResponse`,
        `NetworkInspectOptions`, `NetworkConnect`, `NetworkDisconnect`, `EndpointResource`,
        `NetworkResource`, `NetworksPruneReport`, `ExecConfig`, `ExecStartCheck`,
        `ContainerExecInspect`, `ContainersPruneReport`, `ContainerPathStat`, `CopyToContainerOptions`,
        `ContainerStats`, `ImageSearchOptions`, `ImageImportSource`, `ImageLoadResponse`,
        `ContainerNode`. [moby/moby#48107](https://redirect.github.com/moby/moby/pull/48107)\n-
        \  `libnetwork/iptables`: Remove deprecated `IPV`, `Iptables`, `IP6Tables`
        and `Passthrough()`. [moby/moby#49121](https://redirect.github.com/moby/moby/pull/49121)\n-
        \  `pkg/archive`: Remove deprecated `CanonicalTarNameForPath`, `NewTempArchive`,
        `TempArchive` [moby/moby#48708](https://redirect.github.com/moby/moby/pull/48708)\n-
        \  `pkg/fileutils`: Remove deprecated `GetTotalUsedFds` [moby/moby#49210](https://redirect.github.com/moby/moby/pull/49210)\n-
        \  `pkg/ioutils`: Remove `OnEOFReader`, which was only used internally [moby/moby#49170](https://redirect.github.com/moby/moby/pull/49170)\n-
        \  `pkg/longpath`: Remove deprecated `Prefix` constant. [moby/moby#48779](https://redirect.github.com/moby/moby/pull/48779)\n-
        \  `pkg/stringid`: Remove deprecated `IsShortID` and  `ValidateID` functions
        [moby/moby#48705](https://redirect.github.com/moby/moby/pull/48705)\n-   `runconfig/opts`:
        Remove deprecated `ConvertKVStringsToMap` [moby/moby#48102](https://redirect.github.com/moby/moby/pull/48102)\n-
        \  `runconfig`: Remove deprecated `ContainerConfigWrapper`, `SetDefaultNetModeIfBlank`,
        `DefaultDaemonNetworkMode`, `IsPreDefinedNetwork` [moby/moby#48102](https://redirect.github.com/moby/moby/pull/48102)\n-
        \  `container`: Remove deprecated `ErrNameReserved`, `ErrNameNot\n\n</details>\n\n---\n\n###
        Configuration\n\n\U0001F4C5 **Schedule**: Branch creation - At any time (no
        schedule defined), Automerge - At any time (no schedule defined).\n\n\U0001F6A6
        **Automerge**: Disabled by config. Please merge this manually once you are
        satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you
        tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR and
        you won't be reminded about these updates again.\n\n---\n\n - [ ] <!-- rebase-check
        -->If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was
        generated by [Mend Renovate](https://mend.io/renovate/). View the [repository
        job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjM5LjI1Ny4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
      change_url: https://github.com/osism/release/pull/1807
      child_jobs: []
      commit_id: 65478946b4201083b6ac113f5d0766422a4bd5b9
      event_id: 7122b5f0-3bf2-11f0-867c-f986fee4eb3f
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/bbba6d51ddca498fa38f67e4424b673d/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/bbba6d51ddca498fa38f67e4424b673d/work/logs
        result_data_file: /var/lib/zuul/builds/bbba6d51ddca498fa38f67e4424b673d/work/results.json
        src_root: /var/lib/zuul/builds/bbba6d51ddca498fa38f67e4424b673d/work/src
        work_root: /var/lib/zuul/builds/bbba6d51ddca498fa38f67e4424b673d/work
      include_vars: []
      items:
      - branch: main
        change: '1807'
        change_message: "chore(deps): update dependency moby/moby to v28\n\nThis PR
          contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
          [moby/moby](https://redirect.github.com/moby/moby) | major | `5:27.5.1`
          -> `v28.1.1` |\n| [moby/moby](https://redirect.github.com/moby/moby) | major
          | `27.5.1` -> `28.1.1` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>moby/moby
          (moby/moby)</summary>\n\n### [`v28.1.1`](https://redirect.github.com/moby/moby/releases/tag/v28.1.1)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.1.0...v28.1.1)\n\n#####
          28.1.1\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.1.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.1)\n-
          \  [moby/moby, 28.1.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.1)\n\n#####
          Bug fixes and enhancements\n\n-   Fix `dockerd-rootless-setuptool.sh` incorrectly
          reporting missing `iptables`. [moby/moby#49833](https://redirect.github.com/moby/moby/pull/49833)\n-
          \  containerd image store: Fix a potential daemon crash when using `docker
          load` with archives containing zero-size tar headers. [moby/moby#49837](https://redirect.github.com/moby/moby/pull/49837)\n\n#####
          Packaging updates\n\n-   Update Buildx to [v0.23.0](https://redirect.github.com/docker/buildx/releases/tag/v0.23.0).
          [docker/docker-ce-packaging#1185](https://redirect.github.com/docker/docker-ce-packaging/pull/1185)\n-
          \  Update Compose to [v2.35.1](https://redirect.github.com/docker/compose/releases/tag/v2.35.1).
          [docker/docker-ce-packaging#1188](https://redirect.github.com/docker/docker-ce-packaging/pull/1188)\n\n#####
          Networking\n\n-   Add a warning to a container's `/etc/resolv.conf` when
          no upstream DNS servers were found. [moby/moby#49827](https://redirect.github.com/moby/moby/pull/49827)\n\n###
          [`v28.1.0`](https://redirect.github.com/moby/moby/releases/tag/v28.1.0)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.4...v28.1.0)\n\n#####
          28.1.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.1.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
          \  [moby/moby, 28.1.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
          \  Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.1.0/docs/api/version-history.md).\n\n#####
          New\n\n-   Add `docker bake` sub-command as alias for `docker buildx bake`.
          [docker/cli#5947](https://redirect.github.com/docker/cli/pull/5947)\n-   Experimental:
          add a new `--use-api-socket` flag on `docker run` and `docker create` to
          enable access to Docker socket from inside a container and to share credentials
          from the host with the container. [docker/cli#5858](https://redirect.github.com/docker/cli/pull/5858)\n-
          \  `docker image inspect` now supports a `--platform` flag to inspect a
          specific platform of a multi-platform image. [docker/cli#5934](https://redirect.github.com/docker/cli/pull/5934)\n\n#####
          Bug fixes and enhancements\n\n-   Add CLI shell-completion for context names.
          [docker/cli#6016](https://redirect.github.com/docker/cli/pull/6016)\n-   Fix
          `docker images --tree` not including non-container images content size in
          the total image content size. [docker/cli#6000](https://redirect.github.com/docker/cli/pull/6000)\n-
          \  Fix `docker load` not preserving replaced images. [moby/moby#49650](https://redirect.github.com/moby/moby/pull/49650)\n-
          \  Fix `docker login` hints when logging in to a custom registry. [docker/cli#6015](https://redirect.github.com/docker/cli/pull/6015)\n-
          \  Fix `docker stats` not working properly on machines with high CPU core
          count. [moby/moby#49734](https://redirect.github.com/moby/moby/pull/49734)\n-
          \  Fix a regression causing `docker pull/push` to fail when interacting
          with a private repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n-
          \  Fix an issue preventing rootless Docker setup on a host with no `ip_tables`
          kernel module. [moby/moby#49727](https://redirect.github.com/moby/moby/pull/49727)\n-
          \  Fix an issue that could lead to unwanted iptables rules being restored
          and never deleted following a firewalld reload. [moby/moby#49728](https://redirect.github.com/moby/moby/pull/49728)\n-
          \  Improve CLI completion of `docker service scale`. [docker/cli#5968](https://redirect.github.com/docker/cli/pull/5968)\n-
          \  `docker images --tree` now hides both untagged and dangling images by
          default. [docker/cli#5924](https://redirect.github.com/docker/cli/pull/5924)\n-
          \  `docker system info` will provide an exit code if a connection cannot
          be established to the Docker daemon. [docker/cli#5918](https://redirect.github.com/docker/cli/pull/5918)\n-
          \  containerd image store: Fix `image tag` event not being emitted when
          building with BuildKit. [moby/moby#49678](https://redirect.github.com/moby/moby/pull/49678)\n-
          \  containerd image store: Improve `docker push/pull` handling of remote
          registry errors. [moby/moby#49770](https://redirect.github.com/moby/moby/pull/49770)\n-
          \  containerd image store: Show pull progress for non-layer image blobs.
          [moby/moby#49746](https://redirect.github.com/moby/moby/pull/49746)\n\n#####
          Packaging updates\n\n-   Add Debian \"Trixie\" packages. [docker/docker-ce-packaging#1181](https://redirect.github.com/docker/docker-ce-packaging/pull/1181)\n-
          \  Add Fedora 42 packages. [docker/containerd-packaging#418](https://redirect.github.com/docker/containerd-packaging/pull/418),
          [docker/docker-ce-packaging#1169](https://redirect.github.com/docker/docker-ce-packaging/pull/1169)\n-
          \  Add Ubuntu 25.04 \"Plucky Puffin\" packages. [docker/containerd-packaging#419](https://redirect.github.com/docker/containerd-packaging/pull/419),
          [docker/docker-ce-packaging#1177](https://redirect.github.com/docker/docker-ce-packaging/pull/1177)\n-
          \  Update BuildKit to [v0.21.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.21.0).
          [moby/moby#49809](https://redirect.github.com/moby/moby/pull/49809)\n-   Update
          Compose to [v2.35.0](https://redirect.github.com/docker/compose/releases/tag/v2.35.0).
          [docker/docker-ce-packaging#1183](https://redirect.github.com/docker/docker-ce-packaging/pull/1183)\n-
          \  Update Go runtime to [1.23.8](https://go.dev/doc/devel/release#go1.23.8).
          [docker/cli#5986](https://redirect.github.com/docker/cli/pull/5986), [docker/docker-ce-packaging#1180](https://redirect.github.com/docker/docker-ce-packaging/pull/1180),
          [moby/moby#49737](https://redirect.github.com/moby/moby/pull/49737)\n\n#####
          Networking\n\n-   Fix a bug causing host port-mappings on Swarm containers
          to be duplicated on `docker ps` and `docker inspect`. [moby/moby#49724](https://redirect.github.com/moby/moby/pull/49724)\n-
          \  Fix an issue that caused container network attachment to fail with error
          \"Bridge port not forwarding\". [moby/moby#49705](https://redirect.github.com/moby/moby/pull/49705)\n-
          \  Fix an issue with removal of a `--link` from a container in the default
          bridge network. [moby/moby#49778](https://redirect.github.com/moby/moby/pull/49778)\n-
          \  Improve how network-endpoint relationships are tracked to reduce the
          chance of the \"has active endpoints\" error to be wrongfully returned.
          [moby/moby#49736](https://redirect.github.com/moby/moby/pull/49736)\n-   Improve
          the \"has active endpoints\" error message by including the name of endpoints
          still connected to the network being deleted. [moby/moby#49773](https://redirect.github.com/moby/moby/pull/49773)\n\n#####
          API\n\n-   Update API version to [v1.49](https://docs.docker.com/engine/api/v1.49/).
          [moby/moby#49718](https://redirect.github.com/moby/moby/pull/49718)\n-   `GET
          /image/{name}/json` now supports a `platform` parameter allowing to specify
          which platform variant of a multi-platform image to inspect. [moby/moby#49586](https://redirect.github.com/moby/moby/pull/49586)\n-
          \  `GET /info` now returns a `FirewallBackend` containing information about
          the daemon's firewalling configuration. [moby/moby#49761](https://redirect.github.com/moby/moby/pull/49761)\n\n#####
          Go SDK\n\n-   Update minimum required Go version to go1.23. [docker/cli#5868](https://redirect.github.com/docker/cli/pull/5868)\n-
          \  cli/command/context: remove temporary `ContextType` field from JSON output.
          [docker/cli#5981](https://redirect.github.com/docker/cli/pull/5981)\n-   client:
          Keep image references in canonical format where possible. [moby/moby#49609](https://redirect.github.com/moby/moby/pull/49609)\n\n#####
          Deprecations\n\n-   API: Deprecated `AllowNondistributableArtifactsCIDRs`
          and `AllowNondistributableArtifactsHostnames` fields in the `RegistryConfig`
          struct in the `GET /info` response are omitted in API v1.49. [moby/moby#49749](https://redirect.github.com/moby/moby/pull/49749)\n-
          \  API: Deprecated: The `ContainerdCommit.Expected`, `RuncCommit.Expected`,
          and `InitCommit.Expected` fields in the `GET /info` endpoint were deprecated
          in API v1.48, and are now omitted in API v1.49. [moby/moby#48556](https://redirect.github.com/moby/moby/pull/48556)\n-
          \  Go-SDK: cli/command/image: Deprecate `RunPull`: this function was only
          used internally and will be removed in the next release. [docker/cli#5975](https://redirect.github.com/docker/cli/pull/5975)\n-
          \  Go-SDK: cli/config/configfile: deprecate `ConfigFile.Experimental` field.
          Experimental CLI features are always enabled since version v20.10 and this
          field is no longer used. Use `ConfigFile.Features` instead for optional
          features. This field will be removed in a future release. [docker/cli#5977](https://redirect.github.com/docker/cli/pull/5977)\n-
          \  Go-SDK: deprecate `pkg/archive`, which was migrated to `github.com/moby/go-archive`.
          [moby/moby#49743](https://redirect.github.com/moby/moby/pull/49743)\n-   Go-SDK:
          deprecate `pkg/atomicwriter`, which was migrated to `github.com/moby/sys/atomicwriter`.
          [moby/moby#49748](https://redirect.github.com/moby/moby/pull/49748)\n-   Go-SDK:
          opts: remove deprecated `PortOpt`, `ConfigOpt`, `SecretOpt` aliases. [docker/cli#5953](https://redirect.github.com/docker/cli/pull/5953)\n-
          \  Go-SDK: registry: deprecate `APIEndpoint.Official` field. [moby/moby#49706](https://redirect.github.com/moby/moby/pull/49706)\n\n###
          [`v28.0.4`](https://redirect.github.com/moby/moby/releases/tag/v28.0.4)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.3...v28.0.4)\n\n#####
          28.0.4\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.4 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.4)\n-
          \  [moby/moby, 28.0.4 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.4)\n\n#####
          Bug fixes and enhancements\n\n-   Fix a regression causing `docker pull/push`
          to fail when interacting with a private repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n\n###
          [`v28.0.3`](https://redirect.github.com/moby/moby/releases/tag/v28.0.3)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.2...v28.0.3)\n\n#####
          28.0.3\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.3 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.3)\n-
          \  [moby/moby, 28.0.3 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.3)\n\n#####
          Bug fixes and enhancements\n\n-   Fix `docker run` truncating the `STDOUT`/`STDERR`
          prematurely when the container exits before the data is consumed. [docker/cli#5957](https://redirect.github.com/docker/cli/pull/5957)\n\n#####
          Packaging updates\n\n-   Update BuildKit to [v0.20.2](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.2).
          [moby/moby#49698](https://redirect.github.com/moby/moby/pull/49698)\n-   Update
          `runc` to [v1.2.6](https://redirect.github.com/opencontainers/runc/releases/tag/v1.2.6)
          (static packages only). [moby/moby#49682](https://redirect.github.com/moby/moby/pull/49682)\n-
          \  Update containerd to [v1.7.26](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.26).
          [docker/containerd-packaging#409](https://redirect.github.com/docker/containerd-packaging/pull/409)\n\n###
          [`v28.0.2`](https://redirect.github.com/moby/moby/releases/tag/v28.0.2)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.1...v28.0.2)\n\n#####
          28.0.2\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.2 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.2)\n-
          \  [moby/moby, 28.0.2 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.2)\n\n#####
          Bug fixes and enhancements\n\n-   Fix CLI-specific attributes (`docker.cli.*`)
          being unintentionally passed to downstream OTel services. [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n-
          \  Fix an issue where user-specified `OTEL_RESOURCE_ATTRIBUTES` were being
          overridden by CLI's internal telemetry attributes. The CLI now properly
          merges user-specified attributes with internal ones, allowing both to coexist.
          [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n-   Fix
          daemon failing to start on Windows when a container created before v28.0.0
          was present. [moby/moby#49626](https://redirect.github.com/moby/moby/pull/49626)\n-
          \  Fix possible error on `docker buildx prune` with the `--min-free-space`.
          [moby/moby#49623](https://redirect.github.com/moby/moby/pull/49623)\n-   Fix
          spurious `io: read/write on closed pipe` error in the daemon log when closing
          container. [moby/moby#49590](https://redirect.github.com/moby/moby/pull/49590)\n-
          \  Fix the Docker daemon failing too early if the containerd socket isn't
          immediately available. [moby/moby#49603](https://redirect.github.com/moby/moby/pull/49603)\n-
          \  Mask Linux thermal interrupt info in a container's `/proc` and `/sys`
          by default. [moby/moby#49560](https://redirect.github.com/moby/moby/pull/49560)\n-
          \  Update `contrib/check-config.sh` to check for more kernel modules related
          to iptables. [moby/moby#49622](https://redirect.github.com/moby/moby/pull/49622)\n-
          \  containerd image store: Fix integer overflow in User ID handling passed
          via `--user`. [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n-
          \  containerd image store: Fix spurious `reference for unknown type: application/vnd.in-toto+json`
          warning being logged to the daemon's log. [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n-
          \  containerd image store: Improve performance of `docker ps` when running
          large number of containers. [moby/moby#49365](https://redirect.github.com/moby/moby/pull/49365)\n\n#####
          Packaging updates\n\n-   Update BuildKit to [v0.20.1](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.1).
          [moby/moby#49587](https://redirect.github.com/moby/moby/pull/49587)\n-   Update
          Buildx to [v0.22.0](https://redirect.github.com/docker/buildx/releases/tag/v0.22.0).
          [docker/docker-ce-packaging#1175](https://redirect.github.com/docker/docker-ce-packaging/pull/1175)\n-
          \  Update Compose to [v2.34.0](https://redirect.github.com/docker/compose/releases/tag/v2.34.0).
          [docker/docker-ce-packaging#1172](https://redirect.github.com/docker/docker-ce-packaging/pull/1172)\n-
          \  Update Go runtime to [1.23.7](https://go.dev/doc/devel/release#go1.23.7).
          [docker/cli#5890](https://redirect.github.com/docker/cli/pull/5890), [docker/docker-ce-packaging#1171](https://redirect.github.com/docker/docker-ce-packaging/pull/1171),
          [moby/moby#49580](https://redirect.github.com/moby/moby/pull/49580)\n-   Update
          RootlessKit to [v2.3.4](https://redirect.github.com/rootless-containers/rootlesskit/releases/tag/v2.3.4).
          [moby/moby#49614](https://redirect.github.com/moby/moby/pull/49614)\n-   Update
          containerd (static binaries only) to [v1.7.27](https://www.github.com/containerd/containerd/releases/tag/v1.7.27).
          [moby/moby#49656](https://redirect.github.com/moby/moby/pull/49656)\n\n#####
          Networking\n\n-   Add environment variable `DOCKER_INSECURE_NO_IPTABLES_RAW=1`
          to allow Docker to run on systems where the Linux kernel can't provide `CONFIG_IP_NF_RAW`
          support. When enabled, Docker will not create rules in the iptables `raw`
          table. Warning: This is not recommended for production environments as it
          reduces security by allowing other hosts on the local network to route to
          ports published to host addresses, even when they are published to `127.0.0.1.`
          This option bypasses some of the security hardening introduced in Docker
          Engine 28.0.0. [moby/moby#49621](https://redirect.github.com/moby/moby/pull/49621)\n-
          \  Allow container startup when an endpoint is attached to a macvlan network
          where the parent interface is down. [moby/moby#49630](https://redirect.github.com/moby/moby/pull/49630)\n-
          \  Do not skip DNAT for packets originating in a gateway_mode=routed network.
          [moby/moby#49577](https://redirect.github.com/moby/moby/pull/49577)\n-   Fix
          a bug causing `docker ps` to inconsistently report dual-stack port mappings.
          [moby/moby#49657](https://redirect.github.com/moby/moby/pull/49657)\n-   Fix
          a bug that could cause `docker-proxy` to stop forwarding UDP datagrams to
          containers. [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n-
          \  Fix a bug that was causing `docker-proxy` to close UDP connections to
          containers eagerly and resulting in the source address to change needlessly.
          [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n\n#####
          Go SDK\n\n-   Move various types and consts from `cli-plugins/manager` to
          a separate package. [docker/cli#5902](https://redirect.github.com/docker/cli/pull/5902)\n-
          \  Update minimum required Go version to go1.23. [moby/moby#49541](https://redirect.github.com/moby/moby/pull/49541)\n-
          \  `cli/command`: Move `PrettyPrint` utility to `cli/command/formatter`.
          [docker/cli#5916](https://redirect.github.com/docker/cli/pull/5916)\n-   runconfig/errors:
          split `ErrConflictHostNetwork` into `ErrConflictConnectToHostNetwork` and
          `ErrConflictDisconnectFromHostNetwork`. [moby/moby#49605](https://redirect.github.com/moby/moby/pull/49605)\n\n#####
          Deprecations\n\n-   Go-SDK: Deprecate `cli-plugins/manager.ResourceAttributesEnvvar`
          constant. It was used internally, but holds the `OTEL_RESOURCE_ATTRIBUTES`
          name, which is part of the OpenTelemetry specification. Users of this constant
          should define their own. It will be removed in the next release. [docker/cli#5881](https://redirect.github.com/docker/cli/pull/5881)\n-
          \  Go-SDK: Deprecate `opts.PortOpt`, `opts.ConfigOpt` and `opts.SecretOpt`.
          These types were moved to the `opts/swarmopts` package. [docker/cli#5907](https://redirect.github.com/docker/cli/pull/5907)\n-
          \  Go-SDK: Remove `service/logs` package. [docker/cli#5910](https://redirect.github.com/docker/cli/pull/5910)\n-
          \  Go-SDK: `cli/command/image`: Deprecate `PushTrustedReference` and move
          to `cli/trust`. [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-
          \  Go-SDK: `cli/command/image`: Deprecate and internalize `TrustedPush`.
          [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-   Go-SDK:
          `cli/command`: deprecate `Cli.NotaryClient`: use [`trust.GetNotaryRepository`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/trust#GetNotaryRepository)
          instead. This method is no longer used and will be removed in the next release.
          [docker/cli#5885](https://redirect.github.com/docker/cli/pull/5885)\n-   Go-SDK:
          `cli/command`: deprecate `Cli.RegistryClient`. This method was only used
          internally and will be removed in the next release. Use [`client.NewRegistryClient`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/registry/client#NewRegistryClient)
          instead. [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889),
          [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889)\n-   Go-SDK:
          `registry`: Deprecate `RepositoryInfo.Official` field. [moby/moby#49567](https://redirect.github.com/moby/moby/pull/49567)\n-
          \  Go-SDK: `registry`: deprecate `HostCertsDir`: this function was only
          used internally and will be removed in the next release. [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n-
          \  Go-SDK: `registry`: deprecate `SetCertsDir`: the cert-directory is now
          automatically selected when running with RootlessKit, and should no longer
          be set manually. [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n\n###
          [`v28.0.1`](https://redirect.github.com/moby/moby/releases/tag/v28.0.1)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.0...v28.0.1)\n\n#####
          28.0.1\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.1)\n-
          \  [moby/moby, 28.0.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.1)\n\n#####
          Networking\n\n-   Remove dependency on kernel modules `ip_set`, `ip_set_hash_net`
          and `netfilter_xt_set`.\n    -   The dependency was introduced in release
          28.0.0 but proved too disruptive. The iptables rules using these modules
          have been replaced. [moby/moby#49530](https://redirect.github.com/moby/moby/pull/49530)\n-
          \  Allow daemon startup on a host with IPv6 disabled without requiring `--ip6tables=false`.
          [moby/moby#49525](https://redirect.github.com/moby/moby/pull/49525)\n-   Fix
          a bug that was causing containers with `--restart=always` and a published
          port already in use to restart in a tight loop. [moby/moby#49507](https://redirect.github.com/moby/moby/pull/49507)\n-
          \  Fix an issue with Swarm ingress, caused by incorrect ordering of iptables
          rules. [moby/moby#49538](https://redirect.github.com/moby/moby/pull/49538)\n-
          \  Fix creation of a swarm-scoped network from a `--config-only` network.
          [moby/moby#49521](https://redirect.github.com/moby/moby/pull/49521)\n-   Fix
          `docker network inspect` reporting an IPv6 gateway with CIDR suffix for
          a newly created network with no specific IPAM config, until a daemon restart.
          [moby/moby#49520](https://redirect.github.com/moby/moby/pull/49520)\n-   Improve
          the error reported when kernel modules `ip_set`, `ip_set_hash_net` and `netilter_xt_set`
          are not available. [moby/moby#49524](https://redirect.github.com/moby/moby/pull/49524)\n-
          \  Move most of Docker's iptables rules out of the filter-FORWARD chain,
          so that other applications are free to append rules that must follow Docker's
          rules. [moby/moby#49518](https://redirect.github.com/moby/moby/pull/49518)\n-
          \  Update `--help` output and man page lo state which options only apply
          to the default bridge network. [moby/moby#49522](https://redirect.github.com/moby/moby/pull/49522)\n\n#####
          Bug fixes and enhancements\n\n-   Fix `docker context create` always returning
          an error when using the `\"skip-tls-verify\"` option. [docker/cli#5850](https://redirect.github.com/docker/cli/pull/5850)\n-
          \  Fix shell completion suggesting IDs instead of names for services and
          nodes. [docker/cli#5848](https://redirect.github.com/docker/cli/pull/5848)\n-
          \  Fix unintentionally printing exit status to standard error output when
          `docker exec/run` returns a non-zero status. [docker/cli#5854](https://redirect.github.com/docker/cli/pull/5854)\n-
          \  Fix regression `protocol \"tcp\" is not supported by the RootlessKit
          port driver \"slirp4netns\"`. [moby/moby#49514](https://redirect.github.com/moby/moby/pull/49514)\n-
          \  containerd image store: Fix `docker inspect` not being able to show multi-platform
          images with missing layers for all platforms. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
          \  containerd image store: Fix `docker images --tree` reporting wrong content
          size. [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n-
          \  Fix compilation on i386 [moby/moby#49526](https://redirect.github.com/moby/moby/pull/49526)\n\n#####
          Packaging updates\n\n-   Update `github.com/go-jose/go-jose/v4` to v4.0.5
          to address. [GHSA-c6gw-w398-hv78](https://redirect.github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78)
          / [CVE-2025-27144](https://www.cve.org/CVERecord?id=CVE-2025-27144) [docker/cli#5867](https://redirect.github.com/docker/cli/pull/5867)\n-
          \  Update Buildx to [v0.21.1](https://redirect.github.com/docker/buildx/releases/tag/v0.21.1).
          [docker/docker-ce-packaging#1167](https://redirect.github.com/docker/docker-ce-packaging/pull/1167)\n-
          \  Update Compose to [v2.33.1](https://redirect.github.com/docker/compose/releases/tag/v2.33.1).
          [docker/docker-ce-packaging#1168](https://redirect.github.com/docker/docker-ce-packaging/pull/1168)\n\n#####
          API\n\n-   containerd image store: Fix `GET /images/json?manifests=1` not
          filling `Manifests` for index-only images. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
          \  containerd image store: Fix `GET /images/json and /images/<name>/json`
          `Size.Content` field including the size of content that's not available
          locally. [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n\n###
          [`v28.0.0`](https://redirect.github.com/moby/moby/releases/tag/v28.0.0)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v27.5.1...v28.0.0)\n\n#####
          28.0.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n-   [docker/cli, 28.0.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
          \  [moby/moby, 28.0.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
          \  Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.0.0/docs/deprecated.md).\n-
          \  Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.0.0/docs/api/version-history.md).\n\n#####
          New\n\n-   Add ability to mount an image inside a container via `--mount
          type=image`. [moby/moby#48798](https://redirect.github.com/moby/moby/pull/48798)\n
          \   -   You can also specify `--mount type=image,image-subpath=[subpath],...`
          option to mount a specific path from the image. [docker/cli#5755](https://redirect.github.com/docker/cli/pull/5755)\n-
          \  `docker images --tree` now shows metadata badges. [docker/cli#5744](https://redirect.github.com/docker/cli/pull/5744)\n-
          \  `docker load`, `docker save`, and `docker history` now support a `--platform`
          flag allowing you to choose a specific platform for single-platform operations
          on multi-platform images. [docker/cli#5331](https://redirect.github.com/docker/cli/pull/5331)\n-
          \  Add `OOMScoreAdj` to `docker service create` and `docker stack`. [docker/cli#5145](https://redirect.github.com/docker/cli/pull/5145)\n-
          \  `docker buildx prune` now supports `reserved-space`, `max-used-space`,
          `min-free-space` and `keep-bytes` filters. [moby/moby#48720](https://redirect.github.com/moby/moby/pull/48720)\n-
          \  Windows: Add support for running containerd as a child process of the
          daemon, instead of using a system-installed containerd. [moby/moby#47955](https://redirect.github.com/moby/moby/pull/47955)\n\n#####
          Networking\n\n-   The `docker-proxy` binary has been updated, older versions
          will not work with the updated `dockerd`. [moby/moby#48132](https://redirect.github.com/moby/moby/pull/48132)\n
          \   -   Close a window in which the userland proxy (`docker-proxy`) could
          accept TCP connections, that would then fail after `iptables` NAT rules
          were set up.\n    -   The executable `rootlesskit-docker-proxy` is no longer
          used, it has been removed from the build and distribution.\n-   DNS nameservers
          read from the host's `/etc/resolv.conf` are now always accessed from the
          host's network namespace. [moby/moby#48290](https://redirect.github.com/moby/moby/pull/48290)\n
          \   -   When the host's `/etc/resolv.conf` contains no nameservers and there
          are no `--dns` overrides, Google's DNS servers are no longer used, apart
          from by the default bridge network and in build containers.\n-   Container
          interfaces in bridge and macvlan networks now use randomly generated MAC
          addresses. [moby/moby#48808](https://redirect.github.com/moby/moby/pull/48808)\n
          \   -   Gratuitous ARP / Neighbour Advertisement messages will be sent when
          the interfaces are started so that, when IP addresses are reused, they're
          associated with the newly generated MAC address.\n    -   IPv6 addresses
          in the default bridge network are now IPAM-assigned, rather than being derived
          from the MAC address.\n-   The deprecated OCI `prestart` hook is now only
          used by build containers. For other containers, network interfaces are added
          to the network namespace after task creation is complete, before the container
          task is started. [moby/moby#47406](https://redirect.github.com/moby/moby/pull/47406)\n-
          \  Add a new `gw-priority` option to `docker run`, `docker container create`,
          and `docker network connect`. This option will be used by the Engine to
          determine which network provides the default gateway for a container. On
          `docker run`, this option is only available through the extended `--network`
          syntax. [docker/cli#5664](https://redirect.github.com/docker/cli/pull/5664)\n-
          \  Add a new netlabel `com.docker.network.endpoint.ifname` to customize
          the interface name used when connecting a container to a network. It's supported
          by all built-in network drivers on Linux. [moby/moby#49155](https://redirect.github.com/moby/moby/pull/49155)\n
          \   -   When a container is created with multiple networks specified, there's
          no guarantee on the order networks will be connected to the container. So,
          if a custom interface name uses the same prefix as the auto-generated names,
          for example `eth`, the container might fail to start.\n    -   The recommended
          practice is to use a different prefix, for example `en0`, or a numerical
          suffix high enough to never collide, for example `eth100`.\n    -   This
          label can be specified on `docker network connect` via the `--driver-opt`
          flag, for example `docker network connect --driver-opt=com.docker.network.endpoint.ifname=foobar
          \u2026`.\n    -   Or via the long-form `--network` flag on `docker run`,
          for example `docker run --network=name=bridge,driver-opt=com.docker.network.endpoint.ifname=foobar
          \u2026`\n-   If a custom network driver reports capability `GwAllocChecker`
          then, before a network is created, it will get a `GwAllocCheckerRequest`
          with the network's options. The custom driver may then reply that no gateway
          IP address should be allocated. [moby/moby#49372](https://redirect.github.com/moby/moby/pull/49372)\n\n#####
          Port publishing in bridge networks\n\n-   `dockerd` now requires `ipset`
          support in the Linux kernel. [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n
          \   -   The `iptables` and `ip6tables` rules used to implement port publishing
          and network isolation have been extensively modified. This enables some
          of the following functional changes, and is a first step in refactoring
          to enable native `nftables` support in a future release. [moby/moby#48815](https://redirect.github.com/moby/moby/issues/48815)\n
          \   -   If it becomes necessary to downgrade to an earlier version of the
          daemon, some manual cleanup of the new rules will be necessary. The simplest
          and surest approach is to reboot the host, or use `iptables -F` and `ip6tables
          -F` to flush all existing `iptables` rules from the `filter` table before
          starting the older version of the daemon. When that is not possible, run
          the following commands as root:\n        -   `iptables -D FORWARD -m set
          --match-set docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED
          -j ACCEPT; ip6tables -D FORWARD -m set --match-set docker-ext-bridges-v6
          dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT`\n        -   `iptables
          -D FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER; ip6tables
          -D FORWARD -m set --match-set docker-ext-bridges-v6 dst -j DOCKER`\n        -
          \  If you were previously running with the iptables filter-FORWARD policy
          set to `ACCEPT` and need to restore access to unpublished ports, also delete
          per-bridge-network rules from the `DOCKER` chains. For example, `iptables
          -D DOCKER ! -i docker0 -o docker0 -j DROP`.\n-   Fix a security issue that
          was allowing remote hosts to connect directly to a container on its published
          ports. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
          \  Fix a security issue that was allowing neighbor hosts to connect to ports
          mapped on a loopback address. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
          \  Fix an issue that prevented port publishing to link-local addresses.
          [moby/moby#48570](https://redirect.github.com/moby/moby/pull/48570)\n-   UDP
          ports published by a container are now reliably accessible by containers
          on other networks, via the host's public IP address. [moby/moby#48571](https://redirect.github.com/moby/moby/pull/48571)\n-
          \  Docker will now only set the `ip6tables` policy for the `FORWARD` chain
          in the `filter` table to `DROP` if it enables IP forwarding on the host
          itself (sysctls `net.ipv6.conf.all.forwarding` and `net.ipv6.conf.default.forwarding`).
          This is now aligned with existing IPv4 behaviour. [moby/moby#48594](https://redirect.github.com/moby/moby/pull/48594)\n
          \   -   If IPv6 forwarding is enabled on your host, but you were depending
          on Docker to set the ip6tables filter-FORWARD policy to `DROP`, you may
          need to update your host's configuration to make sure it is secure.\n-   Direct
          routed access to container ports that are not exposed using `p`/`-publish`
          is now blocked in the `DOCKER` iptables chain. [moby/moby#48724](https://redirect.github.com/moby/moby/pull/48724)\n
          \   -   If the default iptables filter-FORWARD policy was previously left
          at `ACCEPT` on your host, and direct routed access to a container's unpublished
          ports from a remote host is still required, options are:\n        -   Publish
          the ports you need.\n        -   Use the new `gateway_mode_ipv[46]=nat-unprotected`,
          described below.\n    -   Container ports published to host addresses will
          continue to be accessible via those host addresses, using NAT or the userland
          proxy.\n    -   Unpublished container ports continue to be directly accessible
          from the Docker host via the container's IP address.\n-   Networks created
          with `gateway_mode_ipv[46]=routed` are now accessible from other bridge
          networks running on the same Docker host, as well as from outside the host.
          [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n-   Bridge
          driver options `com.docker.network.bridge.gateway_mode_ipv4` and `com.docker.network.bridge.gateway_mode_ipv6`
          now accept mode `nat-unprotected`. [moby/moby#48597](https://redirect.github.com/moby/moby/pull/48597)\n
          \   -   `nat-unprotected` is similar to the default `nat` mode, but no per
          port/protocol rules are set up. This means any port on a container can be
          accessed by direct-routing from a remote host.\n-   Bridge driver options
          `com.docker.network.bridge.gateway_mode_ipv4` and `com.docker.network.bridge.gateway_mode_ipv6`
          now accept mode `isolated`, when the network is also `internal`. [moby/moby#49262](https://redirect.github.com/moby/moby/pull/49262)\n
          \   -   An address is normally assigned to the bridge device in an `internal`
          network. So, processes on the Docker host can access the network, and containers
          in the network can access host services listening on that bridge address
          (including services listening on \"any\" host address, `0.0.0.0` or `::`).\n
          \   -   An `internal` bridge network created with gateway mode `isolated`
          does not have an address on the Docker host.\n-   When a port mapping includes
          a host IP address or port number that cannot be used because NAT from the
          host is disabled using `--gateway_mode_ipv[46]`, container creation will
          no longer fail. The unused fields may be needed if the gateway endpoint
          changes when networks are connected or disconnected. A message about the
          unused fields will be logged. [moby/moby#48575](https://redirect.github.com/moby/moby/pull/48575)\n-
          \  Do not create iptables nat-POSTROUTING masquerade rules for a container's
          own published ports, when the userland proxy is enabled. [moby/moby#48854](https://redirect.github.com/moby/moby/pull/48854)\n\n#####
          IPv6\n\n-   Add `docker network create` option `--ipv4`. To disable IPv4
          address assignment for a network, use `docker network create --ipv4=false
          [...]`. [docker/cli#5599](https://redirect.github.com/docker/cli/pull/5599)\n-
          \  Daemon option `--ipv6` (`\"ipv6\": true` in `daemon.json`) can now be
          used without `fixed-cidr-v6`. [moby/moby#48319](https://redirect.github.com/moby/moby/pull/48319)\n-
          \  IPAM now handles subnets bigger than \"/64\". [moby/moby#49223](https://redirect.github.com/moby/moby/pull/49223)\n-
          \  Duplicate address detection (DAD) is now disabled for addresses assigned
          to the bridges belonging to bridge networks. [moby/moby#48609](https://redirect.github.com/moby/moby/pull/48609)\n-
          \  Modifications to `host-gateway`, for compatibility with IPv6-only networks.
          [moby/moby#48807](https://redirect.github.com/moby/moby/pull/48807)\n    -
          \  When special value `host-gateway` is used in an `--add-host` option in
          place of an address, it's replaced by an address on the Docker host to make
          it possible to refer to the host by name. The address used belongs to the
          default bridge (normally `docker0`). Until now it's always been an IPv4
          address, because all containers on bridge networks had IPv4 addresses.\n
          \   -   Now, if IPv6 is enabled on the default bridge network, `/etc/hosts`
          entries will be created for IPv4 and IPv6 addresses. So, a container that's
          only connected to IPv6-only networks can access the host by name.\n    -
          \  The `--host-gateway-ip` option overrides the address used to replace
          `host-gateway`. Two of these options are now allowed on the command line,
          for one IPv4 gateway and one IPv6.\n    -   In the `daemon.json` file, to
          provide two addresses, use `\"host-gateway-ips\"`. For example, `\"host-gateway-ips\":
          [\"192.0.2.1\", \"2001:db8::1111\"]`.\n\n##### Bug fixes and enhancements\n\n-
          \  Add IPv6 loopback address as an insecure registry by default. [moby/moby#48540](https://redirect.github.com/moby/moby/pull/48540)\n-
          \  Add support for Cobra-generated completion scripts for `dockerd`. [moby/moby#49339](https://redirect.github.com/moby/moby/pull/49339)\n-
          \  Fix DNS queries failing when containers are launched via `systemd` auto-start
          on boot [moby/moby#48812](https://redirect.github.com/moby/moby/pull/48812)\n-
          \  Fix Docker Swarm mode ignoring `volume.subpath` [docker/cli#5833](https://redirect.github.com/docker/cli/pull/5833)\n-
          \  Fix `docker export` continuing the export after the operation is canceled.
          [moby/moby#49265](https://redirect.github.com/moby/moby/pull/49265)\n-   Fix
          `docker export` not releasing the container's writable layer after a failure.
          [moby/moby#48517](https://redirect.github.com/moby/moby/pull/48517)\n-   Fix
          `docker images --tree` unnecessary truncating long image names when multiple
          names are available [docker/cli#5757](https://redirect.github.com/docker/cli/pull/5757)\n-
          \  Fix a bug where a container with a name matching another container's
          ID is not restored on daemon startup. [moby/moby#48669](https://redirect.github.com/moby/moby/pull/48669)\n-
          \  Fix an issue preventing some IPv6 addresses shown by `docker ps` to be
          properly bracketed [docker/cli#5468](https://redirect.github.com/docker/cli/pull/5468)\n-
          \  Fix bug preventing image pulls from being cancelled during `docker run`.
          [docker/cli#5645](https://redirect.github.com/docker/cli/pull/5645)\n-   Fix
          error-handling when running the daemon as a Windows service to prevent unclean
          exits. [moby/moby#48518](https://redirect.github.com/moby/moby/pull/48518)\n-
          \  Fix issue causing output of `docker run` to be inconsistent when using
          `--attach stdout` or `--attach stderr` versus `stdin`.  `docker run --attach
          stdin` now exits if the container exits. [docker/cli#5662](https://redirect.github.com/docker/cli/pull/5662)\n-
          \  Fix rootless Docker setup with `subid` backed by NSS modules. [moby/moby#49036](https://redirect.github.com/moby/moby/pull/49036)\n-
          \  Generated completion scripts from the CLI now show descriptions next
          to each command/flag suggestion. [docker/cli#5756](https://redirect.github.com/docker/cli/pull/5756)\n-
          \  IPv6 addresses shown by `docker ps` in port bindings are now bracketed
          [docker/cli#5363](https://redirect.github.com/docker/cli/pull/5363)\n-   Implement
          the ports validation method for Compose [docker/cli#5524](https://redirect.github.com/docker/cli/pull/5524)\n-
          \  Improve error-output for invalid flags on the command line. [docker/cli#5233](https://redirect.github.com/docker/cli/pull/5233)\n-
          \  Improve errors when failing to start a container using anther container's
          network namespace. [moby/moby#49367](https://redirect.github.com/moby/moby/pull/49367)\n-
          \  Improve handling of invalid API errors that could result in an empty
          error message being shown. [moby/moby#49373](https://redirect.github.com/moby/moby/pull/49373)\n-
          \  Improve output and consistency for unknown (sub)commands and invalid
          arguments [docker/cli#5234](https://redirect.github.com/docker/cli/pull/5234)\n-
          \  Improve validation of `exec-opts` in daemon configuration. [moby/moby#48979](https://redirect.github.com/moby/moby/pull/48979)\n-
          \  Update the handling of the `--gpus=0` flag to be consistent with the
          NVIDIA Container Runtime. [moby/moby#48482](https://redirect.github.com/moby/moby/pull/48482)\n-
          \  `client.ContainerCreate` now normalizes `CapAdd` and `CapDrop` fields
          in `HostConfig` to their canonical form. [moby/moby#48551](https://redirect.github.com/moby/moby/pull/48551)\n-
          \  `docker image save` now produces stable timestamps. [moby/moby#48611](https://redirect.github.com/moby/moby/pull/48611)\n-
          \  `docker inspect` now lets you inspect Swarm configs [docker/cli#5573](https://redirect.github.com/docker/cli/pull/5573)\n-
          \  containerd image store: Add support for `Extracting` layer status in
          `docker pull`. [moby/moby#49064](https://redirect.github.com/moby/moby/pull/49064)\n-
          \  containerd image store: Fix `commit`, `import`, and `build` not preserving
          a replaced image as a dangling image. [moby/moby#48316](https://redirect.github.com/moby/moby/pull/48316)\n-
          \  containerd image store: Make `docker load --platform` return an error
          when the requested platform isn't loaded. [moby/moby#48718](https://redirect.github.com/moby/moby/pull/48718)\n-
          \  Fix validation of `--link` option. [docker/cli#5739](https://redirect.github.com/docker/cli/pull/5739)\n-
          \  Add validation of network-diagnostic-port daemon configuration option.
          [moby/moby#49305](https://redirect.github.com/moby/moby/pull/49305)\n-   Unless
          explicitly configured, an IP address is no longer reserved for a gateway
          in cases where it is not required. Namely, \u201Cinternal\u201D bridge networks
          with option `com.docker.network.bridge.inhibit_ipv4`, `ipvlan` or `macvlan`
          networks with no parent interface, and L3 IPvlan modes. [moby/moby#49261](https://redirect.github.com/moby/moby/pull/49261)\n-
          \  If a custom network driver reports capability `GwAllocChecker` then,
          before a network is created, it will get a `GwAllocCheckerRequest` with
          the network's options. The custom driver may then reply that no gateway
          IP address should be allocated. [moby/moby#49372](https://redirect.github.com/moby/moby/pull/49372)\n-
          \  Fixed an issue that meant a container could not be attached to an L3
          IPvlan at the same time as other network types. [moby/moby#49130](https://redirect.github.com/moby/moby/pull/49130)\n-
          \  Remove the correct `/etc/hosts` entries when disconnecting a container
          from a network. [moby/moby#48857](https://redirect.github.com/moby/moby/pull/48857)\n-
          \  Fix duplicate network disconnect events. [moby/moby#48800](https://redirect.github.com/moby/moby/pull/48800)\n-
          \  Resolve issues related to changing `fixed-cidr` for `docker0`, and inferring
          configuration from a user-managed default bridge (`--bridge`). [moby/moby#48319](https://redirect.github.com/moby/moby/pull/48319)\n-
          \  Remove feature flag `windows-dns-proxy`, introduced in release 26.1.0
          to control forwarding to external DNS resolvers from Windows containers,
          to make `nslookup` work. It was enabled by default in release 27.0.0. [moby/moby#48738](https://redirect.github.com/moby/moby/pull/48738)\n-
          \  Remove an `iptables` mangle rule for checksumming SCTP. The rule can
          be re-enabled by setting `DOCKER_IPTABLES_SCTP_CHECKSUM=1` in the daemon's
          environment. This override will be removed in a future release. [moby/moby#48149](https://redirect.github.com/moby/moby/pull/48149)\n-
          \  Faster connection to bridge networks, in most cases. [moby/moby#49302](https://redirect.github.com/moby/moby/pull/49302)\n\n#####
          Packaging updates\n\n-   Update Go runtime to [1.23.6](https://go.dev/doc/devel/release#go1.23.6).
          [docker/cli#5795](https://redirect.github.com/docker/cli/pull/5795), [moby/moby#49393](https://redirect.github.com/moby/moby/pull/49393),
          [docker/docker-ce-packaging#1161](https://redirect.github.com/docker/docker-ce-packaging/pull/1161)\n-
          \  Update `runc` to [v1.2.5](https://redirect.github.com/opencontainers/runc/releases/tag/v1.2.5)
          (static binaries only). [moby/moby#49464](https://redirect.github.com/moby/moby/pull/49464)\n-
          \  Update containerd to [v1.7.25](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.25).
          [moby/moby#49252](https://redirect.github.com/moby/moby/pull/49252)\n-   Update
          BuildKit to [v0.20.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.0).
          [moby/moby#49495](https://redirect.github.com/moby/moby/pull/49495)\n-   Update
          Buildx to [v0.21.0](https://redirect.github.com/docker/buildx/releases/tag/v0.21.0).
          [docker/docker-ce-packaging#1166](https://redirect.github.com/docker/docker-ce-packaging/pull/1166)\n-
          \  Update Compose to [v2.32.4](https://redirect.github.com/docker/compose/releases/tag/v2.32.3).
          [docker/docker-ce-packaging#1143](https://redirect.github.com/docker/docker-ce-packaging/pull/1143)\n-
          \  The canonical source for the `dockerd(8)` man page has been moved back
          to the `moby/moby` repository itself. [moby/moby#48298](https://redirect.github.com/moby/moby/pull/48298)\n\n#####
          Go SDK\n\n-   Improve validation of empty object IDs. The client now returns
          an \"Invalid Parameter\" error when trying to use an empty ID or name. This
          changes the error returned by some \"Inspect\" functions from a \"Not found\"
          error to an \"Invalid Parameter\". [moby/moby#49381](https://redirect.github.com/moby/moby/pull/49381)\n-
          \  `Client.ImageBuild()` now omits default values from the API request's
          query string. [moby/moby#48651](https://redirect.github.com/moby/moby/pull/48651)\n-
          \  `api/types/container`: Merge `Stats` and `StatsResponse` [moby/moby#49287](https://redirect.github.com/moby/moby/pull/49287)\n-
          \  `client.WithVersion`: Strip v-prefix when setting API version [moby/moby#49352](https://redirect.github.com/moby/moby/pull/49352)\n-
          \  `client`: Add `WithTraceOptions` allowing to specify custom OTe1 trace
          options. [moby/moby#49415](https://redirect.github.com/moby/moby/pull/49415)\n-
          \  `client`: Add `HijackDialer` interface. [moby/moby#49388](https://redirect.github.com/moby/moby/pull/49388)\n-
          \  `client`: Add `SwarmManagementAPIClient` interface to describe all API
          client methods related to Swarm-specific objects. [moby/moby#49388](https://redirect.github.com/moby/moby/pull/49388)\n-
          \  `client`: Add `WithTraceOptions` allowing to specify custom OTel trace
          options. [moby/moby#49415](https://redirect.github.com/moby/moby/pull/49415)\n-
          \  `client`: `ImageHistory`, `ImageLoad` and `ImageSave` now use variadic
          functional options [moby/moby#49466](https://redirect.github.com/moby/moby/pull/49466)\n-
          \  `pkg/containerfs`: Move to internal [moby/moby#48097](https://redirect.github.com/moby/moby/pull/48097)\n-
          \  `pkg/reexec`: Can now be used on platforms other than Linux, Windows,
          macOS and FreeBSD [moby/moby#49118](https://redirect.github.com/moby/moby/pull/49118)\n-
          \  `api/types/container`: introduce `CommitResponse` type. This is currently
          an alias for `IDResponse`, but may become a distinct type in a future release.
          [moby/moby#49444](https://redirect.github.com/moby/moby/pull/49444)\n-   `api/types/container`:
          introduce `ExecCreateResponse` type. This is currently an alias for `IDResponse`,
          but may become a distinct type in a future release. [moby/moby#49444](https://redirect.github.com/moby/moby/pull/49444)\n\n#####
          API\n\n-   Update API version to [v1.48](https://docs.docker.com/engine/api/v1.48/)
          [moby/moby#48476](https://redirect.github.com/moby/moby/pull/48476)\n-   `GET
          /images/{name}/json` response now returns the `Manifests` field containing
          information about the sub-manifests contained in the image index. This includes
          things like platform-specific manifests and build attestations. [moby/moby#48264](https://redirect.github.com/moby/moby/pull/48264)\n-
          \  `POST /containers/create` now supports `Mount` of type `image` for mounting
          an image inside a container. [moby/moby#48798](https://redirect.github.com/moby/moby/pull/48798)\n-
          \  `GET /images/{name}/history` now supports a `platform` parameter (JSON
          encoded OCI Platform type) that lets you specify a platform to show the
          history of. [moby/moby#48295](https://redirect.github.com/moby/moby/pull/48295)\n-
          \  `POST /images/{name}/load` and `GET /images/{name}/get` now supports
          a `platform` parameter (JSON encoded OCI Platform type) that lets you specify
          a platform to load/save. Not passing this parameter results in loading/saving
          the full multi-platform image. [moby/moby#48295](https://redirect.github.com/moby/moby/pull/48295)\n-
          \  Improve errors for invalid width/height on container resize and exec
          resize [moby/moby#48679](https://redirect.github.com/moby/moby/pull/48679)\n-
          \  The `POST /containers/create` endpoint now includes a warning in the
          response when setting the container-wide `VolumeDriver` option in combination
          with volumes defined through `Mounts` because the `VolumeDriver` option
          has no effect on those volumes. This warning was previously generated by
          the CLI. [moby/moby#48789](https://redirect.github.com/moby/moby/pull/48789)\n-
          \  containerd image store: `GET /images/json` and `GET /images/{name}/json`
          responses now includes `Descriptor` field, which contains an OCI descriptor
          of the image target. The new field is only populated if the daemon provides
          a multi-platform image store. [moby/moby#48894](https://redirect.github.com/moby/moby/pull/48894)\n-
          \  containerd image store: `GET /containers/{name}/json` now returns an
          `ImageManifestDescriptor` field containing the OCI descriptor of the platform-specific
          image manifest of the image that was used to create the container. [moby/moby#48855](https://redirect.github.com/moby/moby/pull/48855)\n-
          \  Add debug endpoints (`GET /debug/vars`, `GET /debug/pprof/`, `GET /debug/pprof/cmdline`,
          `GET /debug/pprof/profile`, `GET /debug/pprof/symbol`, `GET /debug/pprof/trace`,
          `GET /debug/pprof/{name}`) are now also accessible through the versioned-API
          paths (`/v<API-version>/<endpoint>`). [moby/moby#49051](https://redirect.github.com/moby/moby/pull/49051)\n-
          \  Fix API returning a `500` status code instead of `400` for validation
          errors. [moby/moby#49217](https://redirect.github.com/moby/moby/pull/49217)\n-
          \  Fix status codes for archive endpoints `HEAD /containers/{name:.*}/archive`,
          `GET /containers/{name:.*}/archive`, `PUT /containers/{name:.*}/archive`
          returning a `500` status instead of a `400` status. [moby/moby#49219](https://redirect.github.com/moby/moby/pull/49219)\n-
          \  `POST /containers/create` now accepts a `writable-cgroups=true` option
          in `HostConfig.SecurityOpt` to mount the container's cgroups writable. This
          provides a more granular approach than `HostConfig.Privileged`. [moby/moby#48828](https://redirect.github.com/moby/moby/pull/48828)\n-
          \  `POST /build/prune` renames `keep-bytes` to `reserved-space` and now
          supports additional prune parameters `max-used-space` and `min-free-space`.
          [moby/moby#48720](https://redirect.github.com/moby/moby/pull/48720)\n-   `POST
          /networks/create` now has an `EnableIPv4` field. Setting it to `false` disables
          IPv4 IPAM for the network. [moby/moby#48271](https://redirect.github.com/moby/moby/pull/48271)\n
          \   -   `GET /networks/{id}` now returns an `EnableIPv4` field showing whether
          the network has IPv4 IPAM enabled. [moby/moby#48271](https://redirect.github.com/moby/moby/pull/48271)\n
          \   -   User-defined bridge networks require either IPv4 or IPv6 address
          assignment to be enabled. IPv4 cannot be disabled for the default bridge
          network (`docker0`). [moby/moby#48323](https://redirect.github.com/moby/moby/pull/48323)\n
          \   -   `macvlan` and `ipvlan` networks can be created with address assignment
          disabled for IPv4, IPv6, or both address families. [moby/moby#48299](https://redirect.github.com/moby/moby/pull/48299)\n
          \   -   IPv4 cannot be disabled for Windows or Swarm networks. [moby/moby#48278](https://redirect.github.com/moby/moby/pull/48278)\n-
          \  Add a way to specify which network should provide the default gateway
          for a container. [moby/moby#48936](https://redirect.github.com/moby/moby/pull/48936)\n
          \   -   `POST /networks/{id}/connect` and `POST /containers/create` now
          accept a `GwPriority` field in `EndpointsConfig`. This value is used to
          determine which network endpoint provides the default gateway for the container.
          The endpoint with the highest priority is selected. If multiple endpoints
          have the same priority, endpoints are sorted lexicographically by their
          network name, and the one that sorts first is picked. [moby/moby#48746](https://redirect.github.com/moby/moby/pull/48746)\n
          \   -   `GET /containers/json` now returns a `GwPriority` field in `NetworkSettings`
          for each network endpoint. The `GwPriority` field is used by the CLI\u2019s
          new `gw-priority` option for `docker run` and `docker network connect`.
          [moby/moby#48746](https://redirect.github.com/moby/moby/pull/48746)\n-   Settings
          for `eth0` in `--sysctl` options are no longer automatically migrated to
          the network endpoint. [moby/moby#48746](https://redirect.github.com/moby/moby/pull/48746)\n
          \   -   For example, in the Docker CLI, `docker run --network mynet --sysctl
          net.ipv4.conf.eth0.log_martians=1 ...` is rejected. Instead, you must use
          `docker run --network name=mynet,driver-opt=com.docker.network.endpoint.sysctls=net.ipv4.conf.IFNAME.log_martians=1
          ...`\n-   `GET /containers/json` now returns an `ImageManifestDescriptor`
          field matching the same field in `/containers/{name}/json`. This field is
          only populated if the daemon provides a multi-platform image store. [moby/moby#49407](https://redirect.github.com/moby/moby/pull/49407)\n\n#####
          Removed\n\n-   The Fluent logger option `fluentd-async-connect` has been
          deprecated in v20.10 and is now removed. [moby/moby#46114](https://redirect.github.com/moby/moby/pull/46114)\n-
          \  The `--time` option on `docker stop` and `docker restart` is deprecated
          and renamed to `--timeout`. [docker/cli#5485](https://redirect.github.com/docker/cli/pull/5485)\n-
          \  Go-SDK: `pkg/ioutils`: Remove `NewReaderErrWrapper` as it was never used.
          [moby/moby#49258](https://redirect.github.com/moby/moby/pull/49258)\n-   Go-SDK:
          `pkg/ioutils`: Remove deprecated `BytesPipe`, `NewBytesPipe`, `ErrClosed`,
          `WriteCounter`, `NewWriteCounter`, `NewReaderErrWrapper`, `NopFlusher`.
          [moby/moby#49245](https://redirect.github.com/moby/moby/pull/49245)\n-   Go-SDK:
          `pkg/ioutils`: Remove deprecated `NopWriter` and `NopWriteCloser`. [moby/moby#49256](https://redirect.github.com/moby/moby/pull/49256)\n-
          \  Go-SDK: `pkg/sysinfo`: Remove deprecated NumCPU. [moby/moby#49242](https://redirect.github.com/moby/moby/pull/49242)\n-
          \  Go-SDK: Remove `pkg/broadcaster`, as it was only used internally [moby/moby#49172](https://redirect.github.com/moby/moby/pull/49172)\n-
          \  Go-SDK: Remove deprecated `cli.Errors` type [docker/cli#5549](https://redirect.github.com/docker/cli/pull/5549)\n-
          \  Remove `pkg/ioutils.ReadCloserWrapper`, as it was only used in tests.
          [moby/moby#49237](https://redirect.github.com/moby/moby/pull/49237)\n-   Remove
          deprecated `api-cors-header` config parameter and the `dockerd` `--api-cors-header`
          option [moby/moby#48209](https://redirect.github.com/moby/moby/pull/48209)\n-
          \  Remove deprecated `APIEndpoint.Version` field, `APIVersion` type, and
          `APIVersion1` and `APIVersion2` consts. [moby/moby#49004](https://redirect.github.com/moby/moby/pull/49004)\n-
          \  Remove deprecated `api-cors-header` config parameter and the Docker daemon's
          `--api-cors-header` option. [docker/cli#5437](https://redirect.github.com/docker/cli/pull/5437)\n-
          \  Remove deprecated `pkg/directory` package [moby/moby#48779](https://redirect.github.com/moby/moby/pull/48779)\n-
          \  Remove deprecated `pkg/dmsg.Dmesg()` [moby/moby#48109](https://redirect.github.com/moby/moby/pull/48109)\n-
          \  Remove deprecated image/spec package, which was moved to a separate module
          (`github.com/moby/docker-image-spec`) [moby/moby#48460](https://redirect.github.com/moby/moby/pull/48460)\n-
          \  Remove migration code and errors for the deprecated `logentries` logging
          driver. [moby/moby#48891](https://redirect.github.com/moby/moby/pull/48891)\n-
          \  Remove support for deprecated external graph-driver plugins. [moby/moby#48072](https://redirect.github.com/moby/moby/pull/48072)\n-
          \  `api/types`: Remove deprecated `container.ContainerNode` and `ContainerJSONBase.Node`
          field. [moby/moby#48107](https://redirect.github.com/moby/moby/pull/48107)\n-
          \  `api/types`: Remove deprecated aliases: `ImagesPruneReport`, `VolumesPruneReport`,
          `NetworkCreateRequest`, `NetworkCreate`, `NetworkListOptions`, `NetworkCreateResponse`,
          `NetworkInspectOptions`, `NetworkConnect`, `NetworkDisconnect`, `EndpointResource`,
          `NetworkResource`, `NetworksPruneReport`, `ExecConfig`, `ExecStartCheck`,
          `ContainerExecInspect`, `ContainersPruneReport`, `ContainerPathStat`, `CopyToContainerOptions`,
          `ContainerStats`, `ImageSearchOptions`, `ImageImportSource`, `ImageLoadResponse`,
          `ContainerNode`. [moby/moby#48107](https://redirect.github.com/moby/moby/pull/48107)\n-
          \  `libnetwork/iptables`: Remove deprecated `IPV`, `Iptables`, `IP6Tables`
          and `Passthrough()`. [moby/moby#49121](https://redirect.github.com/moby/moby/pull/49121)\n-
          \  `pkg/archive`: Remove deprecated `CanonicalTarNameForPath`, `NewTempArchive`,
          `TempArchive` [moby/moby#48708](https://redirect.github.com/moby/moby/pull/48708)\n-
          \  `pkg/fileutils`: Remove deprecated `GetTotalUsedFds` [moby/moby#49210](https://redirect.github.com/moby/moby/pull/49210)\n-
          \  `pkg/ioutils`: Remove `OnEOFReader`, which was only used internally [moby/moby#49170](https://redirect.github.com/moby/moby/pull/49170)\n-
          \  `pkg/longpath`: Remove deprecated `Prefix` constant. [moby/moby#48779](https://redirect.github.com/moby/moby/pull/48779)\n-
          \  `pkg/stringid`: Remove deprecated `IsShortID` and  `ValidateID` functions
          [moby/moby#48705](https://redirect.github.com/moby/moby/pull/48705)\n-   `runconfig/opts`:
          Remove deprecated `ConvertKVStringsToMap` [moby/moby#48102](https://redirect.github.com/moby/moby/pull/48102)\n-
          \  `runconfig`: Remove deprecated `ContainerConfigWrapper`, `SetDefaultNetModeIfBlank`,
          `DefaultDaemonNetworkMode`, `IsPreDefinedNetwork` [moby/moby#48102](https://redirect.github.com/moby/moby/pull/48102)\n-
          \  `container`: Remove deprecated `ErrNameReserved`, `ErrNameNot\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: Branch creation - At any time
          (no schedule defined), Automerge - At any time (no schedule defined).\n\n\U0001F6A6
          **Automerge**: Disabled by config. Please merge this manually once you are
          satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you
          tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR
          and you won't be reminded about these updates again.\n\n---\n\n - [ ] <!--
          rebase-check -->If you want to rebase/retry this PR, check this box\n\n---\n\nThis
          PR was generated by [Mend Renovate](https://mend.io/renovate/). View the
          [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjM5LjI1Ny4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/release/pull/1807
        commit_id: 65478946b4201083b6ac113f5d0766422a4bd5b9
        patchset: 65478946b4201083b6ac113f5d0766422a4bd5b9
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
          src_dir: src/github.com/osism/release
        topic: null
      job: python-black
      jobtags: []
      max_attempts: 3
      message: Y2hvcmUoZGVwcyk6IHVwZGF0ZSBkZXBlbmRlbmN5IG1vYnkvbW9ieSB0byB2MjgKClRoaXMgUFIgY29udGFpbnMgdGhlIGZvbGxvd2luZyB1cGRhdGVzOgoKfCBQYWNrYWdlIHwgVXBkYXRlIHwgQ2hhbmdlIHwKfC0tLXwtLS18LS0tfAp8IFttb2J5L21vYnldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkpIHwgbWFqb3IgfCBgNToyNy41LjFgIC0+IGB2MjguMS4xYCB8CnwgW21vYnkvbW9ieV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieSkgfCBtYWpvciB8IGAyNy41LjFgIC0+IGAyOC4xLjFgIHwKCi0tLQoKIyMjIFJlbGVhc2UgTm90ZXMKCjxkZXRhaWxzPgo8c3VtbWFyeT5tb2J5L21vYnkgKG1vYnkvbW9ieSk8L3N1bW1hcnk+CgojIyMgW2B2MjguMS4xYF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9yZWxlYXNlcy90YWcvdjI4LjEuMSkKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9jb21wYXJlL3YyOC4xLjAuLi52MjguMS4xKQoKIyMjIyMgMjguMS4xCgpGb3IgYSBmdWxsIGxpc3Qgb2YgcHVsbCByZXF1ZXN0cyBhbmQgY2hhbmdlcyBpbiB0aGlzIHJlbGVhc2UsIHJlZmVyIHRvIHRoZSByZWxldmFudCBHaXRIdWIgbWlsZXN0b25lczoKCi0gICBbZG9ja2VyL2NsaSwgMjguMS4xIG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMS4xKQotICAgW21vYnkvbW9ieSwgMjguMS4xIG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9pc3N1ZXM/cT1pcyUzQWNsb3NlZCttaWxlc3RvbmUlM0EyOC4xLjEpCgojIyMjIyBCdWcgZml4ZXMgYW5kIGVuaGFuY2VtZW50cwoKLSAgIEZpeCBgZG9ja2VyZC1yb290bGVzcy1zZXR1cHRvb2wuc2hgIGluY29ycmVjdGx5IHJlcG9ydGluZyBtaXNzaW5nIGBpcHRhYmxlc2AuIFttb2J5L21vYnkjNDk4MzNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTgzMykKLSAgIGNvbnRhaW5lcmQgaW1hZ2Ugc3RvcmU6IEZpeCBhIHBvdGVudGlhbCBkYWVtb24gY3Jhc2ggd2hlbiB1c2luZyBgZG9ja2VyIGxvYWRgIHdpdGggYXJjaGl2ZXMgY29udGFpbmluZyB6ZXJvLXNpemUgdGFyIGhlYWRlcnMuIFttb2J5L21vYnkjNDk4MzddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTgzNykKCiMjIyMjIFBhY2thZ2luZyB1cGRhdGVzCgotICAgVXBkYXRlIEJ1aWxkeCB0byBbdjAuMjMuMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9idWlsZHgvcmVsZWFzZXMvdGFnL3YwLjIzLjApLiBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTE4NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTE4NSkKLSAgIFVwZGF0ZSBDb21wb3NlIHRvIFt2Mi4zNS4xXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NvbXBvc2UvcmVsZWFzZXMvdGFnL3YyLjM1LjEpLiBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTE4OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTE4OCkKCiMjIyMjIE5ldHdvcmtpbmcKCi0gICBBZGQgYSB3YXJuaW5nIHRvIGEgY29udGFpbmVyJ3MgYC9ldGMvcmVzb2x2LmNvbmZgIHdoZW4gbm8gdXBzdHJlYW0gRE5TIHNlcnZlcnMgd2VyZSBmb3VuZC4gW21vYnkvbW9ieSM0OTgyN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5ODI3KQoKIyMjIFtgdjI4LjEuMGBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcmVsZWFzZXMvdGFnL3YyOC4xLjApCgpbQ29tcGFyZSBTb3VyY2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvY29tcGFyZS92MjguMC40Li4udjI4LjEuMCkKCiMjIyMjIDI4LjEuMAoKRm9yIGEgZnVsbCBsaXN0IG9mIHB1bGwgcmVxdWVzdHMgYW5kIGNoYW5nZXMgaW4gdGhpcyByZWxlYXNlLCByZWZlciB0byB0aGUgcmVsZXZhbnQgR2l0SHViIG1pbGVzdG9uZXM6CgotICAgW2RvY2tlci9jbGksIDI4LjEuMCBtaWxlc3RvbmVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL2lzc3Vlcz9xPWlzJTNBY2xvc2VkK21pbGVzdG9uZSUzQTI4LjEuMCkKLSAgIFttb2J5L21vYnksIDI4LjEuMCBtaWxlc3RvbmVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMS4wKQotICAgQ2hhbmdlcyB0byB0aGUgRW5naW5lIEFQSSwgc2VlIFtBUEkgdmVyc2lvbiBoaXN0b3J5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L2Jsb2IvdjI4LjEuMC9kb2NzL2FwaS92ZXJzaW9uLWhpc3RvcnkubWQpLgoKIyMjIyMgTmV3CgotICAgQWRkIGBkb2NrZXIgYmFrZWAgc3ViLWNvbW1hbmQgYXMgYWxpYXMgZm9yIGBkb2NrZXIgYnVpbGR4IGJha2VgLiBbZG9ja2VyL2NsaSM1OTQ3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5NDcpCi0gICBFeHBlcmltZW50YWw6IGFkZCBhIG5ldyBgLS11c2UtYXBpLXNvY2tldGAgZmxhZyBvbiBgZG9ja2VyIHJ1bmAgYW5kIGBkb2NrZXIgY3JlYXRlYCB0byBlbmFibGUgYWNjZXNzIHRvIERvY2tlciBzb2NrZXQgZnJvbSBpbnNpZGUgYSBjb250YWluZXIgYW5kIHRvIHNoYXJlIGNyZWRlbnRpYWxzIGZyb20gdGhlIGhvc3Qgd2l0aCB0aGUgY29udGFpbmVyLiBbZG9ja2VyL2NsaSM1ODU4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU4NTgpCi0gICBgZG9ja2VyIGltYWdlIGluc3BlY3RgIG5vdyBzdXBwb3J0cyBhIGAtLXBsYXRmb3JtYCBmbGFnIHRvIGluc3BlY3QgYSBzcGVjaWZpYyBwbGF0Zm9ybSBvZiBhIG11bHRpLXBsYXRmb3JtIGltYWdlLiBbZG9ja2VyL2NsaSM1OTM0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5MzQpCgojIyMjIyBCdWcgZml4ZXMgYW5kIGVuaGFuY2VtZW50cwoKLSAgIEFkZCBDTEkgc2hlbGwtY29tcGxldGlvbiBmb3IgY29udGV4dCBuYW1lcy4gW2RvY2tlci9jbGkjNjAxNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC82MDE2KQotICAgRml4IGBkb2NrZXIgaW1hZ2VzIC0tdHJlZWAgbm90IGluY2x1ZGluZyBub24tY29udGFpbmVyIGltYWdlcyBjb250ZW50IHNpemUgaW4gdGhlIHRvdGFsIGltYWdlIGNvbnRlbnQgc2l6ZS4gW2RvY2tlci9jbGkjNjAwMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC82MDAwKQotICAgRml4IGBkb2NrZXIgbG9hZGAgbm90IHByZXNlcnZpbmcgcmVwbGFjZWQgaW1hZ2VzLiBbbW9ieS9tb2J5IzQ5NjUwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2NTApCi0gICBGaXggYGRvY2tlciBsb2dpbmAgaGludHMgd2hlbiBsb2dnaW5nIGluIHRvIGEgY3VzdG9tIHJlZ2lzdHJ5LiBbZG9ja2VyL2NsaSM2MDE1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzYwMTUpCi0gICBGaXggYGRvY2tlciBzdGF0c2Agbm90IHdvcmtpbmcgcHJvcGVybHkgb24gbWFjaGluZXMgd2l0aCBoaWdoIENQVSBjb3JlIGNvdW50LiBbbW9ieS9tb2J5IzQ5NzM0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk3MzQpCi0gICBGaXggYSByZWdyZXNzaW9uIGNhdXNpbmcgYGRvY2tlciBwdWxsL3B1c2hgIHRvIGZhaWwgd2hlbiBpbnRlcmFjdGluZyB3aXRoIGEgcHJpdmF0ZSByZXBvc2l0b3J5LiBbZG9ja2VyL2NsaSM1OTY0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5NjQpCi0gICBGaXggYW4gaXNzdWUgcHJldmVudGluZyByb290bGVzcyBEb2NrZXIgc2V0dXAgb24gYSBob3N0IHdpdGggbm8gYGlwX3RhYmxlc2Aga2VybmVsIG1vZHVsZS4gW21vYnkvbW9ieSM0OTcyN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NzI3KQotICAgRml4IGFuIGlzc3VlIHRoYXQgY291bGQgbGVhZCB0byB1bndhbnRlZCBpcHRhYmxlcyBydWxlcyBiZWluZyByZXN0b3JlZCBhbmQgbmV2ZXIgZGVsZXRlZCBmb2xsb3dpbmcgYSBmaXJld2FsbGQgcmVsb2FkLiBbbW9ieS9tb2J5IzQ5NzI4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk3MjgpCi0gICBJbXByb3ZlIENMSSBjb21wbGV0aW9uIG9mIGBkb2NrZXIgc2VydmljZSBzY2FsZWAuIFtkb2NrZXIvY2xpIzU5NjhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTk2OCkKLSAgIGBkb2NrZXIgaW1hZ2VzIC0tdHJlZWAgbm93IGhpZGVzIGJvdGggdW50YWdnZWQgYW5kIGRhbmdsaW5nIGltYWdlcyBieSBkZWZhdWx0LiBbZG9ja2VyL2NsaSM1OTI0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5MjQpCi0gICBgZG9ja2VyIHN5c3RlbSBpbmZvYCB3aWxsIHByb3ZpZGUgYW4gZXhpdCBjb2RlIGlmIGEgY29ubmVjdGlvbiBjYW5ub3QgYmUgZXN0YWJsaXNoZWQgdG8gdGhlIERvY2tlciBkYWVtb24uIFtkb2NrZXIvY2xpIzU5MThdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTkxOCkKLSAgIGNvbnRhaW5lcmQgaW1hZ2Ugc3RvcmU6IEZpeCBgaW1hZ2UgdGFnYCBldmVudCBub3QgYmVpbmcgZW1pdHRlZCB3aGVuIGJ1aWxkaW5nIHdpdGggQnVpbGRLaXQuIFttb2J5L21vYnkjNDk2NzhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTY3OCkKLSAgIGNvbnRhaW5lcmQgaW1hZ2Ugc3RvcmU6IEltcHJvdmUgYGRvY2tlciBwdXNoL3B1bGxgIGhhbmRsaW5nIG9mIHJlbW90ZSByZWdpc3RyeSBlcnJvcnMuIFttb2J5L21vYnkjNDk3NzBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTc3MCkKLSAgIGNvbnRhaW5lcmQgaW1hZ2Ugc3RvcmU6IFNob3cgcHVsbCBwcm9ncmVzcyBmb3Igbm9uLWxheWVyIGltYWdlIGJsb2JzLiBbbW9ieS9tb2J5IzQ5NzQ2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk3NDYpCgojIyMjIyBQYWNrYWdpbmcgdXBkYXRlcwoKLSAgIEFkZCBEZWJpYW4gIlRyaXhpZSIgcGFja2FnZXMuIFtkb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZyMxMTgxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcvcHVsbC8xMTgxKQotICAgQWRkIEZlZG9yYSA0MiBwYWNrYWdlcy4gW2RvY2tlci9jb250YWluZXJkLXBhY2thZ2luZyM0MThdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY29udGFpbmVyZC1wYWNrYWdpbmcvcHVsbC80MTgpLCBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTE2OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTE2OSkKLSAgIEFkZCBVYnVudHUgMjUuMDQgIlBsdWNreSBQdWZmaW4iIHBhY2thZ2VzLiBbZG9ja2VyL2NvbnRhaW5lcmQtcGFja2FnaW5nIzQxOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jb250YWluZXJkLXBhY2thZ2luZy9wdWxsLzQxOSksIFtkb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZyMxMTc3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcvcHVsbC8xMTc3KQotICAgVXBkYXRlIEJ1aWxkS2l0IHRvIFt2MC4yMS4wXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9idWlsZGtpdC9yZWxlYXNlcy90YWcvdjAuMjEuMCkuIFttb2J5L21vYnkjNDk4MDldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTgwOSkKLSAgIFVwZGF0ZSBDb21wb3NlIHRvIFt2Mi4zNS4wXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NvbXBvc2UvcmVsZWFzZXMvdGFnL3YyLjM1LjApLiBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTE4M10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTE4MykKLSAgIFVwZGF0ZSBHbyBydW50aW1lIHRvIFsxLjIzLjhdKGh0dHBzOi8vZ28uZGV2L2RvYy9kZXZlbC9yZWxlYXNlI2dvMS4yMy44KS4gW2RvY2tlci9jbGkjNTk4Nl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81OTg2KSwgW2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nIzExODBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZy9wdWxsLzExODApLCBbbW9ieS9tb2J5IzQ5NzM3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk3MzcpCgojIyMjIyBOZXR3b3JraW5nCgotICAgRml4IGEgYnVnIGNhdXNpbmcgaG9zdCBwb3J0LW1hcHBpbmdzIG9uIFN3YXJtIGNvbnRhaW5lcnMgdG8gYmUgZHVwbGljYXRlZCBvbiBgZG9ja2VyIHBzYCBhbmQgYGRvY2tlciBpbnNwZWN0YC4gW21vYnkvbW9ieSM0OTcyNF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NzI0KQotICAgRml4IGFuIGlzc3VlIHRoYXQgY2F1c2VkIGNvbnRhaW5lciBuZXR3b3JrIGF0dGFjaG1lbnQgdG8gZmFpbCB3aXRoIGVycm9yICJCcmlkZ2UgcG9ydCBub3QgZm9yd2FyZGluZyIuIFttb2J5L21vYnkjNDk3MDVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTcwNSkKLSAgIEZpeCBhbiBpc3N1ZSB3aXRoIHJlbW92YWwgb2YgYSBgLS1saW5rYCBmcm9tIGEgY29udGFpbmVyIGluIHRoZSBkZWZhdWx0IGJyaWRnZSBuZXR3b3JrLiBbbW9ieS9tb2J5IzQ5Nzc4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk3NzgpCi0gICBJbXByb3ZlIGhvdyBuZXR3b3JrLWVuZHBvaW50IHJlbGF0aW9uc2hpcHMgYXJlIHRyYWNrZWQgdG8gcmVkdWNlIHRoZSBjaGFuY2Ugb2YgdGhlICJoYXMgYWN0aXZlIGVuZHBvaW50cyIgZXJyb3IgdG8gYmUgd3JvbmdmdWxseSByZXR1cm5lZC4gW21vYnkvbW9ieSM0OTczNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NzM2KQotICAgSW1wcm92ZSB0aGUgImhhcyBhY3RpdmUgZW5kcG9pbnRzIiBlcnJvciBtZXNzYWdlIGJ5IGluY2x1ZGluZyB0aGUgbmFtZSBvZiBlbmRwb2ludHMgc3RpbGwgY29ubmVjdGVkIHRvIHRoZSBuZXR3b3JrIGJlaW5nIGRlbGV0ZWQuIFttb2J5L21vYnkjNDk3NzNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTc3MykKCiMjIyMjIEFQSQoKLSAgIFVwZGF0ZSBBUEkgdmVyc2lvbiB0byBbdjEuNDldKGh0dHBzOi8vZG9jcy5kb2NrZXIuY29tL2VuZ2luZS9hcGkvdjEuNDkvKS4gW21vYnkvbW9ieSM0OTcxOF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NzE4KQotICAgYEdFVCAvaW1hZ2Uve25hbWV9L2pzb25gIG5vdyBzdXBwb3J0cyBhIGBwbGF0Zm9ybWAgcGFyYW1ldGVyIGFsbG93aW5nIHRvIHNwZWNpZnkgd2hpY2ggcGxhdGZvcm0gdmFyaWFudCBvZiBhIG11bHRpLXBsYXRmb3JtIGltYWdlIHRvIGluc3BlY3QuIFttb2J5L21vYnkjNDk1ODZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTU4NikKLSAgIGBHRVQgL2luZm9gIG5vdyByZXR1cm5zIGEgYEZpcmV3YWxsQmFja2VuZGAgY29udGFpbmluZyBpbmZvcm1hdGlvbiBhYm91dCB0aGUgZGFlbW9uJ3MgZmlyZXdhbGxpbmcgY29uZmlndXJhdGlvbi4gW21vYnkvbW9ieSM0OTc2MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NzYxKQoKIyMjIyMgR28gU0RLCgotICAgVXBkYXRlIG1pbmltdW0gcmVxdWlyZWQgR28gdmVyc2lvbiB0byBnbzEuMjMuIFtkb2NrZXIvY2xpIzU4NjhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTg2OCkKLSAgIGNsaS9jb21tYW5kL2NvbnRleHQ6IHJlbW92ZSB0ZW1wb3JhcnkgYENvbnRleHRUeXBlYCBmaWVsZCBmcm9tIEpTT04gb3V0cHV0LiBbZG9ja2VyL2NsaSM1OTgxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5ODEpCi0gICBjbGllbnQ6IEtlZXAgaW1hZ2UgcmVmZXJlbmNlcyBpbiBjYW5vbmljYWwgZm9ybWF0IHdoZXJlIHBvc3NpYmxlLiBbbW9ieS9tb2J5IzQ5NjA5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2MDkpCgojIyMjIyBEZXByZWNhdGlvbnMKCi0gICBBUEk6IERlcHJlY2F0ZWQgYEFsbG93Tm9uZGlzdHJpYnV0YWJsZUFydGlmYWN0c0NJRFJzYCBhbmQgYEFsbG93Tm9uZGlzdHJpYnV0YWJsZUFydGlmYWN0c0hvc3RuYW1lc2AgZmllbGRzIGluIHRoZSBgUmVnaXN0cnlDb25maWdgIHN0cnVjdCBpbiB0aGUgYEdFVCAvaW5mb2AgcmVzcG9uc2UgYXJlIG9taXR0ZWQgaW4gQVBJIHYxLjQ5LiBbbW9ieS9tb2J5IzQ5NzQ5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk3NDkpCi0gICBBUEk6IERlcHJlY2F0ZWQ6IFRoZSBgQ29udGFpbmVyZENvbW1pdC5FeHBlY3RlZGAsIGBSdW5jQ29tbWl0LkV4cGVjdGVkYCwgYW5kIGBJbml0Q29tbWl0LkV4cGVjdGVkYCBmaWVsZHMgaW4gdGhlIGBHRVQgL2luZm9gIGVuZHBvaW50IHdlcmUgZGVwcmVjYXRlZCBpbiBBUEkgdjEuNDgsIGFuZCBhcmUgbm93IG9taXR0ZWQgaW4gQVBJIHYxLjQ5LiBbbW9ieS9tb2J5IzQ4NTU2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg1NTYpCi0gICBHby1TREs6IGNsaS9jb21tYW5kL2ltYWdlOiBEZXByZWNhdGUgYFJ1blB1bGxgOiB0aGlzIGZ1bmN0aW9uIHdhcyBvbmx5IHVzZWQgaW50ZXJuYWxseSBhbmQgd2lsbCBiZSByZW1vdmVkIGluIHRoZSBuZXh0IHJlbGVhc2UuIFtkb2NrZXIvY2xpIzU5NzVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTk3NSkKLSAgIEdvLVNESzogY2xpL2NvbmZpZy9jb25maWdmaWxlOiBkZXByZWNhdGUgYENvbmZpZ0ZpbGUuRXhwZXJpbWVudGFsYCBmaWVsZC4gRXhwZXJpbWVudGFsIENMSSBmZWF0dXJlcyBhcmUgYWx3YXlzIGVuYWJsZWQgc2luY2UgdmVyc2lvbiB2MjAuMTAgYW5kIHRoaXMgZmllbGQgaXMgbm8gbG9uZ2VyIHVzZWQuIFVzZSBgQ29uZmlnRmlsZS5GZWF0dXJlc2AgaW5zdGVhZCBmb3Igb3B0aW9uYWwgZmVhdHVyZXMuIFRoaXMgZmllbGQgd2lsbCBiZSByZW1vdmVkIGluIGEgZnV0dXJlIHJlbGVhc2UuIFtkb2NrZXIvY2xpIzU5NzddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTk3NykKLSAgIEdvLVNESzogZGVwcmVjYXRlIGBwa2cvYXJjaGl2ZWAsIHdoaWNoIHdhcyBtaWdyYXRlZCB0byBgZ2l0aHViLmNvbS9tb2J5L2dvLWFyY2hpdmVgLiBbbW9ieS9tb2J5IzQ5NzQzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk3NDMpCi0gICBHby1TREs6IGRlcHJlY2F0ZSBgcGtnL2F0b21pY3dyaXRlcmAsIHdoaWNoIHdhcyBtaWdyYXRlZCB0byBgZ2l0aHViLmNvbS9tb2J5L3N5cy9hdG9taWN3cml0ZXJgLiBbbW9ieS9tb2J5IzQ5NzQ4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk3NDgpCi0gICBHby1TREs6IG9wdHM6IHJlbW92ZSBkZXByZWNhdGVkIGBQb3J0T3B0YCwgYENvbmZpZ09wdGAsIGBTZWNyZXRPcHRgIGFsaWFzZXMuIFtkb2NrZXIvY2xpIzU5NTNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTk1MykKLSAgIEdvLVNESzogcmVnaXN0cnk6IGRlcHJlY2F0ZSBgQVBJRW5kcG9pbnQuT2ZmaWNpYWxgIGZpZWxkLiBbbW9ieS9tb2J5IzQ5NzA2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk3MDYpCgojIyMgW2B2MjguMC40YF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9yZWxlYXNlcy90YWcvdjI4LjAuNCkKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9jb21wYXJlL3YyOC4wLjMuLi52MjguMC40KQoKIyMjIyMgMjguMC40CgpGb3IgYSBmdWxsIGxpc3Qgb2YgcHVsbCByZXF1ZXN0cyBhbmQgY2hhbmdlcyBpbiB0aGlzIHJlbGVhc2UsIHJlZmVyIHRvIHRoZSByZWxldmFudCBHaXRIdWIgbWlsZXN0b25lczoKCi0gICBbZG9ja2VyL2NsaSwgMjguMC40IG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMC40KQotICAgW21vYnkvbW9ieSwgMjguMC40IG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9pc3N1ZXM/cT1pcyUzQWNsb3NlZCttaWxlc3RvbmUlM0EyOC4wLjQpCgojIyMjIyBCdWcgZml4ZXMgYW5kIGVuaGFuY2VtZW50cwoKLSAgIEZpeCBhIHJlZ3Jlc3Npb24gY2F1c2luZyBgZG9ja2VyIHB1bGwvcHVzaGAgdG8gZmFpbCB3aGVuIGludGVyYWN0aW5nIHdpdGggYSBwcml2YXRlIHJlcG9zaXRvcnkuIFtkb2NrZXIvY2xpIzU5NjRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTk2NCkKCiMjIyBbYHYyOC4wLjNgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3JlbGVhc2VzL3RhZy92MjguMC4zKQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L2NvbXBhcmUvdjI4LjAuMi4uLnYyOC4wLjMpCgojIyMjIyAyOC4wLjMKCkZvciBhIGZ1bGwgbGlzdCBvZiBwdWxsIHJlcXVlc3RzIGFuZCBjaGFuZ2VzIGluIHRoaXMgcmVsZWFzZSwgcmVmZXIgdG8gdGhlIHJlbGV2YW50IEdpdEh1YiBtaWxlc3RvbmVzOgoKLSAgIFtkb2NrZXIvY2xpLCAyOC4wLjMgbWlsZXN0b25lXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9pc3N1ZXM/cT1pcyUzQWNsb3NlZCttaWxlc3RvbmUlM0EyOC4wLjMpCi0gICBbbW9ieS9tb2J5LCAyOC4wLjMgbWlsZXN0b25lXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L2lzc3Vlcz9xPWlzJTNBY2xvc2VkK21pbGVzdG9uZSUzQTI4LjAuMykKCiMjIyMjIEJ1ZyBmaXhlcyBhbmQgZW5oYW5jZW1lbnRzCgotICAgRml4IGBkb2NrZXIgcnVuYCB0cnVuY2F0aW5nIHRoZSBgU1RET1VUYC9gU1RERVJSYCBwcmVtYXR1cmVseSB3aGVuIHRoZSBjb250YWluZXIgZXhpdHMgYmVmb3JlIHRoZSBkYXRhIGlzIGNvbnN1bWVkLiBbZG9ja2VyL2NsaSM1OTU3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5NTcpCgojIyMjIyBQYWNrYWdpbmcgdXBkYXRlcwoKLSAgIFVwZGF0ZSBCdWlsZEtpdCB0byBbdjAuMjAuMl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvYnVpbGRraXQvcmVsZWFzZXMvdGFnL3YwLjIwLjIpLiBbbW9ieS9tb2J5IzQ5Njk4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2OTgpCi0gICBVcGRhdGUgYHJ1bmNgIHRvIFt2MS4yLjZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9vcGVuY29udGFpbmVycy9ydW5jL3JlbGVhc2VzL3RhZy92MS4yLjYpIChzdGF0aWMgcGFja2FnZXMgb25seSkuIFttb2J5L21vYnkjNDk2ODJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTY4MikKLSAgIFVwZGF0ZSBjb250YWluZXJkIHRvIFt2MS43LjI2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY29udGFpbmVyZC9jb250YWluZXJkL3JlbGVhc2VzL3RhZy92MS43LjI2KS4gW2RvY2tlci9jb250YWluZXJkLXBhY2thZ2luZyM0MDldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY29udGFpbmVyZC1wYWNrYWdpbmcvcHVsbC80MDkpCgojIyMgW2B2MjguMC4yYF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9yZWxlYXNlcy90YWcvdjI4LjAuMikKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9jb21wYXJlL3YyOC4wLjEuLi52MjguMC4yKQoKIyMjIyMgMjguMC4yCgpGb3IgYSBmdWxsIGxpc3Qgb2YgcHVsbCByZXF1ZXN0cyBhbmQgY2hhbmdlcyBpbiB0aGlzIHJlbGVhc2UsIHJlZmVyIHRvIHRoZSByZWxldmFudCBHaXRIdWIgbWlsZXN0b25lczoKCi0gICBbZG9ja2VyL2NsaSwgMjguMC4yIG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMC4yKQotICAgW21vYnkvbW9ieSwgMjguMC4yIG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9pc3N1ZXM/cT1pcyUzQWNsb3NlZCttaWxlc3RvbmUlM0EyOC4wLjIpCgojIyMjIyBCdWcgZml4ZXMgYW5kIGVuaGFuY2VtZW50cwoKLSAgIEZpeCBDTEktc3BlY2lmaWMgYXR0cmlidXRlcyAoYGRvY2tlci5jbGkuKmApIGJlaW5nIHVuaW50ZW50aW9uYWxseSBwYXNzZWQgdG8gZG93bnN0cmVhbSBPVGVsIHNlcnZpY2VzLiBbZG9ja2VyL2NsaSM1ODQyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU4NDIpCi0gICBGaXggYW4gaXNzdWUgd2hlcmUgdXNlci1zcGVjaWZpZWQgYE9URUxfUkVTT1VSQ0VfQVRUUklCVVRFU2Agd2VyZSBiZWluZyBvdmVycmlkZGVuIGJ5IENMSSdzIGludGVybmFsIHRlbGVtZXRyeSBhdHRyaWJ1dGVzLiBUaGUgQ0xJIG5vdyBwcm9wZXJseSBtZXJnZXMgdXNlci1zcGVjaWZpZWQgYXR0cmlidXRlcyB3aXRoIGludGVybmFsIG9uZXMsIGFsbG93aW5nIGJvdGggdG8gY29leGlzdC4gW2RvY2tlci9jbGkjNTg0Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81ODQyKQotICAgRml4IGRhZW1vbiBmYWlsaW5nIHRvIHN0YXJ0IG9uIFdpbmRvd3Mgd2hlbiBhIGNvbnRhaW5lciBjcmVhdGVkIGJlZm9yZSB2MjguMC4wIHdhcyBwcmVzZW50LiBbbW9ieS9tb2J5IzQ5NjI2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2MjYpCi0gICBGaXggcG9zc2libGUgZXJyb3Igb24gYGRvY2tlciBidWlsZHggcHJ1bmVgIHdpdGggdGhlIGAtLW1pbi1mcmVlLXNwYWNlYC4gW21vYnkvbW9ieSM0OTYyM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NjIzKQotICAgRml4IHNwdXJpb3VzIGBpbzogcmVhZC93cml0ZSBvbiBjbG9zZWQgcGlwZWAgZXJyb3IgaW4gdGhlIGRhZW1vbiBsb2cgd2hlbiBjbG9zaW5nIGNvbnRhaW5lci4gW21vYnkvbW9ieSM0OTU5MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTkwKQotICAgRml4IHRoZSBEb2NrZXIgZGFlbW9uIGZhaWxpbmcgdG9vIGVhcmx5IGlmIHRoZSBjb250YWluZXJkIHNvY2tldCBpc24ndCBpbW1lZGlhdGVseSBhdmFpbGFibGUuIFttb2J5L21vYnkjNDk2MDNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTYwMykKLSAgIE1hc2sgTGludXggdGhlcm1hbCBpbnRlcnJ1cHQgaW5mbyBpbiBhIGNvbnRhaW5lcidzIGAvcHJvY2AgYW5kIGAvc3lzYCBieSBkZWZhdWx0LiBbbW9ieS9tb2J5IzQ5NTYwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk1NjApCi0gICBVcGRhdGUgYGNvbnRyaWIvY2hlY2stY29uZmlnLnNoYCB0byBjaGVjayBmb3IgbW9yZSBrZXJuZWwgbW9kdWxlcyByZWxhdGVkIHRvIGlwdGFibGVzLiBbbW9ieS9tb2J5IzQ5NjIyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2MjIpCi0gICBjb250YWluZXJkIGltYWdlIHN0b3JlOiBGaXggaW50ZWdlciBvdmVyZmxvdyBpbiBVc2VyIElEIGhhbmRsaW5nIHBhc3NlZCB2aWEgYC0tdXNlcmAuIFttb2J5L21vYnkjNDk2NTJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTY1MikKLSAgIGNvbnRhaW5lcmQgaW1hZ2Ugc3RvcmU6IEZpeCBzcHVyaW91cyBgcmVmZXJlbmNlIGZvciB1bmtub3duIHR5cGU6IGFwcGxpY2F0aW9uL3ZuZC5pbi10b3RvK2pzb25gIHdhcm5pbmcgYmVpbmcgbG9nZ2VkIHRvIHRoZSBkYWVtb24ncyBsb2cuIFttb2J5L21vYnkjNDk2NTJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTY1MikKLSAgIGNvbnRhaW5lcmQgaW1hZ2Ugc3RvcmU6IEltcHJvdmUgcGVyZm9ybWFuY2Ugb2YgYGRvY2tlciBwc2Agd2hlbiBydW5uaW5nIGxhcmdlIG51bWJlciBvZiBjb250YWluZXJzLiBbbW9ieS9tb2J5IzQ5MzY1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkzNjUpCgojIyMjIyBQYWNrYWdpbmcgdXBkYXRlcwoKLSAgIFVwZGF0ZSBCdWlsZEtpdCB0byBbdjAuMjAuMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvYnVpbGRraXQvcmVsZWFzZXMvdGFnL3YwLjIwLjEpLiBbbW9ieS9tb2J5IzQ5NTg3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk1ODcpCi0gICBVcGRhdGUgQnVpbGR4IHRvIFt2MC4yMi4wXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2J1aWxkeC9yZWxlYXNlcy90YWcvdjAuMjIuMCkuIFtkb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZyMxMTc1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcvcHVsbC8xMTc1KQotICAgVXBkYXRlIENvbXBvc2UgdG8gW3YyLjM0LjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY29tcG9zZS9yZWxlYXNlcy90YWcvdjIuMzQuMCkuIFtkb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZyMxMTcyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcvcHVsbC8xMTcyKQotICAgVXBkYXRlIEdvIHJ1bnRpbWUgdG8gWzEuMjMuN10oaHR0cHM6Ly9nby5kZXYvZG9jL2RldmVsL3JlbGVhc2UjZ28xLjIzLjcpLiBbZG9ja2VyL2NsaSM1ODkwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU4OTApLCBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTE3MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTE3MSksIFttb2J5L21vYnkjNDk1ODBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTU4MCkKLSAgIFVwZGF0ZSBSb290bGVzc0tpdCB0byBbdjIuMy40XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vcm9vdGxlc3MtY29udGFpbmVycy9yb290bGVzc2tpdC9yZWxlYXNlcy90YWcvdjIuMy40KS4gW21vYnkvbW9ieSM0OTYxNF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NjE0KQotICAgVXBkYXRlIGNvbnRhaW5lcmQgKHN0YXRpYyBiaW5hcmllcyBvbmx5KSB0byBbdjEuNy4yN10oaHR0cHM6Ly93d3cuZ2l0aHViLmNvbS9jb250YWluZXJkL2NvbnRhaW5lcmQvcmVsZWFzZXMvdGFnL3YxLjcuMjcpLiBbbW9ieS9tb2J5IzQ5NjU2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2NTYpCgojIyMjIyBOZXR3b3JraW5nCgotICAgQWRkIGVudmlyb25tZW50IHZhcmlhYmxlIGBET0NLRVJfSU5TRUNVUkVfTk9fSVBUQUJMRVNfUkFXPTFgIHRvIGFsbG93IERvY2tlciB0byBydW4gb24gc3lzdGVtcyB3aGVyZSB0aGUgTGludXgga2VybmVsIGNhbid0IHByb3ZpZGUgYENPTkZJR19JUF9ORl9SQVdgIHN1cHBvcnQuIFdoZW4gZW5hYmxlZCwgRG9ja2VyIHdpbGwgbm90IGNyZWF0ZSBydWxlcyBpbiB0aGUgaXB0YWJsZXMgYHJhd2AgdGFibGUuIFdhcm5pbmc6IFRoaXMgaXMgbm90IHJlY29tbWVuZGVkIGZvciBwcm9kdWN0aW9uIGVudmlyb25tZW50cyBhcyBpdCByZWR1Y2VzIHNlY3VyaXR5IGJ5IGFsbG93aW5nIG90aGVyIGhvc3RzIG9uIHRoZSBsb2NhbCBuZXR3b3JrIHRvIHJvdXRlIHRvIHBvcnRzIHB1Ymxpc2hlZCB0byBob3N0IGFkZHJlc3NlcywgZXZlbiB3aGVuIHRoZXkgYXJlIHB1Ymxpc2hlZCB0byBgMTI3LjAuMC4xLmAgVGhpcyBvcHRpb24gYnlwYXNzZXMgc29tZSBvZiB0aGUgc2VjdXJpdHkgaGFyZGVuaW5nIGludHJvZHVjZWQgaW4gRG9ja2VyIEVuZ2luZSAyOC4wLjAuIFttb2J5L21vYnkjNDk2MjFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTYyMSkKLSAgIEFsbG93IGNvbnRhaW5lciBzdGFydHVwIHdoZW4gYW4gZW5kcG9pbnQgaXMgYXR0YWNoZWQgdG8gYSBtYWN2bGFuIG5ldHdvcmsgd2hlcmUgdGhlIHBhcmVudCBpbnRlcmZhY2UgaXMgZG93bi4gW21vYnkvbW9ieSM0OTYzMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NjMwKQotICAgRG8gbm90IHNraXAgRE5BVCBmb3IgcGFja2V0cyBvcmlnaW5hdGluZyBpbiBhIGdhdGV3YXlfbW9kZT1yb3V0ZWQgbmV0d29yay4gW21vYnkvbW9ieSM0OTU3N10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTc3KQotICAgRml4IGEgYnVnIGNhdXNpbmcgYGRvY2tlciBwc2AgdG8gaW5jb25zaXN0ZW50bHkgcmVwb3J0IGR1YWwtc3RhY2sgcG9ydCBtYXBwaW5ncy4gW21vYnkvbW9ieSM0OTY1N10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NjU3KQotICAgRml4IGEgYnVnIHRoYXQgY291bGQgY2F1c2UgYGRvY2tlci1wcm94eWAgdG8gc3RvcCBmb3J3YXJkaW5nIFVEUCBkYXRhZ3JhbXMgdG8gY29udGFpbmVycy4gW21vYnkvbW9ieSM0OTY0OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NjQ5KQotICAgRml4IGEgYnVnIHRoYXQgd2FzIGNhdXNpbmcgYGRvY2tlci1wcm94eWAgdG8gY2xvc2UgVURQIGNvbm5lY3Rpb25zIHRvIGNvbnRhaW5lcnMgZWFnZXJseSBhbmQgcmVzdWx0aW5nIGluIHRoZSBzb3VyY2UgYWRkcmVzcyB0byBjaGFuZ2UgbmVlZGxlc3NseS4gW21vYnkvbW9ieSM0OTY0OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NjQ5KQoKIyMjIyMgR28gU0RLCgotICAgTW92ZSB2YXJpb3VzIHR5cGVzIGFuZCBjb25zdHMgZnJvbSBgY2xpLXBsdWdpbnMvbWFuYWdlcmAgdG8gYSBzZXBhcmF0ZSBwYWNrYWdlLiBbZG9ja2VyL2NsaSM1OTAyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5MDIpCi0gICBVcGRhdGUgbWluaW11bSByZXF1aXJlZCBHbyB2ZXJzaW9uIHRvIGdvMS4yMy4gW21vYnkvbW9ieSM0OTU0MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTQxKQotICAgYGNsaS9jb21tYW5kYDogTW92ZSBgUHJldHR5UHJpbnRgIHV0aWxpdHkgdG8gYGNsaS9jb21tYW5kL2Zvcm1hdHRlcmAuIFtkb2NrZXIvY2xpIzU5MTZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTkxNikKLSAgIHJ1bmNvbmZpZy9lcnJvcnM6IHNwbGl0IGBFcnJDb25mbGljdEhvc3ROZXR3b3JrYCBpbnRvIGBFcnJDb25mbGljdENvbm5lY3RUb0hvc3ROZXR3b3JrYCBhbmQgYEVyckNvbmZsaWN0RGlzY29ubmVjdEZyb21Ib3N0TmV0d29ya2AuIFttb2J5L21vYnkjNDk2MDVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTYwNSkKCiMjIyMjIERlcHJlY2F0aW9ucwoKLSAgIEdvLVNESzogRGVwcmVjYXRlIGBjbGktcGx1Z2lucy9tYW5hZ2VyLlJlc291cmNlQXR0cmlidXRlc0VudnZhcmAgY29uc3RhbnQuIEl0IHdhcyB1c2VkIGludGVybmFsbHksIGJ1dCBob2xkcyB0aGUgYE9URUxfUkVTT1VSQ0VfQVRUUklCVVRFU2AgbmFtZSwgd2hpY2ggaXMgcGFydCBvZiB0aGUgT3BlblRlbGVtZXRyeSBzcGVjaWZpY2F0aW9uLiBVc2VycyBvZiB0aGlzIGNvbnN0YW50IHNob3VsZCBkZWZpbmUgdGhlaXIgb3duLiBJdCB3aWxsIGJlIHJlbW92ZWQgaW4gdGhlIG5leHQgcmVsZWFzZS4gW2RvY2tlci9jbGkjNTg4MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81ODgxKQotICAgR28tU0RLOiBEZXByZWNhdGUgYG9wdHMuUG9ydE9wdGAsIGBvcHRzLkNvbmZpZ09wdGAgYW5kIGBvcHRzLlNlY3JldE9wdGAuIFRoZXNlIHR5cGVzIHdlcmUgbW92ZWQgdG8gdGhlIGBvcHRzL3N3YXJtb3B0c2AgcGFja2FnZS4gW2RvY2tlci9jbGkjNTkwN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81OTA3KQotICAgR28tU0RLOiBSZW1vdmUgYHNlcnZpY2UvbG9nc2AgcGFja2FnZS4gW2RvY2tlci9jbGkjNTkxMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81OTEwKQotICAgR28tU0RLOiBgY2xpL2NvbW1hbmQvaW1hZ2VgOiBEZXByZWNhdGUgYFB1c2hUcnVzdGVkUmVmZXJlbmNlYCBhbmQgbW92ZSB0byBgY2xpL3RydXN0YC4gW2RvY2tlci9jbGkjNTg5NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81ODk0KQotICAgR28tU0RLOiBgY2xpL2NvbW1hbmQvaW1hZ2VgOiBEZXByZWNhdGUgYW5kIGludGVybmFsaXplIGBUcnVzdGVkUHVzaGAuIFtkb2NrZXIvY2xpIzU4OTRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTg5NCkKLSAgIEdvLVNESzogYGNsaS9jb21tYW5kYDogZGVwcmVjYXRlIGBDbGkuTm90YXJ5Q2xpZW50YDogdXNlIFtgdHJ1c3QuR2V0Tm90YXJ5UmVwb3NpdG9yeWBdKGh0dHBzOi8vcGtnLmdvLmRldi9naXRodWIuY29tL2RvY2tlci9jbGlAdjI4LjAuMStpbmNvbXBhdGlibGUvY2xpL3RydXN0I0dldE5vdGFyeVJlcG9zaXRvcnkpIGluc3RlYWQuIFRoaXMgbWV0aG9kIGlzIG5vIGxvbmdlciB1c2VkIGFuZCB3aWxsIGJlIHJlbW92ZWQgaW4gdGhlIG5leHQgcmVsZWFzZS4gW2RvY2tlci9jbGkjNTg4NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81ODg1KQotICAgR28tU0RLOiBgY2xpL2NvbW1hbmRgOiBkZXByZWNhdGUgYENsaS5SZWdpc3RyeUNsaWVudGAuIFRoaXMgbWV0aG9kIHdhcyBvbmx5IHVzZWQgaW50ZXJuYWxseSBhbmQgd2lsbCBiZSByZW1vdmVkIGluIHRoZSBuZXh0IHJlbGVhc2UuIFVzZSBbYGNsaWVudC5OZXdSZWdpc3RyeUNsaWVudGBdKGh0dHBzOi8vcGtnLmdvLmRldi9naXRodWIuY29tL2RvY2tlci9jbGlAdjI4LjAuMStpbmNvbXBhdGlibGUvY2xpL3JlZ2lzdHJ5L2NsaWVudCNOZXdSZWdpc3RyeUNsaWVudCkgaW5zdGVhZC4gW2RvY2tlci9jbGkjNTg4OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81ODg5KSwgW2RvY2tlci9jbGkjNTg4OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81ODg5KQotICAgR28tU0RLOiBgcmVnaXN0cnlgOiBEZXByZWNhdGUgYFJlcG9zaXRvcnlJbmZvLk9mZmljaWFsYCBmaWVsZC4gW21vYnkvbW9ieSM0OTU2N10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTY3KQotICAgR28tU0RLOiBgcmVnaXN0cnlgOiBkZXByZWNhdGUgYEhvc3RDZXJ0c0RpcmA6IHRoaXMgZnVuY3Rpb24gd2FzIG9ubHkgdXNlZCBpbnRlcm5hbGx5IGFuZCB3aWxsIGJlIHJlbW92ZWQgaW4gdGhlIG5leHQgcmVsZWFzZS4gW21vYnkvbW9ieSM0OTYxMl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NjEyKQotICAgR28tU0RLOiBgcmVnaXN0cnlgOiBkZXByZWNhdGUgYFNldENlcnRzRGlyYDogdGhlIGNlcnQtZGlyZWN0b3J5IGlzIG5vdyBhdXRvbWF0aWNhbGx5IHNlbGVjdGVkIHdoZW4gcnVubmluZyB3aXRoIFJvb3RsZXNzS2l0LCBhbmQgc2hvdWxkIG5vIGxvbmdlciBiZSBzZXQgbWFudWFsbHkuIFttb2J5L21vYnkjNDk2MTJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTYxMikKCiMjIyBbYHYyOC4wLjFgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3JlbGVhc2VzL3RhZy92MjguMC4xKQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L2NvbXBhcmUvdjI4LjAuMC4uLnYyOC4wLjEpCgojIyMjIyAyOC4wLjEKCkZvciBhIGZ1bGwgbGlzdCBvZiBwdWxsIHJlcXVlc3RzIGFuZCBjaGFuZ2VzIGluIHRoaXMgcmVsZWFzZSwgcmVmZXIgdG8gdGhlIHJlbGV2YW50IEdpdEh1YiBtaWxlc3RvbmVzOgoKLSAgIFtkb2NrZXIvY2xpLCAyOC4wLjEgbWlsZXN0b25lXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9pc3N1ZXM/cT1pcyUzQWNsb3NlZCttaWxlc3RvbmUlM0EyOC4wLjEpCi0gICBbbW9ieS9tb2J5LCAyOC4wLjEgbWlsZXN0b25lXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L2lzc3Vlcz9xPWlzJTNBY2xvc2VkK21pbGVzdG9uZSUzQTI4LjAuMSkKCiMjIyMjIE5ldHdvcmtpbmcKCi0gICBSZW1vdmUgZGVwZW5kZW5jeSBvbiBrZXJuZWwgbW9kdWxlcyBgaXBfc2V0YCwgYGlwX3NldF9oYXNoX25ldGAgYW5kIGBuZXRmaWx0ZXJfeHRfc2V0YC4KICAgIC0gICBUaGUgZGVwZW5kZW5jeSB3YXMgaW50cm9kdWNlZCBpbiByZWxlYXNlIDI4LjAuMCBidXQgcHJvdmVkIHRvbyBkaXNydXB0aXZlLiBUaGUgaXB0YWJsZXMgcnVsZXMgdXNpbmcgdGhlc2UgbW9kdWxlcyBoYXZlIGJlZW4gcmVwbGFjZWQuIFttb2J5L21vYnkjNDk1MzBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTUzMCkKLSAgIEFsbG93IGRhZW1vbiBzdGFydHVwIG9uIGEgaG9zdCB3aXRoIElQdjYgZGlzYWJsZWQgd2l0aG91dCByZXF1aXJpbmcgYC0taXA2dGFibGVzPWZhbHNlYC4gW21vYnkvbW9ieSM0OTUyNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTI1KQotICAgRml4IGEgYnVnIHRoYXQgd2FzIGNhdXNpbmcgY29udGFpbmVycyB3aXRoIGAtLXJlc3RhcnQ9YWx3YXlzYCBhbmQgYSBwdWJsaXNoZWQgcG9ydCBhbHJlYWR5IGluIHVzZSB0byByZXN0YXJ0IGluIGEgdGlnaHQgbG9vcC4gW21vYnkvbW9ieSM0OTUwN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTA3KQotICAgRml4IGFuIGlzc3VlIHdpdGggU3dhcm0gaW5ncmVzcywgY2F1c2VkIGJ5IGluY29ycmVjdCBvcmRlcmluZyBvZiBpcHRhYmxlcyBydWxlcy4gW21vYnkvbW9ieSM0OTUzOF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTM4KQotICAgRml4IGNyZWF0aW9uIG9mIGEgc3dhcm0tc2NvcGVkIG5ldHdvcmsgZnJvbSBhIGAtLWNvbmZpZy1vbmx5YCBuZXR3b3JrLiBbbW9ieS9tb2J5IzQ5NTIxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk1MjEpCi0gICBGaXggYGRvY2tlciBuZXR3b3JrIGluc3BlY3RgIHJlcG9ydGluZyBhbiBJUHY2IGdhdGV3YXkgd2l0aCBDSURSIHN1ZmZpeCBmb3IgYSBuZXdseSBjcmVhdGVkIG5ldHdvcmsgd2l0aCBubyBzcGVjaWZpYyBJUEFNIGNvbmZpZywgdW50aWwgYSBkYWVtb24gcmVzdGFydC4gW21vYnkvbW9ieSM0OTUyMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTIwKQotICAgSW1wcm92ZSB0aGUgZXJyb3IgcmVwb3J0ZWQgd2hlbiBrZXJuZWwgbW9kdWxlcyBgaXBfc2V0YCwgYGlwX3NldF9oYXNoX25ldGAgYW5kIGBuZXRpbHRlcl94dF9zZXRgIGFyZSBub3QgYXZhaWxhYmxlLiBbbW9ieS9tb2J5IzQ5NTI0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk1MjQpCi0gICBNb3ZlIG1vc3Qgb2YgRG9ja2VyJ3MgaXB0YWJsZXMgcnVsZXMgb3V0IG9mIHRoZSBmaWx0ZXItRk9SV0FSRCBjaGFpbiwgc28gdGhhdCBvdGhlciBhcHBsaWNhdGlvbnMgYXJlIGZyZWUgdG8gYXBwZW5kIHJ1bGVzIHRoYXQgbXVzdCBmb2xsb3cgRG9ja2VyJ3MgcnVsZXMuIFttb2J5L21vYnkjNDk1MThdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTUxOCkKLSAgIFVwZGF0ZSBgLS1oZWxwYCBvdXRwdXQgYW5kIG1hbiBwYWdlIGxvIHN0YXRlIHdoaWNoIG9wdGlvbnMgb25seSBhcHBseSB0byB0aGUgZGVmYXVsdCBicmlkZ2UgbmV0d29yay4gW21vYnkvbW9ieSM0OTUyMl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTIyKQoKIyMjIyMgQnVnIGZpeGVzIGFuZCBlbmhhbmNlbWVudHMKCi0gICBGaXggYGRvY2tlciBjb250ZXh0IGNyZWF0ZWAgYWx3YXlzIHJldHVybmluZyBhbiBlcnJvciB3aGVuIHVzaW5nIHRoZSBgInNraXAtdGxzLXZlcmlmeSJgIG9wdGlvbi4gW2RvY2tlci9jbGkjNTg1MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81ODUwKQotICAgRml4IHNoZWxsIGNvbXBsZXRpb24gc3VnZ2VzdGluZyBJRHMgaW5zdGVhZCBvZiBuYW1lcyBmb3Igc2VydmljZXMgYW5kIG5vZGVzLiBbZG9ja2VyL2NsaSM1ODQ4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU4NDgpCi0gICBGaXggdW5pbnRlbnRpb25hbGx5IHByaW50aW5nIGV4aXQgc3RhdHVzIHRvIHN0YW5kYXJkIGVycm9yIG91dHB1dCB3aGVuIGBkb2NrZXIgZXhlYy9ydW5gIHJldHVybnMgYSBub24temVybyBzdGF0dXMuIFtkb2NrZXIvY2xpIzU4NTRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTg1NCkKLSAgIEZpeCByZWdyZXNzaW9uIGBwcm90b2NvbCAidGNwIiBpcyBub3Qgc3VwcG9ydGVkIGJ5IHRoZSBSb290bGVzc0tpdCBwb3J0IGRyaXZlciAic2xpcnA0bmV0bnMiYC4gW21vYnkvbW9ieSM0OTUxNF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTE0KQotICAgY29udGFpbmVyZCBpbWFnZSBzdG9yZTogRml4IGBkb2NrZXIgaW5zcGVjdGAgbm90IGJlaW5nIGFibGUgdG8gc2hvdyBtdWx0aS1wbGF0Zm9ybSBpbWFnZXMgd2l0aCBtaXNzaW5nIGxheWVycyBmb3IgYWxsIHBsYXRmb3Jtcy4gW21vYnkvbW9ieSM0OTUzM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTMzKQotICAgY29udGFpbmVyZCBpbWFnZSBzdG9yZTogRml4IGBkb2NrZXIgaW1hZ2VzIC0tdHJlZWAgcmVwb3J0aW5nIHdyb25nIGNvbnRlbnQgc2l6ZS4gW21vYnkvbW9ieSM0OTUzNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTM1KQotICAgRml4IGNvbXBpbGF0aW9uIG9uIGkzODYgW21vYnkvbW9ieSM0OTUyNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTI2KQoKIyMjIyMgUGFja2FnaW5nIHVwZGF0ZXMKCi0gICBVcGRhdGUgYGdpdGh1Yi5jb20vZ28tam9zZS9nby1qb3NlL3Y0YCB0byB2NC4wLjUgdG8gYWRkcmVzcy4gW0dIU0EtYzZndy13Mzk4LWh2NzhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9nby1qb3NlL2dvLWpvc2Uvc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLWM2Z3ctdzM5OC1odjc4KSAvIFtDVkUtMjAyNS0yNzE0NF0oaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/aWQ9Q1ZFLTIwMjUtMjcxNDQpIFtkb2NrZXIvY2xpIzU4NjddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTg2NykKLSAgIFVwZGF0ZSBCdWlsZHggdG8gW3YwLjIxLjFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvYnVpbGR4L3JlbGVhc2VzL3RhZy92MC4yMS4xKS4gW2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nIzExNjddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZy9wdWxsLzExNjcpCi0gICBVcGRhdGUgQ29tcG9zZSB0byBbdjIuMzMuMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jb21wb3NlL3JlbGVhc2VzL3RhZy92Mi4zMy4xKS4gW2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nIzExNjhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZy9wdWxsLzExNjgpCgojIyMjIyBBUEkKCi0gICBjb250YWluZXJkIGltYWdlIHN0b3JlOiBGaXggYEdFVCAvaW1hZ2VzL2pzb24/bWFuaWZlc3RzPTFgIG5vdCBmaWxsaW5nIGBNYW5pZmVzdHNgIGZvciBpbmRleC1vbmx5IGltYWdlcy4gW21vYnkvbW9ieSM0OTUzM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTMzKQotICAgY29udGFpbmVyZCBpbWFnZSBzdG9yZTogRml4IGBHRVQgL2ltYWdlcy9qc29uIGFuZCAvaW1hZ2VzLzxuYW1lPi9qc29uYCBgU2l6ZS5Db250ZW50YCBmaWVsZCBpbmNsdWRpbmcgdGhlIHNpemUgb2YgY29udGVudCB0aGF0J3Mgbm90IGF2YWlsYWJsZSBsb2NhbGx5LiBbbW9ieS9tb2J5IzQ5NTM1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk1MzUpCgojIyMgW2B2MjguMC4wYF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9yZWxlYXNlcy90YWcvdjI4LjAuMCkKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9jb21wYXJlL3YyNy41LjEuLi52MjguMC4wKQoKIyMjIyMgMjguMC4wCgpGb3IgYSBmdWxsIGxpc3Qgb2YgcHVsbCByZXF1ZXN0cyBhbmQgY2hhbmdlcyBpbiB0aGlzIHJlbGVhc2UsIHJlZmVyIHRvIHRoZSByZWxldmFudCBHaXRIdWIgbWlsZXN0b25lczoKCi0gICBbZG9ja2VyL2NsaSwgMjguMC4wIG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMC4wKQotICAgW21vYnkvbW9ieSwgMjguMC4wIG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9pc3N1ZXM/cT1pcyUzQWNsb3NlZCttaWxlc3RvbmUlM0EyOC4wLjApCi0gICBEZXByZWNhdGVkIGFuZCByZW1vdmVkIGZlYXR1cmVzLCBzZWUgW0RlcHJlY2F0ZWQgRmVhdHVyZXNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL2Jsb2IvdjI4LjAuMC9kb2NzL2RlcHJlY2F0ZWQubWQpLgotICAgQ2hhbmdlcyB0byB0aGUgRW5naW5lIEFQSSwgc2VlIFtBUEkgdmVyc2lvbiBoaXN0b3J5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L2Jsb2IvdjI4LjAuMC9kb2NzL2FwaS92ZXJzaW9uLWhpc3RvcnkubWQpLgoKIyMjIyMgTmV3CgotICAgQWRkIGFiaWxpdHkgdG8gbW91bnQgYW4gaW1hZ2UgaW5zaWRlIGEgY29udGFpbmVyIHZpYSBgLS1tb3VudCB0eXBlPWltYWdlYC4gW21vYnkvbW9ieSM0ODc5OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4Nzk4KQogICAgLSAgIFlvdSBjYW4gYWxzbyBzcGVjaWZ5IGAtLW1vdW50IHR5cGU9aW1hZ2UsaW1hZ2Utc3VicGF0aD1bc3VicGF0aF0sLi4uYCBvcHRpb24gdG8gbW91bnQgYSBzcGVjaWZpYyBwYXRoIGZyb20gdGhlIGltYWdlLiBbZG9ja2VyL2NsaSM1NzU1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU3NTUpCi0gICBgZG9ja2VyIGltYWdlcyAtLXRyZWVgIG5vdyBzaG93cyBtZXRhZGF0YSBiYWRnZXMuIFtkb2NrZXIvY2xpIzU3NDRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTc0NCkKLSAgIGBkb2NrZXIgbG9hZGAsIGBkb2NrZXIgc2F2ZWAsIGFuZCBgZG9ja2VyIGhpc3RvcnlgIG5vdyBzdXBwb3J0IGEgYC0tcGxhdGZvcm1gIGZsYWcgYWxsb3dpbmcgeW91IHRvIGNob29zZSBhIHNwZWNpZmljIHBsYXRmb3JtIGZvciBzaW5nbGUtcGxhdGZvcm0gb3BlcmF0aW9ucyBvbiBtdWx0aS1wbGF0Zm9ybSBpbWFnZXMuIFtkb2NrZXIvY2xpIzUzMzFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTMzMSkKLSAgIEFkZCBgT09NU2NvcmVBZGpgIHRvIGBkb2NrZXIgc2VydmljZSBjcmVhdGVgIGFuZCBgZG9ja2VyIHN0YWNrYC4gW2RvY2tlci9jbGkjNTE0NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81MTQ1KQotICAgYGRvY2tlciBidWlsZHggcHJ1bmVgIG5vdyBzdXBwb3J0cyBgcmVzZXJ2ZWQtc3BhY2VgLCBgbWF4LXVzZWQtc3BhY2VgLCBgbWluLWZyZWUtc3BhY2VgIGFuZCBga2VlcC1ieXRlc2AgZmlsdGVycy4gW21vYnkvbW9ieSM0ODcyMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4NzIwKQotICAgV2luZG93czogQWRkIHN1cHBvcnQgZm9yIHJ1bm5pbmcgY29udGFpbmVyZCBhcyBhIGNoaWxkIHByb2Nlc3Mgb2YgdGhlIGRhZW1vbiwgaW5zdGVhZCBvZiB1c2luZyBhIHN5c3RlbS1pbnN0YWxsZWQgY29udGFpbmVyZC4gW21vYnkvbW9ieSM0Nzk1NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ3OTU1KQoKIyMjIyMgTmV0d29ya2luZwoKLSAgIFRoZSBgZG9ja2VyLXByb3h5YCBiaW5hcnkgaGFzIGJlZW4gdXBkYXRlZCwgb2xkZXIgdmVyc2lvbnMgd2lsbCBub3Qgd29yayB3aXRoIHRoZSB1cGRhdGVkIGBkb2NrZXJkYC4gW21vYnkvbW9ieSM0ODEzMl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4MTMyKQogICAgLSAgIENsb3NlIGEgd2luZG93IGluIHdoaWNoIHRoZSB1c2VybGFuZCBwcm94eSAoYGRvY2tlci1wcm94eWApIGNvdWxkIGFjY2VwdCBUQ1AgY29ubmVjdGlvbnMsIHRoYXQgd291bGQgdGhlbiBmYWlsIGFmdGVyIGBpcHRhYmxlc2AgTkFUIHJ1bGVzIHdlcmUgc2V0IHVwLgogICAgLSAgIFRoZSBleGVjdXRhYmxlIGByb290bGVzc2tpdC1kb2NrZXItcHJveHlgIGlzIG5vIGxvbmdlciB1c2VkLCBpdCBoYXMgYmVlbiByZW1vdmVkIGZyb20gdGhlIGJ1aWxkIGFuZCBkaXN0cmlidXRpb24uCi0gICBETlMgbmFtZXNlcnZlcnMgcmVhZCBmcm9tIHRoZSBob3N0J3MgYC9ldGMvcmVzb2x2LmNvbmZgIGFyZSBub3cgYWx3YXlzIGFjY2Vzc2VkIGZyb20gdGhlIGhvc3QncyBuZXR3b3JrIG5hbWVzcGFjZS4gW21vYnkvbW9ieSM0ODI5MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4MjkwKQogICAgLSAgIFdoZW4gdGhlIGhvc3QncyBgL2V0Yy9yZXNvbHYuY29uZmAgY29udGFpbnMgbm8gbmFtZXNlcnZlcnMgYW5kIHRoZXJlIGFyZSBubyBgLS1kbnNgIG92ZXJyaWRlcywgR29vZ2xlJ3MgRE5TIHNlcnZlcnMgYXJlIG5vIGxvbmdlciB1c2VkLCBhcGFydCBmcm9tIGJ5IHRoZSBkZWZhdWx0IGJyaWRnZSBuZXR3b3JrIGFuZCBpbiBidWlsZCBjb250YWluZXJzLgotICAgQ29udGFpbmVyIGludGVyZmFjZXMgaW4gYnJpZGdlIGFuZCBtYWN2bGFuIG5ldHdvcmtzIG5vdyB1c2UgcmFuZG9tbHkgZ2VuZXJhdGVkIE1BQyBhZGRyZXNzZXMuIFttb2J5L21vYnkjNDg4MDhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODgwOCkKICAgIC0gICBHcmF0dWl0b3VzIEFSUCAvIE5laWdoYm91ciBBZHZlcnRpc2VtZW50IG1lc3NhZ2VzIHdpbGwgYmUgc2VudCB3aGVuIHRoZSBpbnRlcmZhY2VzIGFyZSBzdGFydGVkIHNvIHRoYXQsIHdoZW4gSVAgYWRkcmVzc2VzIGFyZSByZXVzZWQsIHRoZXkncmUgYXNzb2NpYXRlZCB3aXRoIHRoZSBuZXdseSBnZW5lcmF0ZWQgTUFDIGFkZHJlc3MuCiAgICAtICAgSVB2NiBhZGRyZXNzZXMgaW4gdGhlIGRlZmF1bHQgYnJpZGdlIG5ldHdvcmsgYXJlIG5vdyBJUEFNLWFzc2lnbmVkLCByYXRoZXIgdGhhbiBiZWluZyBkZXJpdmVkIGZyb20gdGhlIE1BQyBhZGRyZXNzLgotICAgVGhlIGRlcHJlY2F0ZWQgT0NJIGBwcmVzdGFydGAgaG9vayBpcyBub3cgb25seSB1c2VkIGJ5IGJ1aWxkIGNvbnRhaW5lcnMuIEZvciBvdGhlciBjb250YWluZXJzLCBuZXR3b3JrIGludGVyZmFjZXMgYXJlIGFkZGVkIHRvIHRoZSBuZXR3b3JrIG5hbWVzcGFjZSBhZnRlciB0YXNrIGNyZWF0aW9uIGlzIGNvbXBsZXRlLCBiZWZvcmUgdGhlIGNvbnRhaW5lciB0YXNrIGlzIHN0YXJ0ZWQuIFttb2J5L21vYnkjNDc0MDZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80NzQwNikKLSAgIEFkZCBhIG5ldyBgZ3ctcHJpb3JpdHlgIG9wdGlvbiB0byBgZG9ja2VyIHJ1bmAsIGBkb2NrZXIgY29udGFpbmVyIGNyZWF0ZWAsIGFuZCBgZG9ja2VyIG5ldHdvcmsgY29ubmVjdGAuIFRoaXMgb3B0aW9uIHdpbGwgYmUgdXNlZCBieSB0aGUgRW5naW5lIHRvIGRldGVybWluZSB3aGljaCBuZXR3b3JrIHByb3ZpZGVzIHRoZSBkZWZhdWx0IGdhdGV3YXkgZm9yIGEgY29udGFpbmVyLiBPbiBgZG9ja2VyIHJ1bmAsIHRoaXMgb3B0aW9uIGlzIG9ubHkgYXZhaWxhYmxlIHRocm91Z2ggdGhlIGV4dGVuZGVkIGAtLW5ldHdvcmtgIHN5bnRheC4gW2RvY2tlci9jbGkjNTY2NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81NjY0KQotICAgQWRkIGEgbmV3IG5ldGxhYmVsIGBjb20uZG9ja2VyLm5ldHdvcmsuZW5kcG9pbnQuaWZuYW1lYCB0byBjdXN0b21pemUgdGhlIGludGVyZmFjZSBuYW1lIHVzZWQgd2hlbiBjb25uZWN0aW5nIGEgY29udGFpbmVyIHRvIGEgbmV0d29yay4gSXQncyBzdXBwb3J0ZWQgYnkgYWxsIGJ1aWx0LWluIG5ldHdvcmsgZHJpdmVycyBvbiBMaW51eC4gW21vYnkvbW9ieSM0OTE1NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5MTU1KQogICAgLSAgIFdoZW4gYSBjb250YWluZXIgaXMgY3JlYXRlZCB3aXRoIG11bHRpcGxlIG5ldHdvcmtzIHNwZWNpZmllZCwgdGhlcmUncyBubyBndWFyYW50ZWUgb24gdGhlIG9yZGVyIG5ldHdvcmtzIHdpbGwgYmUgY29ubmVjdGVkIHRvIHRoZSBjb250YWluZXIuIFNvLCBpZiBhIGN1c3RvbSBpbnRlcmZhY2UgbmFtZSB1c2VzIHRoZSBzYW1lIHByZWZpeCBhcyB0aGUgYXV0by1nZW5lcmF0ZWQgbmFtZXMsIGZvciBleGFtcGxlIGBldGhgLCB0aGUgY29udGFpbmVyIG1pZ2h0IGZhaWwgdG8gc3RhcnQuCiAgICAtICAgVGhlIHJlY29tbWVuZGVkIHByYWN0aWNlIGlzIHRvIHVzZSBhIGRpZmZlcmVudCBwcmVmaXgsIGZvciBleGFtcGxlIGBlbjBgLCBvciBhIG51bWVyaWNhbCBzdWZmaXggaGlnaCBlbm91Z2ggdG8gbmV2ZXIgY29sbGlkZSwgZm9yIGV4YW1wbGUgYGV0aDEwMGAuCiAgICAtICAgVGhpcyBsYWJlbCBjYW4gYmUgc3BlY2lmaWVkIG9uIGBkb2NrZXIgbmV0d29yayBjb25uZWN0YCB2aWEgdGhlIGAtLWRyaXZlci1vcHRgIGZsYWcsIGZvciBleGFtcGxlIGBkb2NrZXIgbmV0d29yayBjb25uZWN0IC0tZHJpdmVyLW9wdD1jb20uZG9ja2VyLm5ldHdvcmsuZW5kcG9pbnQuaWZuYW1lPWZvb2JhciDigKZgLgogICAgLSAgIE9yIHZpYSB0aGUgbG9uZy1mb3JtIGAtLW5ldHdvcmtgIGZsYWcgb24gYGRvY2tlciBydW5gLCBmb3IgZXhhbXBsZSBgZG9ja2VyIHJ1biAtLW5ldHdvcms9bmFtZT1icmlkZ2UsZHJpdmVyLW9wdD1jb20uZG9ja2VyLm5ldHdvcmsuZW5kcG9pbnQuaWZuYW1lPWZvb2JhciDigKZgCi0gICBJZiBhIGN1c3RvbSBuZXR3b3JrIGRyaXZlciByZXBvcnRzIGNhcGFiaWxpdHkgYEd3QWxsb2NDaGVja2VyYCB0aGVuLCBiZWZvcmUgYSBuZXR3b3JrIGlzIGNyZWF0ZWQsIGl0IHdpbGwgZ2V0IGEgYEd3QWxsb2NDaGVja2VyUmVxdWVzdGAgd2l0aCB0aGUgbmV0d29yaydzIG9wdGlvbnMuIFRoZSBjdXN0b20gZHJpdmVyIG1heSB0aGVuIHJlcGx5IHRoYXQgbm8gZ2F0ZXdheSBJUCBhZGRyZXNzIHNob3VsZCBiZSBhbGxvY2F0ZWQuIFttb2J5L21vYnkjNDkzNzJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTM3MikKCiMjIyMjIFBvcnQgcHVibGlzaGluZyBpbiBicmlkZ2UgbmV0d29ya3MKCi0gICBgZG9ja2VyZGAgbm93IHJlcXVpcmVzIGBpcHNldGAgc3VwcG9ydCBpbiB0aGUgTGludXgga2VybmVsLiBbbW9ieS9tb2J5IzQ4NTk2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg1OTYpCiAgICAtICAgVGhlIGBpcHRhYmxlc2AgYW5kIGBpcDZ0YWJsZXNgIHJ1bGVzIHVzZWQgdG8gaW1wbGVtZW50IHBvcnQgcHVibGlzaGluZyBhbmQgbmV0d29yayBpc29sYXRpb24gaGF2ZSBiZWVuIGV4dGVuc2l2ZWx5IG1vZGlmaWVkLiBUaGlzIGVuYWJsZXMgc29tZSBvZiB0aGUgZm9sbG93aW5nIGZ1bmN0aW9uYWwgY2hhbmdlcywgYW5kIGlzIGEgZmlyc3Qgc3RlcCBpbiByZWZhY3RvcmluZyB0byBlbmFibGUgbmF0aXZlIGBuZnRhYmxlc2Agc3VwcG9ydCBpbiBhIGZ1dHVyZSByZWxlYXNlLiBbbW9ieS9tb2J5IzQ4ODE1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L2lzc3Vlcy80ODgxNSkKICAgIC0gICBJZiBpdCBiZWNvbWVzIG5lY2Vzc2FyeSB0byBkb3duZ3JhZGUgdG8gYW4gZWFybGllciB2ZXJzaW9uIG9mIHRoZSBkYWVtb24sIHNvbWUgbWFudWFsIGNsZWFudXAgb2YgdGhlIG5ldyBydWxlcyB3aWxsIGJlIG5lY2Vzc2FyeS4gVGhlIHNpbXBsZXN0IGFuZCBzdXJlc3QgYXBwcm9hY2ggaXMgdG8gcmVib290IHRoZSBob3N0LCBvciB1c2UgYGlwdGFibGVzIC1GYCBhbmQgYGlwNnRhYmxlcyAtRmAgdG8gZmx1c2ggYWxsIGV4aXN0aW5nIGBpcHRhYmxlc2AgcnVsZXMgZnJvbSB0aGUgYGZpbHRlcmAgdGFibGUgYmVmb3JlIHN0YXJ0aW5nIHRoZSBvbGRlciB2ZXJzaW9uIG9mIHRoZSBkYWVtb24uIFdoZW4gdGhhdCBpcyBub3QgcG9zc2libGUsIHJ1biB0aGUgZm9sbG93aW5nIGNvbW1hbmRzIGFzIHJvb3Q6CiAgICAgICAgLSAgIGBpcHRhYmxlcyAtRCBGT1JXQVJEIC1tIHNldCAtLW1hdGNoLXNldCBkb2NrZXItZXh0LWJyaWRnZXMtdjQgZHN0IC1tIGNvbm50cmFjayAtLWN0c3RhdGUgUkVMQVRFRCxFU1RBQkxJU0hFRCAtaiBBQ0NFUFQ7IGlwNnRhYmxlcyAtRCBGT1JXQVJEIC1tIHNldCAtLW1hdGNoLXNldCBkb2NrZXItZXh0LWJyaWRnZXMtdjYgZHN0IC1tIGNvbm50cmFjayAtLWN0c3RhdGUgUkVMQVRFRCxFU1RBQkxJU0hFRCAtaiBBQ0NFUFRgCiAgICAgICAgLSAgIGBpcHRhYmxlcyAtRCBGT1JXQVJEIC1tIHNldCAtLW1hdGNoLXNldCBkb2NrZXItZXh0LWJyaWRnZXMtdjQgZHN0IC1qIERPQ0tFUjsgaXA2dGFibGVzIC1EIEZPUldBUkQgLW0gc2V0IC0tbWF0Y2gtc2V0IGRvY2tlci1leHQtYnJpZGdlcy12NiBkc3QgLWogRE9DS0VSYAogICAgICAgIC0gICBJZiB5b3Ugd2VyZSBwcmV2aW91c2x5IHJ1bm5pbmcgd2l0aCB0aGUgaXB0YWJsZXMgZmlsdGVyLUZPUldBUkQgcG9saWN5IHNldCB0byBgQUNDRVBUYCBhbmQgbmVlZCB0byByZXN0b3JlIGFjY2VzcyB0byB1bnB1Ymxpc2hlZCBwb3J0cywgYWxzbyBkZWxldGUgcGVyLWJyaWRnZS1uZXR3b3JrIHJ1bGVzIGZyb20gdGhlIGBET0NLRVJgIGNoYWlucy4gRm9yIGV4YW1wbGUsIGBpcHRhYmxlcyAtRCBET0NLRVIgISAtaSBkb2NrZXIwIC1vIGRvY2tlcjAgLWogRFJPUGAuCi0gICBGaXggYSBzZWN1cml0eSBpc3N1ZSB0aGF0IHdhcyBhbGxvd2luZyByZW1vdGUgaG9zdHMgdG8gY29ubmVjdCBkaXJlY3RseSB0byBhIGNvbnRhaW5lciBvbiBpdHMgcHVibGlzaGVkIHBvcnRzLiBbbW9ieS9tb2J5IzQ5MzI1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkzMjUpCi0gICBGaXggYSBzZWN1cml0eSBpc3N1ZSB0aGF0IHdhcyBhbGxvd2luZyBuZWlnaGJvciBob3N0cyB0byBjb25uZWN0IHRvIHBvcnRzIG1hcHBlZCBvbiBhIGxvb3BiYWNrIGFkZHJlc3MuIFttb2J5L21vYnkjNDkzMjVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTMyNSkKLSAgIEZpeCBhbiBpc3N1ZSB0aGF0IHByZXZlbnRlZCBwb3J0IHB1Ymxpc2hpbmcgdG8gbGluay1sb2NhbCBhZGRyZXNzZXMuIFttb2J5L21vYnkjNDg1NzBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODU3MCkKLSAgIFVEUCBwb3J0cyBwdWJsaXNoZWQgYnkgYSBjb250YWluZXIgYXJlIG5vdyByZWxpYWJseSBhY2Nlc3NpYmxlIGJ5IGNvbnRhaW5lcnMgb24gb3RoZXIgbmV0d29ya3MsIHZpYSB0aGUgaG9zdCdzIHB1YmxpYyBJUCBhZGRyZXNzLiBbbW9ieS9tb2J5IzQ4NTcxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg1NzEpCi0gICBEb2NrZXIgd2lsbCBub3cgb25seSBzZXQgdGhlIGBpcDZ0YWJsZXNgIHBvbGljeSBmb3IgdGhlIGBGT1JXQVJEYCBjaGFpbiBpbiB0aGUgYGZpbHRlcmAgdGFibGUgdG8gYERST1BgIGlmIGl0IGVuYWJsZXMgSVAgZm9yd2FyZGluZyBvbiB0aGUgaG9zdCBpdHNlbGYgKHN5c2N0bHMgYG5ldC5pcHY2LmNvbmYuYWxsLmZvcndhcmRpbmdgIGFuZCBgbmV0LmlwdjYuY29uZi5kZWZhdWx0LmZvcndhcmRpbmdgKS4gVGhpcyBpcyBub3cgYWxpZ25lZCB3aXRoIGV4aXN0aW5nIElQdjQgYmVoYXZpb3VyLiBbbW9ieS9tb2J5IzQ4NTk0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg1OTQpCiAgICAtICAgSWYgSVB2NiBmb3J3YXJkaW5nIGlzIGVuYWJsZWQgb24geW91ciBob3N0LCBidXQgeW91IHdlcmUgZGVwZW5kaW5nIG9uIERvY2tlciB0byBzZXQgdGhlIGlwNnRhYmxlcyBmaWx0ZXItRk9SV0FSRCBwb2xpY3kgdG8gYERST1BgLCB5b3UgbWF5IG5lZWQgdG8gdXBkYXRlIHlvdXIgaG9zdCdzIGNvbmZpZ3VyYXRpb24gdG8gbWFrZSBzdXJlIGl0IGlzIHNlY3VyZS4KLSAgIERpcmVjdCByb3V0ZWQgYWNjZXNzIHRvIGNvbnRhaW5lciBwb3J0cyB0aGF0IGFyZSBub3QgZXhwb3NlZCB1c2luZyBgcGAvYC1wdWJsaXNoYCBpcyBub3cgYmxvY2tlZCBpbiB0aGUgYERPQ0tFUmAgaXB0YWJsZXMgY2hhaW4uIFttb2J5L21vYnkjNDg3MjRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODcyNCkKICAgIC0gICBJZiB0aGUgZGVmYXVsdCBpcHRhYmxlcyBmaWx0ZXItRk9SV0FSRCBwb2xpY3kgd2FzIHByZXZpb3VzbHkgbGVmdCBhdCBgQUNDRVBUYCBvbiB5b3VyIGhvc3QsIGFuZCBkaXJlY3Qgcm91dGVkIGFjY2VzcyB0byBhIGNvbnRhaW5lcidzIHVucHVibGlzaGVkIHBvcnRzIGZyb20gYSByZW1vdGUgaG9zdCBpcyBzdGlsbCByZXF1aXJlZCwgb3B0aW9ucyBhcmU6CiAgICAgICAgLSAgIFB1Ymxpc2ggdGhlIHBvcnRzIHlvdSBuZWVkLgogICAgICAgIC0gICBVc2UgdGhlIG5ldyBgZ2F0ZXdheV9tb2RlX2lwdls0Nl09bmF0LXVucHJvdGVjdGVkYCwgZGVzY3JpYmVkIGJlbG93LgogICAgLSAgIENvbnRhaW5lciBwb3J0cyBwdWJsaXNoZWQgdG8gaG9zdCBhZGRyZXNzZXMgd2lsbCBjb250aW51ZSB0byBiZSBhY2Nlc3NpYmxlIHZpYSB0aG9zZSBob3N0IGFkZHJlc3NlcywgdXNpbmcgTkFUIG9yIHRoZSB1c2VybGFuZCBwcm94eS4KICAgIC0gICBVbnB1Ymxpc2hlZCBjb250YWluZXIgcG9ydHMgY29udGludWUgdG8gYmUgZGlyZWN0bHkgYWNjZXNzaWJsZSBmcm9tIHRoZSBEb2NrZXIgaG9zdCB2aWEgdGhlIGNvbnRhaW5lcidzIElQIGFkZHJlc3MuCi0gICBOZXR3b3JrcyBjcmVhdGVkIHdpdGggYGdhdGV3YXlfbW9kZV9pcHZbNDZdPXJvdXRlZGAgYXJlIG5vdyBhY2Nlc3NpYmxlIGZyb20gb3RoZXIgYnJpZGdlIG5ldHdvcmtzIHJ1bm5pbmcgb24gdGhlIHNhbWUgRG9ja2VyIGhvc3QsIGFzIHdlbGwgYXMgZnJvbSBvdXRzaWRlIHRoZSBob3N0LiBbbW9ieS9tb2J5IzQ4NTk2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg1OTYpCi0gICBCcmlkZ2UgZHJpdmVyIG9wdGlvbnMgYGNvbS5kb2NrZXIubmV0d29yay5icmlkZ2UuZ2F0ZXdheV9tb2RlX2lwdjRgIGFuZCBgY29tLmRvY2tlci5uZXR3b3JrLmJyaWRnZS5nYXRld2F5X21vZGVfaXB2NmAgbm93IGFjY2VwdCBtb2RlIGBuYXQtdW5wcm90ZWN0ZWRgLiBbbW9ieS9tb2J5IzQ4NTk3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg1OTcpCiAgICAtICAgYG5hdC11bnByb3RlY3RlZGAgaXMgc2ltaWxhciB0byB0aGUgZGVmYXVsdCBgbmF0YCBtb2RlLCBidXQgbm8gcGVyIHBvcnQvcHJvdG9jb2wgcnVsZXMgYXJlIHNldCB1cC4gVGhpcyBtZWFucyBhbnkgcG9ydCBvbiBhIGNvbnRhaW5lciBjYW4gYmUgYWNjZXNzZWQgYnkgZGlyZWN0LXJvdXRpbmcgZnJvbSBhIHJlbW90ZSBob3N0LgotICAgQnJpZGdlIGRyaXZlciBvcHRpb25zIGBjb20uZG9ja2VyLm5ldHdvcmsuYnJpZGdlLmdhdGV3YXlfbW9kZV9pcHY0YCBhbmQgYGNvbS5kb2NrZXIubmV0d29yay5icmlkZ2UuZ2F0ZXdheV9tb2RlX2lwdjZgIG5vdyBhY2NlcHQgbW9kZSBgaXNvbGF0ZWRgLCB3aGVuIHRoZSBuZXR3b3JrIGlzIGFsc28gYGludGVybmFsYC4gW21vYnkvbW9ieSM0OTI2Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5MjYyKQogICAgLSAgIEFuIGFkZHJlc3MgaXMgbm9ybWFsbHkgYXNzaWduZWQgdG8gdGhlIGJyaWRnZSBkZXZpY2UgaW4gYW4gYGludGVybmFsYCBuZXR3b3JrLiBTbywgcHJvY2Vzc2VzIG9uIHRoZSBEb2NrZXIgaG9zdCBjYW4gYWNjZXNzIHRoZSBuZXR3b3JrLCBhbmQgY29udGFpbmVycyBpbiB0aGUgbmV0d29yayBjYW4gYWNjZXNzIGhvc3Qgc2VydmljZXMgbGlzdGVuaW5nIG9uIHRoYXQgYnJpZGdlIGFkZHJlc3MgKGluY2x1ZGluZyBzZXJ2aWNlcyBsaXN0ZW5pbmcgb24gImFueSIgaG9zdCBhZGRyZXNzLCBgMC4wLjAuMGAgb3IgYDo6YCkuCiAgICAtICAgQW4gYGludGVybmFsYCBicmlkZ2UgbmV0d29yayBjcmVhdGVkIHdpdGggZ2F0ZXdheSBtb2RlIGBpc29sYXRlZGAgZG9lcyBub3QgaGF2ZSBhbiBhZGRyZXNzIG9uIHRoZSBEb2NrZXIgaG9zdC4KLSAgIFdoZW4gYSBwb3J0IG1hcHBpbmcgaW5jbHVkZXMgYSBob3N0IElQIGFkZHJlc3Mgb3IgcG9ydCBudW1iZXIgdGhhdCBjYW5ub3QgYmUgdXNlZCBiZWNhdXNlIE5BVCBmcm9tIHRoZSBob3N0IGlzIGRpc2FibGVkIHVzaW5nIGAtLWdhdGV3YXlfbW9kZV9pcHZbNDZdYCwgY29udGFpbmVyIGNyZWF0aW9uIHdpbGwgbm8gbG9uZ2VyIGZhaWwuIFRoZSB1bnVzZWQgZmllbGRzIG1heSBiZSBuZWVkZWQgaWYgdGhlIGdhdGV3YXkgZW5kcG9pbnQgY2hhbmdlcyB3aGVuIG5ldHdvcmtzIGFyZSBjb25uZWN0ZWQgb3IgZGlzY29ubmVjdGVkLiBBIG1lc3NhZ2UgYWJvdXQgdGhlIHVudXNlZCBmaWVsZHMgd2lsbCBiZSBsb2dnZWQuIFttb2J5L21vYnkjNDg1NzVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODU3NSkKLSAgIERvIG5vdCBjcmVhdGUgaXB0YWJsZXMgbmF0LVBPU1RST1VUSU5HIG1hc3F1ZXJhZGUgcnVsZXMgZm9yIGEgY29udGFpbmVyJ3Mgb3duIHB1Ymxpc2hlZCBwb3J0cywgd2hlbiB0aGUgdXNlcmxhbmQgcHJveHkgaXMgZW5hYmxlZC4gW21vYnkvbW9ieSM0ODg1NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4ODU0KQoKIyMjIyMgSVB2NgoKLSAgIEFkZCBgZG9ja2VyIG5ldHdvcmsgY3JlYXRlYCBvcHRpb24gYC0taXB2NGAuIFRvIGRpc2FibGUgSVB2NCBhZGRyZXNzIGFzc2lnbm1lbnQgZm9yIGEgbmV0d29yaywgdXNlIGBkb2NrZXIgbmV0d29yayBjcmVhdGUgLS1pcHY0PWZhbHNlIFsuLi5dYC4gW2RvY2tlci9jbGkjNTU5OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81NTk5KQotICAgRGFlbW9uIG9wdGlvbiBgLS1pcHY2YCAoYCJpcHY2IjogdHJ1ZWAgaW4gYGRhZW1vbi5qc29uYCkgY2FuIG5vdyBiZSB1c2VkIHdpdGhvdXQgYGZpeGVkLWNpZHItdjZgLiBbbW9ieS9tb2J5IzQ4MzE5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDgzMTkpCi0gICBJUEFNIG5vdyBoYW5kbGVzIHN1Ym5ldHMgYmlnZ2VyIHRoYW4gIi82NCIuIFttb2J5L21vYnkjNDkyMjNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTIyMykKLSAgIER1cGxpY2F0ZSBhZGRyZXNzIGRldGVjdGlvbiAoREFEKSBpcyBub3cgZGlzYWJsZWQgZm9yIGFkZHJlc3NlcyBhc3NpZ25lZCB0byB0aGUgYnJpZGdlcyBiZWxvbmdpbmcgdG8gYnJpZGdlIG5ldHdvcmtzLiBbbW9ieS9tb2J5IzQ4NjA5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg2MDkpCi0gICBNb2RpZmljYXRpb25zIHRvIGBob3N0LWdhdGV3YXlgLCBmb3IgY29tcGF0aWJpbGl0eSB3aXRoIElQdjYtb25seSBuZXR3b3Jrcy4gW21vYnkvbW9ieSM0ODgwN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4ODA3KQogICAgLSAgIFdoZW4gc3BlY2lhbCB2YWx1ZSBgaG9zdC1nYXRld2F5YCBpcyB1c2VkIGluIGFuIGAtLWFkZC1ob3N0YCBvcHRpb24gaW4gcGxhY2Ugb2YgYW4gYWRkcmVzcywgaXQncyByZXBsYWNlZCBieSBhbiBhZGRyZXNzIG9uIHRoZSBEb2NrZXIgaG9zdCB0byBtYWtlIGl0IHBvc3NpYmxlIHRvIHJlZmVyIHRvIHRoZSBob3N0IGJ5IG5hbWUuIFRoZSBhZGRyZXNzIHVzZWQgYmVsb25ncyB0byB0aGUgZGVmYXVsdCBicmlkZ2UgKG5vcm1hbGx5IGBkb2NrZXIwYCkuIFVudGlsIG5vdyBpdCdzIGFsd2F5cyBiZWVuIGFuIElQdjQgYWRkcmVzcywgYmVjYXVzZSBhbGwgY29udGFpbmVycyBvbiBicmlkZ2UgbmV0d29ya3MgaGFkIElQdjQgYWRkcmVzc2VzLgogICAgLSAgIE5vdywgaWYgSVB2NiBpcyBlbmFibGVkIG9uIHRoZSBkZWZhdWx0IGJyaWRnZSBuZXR3b3JrLCBgL2V0Yy9ob3N0c2AgZW50cmllcyB3aWxsIGJlIGNyZWF0ZWQgZm9yIElQdjQgYW5kIElQdjYgYWRkcmVzc2VzLiBTbywgYSBjb250YWluZXIgdGhhdCdzIG9ubHkgY29ubmVjdGVkIHRvIElQdjYtb25seSBuZXR3b3JrcyBjYW4gYWNjZXNzIHRoZSBob3N0IGJ5IG5hbWUuCiAgICAtICAgVGhlIGAtLWhvc3QtZ2F0ZXdheS1pcGAgb3B0aW9uIG92ZXJyaWRlcyB0aGUgYWRkcmVzcyB1c2VkIHRvIHJlcGxhY2UgYGhvc3QtZ2F0ZXdheWAuIFR3byBvZiB0aGVzZSBvcHRpb25zIGFyZSBub3cgYWxsb3dlZCBvbiB0aGUgY29tbWFuZCBsaW5lLCBmb3Igb25lIElQdjQgZ2F0ZXdheSBhbmQgb25lIElQdjYuCiAgICAtICAgSW4gdGhlIGBkYWVtb24uanNvbmAgZmlsZSwgdG8gcHJvdmlkZSB0d28gYWRkcmVzc2VzLCB1c2UgYCJob3N0LWdhdGV3YXktaXBzImAuIEZvciBleGFtcGxlLCBgImhvc3QtZ2F0ZXdheS1pcHMiOiBbIjE5Mi4wLjIuMSIsICIyMDAxOmRiODo6MTExMSJdYC4KCiMjIyMjIEJ1ZyBmaXhlcyBhbmQgZW5oYW5jZW1lbnRzCgotICAgQWRkIElQdjYgbG9vcGJhY2sgYWRkcmVzcyBhcyBhbiBpbnNlY3VyZSByZWdpc3RyeSBieSBkZWZhdWx0LiBbbW9ieS9tb2J5IzQ4NTQwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg1NDApCi0gICBBZGQgc3VwcG9ydCBmb3IgQ29icmEtZ2VuZXJhdGVkIGNvbXBsZXRpb24gc2NyaXB0cyBmb3IgYGRvY2tlcmRgLiBbbW9ieS9tb2J5IzQ5MzM5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkzMzkpCi0gICBGaXggRE5TIHF1ZXJpZXMgZmFpbGluZyB3aGVuIGNvbnRhaW5lcnMgYXJlIGxhdW5jaGVkIHZpYSBgc3lzdGVtZGAgYXV0by1zdGFydCBvbiBib290IFttb2J5L21vYnkjNDg4MTJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODgxMikKLSAgIEZpeCBEb2NrZXIgU3dhcm0gbW9kZSBpZ25vcmluZyBgdm9sdW1lLnN1YnBhdGhgIFtkb2NrZXIvY2xpIzU4MzNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTgzMykKLSAgIEZpeCBgZG9ja2VyIGV4cG9ydGAgY29udGludWluZyB0aGUgZXhwb3J0IGFmdGVyIHRoZSBvcGVyYXRpb24gaXMgY2FuY2VsZWQuIFttb2J5L21vYnkjNDkyNjVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTI2NSkKLSAgIEZpeCBgZG9ja2VyIGV4cG9ydGAgbm90IHJlbGVhc2luZyB0aGUgY29udGFpbmVyJ3Mgd3JpdGFibGUgbGF5ZXIgYWZ0ZXIgYSBmYWlsdXJlLiBbbW9ieS9tb2J5IzQ4NTE3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg1MTcpCi0gICBGaXggYGRvY2tlciBpbWFnZXMgLS10cmVlYCB1bm5lY2Vzc2FyeSB0cnVuY2F0aW5nIGxvbmcgaW1hZ2UgbmFtZXMgd2hlbiBtdWx0aXBsZSBuYW1lcyBhcmUgYXZhaWxhYmxlIFtkb2NrZXIvY2xpIzU3NTddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTc1NykKLSAgIEZpeCBhIGJ1ZyB3aGVyZSBhIGNvbnRhaW5lciB3aXRoIGEgbmFtZSBtYXRjaGluZyBhbm90aGVyIGNvbnRhaW5lcidzIElEIGlzIG5vdCByZXN0b3JlZCBvbiBkYWVtb24gc3RhcnR1cC4gW21vYnkvbW9ieSM0ODY2OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4NjY5KQotICAgRml4IGFuIGlzc3VlIHByZXZlbnRpbmcgc29tZSBJUHY2IGFkZHJlc3NlcyBzaG93biBieSBgZG9ja2VyIHBzYCB0byBiZSBwcm9wZXJseSBicmFja2V0ZWQgW2RvY2tlci9jbGkjNTQ2OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81NDY4KQotICAgRml4IGJ1ZyBwcmV2ZW50aW5nIGltYWdlIHB1bGxzIGZyb20gYmVpbmcgY2FuY2VsbGVkIGR1cmluZyBgZG9ja2VyIHJ1bmAuIFtkb2NrZXIvY2xpIzU2NDVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTY0NSkKLSAgIEZpeCBlcnJvci1oYW5kbGluZyB3aGVuIHJ1bm5pbmcgdGhlIGRhZW1vbiBhcyBhIFdpbmRvd3Mgc2VydmljZSB0byBwcmV2ZW50IHVuY2xlYW4gZXhpdHMuIFttb2J5L21vYnkjNDg1MThdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODUxOCkKLSAgIEZpeCBpc3N1ZSBjYXVzaW5nIG91dHB1dCBvZiBgZG9ja2VyIHJ1bmAgdG8gYmUgaW5jb25zaXN0ZW50IHdoZW4gdXNpbmcgYC0tYXR0YWNoIHN0ZG91dGAgb3IgYC0tYXR0YWNoIHN0ZGVycmAgdmVyc3VzIGBzdGRpbmAuICBgZG9ja2VyIHJ1biAtLWF0dGFjaCBzdGRpbmAgbm93IGV4aXRzIGlmIHRoZSBjb250YWluZXIgZXhpdHMuIFtkb2NrZXIvY2xpIzU2NjJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTY2MikKLSAgIEZpeCByb290bGVzcyBEb2NrZXIgc2V0dXAgd2l0aCBgc3ViaWRgIGJhY2tlZCBieSBOU1MgbW9kdWxlcy4gW21vYnkvbW9ieSM0OTAzNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5MDM2KQotICAgR2VuZXJhdGVkIGNvbXBsZXRpb24gc2NyaXB0cyBmcm9tIHRoZSBDTEkgbm93IHNob3cgZGVzY3JpcHRpb25zIG5leHQgdG8gZWFjaCBjb21tYW5kL2ZsYWcgc3VnZ2VzdGlvbi4gW2RvY2tlci9jbGkjNTc1Nl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81NzU2KQotICAgSVB2NiBhZGRyZXNzZXMgc2hvd24gYnkgYGRvY2tlciBwc2AgaW4gcG9ydCBiaW5kaW5ncyBhcmUgbm93IGJyYWNrZXRlZCBbZG9ja2VyL2NsaSM1MzYzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzUzNjMpCi0gICBJbXBsZW1lbnQgdGhlIHBvcnRzIHZhbGlkYXRpb24gbWV0aG9kIGZvciBDb21wb3NlIFtkb2NrZXIvY2xpIzU1MjRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTUyNCkKLSAgIEltcHJvdmUgZXJyb3Itb3V0cHV0IGZvciBpbnZhbGlkIGZsYWdzIG9uIHRoZSBjb21tYW5kIGxpbmUuIFtkb2NrZXIvY2xpIzUyMzNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTIzMykKLSAgIEltcHJvdmUgZXJyb3JzIHdoZW4gZmFpbGluZyB0byBzdGFydCBhIGNvbnRhaW5lciB1c2luZyBhbnRoZXIgY29udGFpbmVyJ3MgbmV0d29yayBuYW1lc3BhY2UuIFttb2J5L21vYnkjNDkzNjddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTM2NykKLSAgIEltcHJvdmUgaGFuZGxpbmcgb2YgaW52YWxpZCBBUEkgZXJyb3JzIHRoYXQgY291bGQgcmVzdWx0IGluIGFuIGVtcHR5IGVycm9yIG1lc3NhZ2UgYmVpbmcgc2hvd24uIFttb2J5L21vYnkjNDkzNzNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTM3MykKLSAgIEltcHJvdmUgb3V0cHV0IGFuZCBjb25zaXN0ZW5jeSBmb3IgdW5rbm93biAoc3ViKWNvbW1hbmRzIGFuZCBpbnZhbGlkIGFyZ3VtZW50cyBbZG9ja2VyL2NsaSM1MjM0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzUyMzQpCi0gICBJbXByb3ZlIHZhbGlkYXRpb24gb2YgYGV4ZWMtb3B0c2AgaW4gZGFlbW9uIGNvbmZpZ3VyYXRpb24uIFttb2J5L21vYnkjNDg5NzldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODk3OSkKLSAgIFVwZGF0ZSB0aGUgaGFuZGxpbmcgb2YgdGhlIGAtLWdwdXM9MGAgZmxhZyB0byBiZSBjb25zaXN0ZW50IHdpdGggdGhlIE5WSURJQSBDb250YWluZXIgUnVudGltZS4gW21vYnkvbW9ieSM0ODQ4Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4NDgyKQotICAgYGNsaWVudC5Db250YWluZXJDcmVhdGVgIG5vdyBub3JtYWxpemVzIGBDYXBBZGRgIGFuZCBgQ2FwRHJvcGAgZmllbGRzIGluIGBIb3N0Q29uZmlnYCB0byB0aGVpciBjYW5vbmljYWwgZm9ybS4gW21vYnkvbW9ieSM0ODU1MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4NTUxKQotICAgYGRvY2tlciBpbWFnZSBzYXZlYCBub3cgcHJvZHVjZXMgc3RhYmxlIHRpbWVzdGFtcHMuIFttb2J5L21vYnkjNDg2MTFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODYxMSkKLSAgIGBkb2NrZXIgaW5zcGVjdGAgbm93IGxldHMgeW91IGluc3BlY3QgU3dhcm0gY29uZmlncyBbZG9ja2VyL2NsaSM1NTczXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU1NzMpCi0gICBjb250YWluZXJkIGltYWdlIHN0b3JlOiBBZGQgc3VwcG9ydCBmb3IgYEV4dHJhY3RpbmdgIGxheWVyIHN0YXR1cyBpbiBgZG9ja2VyIHB1bGxgLiBbbW9ieS9tb2J5IzQ5MDY0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkwNjQpCi0gICBjb250YWluZXJkIGltYWdlIHN0b3JlOiBGaXggYGNvbW1pdGAsIGBpbXBvcnRgLCBhbmQgYGJ1aWxkYCBub3QgcHJlc2VydmluZyBhIHJlcGxhY2VkIGltYWdlIGFzIGEgZGFuZ2xpbmcgaW1hZ2UuIFttb2J5L21vYnkjNDgzMTZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODMxNikKLSAgIGNvbnRhaW5lcmQgaW1hZ2Ugc3RvcmU6IE1ha2UgYGRvY2tlciBsb2FkIC0tcGxhdGZvcm1gIHJldHVybiBhbiBlcnJvciB3aGVuIHRoZSByZXF1ZXN0ZWQgcGxhdGZvcm0gaXNuJ3QgbG9hZGVkLiBbbW9ieS9tb2J5IzQ4NzE4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg3MTgpCi0gICBGaXggdmFsaWRhdGlvbiBvZiBgLS1saW5rYCBvcHRpb24uIFtkb2NrZXIvY2xpIzU3MzldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTczOSkKLSAgIEFkZCB2YWxpZGF0aW9uIG9mIG5ldHdvcmstZGlhZ25vc3RpYy1wb3J0IGRhZW1vbiBjb25maWd1cmF0aW9uIG9wdGlvbi4gW21vYnkvbW9ieSM0OTMwNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5MzA1KQotICAgVW5sZXNzIGV4cGxpY2l0bHkgY29uZmlndXJlZCwgYW4gSVAgYWRkcmVzcyBpcyBubyBsb25nZXIgcmVzZXJ2ZWQgZm9yIGEgZ2F0ZXdheSBpbiBjYXNlcyB3aGVyZSBpdCBpcyBub3QgcmVxdWlyZWQuIE5hbWVseSwg4oCcaW50ZXJuYWzigJ0gYnJpZGdlIG5ldHdvcmtzIHdpdGggb3B0aW9uIGBjb20uZG9ja2VyLm5ldHdvcmsuYnJpZGdlLmluaGliaXRfaXB2NGAsIGBpcHZsYW5gIG9yIGBtYWN2bGFuYCBuZXR3b3JrcyB3aXRoIG5vIHBhcmVudCBpbnRlcmZhY2UsIGFuZCBMMyBJUHZsYW4gbW9kZXMuIFttb2J5L21vYnkjNDkyNjFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTI2MSkKLSAgIElmIGEgY3VzdG9tIG5ldHdvcmsgZHJpdmVyIHJlcG9ydHMgY2FwYWJpbGl0eSBgR3dBbGxvY0NoZWNrZXJgIHRoZW4sIGJlZm9yZSBhIG5ldHdvcmsgaXMgY3JlYXRlZCwgaXQgd2lsbCBnZXQgYSBgR3dBbGxvY0NoZWNrZXJSZXF1ZXN0YCB3aXRoIHRoZSBuZXR3b3JrJ3Mgb3B0aW9ucy4gVGhlIGN1c3RvbSBkcml2ZXIgbWF5IHRoZW4gcmVwbHkgdGhhdCBubyBnYXRld2F5IElQIGFkZHJlc3Mgc2hvdWxkIGJlIGFsbG9jYXRlZC4gW21vYnkvbW9ieSM0OTM3Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5MzcyKQotICAgRml4ZWQgYW4gaXNzdWUgdGhhdCBtZWFudCBhIGNvbnRhaW5lciBjb3VsZCBub3QgYmUgYXR0YWNoZWQgdG8gYW4gTDMgSVB2bGFuIGF0IHRoZSBzYW1lIHRpbWUgYXMgb3RoZXIgbmV0d29yayB0eXBlcy4gW21vYnkvbW9ieSM0OTEzMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5MTMwKQotICAgUmVtb3ZlIHRoZSBjb3JyZWN0IGAvZXRjL2hvc3RzYCBlbnRyaWVzIHdoZW4gZGlzY29ubmVjdGluZyBhIGNvbnRhaW5lciBmcm9tIGEgbmV0d29yay4gW21vYnkvbW9ieSM0ODg1N10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4ODU3KQotICAgRml4IGR1cGxpY2F0ZSBuZXR3b3JrIGRpc2Nvbm5lY3QgZXZlbnRzLiBbbW9ieS9tb2J5IzQ4ODAwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg4MDApCi0gICBSZXNvbHZlIGlzc3VlcyByZWxhdGVkIHRvIGNoYW5naW5nIGBmaXhlZC1jaWRyYCBmb3IgYGRvY2tlcjBgLCBhbmQgaW5mZXJyaW5nIGNvbmZpZ3VyYXRpb24gZnJvbSBhIHVzZXItbWFuYWdlZCBkZWZhdWx0IGJyaWRnZSAoYC0tYnJpZGdlYCkuIFttb2J5L21vYnkjNDgzMTldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODMxOSkKLSAgIFJlbW92ZSBmZWF0dXJlIGZsYWcgYHdpbmRvd3MtZG5zLXByb3h5YCwgaW50cm9kdWNlZCBpbiByZWxlYXNlIDI2LjEuMCB0byBjb250cm9sIGZvcndhcmRpbmcgdG8gZXh0ZXJuYWwgRE5TIHJlc29sdmVycyBmcm9tIFdpbmRvd3MgY29udGFpbmVycywgdG8gbWFrZSBgbnNsb29rdXBgIHdvcmsuIEl0IHdhcyBlbmFibGVkIGJ5IGRlZmF1bHQgaW4gcmVsZWFzZSAyNy4wLjAuIFttb2J5L21vYnkjNDg3MzhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODczOCkKLSAgIFJlbW92ZSBhbiBgaXB0YWJsZXNgIG1hbmdsZSBydWxlIGZvciBjaGVja3N1bW1pbmcgU0NUUC4gVGhlIHJ1bGUgY2FuIGJlIHJlLWVuYWJsZWQgYnkgc2V0dGluZyBgRE9DS0VSX0lQVEFCTEVTX1NDVFBfQ0hFQ0tTVU09MWAgaW4gdGhlIGRhZW1vbidzIGVudmlyb25tZW50LiBUaGlzIG92ZXJyaWRlIHdpbGwgYmUgcmVtb3ZlZCBpbiBhIGZ1dHVyZSByZWxlYXNlLiBbbW9ieS9tb2J5IzQ4MTQ5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDgxNDkpCi0gICBGYXN0ZXIgY29ubmVjdGlvbiB0byBicmlkZ2UgbmV0d29ya3MsIGluIG1vc3QgY2FzZXMuIFttb2J5L21vYnkjNDkzMDJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTMwMikKCiMjIyMjIFBhY2thZ2luZyB1cGRhdGVzCgotICAgVXBkYXRlIEdvIHJ1bnRpbWUgdG8gWzEuMjMuNl0oaHR0cHM6Ly9nby5kZXYvZG9jL2RldmVsL3JlbGVhc2UjZ28xLjIzLjYpLiBbZG9ja2VyL2NsaSM1Nzk1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU3OTUpLCBbbW9ieS9tb2J5IzQ5MzkzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkzOTMpLCBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTE2MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTE2MSkKLSAgIFVwZGF0ZSBgcnVuY2AgdG8gW3YxLjIuNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL29wZW5jb250YWluZXJzL3J1bmMvcmVsZWFzZXMvdGFnL3YxLjIuNSkgKHN0YXRpYyBiaW5hcmllcyBvbmx5KS4gW21vYnkvbW9ieSM0OTQ2NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NDY0KQotICAgVXBkYXRlIGNvbnRhaW5lcmQgdG8gW3YxLjcuMjVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jb250YWluZXJkL2NvbnRhaW5lcmQvcmVsZWFzZXMvdGFnL3YxLjcuMjUpLiBbbW9ieS9tb2J5IzQ5MjUyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkyNTIpCi0gICBVcGRhdGUgQnVpbGRLaXQgdG8gW3YwLjIwLjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L2J1aWxka2l0L3JlbGVhc2VzL3RhZy92MC4yMC4wKS4gW21vYnkvbW9ieSM0OTQ5NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NDk1KQotICAgVXBkYXRlIEJ1aWxkeCB0byBbdjAuMjEuMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9idWlsZHgvcmVsZWFzZXMvdGFnL3YwLjIxLjApLiBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTE2Nl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTE2NikKLSAgIFVwZGF0ZSBDb21wb3NlIHRvIFt2Mi4zMi40XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NvbXBvc2UvcmVsZWFzZXMvdGFnL3YyLjMyLjMpLiBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTE0M10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTE0MykKLSAgIFRoZSBjYW5vbmljYWwgc291cmNlIGZvciB0aGUgYGRvY2tlcmQoOClgIG1hbiBwYWdlIGhhcyBiZWVuIG1vdmVkIGJhY2sgdG8gdGhlIGBtb2J5L21vYnlgIHJlcG9zaXRvcnkgaXRzZWxmLiBbbW9ieS9tb2J5IzQ4Mjk4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDgyOTgpCgojIyMjIyBHbyBTREsKCi0gICBJbXByb3ZlIHZhbGlkYXRpb24gb2YgZW1wdHkgb2JqZWN0IElEcy4gVGhlIGNsaWVudCBub3cgcmV0dXJucyBhbiAiSW52YWxpZCBQYXJhbWV0ZXIiIGVycm9yIHdoZW4gdHJ5aW5nIHRvIHVzZSBhbiBlbXB0eSBJRCBvciBuYW1lLiBUaGlzIGNoYW5nZXMgdGhlIGVycm9yIHJldHVybmVkIGJ5IHNvbWUgIkluc3BlY3QiIGZ1bmN0aW9ucyBmcm9tIGEgIk5vdCBmb3VuZCIgZXJyb3IgdG8gYW4gIkludmFsaWQgUGFyYW1ldGVyIi4gW21vYnkvbW9ieSM0OTM4MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5MzgxKQotICAgYENsaWVudC5JbWFnZUJ1aWxkKClgIG5vdyBvbWl0cyBkZWZhdWx0IHZhbHVlcyBmcm9tIHRoZSBBUEkgcmVxdWVzdCdzIHF1ZXJ5IHN0cmluZy4gW21vYnkvbW9ieSM0ODY1MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4NjUxKQotICAgYGFwaS90eXBlcy9jb250YWluZXJgOiBNZXJnZSBgU3RhdHNgIGFuZCBgU3RhdHNSZXNwb25zZWAgW21vYnkvbW9ieSM0OTI4N10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5Mjg3KQotICAgYGNsaWVudC5XaXRoVmVyc2lvbmA6IFN0cmlwIHYtcHJlZml4IHdoZW4gc2V0dGluZyBBUEkgdmVyc2lvbiBbbW9ieS9tb2J5IzQ5MzUyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkzNTIpCi0gICBgY2xpZW50YDogQWRkIGBXaXRoVHJhY2VPcHRpb25zYCBhbGxvd2luZyB0byBzcGVjaWZ5IGN1c3RvbSBPVGUxIHRyYWNlIG9wdGlvbnMuIFttb2J5L21vYnkjNDk0MTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTQxNSkKLSAgIGBjbGllbnRgOiBBZGQgYEhpamFja0RpYWxlcmAgaW50ZXJmYWNlLiBbbW9ieS9tb2J5IzQ5Mzg4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkzODgpCi0gICBgY2xpZW50YDogQWRkIGBTd2FybU1hbmFnZW1lbnRBUElDbGllbnRgIGludGVyZmFjZSB0byBkZXNjcmliZSBhbGwgQVBJIGNsaWVudCBtZXRob2RzIHJlbGF0ZWQgdG8gU3dhcm0tc3BlY2lmaWMgb2JqZWN0cy4gW21vYnkvbW9ieSM0OTM4OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5Mzg4KQotICAgYGNsaWVudGA6IEFkZCBgV2l0aFRyYWNlT3B0aW9uc2AgYWxsb3dpbmcgdG8gc3BlY2lmeSBjdXN0b20gT1RlbCB0cmFjZSBvcHRpb25zLiBbbW9ieS9tb2J5IzQ5NDE1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk0MTUpCi0gICBgY2xpZW50YDogYEltYWdlSGlzdG9yeWAsIGBJbWFnZUxvYWRgIGFuZCBgSW1hZ2VTYXZlYCBub3cgdXNlIHZhcmlhZGljIGZ1bmN0aW9uYWwgb3B0aW9ucyBbbW9ieS9tb2J5IzQ5NDY2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk0NjYpCi0gICBgcGtnL2NvbnRhaW5lcmZzYDogTW92ZSB0byBpbnRlcm5hbCBbbW9ieS9tb2J5IzQ4MDk3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDgwOTcpCi0gICBgcGtnL3JlZXhlY2A6IENhbiBub3cgYmUgdXNlZCBvbiBwbGF0Zm9ybXMgb3RoZXIgdGhhbiBMaW51eCwgV2luZG93cywgbWFjT1MgYW5kIEZyZWVCU0QgW21vYnkvbW9ieSM0OTExOF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5MTE4KQotICAgYGFwaS90eXBlcy9jb250YWluZXJgOiBpbnRyb2R1Y2UgYENvbW1pdFJlc3BvbnNlYCB0eXBlLiBUaGlzIGlzIGN1cnJlbnRseSBhbiBhbGlhcyBmb3IgYElEUmVzcG9uc2VgLCBidXQgbWF5IGJlY29tZSBhIGRpc3RpbmN0IHR5cGUgaW4gYSBmdXR1cmUgcmVsZWFzZS4gW21vYnkvbW9ieSM0OTQ0NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NDQ0KQotICAgYGFwaS90eXBlcy9jb250YWluZXJgOiBpbnRyb2R1Y2UgYEV4ZWNDcmVhdGVSZXNwb25zZWAgdHlwZS4gVGhpcyBpcyBjdXJyZW50bHkgYW4gYWxpYXMgZm9yIGBJRFJlc3BvbnNlYCwgYnV0IG1heSBiZWNvbWUgYSBkaXN0aW5jdCB0eXBlIGluIGEgZnV0dXJlIHJlbGVhc2UuIFttb2J5L21vYnkjNDk0NDRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTQ0NCkKCiMjIyMjIEFQSQoKLSAgIFVwZGF0ZSBBUEkgdmVyc2lvbiB0byBbdjEuNDhdKGh0dHBzOi8vZG9jcy5kb2NrZXIuY29tL2VuZ2luZS9hcGkvdjEuNDgvKSBbbW9ieS9tb2J5IzQ4NDc2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg0NzYpCi0gICBgR0VUIC9pbWFnZXMve25hbWV9L2pzb25gIHJlc3BvbnNlIG5vdyByZXR1cm5zIHRoZSBgTWFuaWZlc3RzYCBmaWVsZCBjb250YWluaW5nIGluZm9ybWF0aW9uIGFib3V0IHRoZSBzdWItbWFuaWZlc3RzIGNvbnRhaW5lZCBpbiB0aGUgaW1hZ2UgaW5kZXguIFRoaXMgaW5jbHVkZXMgdGhpbmdzIGxpa2UgcGxhdGZvcm0tc3BlY2lmaWMgbWFuaWZlc3RzIGFuZCBidWlsZCBhdHRlc3RhdGlvbnMuIFttb2J5L21vYnkjNDgyNjRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODI2NCkKLSAgIGBQT1NUIC9jb250YWluZXJzL2NyZWF0ZWAgbm93IHN1cHBvcnRzIGBNb3VudGAgb2YgdHlwZSBgaW1hZ2VgIGZvciBtb3VudGluZyBhbiBpbWFnZSBpbnNpZGUgYSBjb250YWluZXIuIFttb2J5L21vYnkjNDg3OThdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODc5OCkKLSAgIGBHRVQgL2ltYWdlcy97bmFtZX0vaGlzdG9yeWAgbm93IHN1cHBvcnRzIGEgYHBsYXRmb3JtYCBwYXJhbWV0ZXIgKEpTT04gZW5jb2RlZCBPQ0kgUGxhdGZvcm0gdHlwZSkgdGhhdCBsZXRzIHlvdSBzcGVjaWZ5IGEgcGxhdGZvcm0gdG8gc2hvdyB0aGUgaGlzdG9yeSBvZi4gW21vYnkvbW9ieSM0ODI5NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4Mjk1KQotICAgYFBPU1QgL2ltYWdlcy97bmFtZX0vbG9hZGAgYW5kIGBHRVQgL2ltYWdlcy97bmFtZX0vZ2V0YCBub3cgc3VwcG9ydHMgYSBgcGxhdGZvcm1gIHBhcmFtZXRlciAoSlNPTiBlbmNvZGVkIE9DSSBQbGF0Zm9ybSB0eXBlKSB0aGF0IGxldHMgeW91IHNwZWNpZnkgYSBwbGF0Zm9ybSB0byBsb2FkL3NhdmUuIE5vdCBwYXNzaW5nIHRoaXMgcGFyYW1ldGVyIHJlc3VsdHMgaW4gbG9hZGluZy9zYXZpbmcgdGhlIGZ1bGwgbXVsdGktcGxhdGZvcm0gaW1hZ2UuIFttb2J5L21vYnkjNDgyOTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODI5NSkKLSAgIEltcHJvdmUgZXJyb3JzIGZvciBpbnZhbGlkIHdpZHRoL2hlaWdodCBvbiBjb250YWluZXIgcmVzaXplIGFuZCBleGVjIHJlc2l6ZSBbbW9ieS9tb2J5IzQ4Njc5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg2NzkpCi0gICBUaGUgYFBPU1QgL2NvbnRhaW5lcnMvY3JlYXRlYCBlbmRwb2ludCBub3cgaW5jbHVkZXMgYSB3YXJuaW5nIGluIHRoZSByZXNwb25zZSB3aGVuIHNldHRpbmcgdGhlIGNvbnRhaW5lci13aWRlIGBWb2x1bWVEcml2ZXJgIG9wdGlvbiBpbiBjb21iaW5hdGlvbiB3aXRoIHZvbHVtZXMgZGVmaW5lZCB0aHJvdWdoIGBNb3VudHNgIGJlY2F1c2UgdGhlIGBWb2x1bWVEcml2ZXJgIG9wdGlvbiBoYXMgbm8gZWZmZWN0IG9uIHRob3NlIHZvbHVtZXMuIFRoaXMgd2FybmluZyB3YXMgcHJldmlvdXNseSBnZW5lcmF0ZWQgYnkgdGhlIENMSS4gW21vYnkvbW9ieSM0ODc4OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4Nzg5KQotICAgY29udGFpbmVyZCBpbWFnZSBzdG9yZTogYEdFVCAvaW1hZ2VzL2pzb25gIGFuZCBgR0VUIC9pbWFnZXMve25hbWV9L2pzb25gIHJlc3BvbnNlcyBub3cgaW5jbHVkZXMgYERlc2NyaXB0b3JgIGZpZWxkLCB3aGljaCBjb250YWlucyBhbiBPQ0kgZGVzY3JpcHRvciBvZiB0aGUgaW1hZ2UgdGFyZ2V0LiBUaGUgbmV3IGZpZWxkIGlzIG9ubHkgcG9wdWxhdGVkIGlmIHRoZSBkYWVtb24gcHJvdmlkZXMgYSBtdWx0aS1wbGF0Zm9ybSBpbWFnZSBzdG9yZS4gW21vYnkvbW9ieSM0ODg5NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4ODk0KQotICAgY29udGFpbmVyZCBpbWFnZSBzdG9yZTogYEdFVCAvY29udGFpbmVycy97bmFtZX0vanNvbmAgbm93IHJldHVybnMgYW4gYEltYWdlTWFuaWZlc3REZXNjcmlwdG9yYCBmaWVsZCBjb250YWluaW5nIHRoZSBPQ0kgZGVzY3JpcHRvciBvZiB0aGUgcGxhdGZvcm0tc3BlY2lmaWMgaW1hZ2UgbWFuaWZlc3Qgb2YgdGhlIGltYWdlIHRoYXQgd2FzIHVzZWQgdG8gY3JlYXRlIHRoZSBjb250YWluZXIuIFttb2J5L21vYnkjNDg4NTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODg1NSkKLSAgIEFkZCBkZWJ1ZyBlbmRwb2ludHMgKGBHRVQgL2RlYnVnL3ZhcnNgLCBgR0VUIC9kZWJ1Zy9wcHJvZi9gLCBgR0VUIC9kZWJ1Zy9wcHJvZi9jbWRsaW5lYCwgYEdFVCAvZGVidWcvcHByb2YvcHJvZmlsZWAsIGBHRVQgL2RlYnVnL3Bwcm9mL3N5bWJvbGAsIGBHRVQgL2RlYnVnL3Bwcm9mL3RyYWNlYCwgYEdFVCAvZGVidWcvcHByb2Yve25hbWV9YCkgYXJlIG5vdyBhbHNvIGFjY2Vzc2libGUgdGhyb3VnaCB0aGUgdmVyc2lvbmVkLUFQSSBwYXRocyAoYC92PEFQSS12ZXJzaW9uPi88ZW5kcG9pbnQ+YCkuIFttb2J5L21vYnkjNDkwNTFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTA1MSkKLSAgIEZpeCBBUEkgcmV0dXJuaW5nIGEgYDUwMGAgc3RhdHVzIGNvZGUgaW5zdGVhZCBvZiBgNDAwYCBmb3IgdmFsaWRhdGlvbiBlcnJvcnMuIFttb2J5L21vYnkjNDkyMTddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTIxNykKLSAgIEZpeCBzdGF0dXMgY29kZXMgZm9yIGFyY2hpdmUgZW5kcG9pbnRzIGBIRUFEIC9jb250YWluZXJzL3tuYW1lOi4qfS9hcmNoaXZlYCwgYEdFVCAvY29udGFpbmVycy97bmFtZTouKn0vYXJjaGl2ZWAsIGBQVVQgL2NvbnRhaW5lcnMve25hbWU6Lip9L2FyY2hpdmVgIHJldHVybmluZyBhIGA1MDBgIHN0YXR1cyBpbnN0ZWFkIG9mIGEgYDQwMGAgc3RhdHVzLiBbbW9ieS9tb2J5IzQ5MjE5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkyMTkpCi0gICBgUE9TVCAvY29udGFpbmVycy9jcmVhdGVgIG5vdyBhY2NlcHRzIGEgYHdyaXRhYmxlLWNncm91cHM9dHJ1ZWAgb3B0aW9uIGluIGBIb3N0Q29uZmlnLlNlY3VyaXR5T3B0YCB0byBtb3VudCB0aGUgY29udGFpbmVyJ3MgY2dyb3VwcyB3cml0YWJsZS4gVGhpcyBwcm92aWRlcyBhIG1vcmUgZ3JhbnVsYXIgYXBwcm9hY2ggdGhhbiBgSG9zdENvbmZpZy5Qcml2aWxlZ2VkYC4gW21vYnkvbW9ieSM0ODgyOF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4ODI4KQotICAgYFBPU1QgL2J1aWxkL3BydW5lYCByZW5hbWVzIGBrZWVwLWJ5dGVzYCB0byBgcmVzZXJ2ZWQtc3BhY2VgIGFuZCBub3cgc3VwcG9ydHMgYWRkaXRpb25hbCBwcnVuZSBwYXJhbWV0ZXJzIGBtYXgtdXNlZC1zcGFjZWAgYW5kIGBtaW4tZnJlZS1zcGFjZWAuIFttb2J5L21vYnkjNDg3MjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODcyMCkKLSAgIGBQT1NUIC9uZXR3b3Jrcy9jcmVhdGVgIG5vdyBoYXMgYW4gYEVuYWJsZUlQdjRgIGZpZWxkLiBTZXR0aW5nIGl0IHRvIGBmYWxzZWAgZGlzYWJsZXMgSVB2NCBJUEFNIGZvciB0aGUgbmV0d29yay4gW21vYnkvbW9ieSM0ODI3MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4MjcxKQogICAgLSAgIGBHRVQgL25ldHdvcmtzL3tpZH1gIG5vdyByZXR1cm5zIGFuIGBFbmFibGVJUHY0YCBmaWVsZCBzaG93aW5nIHdoZXRoZXIgdGhlIG5ldHdvcmsgaGFzIElQdjQgSVBBTSBlbmFibGVkLiBbbW9ieS9tb2J5IzQ4MjcxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDgyNzEpCiAgICAtICAgVXNlci1kZWZpbmVkIGJyaWRnZSBuZXR3b3JrcyByZXF1aXJlIGVpdGhlciBJUHY0IG9yIElQdjYgYWRkcmVzcyBhc3NpZ25tZW50IHRvIGJlIGVuYWJsZWQuIElQdjQgY2Fubm90IGJlIGRpc2FibGVkIGZvciB0aGUgZGVmYXVsdCBicmlkZ2UgbmV0d29yayAoYGRvY2tlcjBgKS4gW21vYnkvbW9ieSM0ODMyM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4MzIzKQogICAgLSAgIGBtYWN2bGFuYCBhbmQgYGlwdmxhbmAgbmV0d29ya3MgY2FuIGJlIGNyZWF0ZWQgd2l0aCBhZGRyZXNzIGFzc2lnbm1lbnQgZGlzYWJsZWQgZm9yIElQdjQsIElQdjYsIG9yIGJvdGggYWRkcmVzcyBmYW1pbGllcy4gW21vYnkvbW9ieSM0ODI5OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4Mjk5KQogICAgLSAgIElQdjQgY2Fubm90IGJlIGRpc2FibGVkIGZvciBXaW5kb3dzIG9yIFN3YXJtIG5ldHdvcmtzLiBbbW9ieS9tb2J5IzQ4Mjc4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDgyNzgpCi0gICBBZGQgYSB3YXkgdG8gc3BlY2lmeSB3aGljaCBuZXR3b3JrIHNob3VsZCBwcm92aWRlIHRoZSBkZWZhdWx0IGdhdGV3YXkgZm9yIGEgY29udGFpbmVyLiBbbW9ieS9tb2J5IzQ4OTM2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg5MzYpCiAgICAtICAgYFBPU1QgL25ldHdvcmtzL3tpZH0vY29ubmVjdGAgYW5kIGBQT1NUIC9jb250YWluZXJzL2NyZWF0ZWAgbm93IGFjY2VwdCBhIGBHd1ByaW9yaXR5YCBmaWVsZCBpbiBgRW5kcG9pbnRzQ29uZmlnYC4gVGhpcyB2YWx1ZSBpcyB1c2VkIHRvIGRldGVybWluZSB3aGljaCBuZXR3b3JrIGVuZHBvaW50IHByb3ZpZGVzIHRoZSBkZWZhdWx0IGdhdGV3YXkgZm9yIHRoZSBjb250YWluZXIuIFRoZSBlbmRwb2ludCB3aXRoIHRoZSBoaWdoZXN0IHByaW9yaXR5IGlzIHNlbGVjdGVkLiBJZiBtdWx0aXBsZSBlbmRwb2ludHMgaGF2ZSB0aGUgc2FtZSBwcmlvcml0eSwgZW5kcG9pbnRzIGFyZSBzb3J0ZWQgbGV4aWNvZ3JhcGhpY2FsbHkgYnkgdGhlaXIgbmV0d29yayBuYW1lLCBhbmQgdGhlIG9uZSB0aGF0IHNvcnRzIGZpcnN0IGlzIHBpY2tlZC4gW21vYnkvbW9ieSM0ODc0Nl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4NzQ2KQogICAgLSAgIGBHRVQgL2NvbnRhaW5lcnMvanNvbmAgbm93IHJldHVybnMgYSBgR3dQcmlvcml0eWAgZmllbGQgaW4gYE5ldHdvcmtTZXR0aW5nc2AgZm9yIGVhY2ggbmV0d29yayBlbmRwb2ludC4gVGhlIGBHd1ByaW9yaXR5YCBmaWVsZCBpcyB1c2VkIGJ5IHRoZSBDTEnigJlzIG5ldyBgZ3ctcHJpb3JpdHlgIG9wdGlvbiBmb3IgYGRvY2tlciBydW5gIGFuZCBgZG9ja2VyIG5ldHdvcmsgY29ubmVjdGAuIFttb2J5L21vYnkjNDg3NDZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODc0NikKLSAgIFNldHRpbmdzIGZvciBgZXRoMGAgaW4gYC0tc3lzY3RsYCBvcHRpb25zIGFyZSBubyBsb25nZXIgYXV0b21hdGljYWxseSBtaWdyYXRlZCB0byB0aGUgbmV0d29yayBlbmRwb2ludC4gW21vYnkvbW9ieSM0ODc0Nl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4NzQ2KQogICAgLSAgIEZvciBleGFtcGxlLCBpbiB0aGUgRG9ja2VyIENMSSwgYGRvY2tlciBydW4gLS1uZXR3b3JrIG15bmV0IC0tc3lzY3RsIG5ldC5pcHY0LmNvbmYuZXRoMC5sb2dfbWFydGlhbnM9MSAuLi5gIGlzIHJlamVjdGVkLiBJbnN0ZWFkLCB5b3UgbXVzdCB1c2UgYGRvY2tlciBydW4gLS1uZXR3b3JrIG5hbWU9bXluZXQsZHJpdmVyLW9wdD1jb20uZG9ja2VyLm5ldHdvcmsuZW5kcG9pbnQuc3lzY3Rscz1uZXQuaXB2NC5jb25mLklGTkFNRS5sb2dfbWFydGlhbnM9MSAuLi5gCi0gICBgR0VUIC9jb250YWluZXJzL2pzb25gIG5vdyByZXR1cm5zIGFuIGBJbWFnZU1hbmlmZXN0RGVzY3JpcHRvcmAgZmllbGQgbWF0Y2hpbmcgdGhlIHNhbWUgZmllbGQgaW4gYC9jb250YWluZXJzL3tuYW1lfS9qc29uYC4gVGhpcyBmaWVsZCBpcyBvbmx5IHBvcHVsYXRlZCBpZiB0aGUgZGFlbW9uIHByb3ZpZGVzIGEgbXVsdGktcGxhdGZvcm0gaW1hZ2Ugc3RvcmUuIFttb2J5L21vYnkjNDk0MDddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTQwNykKCiMjIyMjIFJlbW92ZWQKCi0gICBUaGUgRmx1ZW50IGxvZ2dlciBvcHRpb24gYGZsdWVudGQtYXN5bmMtY29ubmVjdGAgaGFzIGJlZW4gZGVwcmVjYXRlZCBpbiB2MjAuMTAgYW5kIGlzIG5vdyByZW1vdmVkLiBbbW9ieS9tb2J5IzQ2MTE0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDYxMTQpCi0gICBUaGUgYC0tdGltZWAgb3B0aW9uIG9uIGBkb2NrZXIgc3RvcGAgYW5kIGBkb2NrZXIgcmVzdGFydGAgaXMgZGVwcmVjYXRlZCBhbmQgcmVuYW1lZCB0byBgLS10aW1lb3V0YC4gW2RvY2tlci9jbGkjNTQ4NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81NDg1KQotICAgR28tU0RLOiBgcGtnL2lvdXRpbHNgOiBSZW1vdmUgYE5ld1JlYWRlckVycldyYXBwZXJgIGFzIGl0IHdhcyBuZXZlciB1c2VkLiBbbW9ieS9tb2J5IzQ5MjU4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkyNTgpCi0gICBHby1TREs6IGBwa2cvaW91dGlsc2A6IFJlbW92ZSBkZXByZWNhdGVkIGBCeXRlc1BpcGVgLCBgTmV3Qnl0ZXNQaXBlYCwgYEVyckNsb3NlZGAsIGBXcml0ZUNvdW50ZXJgLCBgTmV3V3JpdGVDb3VudGVyYCwgYE5ld1JlYWRlckVycldyYXBwZXJgLCBgTm9wRmx1c2hlcmAuIFttb2J5L21vYnkjNDkyNDVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTI0NSkKLSAgIEdvLVNESzogYHBrZy9pb3V0aWxzYDogUmVtb3ZlIGRlcHJlY2F0ZWQgYE5vcFdyaXRlcmAgYW5kIGBOb3BXcml0ZUNsb3NlcmAuIFttb2J5L21vYnkjNDkyNTZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTI1NikKLSAgIEdvLVNESzogYHBrZy9zeXNpbmZvYDogUmVtb3ZlIGRlcHJlY2F0ZWQgTnVtQ1BVLiBbbW9ieS9tb2J5IzQ5MjQyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkyNDIpCi0gICBHby1TREs6IFJlbW92ZSBgcGtnL2Jyb2FkY2FzdGVyYCwgYXMgaXQgd2FzIG9ubHkgdXNlZCBpbnRlcm5hbGx5IFttb2J5L21vYnkjNDkxNzJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTE3MikKLSAgIEdvLVNESzogUmVtb3ZlIGRlcHJlY2F0ZWQgYGNsaS5FcnJvcnNgIHR5cGUgW2RvY2tlci9jbGkjNTU0OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81NTQ5KQotICAgUmVtb3ZlIGBwa2cvaW91dGlscy5SZWFkQ2xvc2VyV3JhcHBlcmAsIGFzIGl0IHdhcyBvbmx5IHVzZWQgaW4gdGVzdHMuIFttb2J5L21vYnkjNDkyMzddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTIzNykKLSAgIFJlbW92ZSBkZXByZWNhdGVkIGBhcGktY29ycy1oZWFkZXJgIGNvbmZpZyBwYXJhbWV0ZXIgYW5kIHRoZSBgZG9ja2VyZGAgYC0tYXBpLWNvcnMtaGVhZGVyYCBvcHRpb24gW21vYnkvbW9ieSM0ODIwOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4MjA5KQotICAgUmVtb3ZlIGRlcHJlY2F0ZWQgYEFQSUVuZHBvaW50LlZlcnNpb25gIGZpZWxkLCBgQVBJVmVyc2lvbmAgdHlwZSwgYW5kIGBBUElWZXJzaW9uMWAgYW5kIGBBUElWZXJzaW9uMmAgY29uc3RzLiBbbW9ieS9tb2J5IzQ5MDA0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkwMDQpCi0gICBSZW1vdmUgZGVwcmVjYXRlZCBgYXBpLWNvcnMtaGVhZGVyYCBjb25maWcgcGFyYW1ldGVyIGFuZCB0aGUgRG9ja2VyIGRhZW1vbidzIGAtLWFwaS1jb3JzLWhlYWRlcmAgb3B0aW9uLiBbZG9ja2VyL2NsaSM1NDM3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU0MzcpCi0gICBSZW1vdmUgZGVwcmVjYXRlZCBgcGtnL2RpcmVjdG9yeWAgcGFja2FnZSBbbW9ieS9tb2J5IzQ4Nzc5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg3NzkpCi0gICBSZW1vdmUgZGVwcmVjYXRlZCBgcGtnL2Rtc2cuRG1lc2coKWAgW21vYnkvbW9ieSM0ODEwOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4MTA5KQotICAgUmVtb3ZlIGRlcHJlY2F0ZWQgaW1hZ2Uvc3BlYyBwYWNrYWdlLCB3aGljaCB3YXMgbW92ZWQgdG8gYSBzZXBhcmF0ZSBtb2R1bGUgKGBnaXRodWIuY29tL21vYnkvZG9ja2VyLWltYWdlLXNwZWNgKSBbbW9ieS9tb2J5IzQ4NDYwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg0NjApCi0gICBSZW1vdmUgbWlncmF0aW9uIGNvZGUgYW5kIGVycm9ycyBmb3IgdGhlIGRlcHJlY2F0ZWQgYGxvZ2VudHJpZXNgIGxvZ2dpbmcgZHJpdmVyLiBbbW9ieS9tb2J5IzQ4ODkxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg4OTEpCi0gICBSZW1vdmUgc3VwcG9ydCBmb3IgZGVwcmVjYXRlZCBleHRlcm5hbCBncmFwaC1kcml2ZXIgcGx1Z2lucy4gW21vYnkvbW9ieSM0ODA3Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4MDcyKQotICAgYGFwaS90eXBlc2A6IFJlbW92ZSBkZXByZWNhdGVkIGBjb250YWluZXIuQ29udGFpbmVyTm9kZWAgYW5kIGBDb250YWluZXJKU09OQmFzZS5Ob2RlYCBmaWVsZC4gW21vYnkvbW9ieSM0ODEwN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4MTA3KQotICAgYGFwaS90eXBlc2A6IFJlbW92ZSBkZXByZWNhdGVkIGFsaWFzZXM6IGBJbWFnZXNQcnVuZVJlcG9ydGAsIGBWb2x1bWVzUHJ1bmVSZXBvcnRgLCBgTmV0d29ya0NyZWF0ZVJlcXVlc3RgLCBgTmV0d29ya0NyZWF0ZWAsIGBOZXR3b3JrTGlzdE9wdGlvbnNgLCBgTmV0d29ya0NyZWF0ZVJlc3BvbnNlYCwgYE5ldHdvcmtJbnNwZWN0T3B0aW9uc2AsIGBOZXR3b3JrQ29ubmVjdGAsIGBOZXR3b3JrRGlzY29ubmVjdGAsIGBFbmRwb2ludFJlc291cmNlYCwgYE5ldHdvcmtSZXNvdXJjZWAsIGBOZXR3b3Jrc1BydW5lUmVwb3J0YCwgYEV4ZWNDb25maWdgLCBgRXhlY1N0YXJ0Q2hlY2tgLCBgQ29udGFpbmVyRXhlY0luc3BlY3RgLCBgQ29udGFpbmVyc1BydW5lUmVwb3J0YCwgYENvbnRhaW5lclBhdGhTdGF0YCwgYENvcHlUb0NvbnRhaW5lck9wdGlvbnNgLCBgQ29udGFpbmVyU3RhdHNgLCBgSW1hZ2VTZWFyY2hPcHRpb25zYCwgYEltYWdlSW1wb3J0U291cmNlYCwgYEltYWdlTG9hZFJlc3BvbnNlYCwgYENvbnRhaW5lck5vZGVgLiBbbW9ieS9tb2J5IzQ4MTA3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDgxMDcpCi0gICBgbGlibmV0d29yay9pcHRhYmxlc2A6IFJlbW92ZSBkZXByZWNhdGVkIGBJUFZgLCBgSXB0YWJsZXNgLCBgSVA2VGFibGVzYCBhbmQgYFBhc3N0aHJvdWdoKClgLiBbbW9ieS9tb2J5IzQ5MTIxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkxMjEpCi0gICBgcGtnL2FyY2hpdmVgOiBSZW1vdmUgZGVwcmVjYXRlZCBgQ2Fub25pY2FsVGFyTmFtZUZvclBhdGhgLCBgTmV3VGVtcEFyY2hpdmVgLCBgVGVtcEFyY2hpdmVgIFttb2J5L21vYnkjNDg3MDhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODcwOCkKLSAgIGBwa2cvZmlsZXV0aWxzYDogUmVtb3ZlIGRlcHJlY2F0ZWQgYEdldFRvdGFsVXNlZEZkc2AgW21vYnkvbW9ieSM0OTIxMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5MjEwKQotICAgYHBrZy9pb3V0aWxzYDogUmVtb3ZlIGBPbkVPRlJlYWRlcmAsIHdoaWNoIHdhcyBvbmx5IHVzZWQgaW50ZXJuYWxseSBbbW9ieS9tb2J5IzQ5MTcwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkxNzApCi0gICBgcGtnL2xvbmdwYXRoYDogUmVtb3ZlIGRlcHJlY2F0ZWQgYFByZWZpeGAgY29uc3RhbnQuIFttb2J5L21vYnkjNDg3NzldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODc3OSkKLSAgIGBwa2cvc3RyaW5naWRgOiBSZW1vdmUgZGVwcmVjYXRlZCBgSXNTaG9ydElEYCBhbmQgIGBWYWxpZGF0ZUlEYCBmdW5jdGlvbnMgW21vYnkvbW9ieSM0ODcwNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4NzA1KQotICAgYHJ1bmNvbmZpZy9vcHRzYDogUmVtb3ZlIGRlcHJlY2F0ZWQgYENvbnZlcnRLVlN0cmluZ3NUb01hcGAgW21vYnkvbW9ieSM0ODEwMl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4MTAyKQotICAgYHJ1bmNvbmZpZ2A6IFJlbW92ZSBkZXByZWNhdGVkIGBDb250YWluZXJDb25maWdXcmFwcGVyYCwgYFNldERlZmF1bHROZXRNb2RlSWZCbGFua2AsIGBEZWZhdWx0RGFlbW9uTmV0d29ya01vZGVgLCBgSXNQcmVEZWZpbmVkTmV0d29ya2AgW21vYnkvbW9ieSM0ODEwMl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4MTAyKQotICAgYGNvbnRhaW5lcmA6IFJlbW92ZSBkZXByZWNhdGVkIGBFcnJOYW1lUmVzZXJ2ZWRgLCBgRXJyTmFtZU5vdAoKPC9kZXRhaWxzPgoKLS0tCgojIyMgQ29uZmlndXJhdGlvbgoK8J+ThSAqKlNjaGVkdWxlKio6IEJyYW5jaCBjcmVhdGlvbiAtIEF0IGFueSB0aW1lIChubyBzY2hlZHVsZSBkZWZpbmVkKSwgQXV0b21lcmdlIC0gQXQgYW55IHRpbWUgKG5vIHNjaGVkdWxlIGRlZmluZWQpLgoK8J+apiAqKkF1dG9tZXJnZSoqOiBEaXNhYmxlZCBieSBjb25maWcuIFBsZWFzZSBtZXJnZSB0aGlzIG1hbnVhbGx5IG9uY2UgeW91IGFyZSBzYXRpc2ZpZWQuCgrimbsgKipSZWJhc2luZyoqOiBXaGVuZXZlciBQUiBiZWNvbWVzIGNvbmZsaWN0ZWQsIG9yIHlvdSB0aWNrIHRoZSByZWJhc2UvcmV0cnkgY2hlY2tib3guCgrwn5SVICoqSWdub3JlKio6IENsb3NlIHRoaXMgUFIgYW5kIHlvdSB3b24ndCBiZSByZW1pbmRlZCBhYm91dCB0aGVzZSB1cGRhdGVzIGFnYWluLgoKLS0tCgogLSBbIF0gPCEtLSByZWJhc2UtY2hlY2sgLS0+SWYgeW91IHdhbnQgdG8gcmViYXNlL3JldHJ5IHRoaXMgUFIsIGNoZWNrIHRoaXMgYm94CgotLS0KClRoaXMgUFIgd2FzIGdlbmVyYXRlZCBieSBbTWVuZCBSZW5vdmF0ZV0oaHR0cHM6Ly9tZW5kLmlvL3Jlbm92YXRlLykuIFZpZXcgdGhlIFtyZXBvc2l0b3J5IGpvYiBsb2ddKGh0dHBzOi8vZGV2ZWxvcGVyLm1lbmQuaW8vZ2l0aHViL29zaXNtL3JlbGVhc2UpLgo8IS0tcmVub3ZhdGUtZGVidWc6ZXlKamNtVmhkR1ZrU1c1V1pYSWlPaUl6T1M0eE56TXVNU0lzSW5Wd1pHRjBaV1JKYmxabGNpSTZJak01TGpJMU55NHpJaXdpZEdGeVoyVjBRbkpoYm1Ob0lqb2liV0ZwYmlJc0lteGhZbVZzY3lJNld5SnlaVzV2ZG1GMFpTSmRmUT09LS0+Cg==
      patchset: 65478946b4201083b6ac113f5d0766422a4bd5b9
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: caa0df55ed55158f32903d317317ac95db4da6ce
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 397240f42127868e42e86e6aeb120c2cb092d117
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: bf7b7dc34a5e494fa043dc2f23e4626bf96f5aac
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: caa0df55ed55158f32903d317317ac95db4da6ce
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 397240f42127868e42e86e6aeb120c2cb092d117
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/python-black/run.yml
          roles:
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_0/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_0/zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/release
        name: osism/release
        short_name: release
        src_dir: src/github.com/osism/release
      projects:
        github.com/osism/release:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          checkout: main
          checkout_description: zuul branch
          commit: 43317c3a088eecbcf6c3db283c66f0e5e3407c0c
          name: osism/release
          required: false
          short_name: release
          src_dir: src/github.com/osism/release
      ref: refs/pull/1807/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
