all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe78:e276
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: b765de02-9ba6-4b00-b27b-8bc526bdd846
        host_id: 7f2607eceb24f4583c6f9496c53c64b51afe50de5eacda4379b21c42
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe78:e276
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.0.102
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.12
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe78:e276
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job ansible-lint explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#7>'
      - '<Job ansible-lint explicit: None implied: None source: osism/ci-image/.zuul.yaml@main#57>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: fcc33139265148e499b918c0cb53e293
      build_refs:
      - branch: main
        change: '57'
        change_message: "chore(deps): update dependency moby/moby to v28\n\nThis PR
          contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
          [moby/moby](https://redirect.github.com/moby/moby) | major | `27.5.1` ->
          `28.3.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>moby/moby
          (moby/moby)</summary>\n\n### [`v28.3.0`](https://redirect.github.com/moby/moby/releases/tag/v28.3.0):
          28.3.0\n\n[Compare Source](https://redirect.github.com/moby/moby/compare/v28.2.2...v28.3.0)\n\n####
          28.3.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.3.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.3.0)\n-
          [moby/moby, 28.3.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.3.0)\n-
          Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.3.0/docs/deprecated.md).\n-
          Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.3.0/docs/api/version-history.md).\n\n#####
          New\n\n- Add support for AMD GPUs in `docker run --gpus`. [moby/moby#49952](https://redirect.github.com/moby/moby/pull/49952)\n-
          Use `DOCKER_AUTH_CONFIG` as a credential store. [docker/cli#6008](https://redirect.github.com/docker/cli/pull/6008)\n\n#####
          Bug fixes and enhancements\n\n- Ensure that the state of the container in
          the daemon database (used by [/containers/json](https://docs.docker.com/reference/api/engine/version/v1.49/#tag/Container/operation/ContainerList)
          API) is up to date when the container is stopped using the [/containers/{id}/stop](https://docs.docker.com/reference/api/engine/version/v1.49/#tag/Container/operation/ContainerStop)
          API (before response of API). [moby/moby#50136](https://redirect.github.com/moby/moby/pull/50136)\n-
          Fix `docker image inspect inspect` omitting empty fields. [moby/moby#50135](https://redirect.github.com/moby/moby/pull/50135)\n-
          Fix `docker images --tree` not marking images as in-use when the containerd
          image store is disabled. [docker/cli#6140](https://redirect.github.com/docker/cli/pull/6140)\n-
          Fix `docker pull/push` hang in non-interactive when authentication is required
          caused by prompting for login credentials. [docker/cli#6141](https://redirect.github.com/docker/cli/pull/6141)\n-
          Fix a potential resource leak when a node leaves a Swarm. [moby/moby#50115](https://redirect.github.com/moby/moby/pull/50115)\n-
          Fix a regression where a login prompt on `docker pull` would show Docker
          Hub-specific hints when logging in on other registries. [docker/cli#6135](https://redirect.github.com/docker/cli/pull/6135)\n-
          Fix an issue where all new tasks in the Swarm could get stuck in the PENDING
          state forever after scaling up a service with placement preferences. [moby/moby#50211](https://redirect.github.com/moby/moby/pull/50211)\n-
          Remove an undocumented, hidden, top-level `docker remove` command that was
          accidentally introduced in Docker 23.0. [docker/cli#6144](https://redirect.github.com/docker/cli/pull/6144)\n-
          Validate registry-mirrors configuration as part of `dockerd --validate`
          and improve error messages for invalid mirrors. [moby/moby#50240](https://redirect.github.com/moby/moby/pull/50240)\n-
          `dockerd-rootless-setuptool.sh`: Fix the script from silently returning
          with no error message when subuid/subgid system requirements are not satisfied.
          [moby/moby#50059](https://redirect.github.com/moby/moby/pull/50059)\n- containerd
          image store: Fix `docker push` not creating a tag on the remote repository.
          [moby/moby#50199](https://redirect.github.com/moby/moby/pull/50199)\n- containerd
          image store: Improve handling of errors returned by the token server during
          `docker pull/push`. [moby/moby#50176](https://redirect.github.com/moby/moby/pull/50176)\n\n#####
          Packaging updates\n\n- Allow customizing containerd service name for OpenRC.
          [moby/moby#50156](https://redirect.github.com/moby/moby/pull/50156)\n- Update
          BuildKit to [v0.23.1](https://redirect.github.com/moby/buildkit/releases/tag/v0.23.1).
          [moby/moby#50243](https://redirect.github.com/moby/moby/pull/50243)\n- Update
          Buildx to [v0.25.0](https://redirect.github.com/docker/buildx/releases/tag/v0.25.0).
          [docker/docker-ce-packaging#1217](https://redirect.github.com/docker/docker-ce-packaging/pull/1217)\n-
          Update Compose to [v2.37.2](https://redirect.github.com/docker/compose/releases/tag/v2.37.2).
          [docker/docker-ce-packaging#1219](https://redirect.github.com/docker/docker-ce-packaging/pull/1219)\n-
          Update Docker Model CLI plugin to [v0.1.30](https://redirect.github.com/docker/model-cli/releases/tag/v0.1.30).
          [docker/docker-ce-packaging#1218](https://redirect.github.com/docker/docker-ce-packaging/pull/1218)\n-
          Update Go runtime to [1.24.4](https://go.dev/doc/devel/release#go1.24.4).
          [docker/docker-ce-packaging#1213](https://redirect.github.com/docker/docker-ce-packaging/pull/1213),
          [moby/moby#50153](https://redirect.github.com/moby/moby/pull/50153), [docker/cli#6124](https://redirect.github.com/docker/cli/pull/6124)\n\n#####
          Networking\n\n- Revert Swarm related changes added in 28.2.x builds, due
          to a regression reported in [https://github.com/moby/moby/issues/50129](https://redirect.github.com/moby/moby/issues/50129).
          [moby/moby#50169](https://redirect.github.com/moby/moby/pull/50169)\n  -
          Revert: Fix an issue where `docker network inspect --verbose` could sometimes
          crash the daemon ([https://github.com/moby/moby/pull/49937](https://redirect.github.com/moby/moby/pull/49937)).\n
          \ - Revert: Fix an issue where the load-balancer IP address for an overlay
          network would not be released in certain cases if the Swarm was lacking
          an ingress network ([https://github.com/moby/moby/pull/49948](https://redirect.github.com/moby/moby/pull/49948)).\n
          \ - Revert: Improve the reliability of NetworkDB in busy clusters and lossy
          networks ([https://github.com/moby/moby/pull/49932](https://redirect.github.com/moby/moby/pull/49932)).\n
          \ - Revert: Improvements to the reliability and convergence speed of NetworkDB
          ([https://github.com/moby/moby/pull/49939](https://redirect.github.com/moby/moby/pull/49939)).\n-
          Fix an issue that could cause container startup to fail, or lead to failed
          UDP port mappings, when some container ports are mapped to `0.0.0.0` and
          others are mapped to specific host addresses. [moby/moby#50054](https://redirect.github.com/moby/moby/pull/50054)\n-
          The `network inspect` response for an overlay network now reports that `EnableIPv4`
          is true. [moby/moby#50147](https://redirect.github.com/moby/moby/pull/50147)\n-
          Windows: Improve daemon startup time in cases where the host has networks
          of type `\"Mirrored\"`. [moby/moby#50155](https://redirect.github.com/moby/moby/pull/50155)\n-
          Windows: Make sure `docker system prune` and `docker network prune` only
          remove networks created by Docker. [moby/moby#50154](https://redirect.github.com/moby/moby/pull/50154)\n\n#####
          API\n\n- Update API version to 1.51. [moby/moby#50145](https://redirect.github.com/moby/moby/pull/50145)\n-
          `GET /images/json` now sets the value of the `Containers` field for all
          images to the count of containers using the image. [moby/moby#50146](https://redirect.github.com/moby/moby/pull/50146)\n\n#####
          Deprecations\n\n- Empty/nil image config fields in the `GET /images/{name}/json`
          response are now deprecated and will be removed in v29.0. [docker/cli#6129](https://redirect.github.com/docker/cli/pull/6129)\n-
          api/types/container: deprecate `ExecOptions.Detach`. This field is not used,
          and will be removed in a future release. [moby/moby#50219](https://redirect.github.com/moby/moby/pull/50219)\n-
          pkg/idtools: deprecate `IdentityMapping` and `Identity.Chown`. [moby/moby#50210](https://redirect.github.com/moby/moby/pull/50210)\n\n###
          [`v28.2.2`](https://redirect.github.com/moby/moby/releases/tag/v28.2.2):
          28.2.2\n\n[Compare Source](https://redirect.github.com/moby/moby/compare/v28.2.1...v28.2.2)\n\n####
          28.2.2\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.2.2 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.2.2)\n-
          [moby/moby, 28.2.2 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.2.2)\n\n#####
          Bug fixes and enhancements\n\n- containerd image store: Fix a regression
          causing `docker build --push` to fail. This reverts [the fix](https://redirect.github.com/moby/moby/pull/49702)
          for `docker build` not persisting overridden images as dangling. [moby/moby#50105](https://redirect.github.com/moby/moby/pull/50105)\n\n#####
          Networking\n\n- When creating the iptables `DOCKER-USER` chain, do not add
          an explicit `RETURN` rule, allowing users to append as well as insert their
          own rules. Existing rules are not removed on upgrade, but it won't be replaced
          after a reboot. [moby/moby#50098](https://redirect.github.com/moby/moby/pull/50098)\n\n###
          [`v28.2.1`](https://redirect.github.com/moby/moby/releases/tag/v28.2.1):
          28.2.1\n\n[Compare Source](https://redirect.github.com/moby/moby/compare/v28.2.0...v28.2.1)\n\n####
          28.2.1\n\n#### Packaging updates\n\n- Fix packaging regression in [v28.2.0](https://redirect.github.com/moby/moby/releases/tag/v28.2.0)
          which broke creating the `docker` group/user on fresh installations. [docker-ce-packaging#1209](https://redirect.github.com/docker/docker-ce-packaging/issues/1209)\n\n###
          [`v28.2.0`](https://redirect.github.com/moby/moby/releases/tag/v28.2.0):
          28.2.0\n\n[Compare Source](https://redirect.github.com/moby/moby/compare/v28.1.1...v28.2.0)\n\n####
          28.2.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.2.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.2.0)\n-
          [moby/moby, 28.2.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.2.0)\n-
          Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.2.0/docs/deprecated.md).\n-
          Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.2.0/docs/api/version-history.md).\n\n>
          \\[!NOTE]\n> RHEL packages are currently not available and will be released
          later.\n\n##### New\n\n- Add `{{.Platform}}` as formatting option for `docker
          ps` to show the platform of the image the container is running. [docker/cli#6042](https://redirect.github.com/docker/cli/pull/6042)\n-
          Add support for relative parent paths (`../`) on bind mount sources when
          using `docker run/create` with `-v/--volume` or `--mount type=bind` options.
          [docker/cli#4966](https://redirect.github.com/docker/cli/pull/4966)\n- CDI
          is now enabled by default. [moby/moby#49963](https://redirect.github.com/moby/moby/pull/49963)\n-
          Show discovered CDI devices in `docker info`. [docker/cli#6078](https://redirect.github.com/docker/cli/pull/6078)\n-
          `docker image rm`: add `--platform` option to remove a variant from multi-platform
          images. [docker/cli#6109](https://redirect.github.com/docker/cli/pull/6109)\n-
          containerd image store: Initial BuildKit support for building Windows container
          images on Windows (requires an opt-in with `DOCKER_BUILDKIT=1`). [moby/moby#49740](https://redirect.github.com/moby/moby/pull/49740)\n\n#####
          Bug fixes and enhancements\n\n- Add a new log option for fluentd log driver
          (`fluentd-write-timeout`), which enables specifying write timeouts for fluentd
          connections. [moby/moby#49911](https://redirect.github.com/moby/moby/pull/49911)\n-
          Add support for `DOCKER_AUTH_CONFIG` for the experimental `--use-api-socket`
          option. [docker/cli#6019](https://redirect.github.com/docker/cli/pull/6019)\n-
          Fix `docker exec` waiting for 10 seconds if a non-existing user or group
          was specified. [moby/moby#49868](https://redirect.github.com/moby/moby/pull/49868)\n-
          Fix `docker swarm init` ignoring `cacert` option of `--external-ca`. [docker/cli#5995](https://redirect.github.com/docker/cli/pull/5995)\n-
          Fix an issue where the CLI would not correctly save the configuration file
          (`~/.docker/config.json`) if it was a relative symbolic link. [docker/cli#5282](https://redirect.github.com/docker/cli/pull/5282)\n-
          Fix containers with `--restart always` policy using CDI devices failing
          to start on daemon restart. [moby/moby#49990](https://redirect.github.com/moby/moby/pull/49990)\n-
          Fix shell-completion to only complete some flags once, even though they
          can be set multiple times. [docker/cli#6030](https://redirect.github.com/docker/cli/pull/6030)\n-
          Fix the `plugin does not implement PluginAddr interface` error for Swarm
          CSI drivers. [moby/moby#49961](https://redirect.github.com/moby/moby/pull/49961)\n-
          Improve `docker login` error messages for invalid options. [docker/cli#6036](https://redirect.github.com/docker/cli/pull/6036)\n-
          Make sure the terminal state is restored if the CLI is forcefully terminated.
          [docker/cli#6058](https://redirect.github.com/docker/cli/pull/6058)\n- Update
          the default seccomp profile to match the libseccomp v2.6.0. The new syscalls
          are: `listmount`, `statmount`, `lsm_get_self_attr`, `lsm_list_modules`,
          `lsm_set_self_attr`, `mseal`, `uretprobe`, `riscv_hwprobe`, `getxattrat`,
          `listxattrat`, `removexattrat`, and `setxattrat`. This prevents containers
          from receiving EPERM errors when using them. [moby/moby#50077](https://redirect.github.com/moby/moby/pull/50077)\n-
          `docker inspect`: add shell completion, improve flag-description for `--type`
          and improve validation. [docker/cli#6052](https://redirect.github.com/docker/cli/pull/6052)\n-
          containerd image store: Enable BuildKit garbage collector by default. [moby/moby#49899](https://redirect.github.com/moby/moby/pull/49899)\n-
          containerd image store: Fix `docker build` not persisting overridden images
          as dangling. [moby/moby#49702](https://redirect.github.com/moby/moby/pull/49702)\n-
          containerd image store: Fix `docker system df` reporting a negative reclaimable
          space amount. [moby/moby#49707](https://redirect.github.com/moby/moby/pull/49707)\n-
          containerd image store: Fix duplicate `PUT` requests when pushing a multi-platform
          image. [moby/moby#49949](https://redirect.github.com/moby/moby/pull/49949)\n\n#####
          Packaging updates\n\n- Drop Ubuntu 20.04 \"Focal\" packages as it reached
          end of life. [docker/docker-ce-packaging#1200](https://redirect.github.com/docker/docker-ce-packaging/pull/1200)\n-
          Fix install location for RPM-based `docker-ce` man-pages. [docker/docker-ce-packaging#1203](https://redirect.github.com/docker/docker-ce-packaging/pull/1203)\n-
          Update BuildKit to [v0.22.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.22.0).
          [moby/moby#50046](https://redirect.github.com/moby/moby/pull/50046)\n- Update
          Buildx to [v0.24.0](https://redirect.github.com/docker/buildx/releases/tag/v0.24.0).
          [docker/docker-ce-packaging#1205](https://redirect.github.com/docker/docker-ce-packaging/pull/1205)\n-
          Update Compose to [v2.36.2](https://redirect.github.com/docker/compose/releases/tag/v2.36.2).
          [docker/docker-ce-packaging#1208](https://redirect.github.com/docker/docker-ce-packaging/pull/1208)\n-
          Update Go runtime to [1.24.3](https://go.dev/doc/devel/release#go1.24.3).
          [docker/docker-ce-packaging#1192](https://redirect.github.com/docker/docker-ce-packaging/pull/1192),
          [docker/cli#6060](https://redirect.github.com/docker/cli/pull/6060), [moby/moby#49174](https://redirect.github.com/moby/moby/pull/49174)\n\n#####
          Networking\n\n- Add bridge network option `\"com.docker.network.bridge.trusted_host_interfaces\"`,
          accepting a colon-separated list of interface names. These interfaces have
          direct access to published ports on container IP addresses. [moby/moby#49832](https://redirect.github.com/moby/moby/pull/49832)\n-
          Add daemon option `\"allow-direct-routing\"` to disable filtering of packets
          from outside the host addressed directly to containers. [moby/moby#49832](https://redirect.github.com/moby/moby/pull/49832)\n-
          Do not display network options `com.docker.network.enable_ipv4` or `com.docker.network.enable_ipv6`
          in inspect output if they have been overridden by `EnableIPv4` or `EnableIPv6`
          in the network create request. [moby/moby#49866](https://redirect.github.com/moby/moby/pull/49866)\n-
          Fix an issue that could cause network deletion to fail after a daemon restart,
          with error \"has active endpoints\" listing empty endpoint names. [moby/moby#49901](https://redirect.github.com/moby/moby/pull/49901)\n-
          Fix an issue where `docker network inspect --verbose` could sometimes crash
          the daemon. [moby/moby#49937](https://redirect.github.com/moby/moby/pull/49937)\n-
          Fix an issue where the load-balancer IP address for an overlay network would
          not be released in certain cases if the Swarm was lacking an ingress network.
          [moby/moby#49948](https://redirect.github.com/moby/moby/pull/49948)\n- Improve
          the reliability of NetworkDB in busy clusters and lossy networks. [moby/moby#49932](https://redirect.github.com/moby/moby/pull/49932)\n-
          Improvements to the reliability and convergence speed of NetworkDB. [moby/moby#49939](https://redirect.github.com/moby/moby/pull/49939)\n\n#####
          API\n\n- Update API version to `1.50`.\n- `DELETE /images/{name}` now supports
          a `platforms` query parameter. It accepts an array of JSON-encoded OCI Platform
          objects, allowing for selecting a specific platforms to delete content for.
          [moby/moby#49982](https://redirect.github.com/moby/moby/pull/49982)\n- `GET
          /info` now includes a `DiscoveredDevices` field. This is an array of `DeviceInfo`
          objects, each providing details about a device discovered by a device driver.
          [moby/moby#49980](https://redirect.github.com/moby/moby/pull/49980)\n\n#####
          Go SDK\n\n- `api/types/container`: add `ContainerState` and constants for
          container state. [moby/moby#49965](https://redirect.github.com/moby/moby/pull/49965)\n-
          `api/types/container`: change `Summary.State` to a `ContainerState`. [moby/moby#49991](https://redirect.github.com/moby/moby/pull/49991)\n-
          `api/types/container`: define `HealthStatus` type for health-status constants.
          [moby/moby#49876](https://redirect.github.com/moby/moby/pull/49876)\n- `api/types`:
          deprecate `BuildResult`, `ImageBuildOptions`, `ImageBuildOutput`, `ImageBuildResponse`,
          `BuilderVersion`, `BuilderV1`, and `BuilderBuildKi` which were moved to
          `api/types/build`. [moby/moby#50025](https://redirect.github.com/moby/moby/pull/50025)\n\n#####
          Deprecations\n\n- API: Deprecated: `GET /images/{name}/json` no longer returns
          the following fields: `Config`, `Hostname`, `Domainname`, `AttachStdin`,
          `AttachStdout`, `AttachStderr`, `Tty`, `OpenStdin`, `StdinOnce`, `Image`,
          `NetworkDisabled` (already omitted unless set), `MacAddress` (already omitted
          unless set), `StopTimeout` (already omitted unless set). These additional
          fields were included in the response due to an implementation detail but
          not part of the image's Configuration, were marked deprecated in API v1.46,
          and are now omitted. [moby/moby#48457](https://redirect.github.com/moby/moby/pull/48457)\n-
          Go-SDK: Deprecate builder/remotecontext.Rel(). This function was needed
          on older versions of Go, but can now be replaced by `filepath.Rel()`. [moby/moby#49843](https://redirect.github.com/moby/moby/pull/49843)\n-
          Go-SDK: api/types: deprecate `BuildCachePruneOptions` in favor of `api/types/builder.CachePruneOptions`.
          [moby/moby#50015](https://redirect.github.com/moby/moby/pull/50015)\n- Go-SDK:
          api/types: deprecate `BuildCachePruneReport` in favor of `api/types/builder.CachePruneReport`.
          [moby/moby#50015](https://redirect.github.com/moby/moby/pull/50015)\n- Go-SDK:
          api/types: deprecate `NodeListOptions`, `NodeRemoveOptions`, `ServiceCreateOptions`,
          `ServiceUpdateOptions`, `RegistryAuthFromSpec`, `RegistryAuthFromPreviousSpec`,
          `ServiceListOptions`, `ServiceInspectOptions`, and `SwarmUnlockKeyResponse`
          which were moved to `api/types/swarm`. [moby/moby#50027](https://redirect.github.com/moby/moby/pull/50027)\n-
          Go-SDK: api/types: deprecate `SecretCreateResponse`, `SecretListOptions`,
          `ConfigCreateResponse`, `ConfigListOptions` which were moved to api/types/swarm.
          [moby/moby#50024](https://redirect.github.com/moby/moby/pull/50024)\n- Go-SDK:
          client: deprecate `IsErrNotFound`. [moby/moby#50012](https://redirect.github.com/moby/moby/pull/50012)\n-
          Go-SDK: container: deprecate `IsValidHealthString` in favor of `api/types/container.ValidateHealthStatus`.
          [moby/moby#49893](https://redirect.github.com/moby/moby/pull/49893)\n- Go-SDK:
          container: deprecate `StateStatus`, `WaitCondition`, and the related  `WaitConditionNotRunning`,
          `WaitConditionNextExit`, and `WaitConditionRemoved` consts in favor of their
          equivalents in `api/types/container`. [moby/moby#49874](https://redirect.github.com/moby/moby/pull/49874)\n-
          Go-SDK: opts: deprecate `ListOpts.GetAll` in favor of `ListOpts.GetSlice`.
          [docker/cli#6032](https://redirect.github.com/docker/cli/pull/6032)\n- Remove
          deprecated `IsAutomated` formatting placeholder from `docker search`. [docker/cli#6091](https://redirect.github.com/docker/cli/pull/6091)\n-
          Remove fallback for pulling images from non-OCI-compliant `docker.pkg.github.com`
          registry. [moby/moby#50094](https://redirect.github.com/moby/moby/pull/50094)\n-
          Remove support for pulling legacy v2, schema 1 images and remove `DOCKER_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE`
          environment-variable. [moby/moby#50036](https://redirect.github.com/moby/moby/pull/50036),
          [moby/moby#42300](https://redirect.github.com/moby/moby/pull/42300)\n- The
          `BridgeNfIptables` and `BridgeNfIp6tables` fields in the `GET /info` response
          were deprecated in API v1.48, and are now omitted in API v1.50. [moby/moby#49904](https://redirect.github.com/moby/moby/pull/49904)\n-
          errdefs: Deprecate `errdefs.FromStatusCode`. Use containerd's `errhttp.ToNative`
          instead. [moby/moby#50030](https://redirect.github.com/moby/moby/pull/50030)\n\n###
          [`v28.1.1`](https://redirect.github.com/moby/moby/releases/tag/v28.1.1)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.1.0...v28.1.1)\n\n####
          28.1.1\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.1.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.1)\n-
          [moby/moby, 28.1.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.1)\n\n#####
          Bug fixes and enhancements\n\n- Fix `dockerd-rootless-setuptool.sh` incorrectly
          reporting missing `iptables`. [moby/moby#49833](https://redirect.github.com/moby/moby/pull/49833)\n-
          containerd image store: Fix a potential daemon crash when using `docker
          load` with archives containing zero-size tar headers. [moby/moby#49837](https://redirect.github.com/moby/moby/pull/49837)\n\n#####
          Packaging updates\n\n- Update Buildx to [v0.23.0](https://redirect.github.com/docker/buildx/releases/tag/v0.23.0).
          [docker/docker-ce-packaging#1185](https://redirect.github.com/docker/docker-ce-packaging/pull/1185)\n-
          Update Compose to [v2.35.1](https://redirect.github.com/docker/compose/releases/tag/v2.35.1).
          [docker/docker-ce-packaging#1188](https://redirect.github.com/docker/docker-ce-packaging/pull/1188)\n\n#####
          Networking\n\n- Add a warning to a container's `/etc/resolv.conf` when no
          upstream DNS servers were found. [moby/moby#49827](https://redirect.github.com/moby/moby/pull/49827)\n\n###
          [`v28.1.0`](https://redirect.github.com/moby/moby/releases/tag/v28.1.0)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.4...v28.1.0)\n\n####
          28.1.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.1.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
          [moby/moby, 28.1.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
          Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.1.0/docs/api/version-history.md).\n\n#####
          New\n\n- Add `docker bake` sub-command as alias for `docker buildx bake`.
          [docker/cli#5947](https://redirect.github.com/docker/cli/pull/5947)\n- Experimental:
          add a new `--use-api-socket` flag on `docker run` and `docker create` to
          enable access to Docker socket from inside a container and to share credentials
          from the host with the container. [docker/cli#5858](https://redirect.github.com/docker/cli/pull/5858)\n-
          `docker image inspect` now supports a `--platform` flag to inspect a specific
          platform of a multi-platform image. [docker/cli#5934](https://redirect.github.com/docker/cli/pull/5934)\n\n#####
          Bug fixes and enhancements\n\n- Add CLI shell-completion for context names.
          [docker/cli#6016](https://redirect.github.com/docker/cli/pull/6016)\n- Fix
          `docker images --tree` not including non-container images content size in
          the total image content size. [docker/cli#6000](https://redirect.github.com/docker/cli/pull/6000)\n-
          Fix `docker load` not preserving replaced images. [moby/moby#49650](https://redirect.github.com/moby/moby/pull/49650)\n-
          Fix `docker login` hints when logging in to a custom registry. [docker/cli#6015](https://redirect.github.com/docker/cli/pull/6015)\n-
          Fix `docker stats` not working properly on machines with high CPU core count.
          [moby/moby#49734](https://redirect.github.com/moby/moby/pull/49734)\n- Fix
          a regression causing `docker pull/push` to fail when interacting with a
          private repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n-
          Fix an issue preventing rootless Docker setup on a host with no `ip_tables`
          kernel module. [moby/moby#49727](https://redirect.github.com/moby/moby/pull/49727)\n-
          Fix an issue that could lead to unwanted iptables rules being restored and
          never deleted following a firewalld reload. [moby/moby#49728](https://redirect.github.com/moby/moby/pull/49728)\n-
          Improve CLI completion of `docker service scale`. [docker/cli#5968](https://redirect.github.com/docker/cli/pull/5968)\n-
          `docker images --tree` now hides both untagged and dangling images by default.
          [docker/cli#5924](https://redirect.github.com/docker/cli/pull/5924)\n- `docker
          system info` will provide an exit code if a connection cannot be established
          to the Docker daemon. [docker/cli#5918](https://redirect.github.com/docker/cli/pull/5918)\n-
          containerd image store: Fix `image tag` event not being emitted when building
          with BuildKit. [moby/moby#49678](https://redirect.github.com/moby/moby/pull/49678)\n-
          containerd image store: Improve `docker push/pull` handling of remote registry
          errors. [moby/moby#49770](https://redirect.github.com/moby/moby/pull/49770)\n-
          containerd image store: Show pull progress for non-layer image blobs. [moby/moby#49746](https://redirect.github.com/moby/moby/pull/49746)\n\n#####
          Packaging updates\n\n- Add Debian \"Trixie\" packages. [docker/docker-ce-packaging#1181](https://redirect.github.com/docker/docker-ce-packaging/pull/1181)\n-
          Add Fedora 42 packages. [docker/containerd-packaging#418](https://redirect.github.com/docker/containerd-packaging/pull/418),
          [docker/docker-ce-packaging#1169](https://redirect.github.com/docker/docker-ce-packaging/pull/1169)\n-
          Add Ubuntu 25.04 \"Plucky Puffin\" packages. [docker/containerd-packaging#419](https://redirect.github.com/docker/containerd-packaging/pull/419),
          [docker/docker-ce-packaging#1177](https://redirect.github.com/docker/docker-ce-packaging/pull/1177)\n-
          Update BuildKit to [v0.21.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.21.0).
          [moby/moby#49809](https://redirect.github.com/moby/moby/pull/49809)\n- Update
          Compose to [v2.35.0](https://redirect.github.com/docker/compose/releases/tag/v2.35.0).
          [docker/docker-ce-packaging#1183](https://redirect.github.com/docker/docker-ce-packaging/pull/1183)\n-
          Update Go runtime to [1.23.8](https://go.dev/doc/devel/release#go1.23.8).
          [docker/cli#5986](https://redirect.github.com/docker/cli/pull/5986), [docker/docker-ce-packaging#1180](https://redirect.github.com/docker/docker-ce-packaging/pull/1180),
          [moby/moby#49737](https://redirect.github.com/moby/moby/pull/49737)\n\n#####
          Networking\n\n- Fix a bug causing host port-mappings on Swarm containers
          to be duplicated on `docker ps` and `docker inspect`. [moby/moby#49724](https://redirect.github.com/moby/moby/pull/49724)\n-
          Fix an issue that caused container network attachment to fail with error
          \"Bridge port not forwarding\". [moby/moby#49705](https://redirect.github.com/moby/moby/pull/49705)\n-
          Fix an issue with removal of a `--link` from a container in the default
          bridge network. [moby/moby#49778](https://redirect.github.com/moby/moby/pull/49778)\n-
          Improve how network-endpoint relationships are tracked to reduce the chance
          of the \"has active endpoints\" error to be wrongfully returned. [moby/moby#49736](https://redirect.github.com/moby/moby/pull/49736)\n-
          Improve the \"has active endpoints\" error message by including the name
          of endpoints still connected to the network being deleted. [moby/moby#49773](https://redirect.github.com/moby/moby/pull/49773)\n\n#####
          API\n\n- Update API version to [v1.49](https://docs.docker.com/engine/api/v1.49/).
          [moby/moby#49718](https://redirect.github.com/moby/moby/pull/49718)\n- `GET
          /image/{name}/json` now supports a `platform` parameter allowing to specify
          which platform variant of a multi-platform image to inspect. [moby/moby#49586](https://redirect.github.com/moby/moby/pull/49586)\n-
          `GET /info` now returns a `FirewallBackend` containing information about
          the daemon's firewalling configuration. [moby/moby#49761](https://redirect.github.com/moby/moby/pull/49761)\n\n#####
          Go SDK\n\n- Update minimum required Go version to go1.23. [docker/cli#5868](https://redirect.github.com/docker/cli/pull/5868)\n-
          cli/command/context: remove temporary `ContextType` field from JSON output.
          [docker/cli#5981](https://redirect.github.com/docker/cli/pull/5981)\n- client:
          Keep image references in canonical format where possible. [moby/moby#49609](https://redirect.github.com/moby/moby/pull/49609)\n\n#####
          Deprecations\n\n- API: Deprecated `AllowNondistributableArtifactsCIDRs`
          and `AllowNondistributableArtifactsHostnames` fields in the `RegistryConfig`
          struct in the `GET /info` response are omitted in API v1.49. [moby/moby#49749](https://redirect.github.com/moby/moby/pull/49749)\n-
          API: Deprecated: The `ContainerdCommit.Expected`, `RuncCommit.Expected`,
          and `InitCommit.Expected` fields in the `GET /info` endpoint were deprecated
          in API v1.48, and are now omitted in API v1.49. [moby/moby#48556](https://redirect.github.com/moby/moby/pull/48556)\n-
          Go-SDK: cli/command/image: Deprecate `RunPull`: this function was only used
          internally and will be removed in the next release. [docker/cli#5975](https://redirect.github.com/docker/cli/pull/5975)\n-
          Go-SDK: cli/config/configfile: deprecate `ConfigFile.Experimental` field.
          Experimental CLI features are always enabled since version v20.10 and this
          field is no longer used. Use `ConfigFile.Features` instead for optional
          features. This field will be removed in a future release. [docker/cli#5977](https://redirect.github.com/docker/cli/pull/5977)\n-
          Go-SDK: deprecate `pkg/archive`, which was migrated to `github.com/moby/go-archive`.
          [moby/moby#49743](https://redirect.github.com/moby/moby/pull/49743)\n- Go-SDK:
          deprecate `pkg/atomicwriter`, which was migrated to `github.com/moby/sys/atomicwriter`.
          [moby/moby#49748](https://redirect.github.com/moby/moby/pull/49748)\n- Go-SDK:
          opts: remove deprecated `PortOpt`, `ConfigOpt`, `SecretOpt` aliases. [docker/cli#5953](https://redirect.github.com/docker/cli/pull/5953)\n-
          Go-SDK: registry: deprecate `APIEndpoint.Official` field. [moby/moby#49706](https://redirect.github.com/moby/moby/pull/49706)\n\n###
          [`v28.0.4`](https://redirect.github.com/moby/moby/releases/tag/v28.0.4)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.3...v28.0.4)\n\n####
          28.0.4\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.4 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.4)\n-
          [moby/moby, 28.0.4 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.4)\n\n#####
          Bug fixes and enhancements\n\n- Fix a regression causing `docker pull/push`
          to fail when interacting with a private repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n\n###
          [`v28.0.3`](https://redirect.github.com/moby/moby/releases/tag/v28.0.3)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.2...v28.0.3)\n\n####
          28.0.3\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.3 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.3)\n-
          [moby/moby, 28.0.3 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.3)\n\n#####
          Bug fixes and enhancements\n\n- Fix `docker run` truncating the `STDOUT`/`STDERR`
          prematurely when the container exits before the data is consumed. [docker/cli#5957](https://redirect.github.com/docker/cli/pull/5957)\n\n#####
          Packaging updates\n\n- Update BuildKit to [v0.20.2](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.2).
          [moby/moby#49698](https://redirect.github.com/moby/moby/pull/49698)\n- Update
          `runc` to [v1.2.6](https://redirect.github.com/opencontainers/runc/releases/tag/v1.2.6)
          (static packages only). [moby/moby#49682](https://redirect.github.com/moby/moby/pull/49682)\n-
          Update containerd to [v1.7.26](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.26).
          [docker/containerd-packaging#409](https://redirect.github.com/docker/containerd-packaging/pull/409)\n\n###
          [`v28.0.2`](https://redirect.github.com/moby/moby/releases/tag/v28.0.2)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.1...v28.0.2)\n\n####
          28.0.2\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.2 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.2)\n-
          [moby/moby, 28.0.2 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.2)\n\n#####
          Bug fixes and enhancements\n\n- Fix CLI-specific attributes (`docker.cli.*`)
          being unintentionally passed to downstream OTel services. [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n-
          Fix an issue where user-specified `OTEL_RESOURCE_ATTRIBUTES` were being
          overridden by CLI's internal telemetry attributes. The CLI now properly
          merges user-specified attributes with internal ones, allowing both to coexist.
          [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n- Fix
          daemon failing to start on Windows when a container created before v28.0.0
          was present. [moby/moby#49626](https://redirect.github.com/moby/moby/pull/49626)\n-
          Fix possible error on `docker buildx prune` with the `--min-free-space`.
          [moby/moby#49623](https://redirect.github.com/moby/moby/pull/49623)\n- Fix
          spurious `io: read/write on closed pipe` error in the daemon log when closing
          container. [moby/moby#49590](https://redirect.github.com/moby/moby/pull/49590)\n-
          Fix the Docker daemon failing too early if the containerd socket isn't immediately
          available. [moby/moby#49603](https://redirect.github.com/moby/moby/pull/49603)\n-
          Mask Linux thermal interrupt info in a container's `/proc` and `/sys` by
          default. [moby/moby#49560](https://redirect.github.com/moby/moby/pull/49560)\n-
          Update `contrib/check-config.sh` to check for more kernel modules related
          to iptables. [moby/moby#49622](https://redirect.github.com/moby/moby/pull/49622)\n-
          containerd image store: Fix integer overflow in User ID handling passed
          via `--user`. [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n-
          containerd image store: Fix spurious `reference for unknown type: application/vnd.in-toto+json`
          warning being logged to the daemon's log. [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n-
          containerd image store: Improve performance of `docker ps` when running
          large number of containers. [moby/moby#49365](https://redirect.github.com/moby/moby/pull/49365)\n\n#####
          Packaging updates\n\n- Update BuildKit to [v0.20.1](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.1).
          [moby/moby#49587](https://redirect.github.com/moby/moby/pull/49587)\n- Update
          Buildx to [v0.22.0](https://redirect.github.com/docker/buildx/releases/tag/v0.22.0).
          [docker/docker-ce-packaging#1175](https://redirect.github.com/docker/docker-ce-packaging/pull/1175)\n-
          Update Compose to [v2.34.0](https://redirect.github.com/docker/compose/releases/tag/v2.34.0).
          [docker/docker-ce-packaging#1172](https://redirect.github.com/docker/docker-ce-packaging/pull/1172)\n-
          Update Go runtime to [1.23.7](https://go.dev/doc/devel/release#go1.23.7).
          [docker/cli#5890](https://redirect.github.com/docker/cli/pull/5890), [docker/docker-ce-packaging#1171](https://redirect.github.com/docker/docker-ce-packaging/pull/1171),
          [moby/moby#49580](https://redirect.github.com/moby/moby/pull/49580)\n- Update
          RootlessKit to [v2.3.4](https://redirect.github.com/rootless-containers/rootlesskit/releases/tag/v2.3.4).
          [moby/moby#49614](https://redirect.github.com/moby/moby/pull/49614)\n- Update
          containerd (static binaries only) to [v1.7.27](https://www.github.com/containerd/containerd/releases/tag/v1.7.27).
          [moby/moby#49656](https://redirect.github.com/moby/moby/pull/49656)\n\n#####
          Networking\n\n- Add environment variable `DOCKER_INSECURE_NO_IPTABLES_RAW=1`
          to allow Docker to run on systems where the Linux kernel can't provide `CONFIG_IP_NF_RAW`
          support. When enabled, Docker will not create rules in the iptables `raw`
          table. Warning: This is not recommended for production environments as it
          reduces security by allowing other hosts on the local network to route to
          ports published to host addresses, even when they are published to `127.0.0.1.`
          This option bypasses some of the security hardening introduced in Docker
          Engine 28.0.0. [moby/moby#49621](https://redirect.github.com/moby/moby/pull/49621)\n-
          Allow container startup when an endpoint is attached to a macvlan network
          where the parent interface is down. [moby/moby#49630](https://redirect.github.com/moby/moby/pull/49630)\n-
          Do not skip DNAT for packets originating in a gateway\\_mode=routed network.
          [moby/moby#49577](https://redirect.github.com/moby/moby/pull/49577)\n- Fix
          a bug causing `docker ps` to inconsistently report dual-stack port mappings.
          [moby/moby#49657](https://redirect.github.com/moby/moby/pull/49657)\n- Fix
          a bug that could cause `docker-proxy` to stop forwarding UDP datagrams to
          containers. [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n-
          Fix a bug that was causing `docker-proxy` to close UDP connections to containers
          eagerly and resulting in the source address to change needlessly. [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n\n#####
          Go SDK\n\n- Move various types and consts from `cli-plugins/manager` to
          a separate package. [docker/cli#5902](https://redirect.github.com/docker/cli/pull/5902)\n-
          Update minimum required Go version to go1.23. [moby/moby#49541](https://redirect.github.com/moby/moby/pull/49541)\n-
          `cli/command`: Move `PrettyPrint` utility to `cli/command/formatter`. [docker/cli#5916](https://redirect.github.com/docker/cli/pull/5916)\n-
          runconfig/errors: split `ErrConflictHostNetwork` into `ErrConflictConnectToHostNetwork`
          and `ErrConflictDisconnectFromHostNetwork`. [moby/moby#49605](https://redirect.github.com/moby/moby/pull/49605)\n\n#####
          Deprecations\n\n- Go-SDK: Deprecate `cli-plugins/manager.ResourceAttributesEnvvar`
          constant. It was used internally, but holds the `OTEL_RESOURCE_ATTRIBUTES`
          name, which is part of the OpenTelemetry specification. Users of this constant
          should define their own. It will be removed in the next release. [docker/cli#5881](https://redirect.github.com/docker/cli/pull/5881)\n-
          Go-SDK: Deprecate `opts.PortOpt`, `opts.ConfigOpt` and `opts.SecretOpt`.
          These types were moved to the `opts/swarmopts` package. [docker/cli#5907](https://redirect.github.com/docker/cli/pull/5907)\n-
          Go-SDK: Remove `service/logs` package. [docker/cli#5910](https://redirect.github.com/docker/cli/pull/5910)\n-
          Go-SDK: `cli/command/image`: Deprecate `PushTrustedReference` and move to
          `cli/trust`. [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-
          Go-SDK: `cli/command/image`: Deprecate and internalize `TrustedPush`. [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-
          Go-SDK: `cli/command`: deprecate `Cli.NotaryClient`: use [`trust.GetNotaryRepository`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/trust#GetNotaryRepository)
          instead. This method is no longer used and will be removed in the next release.
          [docker/cli#5885](https://redirect.github.com/docker/cli/pull/5885)\n- Go-SDK:
          `cli/command`: deprecate `Cli.RegistryClient`. This method was only used
          internally and will be removed in the next release. Use [`client.NewRegistryClient`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/registry/client#NewRegistryClient)
          instead. [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889),
          [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889)\n- Go-SDK:
          `registry`: Deprecate `RepositoryInfo.Official` field. [moby/moby#49567](https://redirect.github.com/moby/moby/pull/49567)\n-
          Go-SDK: `registry`: deprecate `HostCertsDir`: this function was only used
          internally and will be removed in the next release. [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n-
          Go-SDK: `registry`: deprecate `SetCertsDir`: the cert-directory is now automatically
          selected when running with RootlessKit, and should no longer be set manually.
          [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n\n###
          [`v28.0.1`](https://redirect.github.com/moby/moby/releases/tag/v28.0.1)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.0...v28.0.1)\n\n###
          28.0.1\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.1)\n-
          [moby/moby, 28.0.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.1)\n\n####
          Networking\n\n- Remove dependency on kernel modules `ip_set`, `ip_set_hash_net`
          and `netfilter_xt_set`.\n  - The dependency was introduced in release 28.0.0
          but proved too disruptive. The iptables rules using these modules have been
          replaced. [moby/moby#49530](https://redirect.github.com/moby/moby/pull/49530)\n-
          Allow daemon startup on a host with IPv6 disabled without requiring `--ip6tables=false`.
          [moby/moby#49525](https://redirect.github.com/moby/moby/pull/49525)\n- Fix
          a bug that was causing containers with `--restart=always` and a published
          port already in use to restart in a tight loop. [moby/moby#49507](https://redirect.github.com/moby/moby/pull/49507)\n-
          Fix an issue with Swarm ingress, caused by incorrect ordering of iptables
          rules. [moby/moby#49538](https://redirect.github.com/moby/moby/pull/49538)\n-
          Fix creation of a swarm-scoped network from a `--config-only` network. [moby/moby#49521](https://redirect.github.com/moby/moby/pull/49521)\n-
          Fix `docker network inspect` reporting an IPv6 gateway with CIDR suffix
          for a newly created network with no specific IPAM config, until a daemon
          restart. [moby/moby#49520](https://redirect.github.com/moby/moby/pull/49520)\n-
          Improve the error reported when kernel modules `ip_set`, `ip_set_hash_net`
          and `netilter_xt_set` are not available. [moby/moby#49524](https://redirect.github.com/moby/moby/pull/49524)\n-
          Move most of Docker's iptables rules out of the filter-FORWARD chain, so
          that other applications are free to append rules that must follow Docker's
          rules. [moby/moby#49518](https://redirect.github.com/moby/moby/pull/49518)\n-
          Update `--help` output and man page lo state which options only apply to
          the default bridge network. [moby/moby#49522](https://redirect.github.com/moby/moby/pull/49522)\n\n####
          Bug fixes and enhancements\n\n- Fix `docker context create` always returning
          an error when using the `\"skip-tls-verify\"` option. [docker/cli#5850](https://redirect.github.com/docker/cli/pull/5850)\n-
          Fix shell completion suggesting IDs instead of names for services and nodes.
          [docker/cli#5848](https://redirect.github.com/docker/cli/pull/5848)\n- Fix
          unintentionally printing exit status to standard error output when `docker
          exec/run` returns a non-zero status. [docker/cli#5854](https://redirect.github.com/docker/cli/pull/5854)\n-
          Fix regression `protocol \"tcp\" is not supported by the RootlessKit port
          driver \"slirp4netns\"`. [moby/moby#49514](https://redirect.github.com/moby/moby/pull/49514)\n-
          containerd image store: Fix `docker inspect` not being able to show multi-platform
          images with missing layers for all platforms. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
          containerd image store: Fix `docker images --tree` reporting wrong content
          size. [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n-
          Fix compilation on i386 [moby/moby#49526](https://redirect.github.com/moby/moby/pull/49526)\n\n####
          Packaging updates\n\n- Update `github.com/go-jose/go-jose/v4` to v4.0.5
          to address. [GHSA-c6gw-w398-hv78](https://redirect.github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78)
          / [CVE-2025-27144](https://www.cve.org/CVERecord?id=CVE-2025-27144) [docker/cli#5867](https://redirect.github.com/docker/cli/pull/5867)\n-
          Update Buildx to [v0.21.1](https://redirect.github.com/docker/buildx/releases/tag/v0.21.1).
          [docker/docker-ce-packaging#1167](https://redirect.github.com/docker/docker-ce-packaging/pull/1167)\n-
          Update Compose to [v2.33.1](https://redirect.github.com/docker/compose/releases/tag/v2.33.1).
          [docker/docker-ce-packaging#1168](https://redirect.github.com/docker/docker-ce-packaging/pull/1168)\n\n####
          API\n\n- containerd image store: Fix `GET /images/json?manifests=1` not
          filling `Manifests` for index-only images. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
          containerd image store: Fix `GET /images/json and /images/<name>/json` `Size.Content`
          field including the size of content that's not available locally. [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n\n###
          [`v28.0.0`](https://redirect.github.com/moby/moby/releases/tag/v28.0.0)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v27.5.1...v28.0.0)\n\n###
          28.0.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
          [moby/moby, 28.0.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
          Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.0.0/docs/deprecated.md).\n-
          Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.0.0/docs/api/version-history.md).\n\n####
          New\n\n- Add ability to mount an image inside a container via `--mount type=image`.
          [moby/moby#48798](https://redirect.github.com/moby/moby/pull/48798)\n  -
          You can also specify `--mount type=image,image-subpath=[subpath],...` option
          to mount a specific path from the image. [docker/cli#5755](https://redirect.github.com/docker/cli/pull/5755)\n-
          `docker images --tree` now shows metadata badges. [docker/cli#5744](https://redirect.github.com/docker/cli/pull/5744)\n-
          `docker load`, `docker save`, and `docker history` now support a `--platform`
          flag allowing you to choose a specific platform for single-platform operations
          on multi-platform images. [docker/cli#5331](https://redirect.github.com/docker/cli/pull/5331)\n-
          Add `OOMScoreAdj` to `docker service create` and `docker stack`. [docker/cli#5145](https://redirect.github.com/docker/cli/pull/5145)\n-
          `docker buildx prune` now supports `reserved-space`, `max-used-space`, `min-free-space`
          and `keep-bytes` filters. [moby/moby#48720](https://redirect.github.com/moby/moby/pull/48720)\n-
          Windows: Add support for running containerd as a child process of the daemon,
          instead of using a system-installed containerd. [moby/moby#47955](https://redirect.github.com/moby/moby/pull/47955)\n\n####
          Networking\n\n- The `docker-proxy` binary has been updated, older versions
          will not work with the updated `dockerd`. [moby/moby#48132](https://redirect.github.com/moby/moby/pull/48132)\n
          \ - Close a window in which the userland proxy (`docker-proxy`) could accept
          TCP connections, that would then fail after `iptables` NAT rules were set
          up.\n  - The executable `rootlesskit-docker-proxy` is no longer used, it
          has been removed from the build and distribution.\n- DNS nameservers read
          from the host's `/etc/resolv.conf` are now always accessed from the host's
          network namespace. [moby/moby#48290](https://redirect.github.com/moby/moby/pull/48290)\n
          \ - When the host's `/etc/resolv.conf` contains no nameservers and there
          are no `--dns` overrides, Google's DNS servers are no longer used, apart
          from by the default bridge network and in build containers.\n- Container
          interfaces in bridge and macvlan networks now use randomly generated MAC
          addresses. [moby/moby#48808](https://redirect.github.com/moby/moby/pull/48808)\n
          \ - Gratuitous ARP / Neighbour Advertisement messages will be sent when
          the interfaces are started so that, when IP addresses are reused, they're
          associated with the newly generated MAC address.\n  - IPv6 addresses in
          the default bridge network are now IPAM-assigned, rather than being derived
          from the MAC address.\n- The deprecated OCI `prestart` hook is now only
          used by build containers. For other containers, network interfaces are added
          to the network namespace after task creation is complete, before the container
          task is started. [moby/moby#47406](https://redirect.github.com/moby/moby/pull/47406)\n-
          Add a new `gw-priority` option to `docker run`, `docker container create`,
          and `docker network connect`. This option will be used by the Engine to
          determine which network provides the default gateway for a container. On
          `docker run`, this option is only available through the extended `--network`
          syntax. [docker/cli#5664](https://redirect.github.com/docker/cli/pull/5664)\n-
          Add a new netlabel `com.docker.network.endpoint.ifname` to customize the
          interface name used when connecting a container to a network. It's supported
          by all built-in network drivers on Linux. [moby/moby#49155](https://redirect.github.com/moby/moby/pull/49155)\n
          \ - When a container is created with multiple networks specified, there's
          no guarantee on the order networks will be connected to the container. So,
          if a custom interface name uses the same prefix as the auto-generated names,
          for example `eth`, the container might fail to start.\n  - The recommended
          practice is to use a different prefix, for example `en0`, or a numerical
          suffix high enough to never collide, for example `eth100`.\n  - This label
          can be specified on `docker network connect` via the `--driver-opt` flag,
          for example `docker network connect --driver-opt=com.docker.network.endpoint.ifname=foobar
          \u2026`.\n  - Or via the long-form `--network` flag on `docker run`, for
          example `docker run --network=name=bridge,driver-opt=com.docker.network.endpoint.ifname=foobar
          \u2026`\n- If a custom network driver reports capability `GwAllocChecker`
          then, before a network is created, it will get a `GwAllocCheckerRequest`
          with the network's options. The custom driver may then reply that no gateway
          IP address should be allocated. [moby/moby#49372](https://redirect.github.com/moby/moby/pull/49372)\n\n####
          Port publishing in bridge networks\n\n- `dockerd` now requires `ipset` support
          in the Linux kernel. [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n
          \ - The `iptables` and `ip6tables` rules used to implement port publishing
          and network isolation have been extensively modified. This enables some
          of the following functional changes, and is a first step in refactoring
          to enable native `nftables` support in a future release. [moby/moby#48815](https://redirect.github.com/moby/moby/issues/48815)\n
          \ - If it becomes necessary to downgrade to an earlier version of the daemon,
          some manual cleanup of the new rules will be necessary. The simplest and
          surest approach is to reboot the host, or use `iptables -F` and `ip6tables
          -F` to flush all existing `iptables` rules from the `filter` table before
          starting the older version of the daemon. When that is not possible, run
          the following commands as root:\n    - `iptables -D FORWARD -m set --match-set
          docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED -j
          ACCEPT; ip6tables -D FORWARD -m set --match-set docker-ext-bridges-v6 dst
          -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT`\n    - `iptables -D
          FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER; ip6tables
          -D FORWARD -m set --match-set docker-ext-bridges-v6 dst -j DOCKER`\n    -
          If you were previously running with the iptables filter-FORWARD policy set
          to `ACCEPT` and need to restore access to unpublished ports, also delete
          per-bridge-network rules from the `DOCKER` chains. For example, `iptables
          -D DOCKER ! -i docker0 -o docker0 -j DROP`.\n- Fix a security issue that
          was allowing remote hosts to connect directly to a container on its published
          ports. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
          Fix a security issue that was allowing neighbor hosts to connect to ports
          mapped on a loopback address. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
          Fix an issue that prevented port publishing to link-local addresses. [moby/moby#48570](https://redirect.github.com/moby/moby/pull/48570)\n-
          UDP ports published by a container are now reliably accessible by containers
          on other networks, via the host's public IP address. [moby/moby#48571](https://redirect.github.com/moby/moby/pull/48571)\n-
          Docker will now only set the `ip6tables` policy for the `FORWARD` chain
          in the `filter` table to `DROP` if it enables IP forwarding on the host
          itself (sysctls `net.ipv6.conf.all.forwarding` and `net.ipv6.conf.default.forwarding`).
          This is now aligned with existing IPv4 behaviour. [moby/moby#48594](https://redirect.github.com/moby/moby/pull/48594)\n
          \ - If IPv6 forwarding is enabled on your host, but you were depending on
          Docker to set the ip6tables filter-FORWARD policy to `DROP`, you may need
          to update your host's configuration to make sure it is secure.\n- Direct
          routed access to container ports that are not exposed using `p`/`-publish`
          is now blocked in the `DOCKER` iptables chain. [moby/moby#48724](https://redirect.github.com/moby/moby/pull/48724)\n
          \ - If the default iptables filter-FORWARD policy was previously left at
          `ACCEPT` on your host, and direct routed access to a container's unpublished
          ports from a remote host is still required, options are:\n    - Publish
          the ports you need.\n    - Use the new `gateway_mode_ipv[46]=nat-unprotected`,
          described below.\n  - Container ports published to host addresses will continue
          to be accessible via those host addresses, using NAT or the userland proxy.\n
          \ - Unpublished container ports continue to be directly accessible from
          the Docker host via the container's IP address.\n- Networks created with
          `gateway_mode_ipv[46]=routed` are now accessible from other bridge networks
          running on the same Docker host, as well as from outside the host. [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n-
          Bridge driver options `com.docker.network.bridge.gateway_mode_ipv4` and
          `com.docker.network.bridge.gateway_mode_ipv6` now accept mode `nat-unprotected`.
          [moby/moby#48597](https://redirect.github.com/moby/moby/pull/48597)\n  -
          `nat-unprotected` is similar to the default `nat` mode, but no per port/protocol
          rules are set up. This means any port on a container can be accessed by
          direct-routing from a remote host.\n- Bridge driver options `com.docker.network.bridge.gateway_mode_ipv4`
          and `com.docker.network.bridge.gateway_mode_ipv6` now accept mode `isolated`,
          when the network is also `internal`. [moby/moby#49262](https://redirect.github.com/moby/moby/pull/49262)\n
          \ - An address is normally assigned to the bridge device in an `internal`
          network. So, processes on the Docker host can access the network, and containers
          in the network can access host services listening on that bridge address
          (including services listening on \"any\" host address, `0.0.0.0` or `::`).\n
          \ - An `internal` bridge network created with gateway mode `isolated` does
          not have an address on the Docker host.\n- When a port mapping includes
          a host IP address or port number that cannot be used because NAT from the
          host is disabled using `--gateway_mode_ipv[46]`, container creation will
          no longer fail. The unused fields may be needed if the gateway endpoint
          changes when networks are connected or disconnected. A message about the
          unused fields will be logged. [moby/moby#48575](https://redirect.github.com/moby/moby/pull/48575)\n-
          Do not create iptables nat-POSTROUTING masquerade rules for a container's
          own published ports, when the userland proxy is enabled. [moby/moby#48854](https://redirect.github.com/moby/moby/pull/48854)\n\n####
          IPv6\n\n- Add `docker network create` option `--ipv4`. To disable IPv4 address
          assignment for a network, use `docker network create --ipv4=false [...]`.
          [docker/cli#5599](https://redirect.github.com/docker/cli/pull/5599)\n- Daemon
          option `--ipv6` (`\"ipv6\": true` in `daemon.json`) can now be used without
          `fixed-cidr-v6`. [moby/moby#48319](https://redirect.github.com/moby/moby/pull/48319)\n-
          IPAM now handles subnets bigger than \"/64\". [moby/moby#49223](https://redirect.github.com/moby/moby/pull/49223)\n-
          Duplicate address detection (DAD) is now disabled for addresses assigned
          to the bridges belonging to bridge networks. [moby/moby#48609](https://redirect.github.com/moby/moby/pull/48609)\n-
          Modifications to `host-gateway`, for compatibility with IPv6-only networks.
          [moby/moby#48807](https://redirect.github.com/moby/moby/pull/48807)\n  -
          When special value `host-gateway` is used in an `--add-host` option in place
          of an address, it's replaced by an address on the Docker host to make it
          possible to refer to the host by name. The address used belongs to the default
          bridge (normally `docker0`). Until now it's always been an IPv4 address,
          because all containers on bridge networks had IPv4 addresses.\n  - Now,
          if IPv6 is enabled on the default bridge network, `/etc/hosts` entries will
          be created for IPv4 and IPv6 addresses. So, a container that's only connected
          to IPv6-only networks can access the host by name.\n  - The `--host-gateway-ip`
          option overrides the address used to replace `host-gateway`. Two of these
          options are now allowed on the command line, for one IPv4 gateway and one
          IPv6.\n  - In the `daemon.json` file, to provide two addresses, use `\"host-gateway-ips\"`.
          For example, `\"host-gateway-ips\": [\"192.0.2.1\", \"2001:db8::1111\"]`.\n\n####
          Bug fixes and enhancements\n\n- Add IPv6 loopback address as an insecure
          registry by default. [moby/moby#48540](https://redirect.github.com/moby/moby/pull/48540)\n-
          Add support for Cobra-generated completion scripts for `dockerd`. [moby/moby#49339](https://redirect.github.com/moby/moby/pull/49339)\n-
          Fix DNS queries failing when containers are launched via `systemd` auto-start
          on boot [moby/moby#48812](htt\n\n</details>\n\n---\n\n### Configuration\n\n\U0001F4C5
          **Schedule**: Branch creation - At any time (no schedule defined), Automerge
          - At any time (no schedule defined).\n\n\U0001F6A6 **Automerge**: Disabled
          by config. Please merge this manually once you are satisfied.\n\n\u267B
          **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry
          checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded
          about this update again.\n\n---\n\n - [ ] <!-- rebase-check -->If you want
          to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated
          by [Mend Renovate](https://mend.io/renovate/). View the [repository job
          log](https://developer.mend.io/github/osism/ci-image).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQwLjYyLjEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbInJlbm92YXRlIl19-->\n"
        change_url: https://github.com/osism/ci-image/pull/57
        commit_id: 5782a1d08cb7c618372f9c0486e17f9ea793d5c1
        patchset: 5782a1d08cb7c618372f9c0486e17f9ea793d5c1
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ci-image
          name: osism/ci-image
          short_name: ci-image
        src_dir: src/github.com/osism/ci-image
        topic: null
      buildset: a1547bd4f05244e58cfda6acadb85157
      buildset_refs:
      - branch: main
        change: '57'
        change_message: "chore(deps): update dependency moby/moby to v28\n\nThis PR
          contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
          [moby/moby](https://redirect.github.com/moby/moby) | major | `27.5.1` ->
          `28.3.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>moby/moby
          (moby/moby)</summary>\n\n### [`v28.3.0`](https://redirect.github.com/moby/moby/releases/tag/v28.3.0):
          28.3.0\n\n[Compare Source](https://redirect.github.com/moby/moby/compare/v28.2.2...v28.3.0)\n\n####
          28.3.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.3.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.3.0)\n-
          [moby/moby, 28.3.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.3.0)\n-
          Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.3.0/docs/deprecated.md).\n-
          Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.3.0/docs/api/version-history.md).\n\n#####
          New\n\n- Add support for AMD GPUs in `docker run --gpus`. [moby/moby#49952](https://redirect.github.com/moby/moby/pull/49952)\n-
          Use `DOCKER_AUTH_CONFIG` as a credential store. [docker/cli#6008](https://redirect.github.com/docker/cli/pull/6008)\n\n#####
          Bug fixes and enhancements\n\n- Ensure that the state of the container in
          the daemon database (used by [/containers/json](https://docs.docker.com/reference/api/engine/version/v1.49/#tag/Container/operation/ContainerList)
          API) is up to date when the container is stopped using the [/containers/{id}/stop](https://docs.docker.com/reference/api/engine/version/v1.49/#tag/Container/operation/ContainerStop)
          API (before response of API). [moby/moby#50136](https://redirect.github.com/moby/moby/pull/50136)\n-
          Fix `docker image inspect inspect` omitting empty fields. [moby/moby#50135](https://redirect.github.com/moby/moby/pull/50135)\n-
          Fix `docker images --tree` not marking images as in-use when the containerd
          image store is disabled. [docker/cli#6140](https://redirect.github.com/docker/cli/pull/6140)\n-
          Fix `docker pull/push` hang in non-interactive when authentication is required
          caused by prompting for login credentials. [docker/cli#6141](https://redirect.github.com/docker/cli/pull/6141)\n-
          Fix a potential resource leak when a node leaves a Swarm. [moby/moby#50115](https://redirect.github.com/moby/moby/pull/50115)\n-
          Fix a regression where a login prompt on `docker pull` would show Docker
          Hub-specific hints when logging in on other registries. [docker/cli#6135](https://redirect.github.com/docker/cli/pull/6135)\n-
          Fix an issue where all new tasks in the Swarm could get stuck in the PENDING
          state forever after scaling up a service with placement preferences. [moby/moby#50211](https://redirect.github.com/moby/moby/pull/50211)\n-
          Remove an undocumented, hidden, top-level `docker remove` command that was
          accidentally introduced in Docker 23.0. [docker/cli#6144](https://redirect.github.com/docker/cli/pull/6144)\n-
          Validate registry-mirrors configuration as part of `dockerd --validate`
          and improve error messages for invalid mirrors. [moby/moby#50240](https://redirect.github.com/moby/moby/pull/50240)\n-
          `dockerd-rootless-setuptool.sh`: Fix the script from silently returning
          with no error message when subuid/subgid system requirements are not satisfied.
          [moby/moby#50059](https://redirect.github.com/moby/moby/pull/50059)\n- containerd
          image store: Fix `docker push` not creating a tag on the remote repository.
          [moby/moby#50199](https://redirect.github.com/moby/moby/pull/50199)\n- containerd
          image store: Improve handling of errors returned by the token server during
          `docker pull/push`. [moby/moby#50176](https://redirect.github.com/moby/moby/pull/50176)\n\n#####
          Packaging updates\n\n- Allow customizing containerd service name for OpenRC.
          [moby/moby#50156](https://redirect.github.com/moby/moby/pull/50156)\n- Update
          BuildKit to [v0.23.1](https://redirect.github.com/moby/buildkit/releases/tag/v0.23.1).
          [moby/moby#50243](https://redirect.github.com/moby/moby/pull/50243)\n- Update
          Buildx to [v0.25.0](https://redirect.github.com/docker/buildx/releases/tag/v0.25.0).
          [docker/docker-ce-packaging#1217](https://redirect.github.com/docker/docker-ce-packaging/pull/1217)\n-
          Update Compose to [v2.37.2](https://redirect.github.com/docker/compose/releases/tag/v2.37.2).
          [docker/docker-ce-packaging#1219](https://redirect.github.com/docker/docker-ce-packaging/pull/1219)\n-
          Update Docker Model CLI plugin to [v0.1.30](https://redirect.github.com/docker/model-cli/releases/tag/v0.1.30).
          [docker/docker-ce-packaging#1218](https://redirect.github.com/docker/docker-ce-packaging/pull/1218)\n-
          Update Go runtime to [1.24.4](https://go.dev/doc/devel/release#go1.24.4).
          [docker/docker-ce-packaging#1213](https://redirect.github.com/docker/docker-ce-packaging/pull/1213),
          [moby/moby#50153](https://redirect.github.com/moby/moby/pull/50153), [docker/cli#6124](https://redirect.github.com/docker/cli/pull/6124)\n\n#####
          Networking\n\n- Revert Swarm related changes added in 28.2.x builds, due
          to a regression reported in [https://github.com/moby/moby/issues/50129](https://redirect.github.com/moby/moby/issues/50129).
          [moby/moby#50169](https://redirect.github.com/moby/moby/pull/50169)\n  -
          Revert: Fix an issue where `docker network inspect --verbose` could sometimes
          crash the daemon ([https://github.com/moby/moby/pull/49937](https://redirect.github.com/moby/moby/pull/49937)).\n
          \ - Revert: Fix an issue where the load-balancer IP address for an overlay
          network would not be released in certain cases if the Swarm was lacking
          an ingress network ([https://github.com/moby/moby/pull/49948](https://redirect.github.com/moby/moby/pull/49948)).\n
          \ - Revert: Improve the reliability of NetworkDB in busy clusters and lossy
          networks ([https://github.com/moby/moby/pull/49932](https://redirect.github.com/moby/moby/pull/49932)).\n
          \ - Revert: Improvements to the reliability and convergence speed of NetworkDB
          ([https://github.com/moby/moby/pull/49939](https://redirect.github.com/moby/moby/pull/49939)).\n-
          Fix an issue that could cause container startup to fail, or lead to failed
          UDP port mappings, when some container ports are mapped to `0.0.0.0` and
          others are mapped to specific host addresses. [moby/moby#50054](https://redirect.github.com/moby/moby/pull/50054)\n-
          The `network inspect` response for an overlay network now reports that `EnableIPv4`
          is true. [moby/moby#50147](https://redirect.github.com/moby/moby/pull/50147)\n-
          Windows: Improve daemon startup time in cases where the host has networks
          of type `\"Mirrored\"`. [moby/moby#50155](https://redirect.github.com/moby/moby/pull/50155)\n-
          Windows: Make sure `docker system prune` and `docker network prune` only
          remove networks created by Docker. [moby/moby#50154](https://redirect.github.com/moby/moby/pull/50154)\n\n#####
          API\n\n- Update API version to 1.51. [moby/moby#50145](https://redirect.github.com/moby/moby/pull/50145)\n-
          `GET /images/json` now sets the value of the `Containers` field for all
          images to the count of containers using the image. [moby/moby#50146](https://redirect.github.com/moby/moby/pull/50146)\n\n#####
          Deprecations\n\n- Empty/nil image config fields in the `GET /images/{name}/json`
          response are now deprecated and will be removed in v29.0. [docker/cli#6129](https://redirect.github.com/docker/cli/pull/6129)\n-
          api/types/container: deprecate `ExecOptions.Detach`. This field is not used,
          and will be removed in a future release. [moby/moby#50219](https://redirect.github.com/moby/moby/pull/50219)\n-
          pkg/idtools: deprecate `IdentityMapping` and `Identity.Chown`. [moby/moby#50210](https://redirect.github.com/moby/moby/pull/50210)\n\n###
          [`v28.2.2`](https://redirect.github.com/moby/moby/releases/tag/v28.2.2):
          28.2.2\n\n[Compare Source](https://redirect.github.com/moby/moby/compare/v28.2.1...v28.2.2)\n\n####
          28.2.2\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.2.2 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.2.2)\n-
          [moby/moby, 28.2.2 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.2.2)\n\n#####
          Bug fixes and enhancements\n\n- containerd image store: Fix a regression
          causing `docker build --push` to fail. This reverts [the fix](https://redirect.github.com/moby/moby/pull/49702)
          for `docker build` not persisting overridden images as dangling. [moby/moby#50105](https://redirect.github.com/moby/moby/pull/50105)\n\n#####
          Networking\n\n- When creating the iptables `DOCKER-USER` chain, do not add
          an explicit `RETURN` rule, allowing users to append as well as insert their
          own rules. Existing rules are not removed on upgrade, but it won't be replaced
          after a reboot. [moby/moby#50098](https://redirect.github.com/moby/moby/pull/50098)\n\n###
          [`v28.2.1`](https://redirect.github.com/moby/moby/releases/tag/v28.2.1):
          28.2.1\n\n[Compare Source](https://redirect.github.com/moby/moby/compare/v28.2.0...v28.2.1)\n\n####
          28.2.1\n\n#### Packaging updates\n\n- Fix packaging regression in [v28.2.0](https://redirect.github.com/moby/moby/releases/tag/v28.2.0)
          which broke creating the `docker` group/user on fresh installations. [docker-ce-packaging#1209](https://redirect.github.com/docker/docker-ce-packaging/issues/1209)\n\n###
          [`v28.2.0`](https://redirect.github.com/moby/moby/releases/tag/v28.2.0):
          28.2.0\n\n[Compare Source](https://redirect.github.com/moby/moby/compare/v28.1.1...v28.2.0)\n\n####
          28.2.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.2.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.2.0)\n-
          [moby/moby, 28.2.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.2.0)\n-
          Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.2.0/docs/deprecated.md).\n-
          Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.2.0/docs/api/version-history.md).\n\n>
          \\[!NOTE]\n> RHEL packages are currently not available and will be released
          later.\n\n##### New\n\n- Add `{{.Platform}}` as formatting option for `docker
          ps` to show the platform of the image the container is running. [docker/cli#6042](https://redirect.github.com/docker/cli/pull/6042)\n-
          Add support for relative parent paths (`../`) on bind mount sources when
          using `docker run/create` with `-v/--volume` or `--mount type=bind` options.
          [docker/cli#4966](https://redirect.github.com/docker/cli/pull/4966)\n- CDI
          is now enabled by default. [moby/moby#49963](https://redirect.github.com/moby/moby/pull/49963)\n-
          Show discovered CDI devices in `docker info`. [docker/cli#6078](https://redirect.github.com/docker/cli/pull/6078)\n-
          `docker image rm`: add `--platform` option to remove a variant from multi-platform
          images. [docker/cli#6109](https://redirect.github.com/docker/cli/pull/6109)\n-
          containerd image store: Initial BuildKit support for building Windows container
          images on Windows (requires an opt-in with `DOCKER_BUILDKIT=1`). [moby/moby#49740](https://redirect.github.com/moby/moby/pull/49740)\n\n#####
          Bug fixes and enhancements\n\n- Add a new log option for fluentd log driver
          (`fluentd-write-timeout`), which enables specifying write timeouts for fluentd
          connections. [moby/moby#49911](https://redirect.github.com/moby/moby/pull/49911)\n-
          Add support for `DOCKER_AUTH_CONFIG` for the experimental `--use-api-socket`
          option. [docker/cli#6019](https://redirect.github.com/docker/cli/pull/6019)\n-
          Fix `docker exec` waiting for 10 seconds if a non-existing user or group
          was specified. [moby/moby#49868](https://redirect.github.com/moby/moby/pull/49868)\n-
          Fix `docker swarm init` ignoring `cacert` option of `--external-ca`. [docker/cli#5995](https://redirect.github.com/docker/cli/pull/5995)\n-
          Fix an issue where the CLI would not correctly save the configuration file
          (`~/.docker/config.json`) if it was a relative symbolic link. [docker/cli#5282](https://redirect.github.com/docker/cli/pull/5282)\n-
          Fix containers with `--restart always` policy using CDI devices failing
          to start on daemon restart. [moby/moby#49990](https://redirect.github.com/moby/moby/pull/49990)\n-
          Fix shell-completion to only complete some flags once, even though they
          can be set multiple times. [docker/cli#6030](https://redirect.github.com/docker/cli/pull/6030)\n-
          Fix the `plugin does not implement PluginAddr interface` error for Swarm
          CSI drivers. [moby/moby#49961](https://redirect.github.com/moby/moby/pull/49961)\n-
          Improve `docker login` error messages for invalid options. [docker/cli#6036](https://redirect.github.com/docker/cli/pull/6036)\n-
          Make sure the terminal state is restored if the CLI is forcefully terminated.
          [docker/cli#6058](https://redirect.github.com/docker/cli/pull/6058)\n- Update
          the default seccomp profile to match the libseccomp v2.6.0. The new syscalls
          are: `listmount`, `statmount`, `lsm_get_self_attr`, `lsm_list_modules`,
          `lsm_set_self_attr`, `mseal`, `uretprobe`, `riscv_hwprobe`, `getxattrat`,
          `listxattrat`, `removexattrat`, and `setxattrat`. This prevents containers
          from receiving EPERM errors when using them. [moby/moby#50077](https://redirect.github.com/moby/moby/pull/50077)\n-
          `docker inspect`: add shell completion, improve flag-description for `--type`
          and improve validation. [docker/cli#6052](https://redirect.github.com/docker/cli/pull/6052)\n-
          containerd image store: Enable BuildKit garbage collector by default. [moby/moby#49899](https://redirect.github.com/moby/moby/pull/49899)\n-
          containerd image store: Fix `docker build` not persisting overridden images
          as dangling. [moby/moby#49702](https://redirect.github.com/moby/moby/pull/49702)\n-
          containerd image store: Fix `docker system df` reporting a negative reclaimable
          space amount. [moby/moby#49707](https://redirect.github.com/moby/moby/pull/49707)\n-
          containerd image store: Fix duplicate `PUT` requests when pushing a multi-platform
          image. [moby/moby#49949](https://redirect.github.com/moby/moby/pull/49949)\n\n#####
          Packaging updates\n\n- Drop Ubuntu 20.04 \"Focal\" packages as it reached
          end of life. [docker/docker-ce-packaging#1200](https://redirect.github.com/docker/docker-ce-packaging/pull/1200)\n-
          Fix install location for RPM-based `docker-ce` man-pages. [docker/docker-ce-packaging#1203](https://redirect.github.com/docker/docker-ce-packaging/pull/1203)\n-
          Update BuildKit to [v0.22.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.22.0).
          [moby/moby#50046](https://redirect.github.com/moby/moby/pull/50046)\n- Update
          Buildx to [v0.24.0](https://redirect.github.com/docker/buildx/releases/tag/v0.24.0).
          [docker/docker-ce-packaging#1205](https://redirect.github.com/docker/docker-ce-packaging/pull/1205)\n-
          Update Compose to [v2.36.2](https://redirect.github.com/docker/compose/releases/tag/v2.36.2).
          [docker/docker-ce-packaging#1208](https://redirect.github.com/docker/docker-ce-packaging/pull/1208)\n-
          Update Go runtime to [1.24.3](https://go.dev/doc/devel/release#go1.24.3).
          [docker/docker-ce-packaging#1192](https://redirect.github.com/docker/docker-ce-packaging/pull/1192),
          [docker/cli#6060](https://redirect.github.com/docker/cli/pull/6060), [moby/moby#49174](https://redirect.github.com/moby/moby/pull/49174)\n\n#####
          Networking\n\n- Add bridge network option `\"com.docker.network.bridge.trusted_host_interfaces\"`,
          accepting a colon-separated list of interface names. These interfaces have
          direct access to published ports on container IP addresses. [moby/moby#49832](https://redirect.github.com/moby/moby/pull/49832)\n-
          Add daemon option `\"allow-direct-routing\"` to disable filtering of packets
          from outside the host addressed directly to containers. [moby/moby#49832](https://redirect.github.com/moby/moby/pull/49832)\n-
          Do not display network options `com.docker.network.enable_ipv4` or `com.docker.network.enable_ipv6`
          in inspect output if they have been overridden by `EnableIPv4` or `EnableIPv6`
          in the network create request. [moby/moby#49866](https://redirect.github.com/moby/moby/pull/49866)\n-
          Fix an issue that could cause network deletion to fail after a daemon restart,
          with error \"has active endpoints\" listing empty endpoint names. [moby/moby#49901](https://redirect.github.com/moby/moby/pull/49901)\n-
          Fix an issue where `docker network inspect --verbose` could sometimes crash
          the daemon. [moby/moby#49937](https://redirect.github.com/moby/moby/pull/49937)\n-
          Fix an issue where the load-balancer IP address for an overlay network would
          not be released in certain cases if the Swarm was lacking an ingress network.
          [moby/moby#49948](https://redirect.github.com/moby/moby/pull/49948)\n- Improve
          the reliability of NetworkDB in busy clusters and lossy networks. [moby/moby#49932](https://redirect.github.com/moby/moby/pull/49932)\n-
          Improvements to the reliability and convergence speed of NetworkDB. [moby/moby#49939](https://redirect.github.com/moby/moby/pull/49939)\n\n#####
          API\n\n- Update API version to `1.50`.\n- `DELETE /images/{name}` now supports
          a `platforms` query parameter. It accepts an array of JSON-encoded OCI Platform
          objects, allowing for selecting a specific platforms to delete content for.
          [moby/moby#49982](https://redirect.github.com/moby/moby/pull/49982)\n- `GET
          /info` now includes a `DiscoveredDevices` field. This is an array of `DeviceInfo`
          objects, each providing details about a device discovered by a device driver.
          [moby/moby#49980](https://redirect.github.com/moby/moby/pull/49980)\n\n#####
          Go SDK\n\n- `api/types/container`: add `ContainerState` and constants for
          container state. [moby/moby#49965](https://redirect.github.com/moby/moby/pull/49965)\n-
          `api/types/container`: change `Summary.State` to a `ContainerState`. [moby/moby#49991](https://redirect.github.com/moby/moby/pull/49991)\n-
          `api/types/container`: define `HealthStatus` type for health-status constants.
          [moby/moby#49876](https://redirect.github.com/moby/moby/pull/49876)\n- `api/types`:
          deprecate `BuildResult`, `ImageBuildOptions`, `ImageBuildOutput`, `ImageBuildResponse`,
          `BuilderVersion`, `BuilderV1`, and `BuilderBuildKi` which were moved to
          `api/types/build`. [moby/moby#50025](https://redirect.github.com/moby/moby/pull/50025)\n\n#####
          Deprecations\n\n- API: Deprecated: `GET /images/{name}/json` no longer returns
          the following fields: `Config`, `Hostname`, `Domainname`, `AttachStdin`,
          `AttachStdout`, `AttachStderr`, `Tty`, `OpenStdin`, `StdinOnce`, `Image`,
          `NetworkDisabled` (already omitted unless set), `MacAddress` (already omitted
          unless set), `StopTimeout` (already omitted unless set). These additional
          fields were included in the response due to an implementation detail but
          not part of the image's Configuration, were marked deprecated in API v1.46,
          and are now omitted. [moby/moby#48457](https://redirect.github.com/moby/moby/pull/48457)\n-
          Go-SDK: Deprecate builder/remotecontext.Rel(). This function was needed
          on older versions of Go, but can now be replaced by `filepath.Rel()`. [moby/moby#49843](https://redirect.github.com/moby/moby/pull/49843)\n-
          Go-SDK: api/types: deprecate `BuildCachePruneOptions` in favor of `api/types/builder.CachePruneOptions`.
          [moby/moby#50015](https://redirect.github.com/moby/moby/pull/50015)\n- Go-SDK:
          api/types: deprecate `BuildCachePruneReport` in favor of `api/types/builder.CachePruneReport`.
          [moby/moby#50015](https://redirect.github.com/moby/moby/pull/50015)\n- Go-SDK:
          api/types: deprecate `NodeListOptions`, `NodeRemoveOptions`, `ServiceCreateOptions`,
          `ServiceUpdateOptions`, `RegistryAuthFromSpec`, `RegistryAuthFromPreviousSpec`,
          `ServiceListOptions`, `ServiceInspectOptions`, and `SwarmUnlockKeyResponse`
          which were moved to `api/types/swarm`. [moby/moby#50027](https://redirect.github.com/moby/moby/pull/50027)\n-
          Go-SDK: api/types: deprecate `SecretCreateResponse`, `SecretListOptions`,
          `ConfigCreateResponse`, `ConfigListOptions` which were moved to api/types/swarm.
          [moby/moby#50024](https://redirect.github.com/moby/moby/pull/50024)\n- Go-SDK:
          client: deprecate `IsErrNotFound`. [moby/moby#50012](https://redirect.github.com/moby/moby/pull/50012)\n-
          Go-SDK: container: deprecate `IsValidHealthString` in favor of `api/types/container.ValidateHealthStatus`.
          [moby/moby#49893](https://redirect.github.com/moby/moby/pull/49893)\n- Go-SDK:
          container: deprecate `StateStatus`, `WaitCondition`, and the related  `WaitConditionNotRunning`,
          `WaitConditionNextExit`, and `WaitConditionRemoved` consts in favor of their
          equivalents in `api/types/container`. [moby/moby#49874](https://redirect.github.com/moby/moby/pull/49874)\n-
          Go-SDK: opts: deprecate `ListOpts.GetAll` in favor of `ListOpts.GetSlice`.
          [docker/cli#6032](https://redirect.github.com/docker/cli/pull/6032)\n- Remove
          deprecated `IsAutomated` formatting placeholder from `docker search`. [docker/cli#6091](https://redirect.github.com/docker/cli/pull/6091)\n-
          Remove fallback for pulling images from non-OCI-compliant `docker.pkg.github.com`
          registry. [moby/moby#50094](https://redirect.github.com/moby/moby/pull/50094)\n-
          Remove support for pulling legacy v2, schema 1 images and remove `DOCKER_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE`
          environment-variable. [moby/moby#50036](https://redirect.github.com/moby/moby/pull/50036),
          [moby/moby#42300](https://redirect.github.com/moby/moby/pull/42300)\n- The
          `BridgeNfIptables` and `BridgeNfIp6tables` fields in the `GET /info` response
          were deprecated in API v1.48, and are now omitted in API v1.50. [moby/moby#49904](https://redirect.github.com/moby/moby/pull/49904)\n-
          errdefs: Deprecate `errdefs.FromStatusCode`. Use containerd's `errhttp.ToNative`
          instead. [moby/moby#50030](https://redirect.github.com/moby/moby/pull/50030)\n\n###
          [`v28.1.1`](https://redirect.github.com/moby/moby/releases/tag/v28.1.1)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.1.0...v28.1.1)\n\n####
          28.1.1\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.1.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.1)\n-
          [moby/moby, 28.1.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.1)\n\n#####
          Bug fixes and enhancements\n\n- Fix `dockerd-rootless-setuptool.sh` incorrectly
          reporting missing `iptables`. [moby/moby#49833](https://redirect.github.com/moby/moby/pull/49833)\n-
          containerd image store: Fix a potential daemon crash when using `docker
          load` with archives containing zero-size tar headers. [moby/moby#49837](https://redirect.github.com/moby/moby/pull/49837)\n\n#####
          Packaging updates\n\n- Update Buildx to [v0.23.0](https://redirect.github.com/docker/buildx/releases/tag/v0.23.0).
          [docker/docker-ce-packaging#1185](https://redirect.github.com/docker/docker-ce-packaging/pull/1185)\n-
          Update Compose to [v2.35.1](https://redirect.github.com/docker/compose/releases/tag/v2.35.1).
          [docker/docker-ce-packaging#1188](https://redirect.github.com/docker/docker-ce-packaging/pull/1188)\n\n#####
          Networking\n\n- Add a warning to a container's `/etc/resolv.conf` when no
          upstream DNS servers were found. [moby/moby#49827](https://redirect.github.com/moby/moby/pull/49827)\n\n###
          [`v28.1.0`](https://redirect.github.com/moby/moby/releases/tag/v28.1.0)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.4...v28.1.0)\n\n####
          28.1.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.1.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
          [moby/moby, 28.1.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
          Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.1.0/docs/api/version-history.md).\n\n#####
          New\n\n- Add `docker bake` sub-command as alias for `docker buildx bake`.
          [docker/cli#5947](https://redirect.github.com/docker/cli/pull/5947)\n- Experimental:
          add a new `--use-api-socket` flag on `docker run` and `docker create` to
          enable access to Docker socket from inside a container and to share credentials
          from the host with the container. [docker/cli#5858](https://redirect.github.com/docker/cli/pull/5858)\n-
          `docker image inspect` now supports a `--platform` flag to inspect a specific
          platform of a multi-platform image. [docker/cli#5934](https://redirect.github.com/docker/cli/pull/5934)\n\n#####
          Bug fixes and enhancements\n\n- Add CLI shell-completion for context names.
          [docker/cli#6016](https://redirect.github.com/docker/cli/pull/6016)\n- Fix
          `docker images --tree` not including non-container images content size in
          the total image content size. [docker/cli#6000](https://redirect.github.com/docker/cli/pull/6000)\n-
          Fix `docker load` not preserving replaced images. [moby/moby#49650](https://redirect.github.com/moby/moby/pull/49650)\n-
          Fix `docker login` hints when logging in to a custom registry. [docker/cli#6015](https://redirect.github.com/docker/cli/pull/6015)\n-
          Fix `docker stats` not working properly on machines with high CPU core count.
          [moby/moby#49734](https://redirect.github.com/moby/moby/pull/49734)\n- Fix
          a regression causing `docker pull/push` to fail when interacting with a
          private repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n-
          Fix an issue preventing rootless Docker setup on a host with no `ip_tables`
          kernel module. [moby/moby#49727](https://redirect.github.com/moby/moby/pull/49727)\n-
          Fix an issue that could lead to unwanted iptables rules being restored and
          never deleted following a firewalld reload. [moby/moby#49728](https://redirect.github.com/moby/moby/pull/49728)\n-
          Improve CLI completion of `docker service scale`. [docker/cli#5968](https://redirect.github.com/docker/cli/pull/5968)\n-
          `docker images --tree` now hides both untagged and dangling images by default.
          [docker/cli#5924](https://redirect.github.com/docker/cli/pull/5924)\n- `docker
          system info` will provide an exit code if a connection cannot be established
          to the Docker daemon. [docker/cli#5918](https://redirect.github.com/docker/cli/pull/5918)\n-
          containerd image store: Fix `image tag` event not being emitted when building
          with BuildKit. [moby/moby#49678](https://redirect.github.com/moby/moby/pull/49678)\n-
          containerd image store: Improve `docker push/pull` handling of remote registry
          errors. [moby/moby#49770](https://redirect.github.com/moby/moby/pull/49770)\n-
          containerd image store: Show pull progress for non-layer image blobs. [moby/moby#49746](https://redirect.github.com/moby/moby/pull/49746)\n\n#####
          Packaging updates\n\n- Add Debian \"Trixie\" packages. [docker/docker-ce-packaging#1181](https://redirect.github.com/docker/docker-ce-packaging/pull/1181)\n-
          Add Fedora 42 packages. [docker/containerd-packaging#418](https://redirect.github.com/docker/containerd-packaging/pull/418),
          [docker/docker-ce-packaging#1169](https://redirect.github.com/docker/docker-ce-packaging/pull/1169)\n-
          Add Ubuntu 25.04 \"Plucky Puffin\" packages. [docker/containerd-packaging#419](https://redirect.github.com/docker/containerd-packaging/pull/419),
          [docker/docker-ce-packaging#1177](https://redirect.github.com/docker/docker-ce-packaging/pull/1177)\n-
          Update BuildKit to [v0.21.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.21.0).
          [moby/moby#49809](https://redirect.github.com/moby/moby/pull/49809)\n- Update
          Compose to [v2.35.0](https://redirect.github.com/docker/compose/releases/tag/v2.35.0).
          [docker/docker-ce-packaging#1183](https://redirect.github.com/docker/docker-ce-packaging/pull/1183)\n-
          Update Go runtime to [1.23.8](https://go.dev/doc/devel/release#go1.23.8).
          [docker/cli#5986](https://redirect.github.com/docker/cli/pull/5986), [docker/docker-ce-packaging#1180](https://redirect.github.com/docker/docker-ce-packaging/pull/1180),
          [moby/moby#49737](https://redirect.github.com/moby/moby/pull/49737)\n\n#####
          Networking\n\n- Fix a bug causing host port-mappings on Swarm containers
          to be duplicated on `docker ps` and `docker inspect`. [moby/moby#49724](https://redirect.github.com/moby/moby/pull/49724)\n-
          Fix an issue that caused container network attachment to fail with error
          \"Bridge port not forwarding\". [moby/moby#49705](https://redirect.github.com/moby/moby/pull/49705)\n-
          Fix an issue with removal of a `--link` from a container in the default
          bridge network. [moby/moby#49778](https://redirect.github.com/moby/moby/pull/49778)\n-
          Improve how network-endpoint relationships are tracked to reduce the chance
          of the \"has active endpoints\" error to be wrongfully returned. [moby/moby#49736](https://redirect.github.com/moby/moby/pull/49736)\n-
          Improve the \"has active endpoints\" error message by including the name
          of endpoints still connected to the network being deleted. [moby/moby#49773](https://redirect.github.com/moby/moby/pull/49773)\n\n#####
          API\n\n- Update API version to [v1.49](https://docs.docker.com/engine/api/v1.49/).
          [moby/moby#49718](https://redirect.github.com/moby/moby/pull/49718)\n- `GET
          /image/{name}/json` now supports a `platform` parameter allowing to specify
          which platform variant of a multi-platform image to inspect. [moby/moby#49586](https://redirect.github.com/moby/moby/pull/49586)\n-
          `GET /info` now returns a `FirewallBackend` containing information about
          the daemon's firewalling configuration. [moby/moby#49761](https://redirect.github.com/moby/moby/pull/49761)\n\n#####
          Go SDK\n\n- Update minimum required Go version to go1.23. [docker/cli#5868](https://redirect.github.com/docker/cli/pull/5868)\n-
          cli/command/context: remove temporary `ContextType` field from JSON output.
          [docker/cli#5981](https://redirect.github.com/docker/cli/pull/5981)\n- client:
          Keep image references in canonical format where possible. [moby/moby#49609](https://redirect.github.com/moby/moby/pull/49609)\n\n#####
          Deprecations\n\n- API: Deprecated `AllowNondistributableArtifactsCIDRs`
          and `AllowNondistributableArtifactsHostnames` fields in the `RegistryConfig`
          struct in the `GET /info` response are omitted in API v1.49. [moby/moby#49749](https://redirect.github.com/moby/moby/pull/49749)\n-
          API: Deprecated: The `ContainerdCommit.Expected`, `RuncCommit.Expected`,
          and `InitCommit.Expected` fields in the `GET /info` endpoint were deprecated
          in API v1.48, and are now omitted in API v1.49. [moby/moby#48556](https://redirect.github.com/moby/moby/pull/48556)\n-
          Go-SDK: cli/command/image: Deprecate `RunPull`: this function was only used
          internally and will be removed in the next release. [docker/cli#5975](https://redirect.github.com/docker/cli/pull/5975)\n-
          Go-SDK: cli/config/configfile: deprecate `ConfigFile.Experimental` field.
          Experimental CLI features are always enabled since version v20.10 and this
          field is no longer used. Use `ConfigFile.Features` instead for optional
          features. This field will be removed in a future release. [docker/cli#5977](https://redirect.github.com/docker/cli/pull/5977)\n-
          Go-SDK: deprecate `pkg/archive`, which was migrated to `github.com/moby/go-archive`.
          [moby/moby#49743](https://redirect.github.com/moby/moby/pull/49743)\n- Go-SDK:
          deprecate `pkg/atomicwriter`, which was migrated to `github.com/moby/sys/atomicwriter`.
          [moby/moby#49748](https://redirect.github.com/moby/moby/pull/49748)\n- Go-SDK:
          opts: remove deprecated `PortOpt`, `ConfigOpt`, `SecretOpt` aliases. [docker/cli#5953](https://redirect.github.com/docker/cli/pull/5953)\n-
          Go-SDK: registry: deprecate `APIEndpoint.Official` field. [moby/moby#49706](https://redirect.github.com/moby/moby/pull/49706)\n\n###
          [`v28.0.4`](https://redirect.github.com/moby/moby/releases/tag/v28.0.4)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.3...v28.0.4)\n\n####
          28.0.4\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.4 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.4)\n-
          [moby/moby, 28.0.4 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.4)\n\n#####
          Bug fixes and enhancements\n\n- Fix a regression causing `docker pull/push`
          to fail when interacting with a private repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n\n###
          [`v28.0.3`](https://redirect.github.com/moby/moby/releases/tag/v28.0.3)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.2...v28.0.3)\n\n####
          28.0.3\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.3 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.3)\n-
          [moby/moby, 28.0.3 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.3)\n\n#####
          Bug fixes and enhancements\n\n- Fix `docker run` truncating the `STDOUT`/`STDERR`
          prematurely when the container exits before the data is consumed. [docker/cli#5957](https://redirect.github.com/docker/cli/pull/5957)\n\n#####
          Packaging updates\n\n- Update BuildKit to [v0.20.2](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.2).
          [moby/moby#49698](https://redirect.github.com/moby/moby/pull/49698)\n- Update
          `runc` to [v1.2.6](https://redirect.github.com/opencontainers/runc/releases/tag/v1.2.6)
          (static packages only). [moby/moby#49682](https://redirect.github.com/moby/moby/pull/49682)\n-
          Update containerd to [v1.7.26](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.26).
          [docker/containerd-packaging#409](https://redirect.github.com/docker/containerd-packaging/pull/409)\n\n###
          [`v28.0.2`](https://redirect.github.com/moby/moby/releases/tag/v28.0.2)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.1...v28.0.2)\n\n####
          28.0.2\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.2 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.2)\n-
          [moby/moby, 28.0.2 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.2)\n\n#####
          Bug fixes and enhancements\n\n- Fix CLI-specific attributes (`docker.cli.*`)
          being unintentionally passed to downstream OTel services. [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n-
          Fix an issue where user-specified `OTEL_RESOURCE_ATTRIBUTES` were being
          overridden by CLI's internal telemetry attributes. The CLI now properly
          merges user-specified attributes with internal ones, allowing both to coexist.
          [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n- Fix
          daemon failing to start on Windows when a container created before v28.0.0
          was present. [moby/moby#49626](https://redirect.github.com/moby/moby/pull/49626)\n-
          Fix possible error on `docker buildx prune` with the `--min-free-space`.
          [moby/moby#49623](https://redirect.github.com/moby/moby/pull/49623)\n- Fix
          spurious `io: read/write on closed pipe` error in the daemon log when closing
          container. [moby/moby#49590](https://redirect.github.com/moby/moby/pull/49590)\n-
          Fix the Docker daemon failing too early if the containerd socket isn't immediately
          available. [moby/moby#49603](https://redirect.github.com/moby/moby/pull/49603)\n-
          Mask Linux thermal interrupt info in a container's `/proc` and `/sys` by
          default. [moby/moby#49560](https://redirect.github.com/moby/moby/pull/49560)\n-
          Update `contrib/check-config.sh` to check for more kernel modules related
          to iptables. [moby/moby#49622](https://redirect.github.com/moby/moby/pull/49622)\n-
          containerd image store: Fix integer overflow in User ID handling passed
          via `--user`. [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n-
          containerd image store: Fix spurious `reference for unknown type: application/vnd.in-toto+json`
          warning being logged to the daemon's log. [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n-
          containerd image store: Improve performance of `docker ps` when running
          large number of containers. [moby/moby#49365](https://redirect.github.com/moby/moby/pull/49365)\n\n#####
          Packaging updates\n\n- Update BuildKit to [v0.20.1](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.1).
          [moby/moby#49587](https://redirect.github.com/moby/moby/pull/49587)\n- Update
          Buildx to [v0.22.0](https://redirect.github.com/docker/buildx/releases/tag/v0.22.0).
          [docker/docker-ce-packaging#1175](https://redirect.github.com/docker/docker-ce-packaging/pull/1175)\n-
          Update Compose to [v2.34.0](https://redirect.github.com/docker/compose/releases/tag/v2.34.0).
          [docker/docker-ce-packaging#1172](https://redirect.github.com/docker/docker-ce-packaging/pull/1172)\n-
          Update Go runtime to [1.23.7](https://go.dev/doc/devel/release#go1.23.7).
          [docker/cli#5890](https://redirect.github.com/docker/cli/pull/5890), [docker/docker-ce-packaging#1171](https://redirect.github.com/docker/docker-ce-packaging/pull/1171),
          [moby/moby#49580](https://redirect.github.com/moby/moby/pull/49580)\n- Update
          RootlessKit to [v2.3.4](https://redirect.github.com/rootless-containers/rootlesskit/releases/tag/v2.3.4).
          [moby/moby#49614](https://redirect.github.com/moby/moby/pull/49614)\n- Update
          containerd (static binaries only) to [v1.7.27](https://www.github.com/containerd/containerd/releases/tag/v1.7.27).
          [moby/moby#49656](https://redirect.github.com/moby/moby/pull/49656)\n\n#####
          Networking\n\n- Add environment variable `DOCKER_INSECURE_NO_IPTABLES_RAW=1`
          to allow Docker to run on systems where the Linux kernel can't provide `CONFIG_IP_NF_RAW`
          support. When enabled, Docker will not create rules in the iptables `raw`
          table. Warning: This is not recommended for production environments as it
          reduces security by allowing other hosts on the local network to route to
          ports published to host addresses, even when they are published to `127.0.0.1.`
          This option bypasses some of the security hardening introduced in Docker
          Engine 28.0.0. [moby/moby#49621](https://redirect.github.com/moby/moby/pull/49621)\n-
          Allow container startup when an endpoint is attached to a macvlan network
          where the parent interface is down. [moby/moby#49630](https://redirect.github.com/moby/moby/pull/49630)\n-
          Do not skip DNAT for packets originating in a gateway\\_mode=routed network.
          [moby/moby#49577](https://redirect.github.com/moby/moby/pull/49577)\n- Fix
          a bug causing `docker ps` to inconsistently report dual-stack port mappings.
          [moby/moby#49657](https://redirect.github.com/moby/moby/pull/49657)\n- Fix
          a bug that could cause `docker-proxy` to stop forwarding UDP datagrams to
          containers. [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n-
          Fix a bug that was causing `docker-proxy` to close UDP connections to containers
          eagerly and resulting in the source address to change needlessly. [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n\n#####
          Go SDK\n\n- Move various types and consts from `cli-plugins/manager` to
          a separate package. [docker/cli#5902](https://redirect.github.com/docker/cli/pull/5902)\n-
          Update minimum required Go version to go1.23. [moby/moby#49541](https://redirect.github.com/moby/moby/pull/49541)\n-
          `cli/command`: Move `PrettyPrint` utility to `cli/command/formatter`. [docker/cli#5916](https://redirect.github.com/docker/cli/pull/5916)\n-
          runconfig/errors: split `ErrConflictHostNetwork` into `ErrConflictConnectToHostNetwork`
          and `ErrConflictDisconnectFromHostNetwork`. [moby/moby#49605](https://redirect.github.com/moby/moby/pull/49605)\n\n#####
          Deprecations\n\n- Go-SDK: Deprecate `cli-plugins/manager.ResourceAttributesEnvvar`
          constant. It was used internally, but holds the `OTEL_RESOURCE_ATTRIBUTES`
          name, which is part of the OpenTelemetry specification. Users of this constant
          should define their own. It will be removed in the next release. [docker/cli#5881](https://redirect.github.com/docker/cli/pull/5881)\n-
          Go-SDK: Deprecate `opts.PortOpt`, `opts.ConfigOpt` and `opts.SecretOpt`.
          These types were moved to the `opts/swarmopts` package. [docker/cli#5907](https://redirect.github.com/docker/cli/pull/5907)\n-
          Go-SDK: Remove `service/logs` package. [docker/cli#5910](https://redirect.github.com/docker/cli/pull/5910)\n-
          Go-SDK: `cli/command/image`: Deprecate `PushTrustedReference` and move to
          `cli/trust`. [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-
          Go-SDK: `cli/command/image`: Deprecate and internalize `TrustedPush`. [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-
          Go-SDK: `cli/command`: deprecate `Cli.NotaryClient`: use [`trust.GetNotaryRepository`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/trust#GetNotaryRepository)
          instead. This method is no longer used and will be removed in the next release.
          [docker/cli#5885](https://redirect.github.com/docker/cli/pull/5885)\n- Go-SDK:
          `cli/command`: deprecate `Cli.RegistryClient`. This method was only used
          internally and will be removed in the next release. Use [`client.NewRegistryClient`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/registry/client#NewRegistryClient)
          instead. [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889),
          [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889)\n- Go-SDK:
          `registry`: Deprecate `RepositoryInfo.Official` field. [moby/moby#49567](https://redirect.github.com/moby/moby/pull/49567)\n-
          Go-SDK: `registry`: deprecate `HostCertsDir`: this function was only used
          internally and will be removed in the next release. [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n-
          Go-SDK: `registry`: deprecate `SetCertsDir`: the cert-directory is now automatically
          selected when running with RootlessKit, and should no longer be set manually.
          [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n\n###
          [`v28.0.1`](https://redirect.github.com/moby/moby/releases/tag/v28.0.1)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.0...v28.0.1)\n\n###
          28.0.1\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.1)\n-
          [moby/moby, 28.0.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.1)\n\n####
          Networking\n\n- Remove dependency on kernel modules `ip_set`, `ip_set_hash_net`
          and `netfilter_xt_set`.\n  - The dependency was introduced in release 28.0.0
          but proved too disruptive. The iptables rules using these modules have been
          replaced. [moby/moby#49530](https://redirect.github.com/moby/moby/pull/49530)\n-
          Allow daemon startup on a host with IPv6 disabled without requiring `--ip6tables=false`.
          [moby/moby#49525](https://redirect.github.com/moby/moby/pull/49525)\n- Fix
          a bug that was causing containers with `--restart=always` and a published
          port already in use to restart in a tight loop. [moby/moby#49507](https://redirect.github.com/moby/moby/pull/49507)\n-
          Fix an issue with Swarm ingress, caused by incorrect ordering of iptables
          rules. [moby/moby#49538](https://redirect.github.com/moby/moby/pull/49538)\n-
          Fix creation of a swarm-scoped network from a `--config-only` network. [moby/moby#49521](https://redirect.github.com/moby/moby/pull/49521)\n-
          Fix `docker network inspect` reporting an IPv6 gateway with CIDR suffix
          for a newly created network with no specific IPAM config, until a daemon
          restart. [moby/moby#49520](https://redirect.github.com/moby/moby/pull/49520)\n-
          Improve the error reported when kernel modules `ip_set`, `ip_set_hash_net`
          and `netilter_xt_set` are not available. [moby/moby#49524](https://redirect.github.com/moby/moby/pull/49524)\n-
          Move most of Docker's iptables rules out of the filter-FORWARD chain, so
          that other applications are free to append rules that must follow Docker's
          rules. [moby/moby#49518](https://redirect.github.com/moby/moby/pull/49518)\n-
          Update `--help` output and man page lo state which options only apply to
          the default bridge network. [moby/moby#49522](https://redirect.github.com/moby/moby/pull/49522)\n\n####
          Bug fixes and enhancements\n\n- Fix `docker context create` always returning
          an error when using the `\"skip-tls-verify\"` option. [docker/cli#5850](https://redirect.github.com/docker/cli/pull/5850)\n-
          Fix shell completion suggesting IDs instead of names for services and nodes.
          [docker/cli#5848](https://redirect.github.com/docker/cli/pull/5848)\n- Fix
          unintentionally printing exit status to standard error output when `docker
          exec/run` returns a non-zero status. [docker/cli#5854](https://redirect.github.com/docker/cli/pull/5854)\n-
          Fix regression `protocol \"tcp\" is not supported by the RootlessKit port
          driver \"slirp4netns\"`. [moby/moby#49514](https://redirect.github.com/moby/moby/pull/49514)\n-
          containerd image store: Fix `docker inspect` not being able to show multi-platform
          images with missing layers for all platforms. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
          containerd image store: Fix `docker images --tree` reporting wrong content
          size. [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n-
          Fix compilation on i386 [moby/moby#49526](https://redirect.github.com/moby/moby/pull/49526)\n\n####
          Packaging updates\n\n- Update `github.com/go-jose/go-jose/v4` to v4.0.5
          to address. [GHSA-c6gw-w398-hv78](https://redirect.github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78)
          / [CVE-2025-27144](https://www.cve.org/CVERecord?id=CVE-2025-27144) [docker/cli#5867](https://redirect.github.com/docker/cli/pull/5867)\n-
          Update Buildx to [v0.21.1](https://redirect.github.com/docker/buildx/releases/tag/v0.21.1).
          [docker/docker-ce-packaging#1167](https://redirect.github.com/docker/docker-ce-packaging/pull/1167)\n-
          Update Compose to [v2.33.1](https://redirect.github.com/docker/compose/releases/tag/v2.33.1).
          [docker/docker-ce-packaging#1168](https://redirect.github.com/docker/docker-ce-packaging/pull/1168)\n\n####
          API\n\n- containerd image store: Fix `GET /images/json?manifests=1` not
          filling `Manifests` for index-only images. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
          containerd image store: Fix `GET /images/json and /images/<name>/json` `Size.Content`
          field including the size of content that's not available locally. [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n\n###
          [`v28.0.0`](https://redirect.github.com/moby/moby/releases/tag/v28.0.0)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v27.5.1...v28.0.0)\n\n###
          28.0.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
          [moby/moby, 28.0.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
          Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.0.0/docs/deprecated.md).\n-
          Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.0.0/docs/api/version-history.md).\n\n####
          New\n\n- Add ability to mount an image inside a container via `--mount type=image`.
          [moby/moby#48798](https://redirect.github.com/moby/moby/pull/48798)\n  -
          You can also specify `--mount type=image,image-subpath=[subpath],...` option
          to mount a specific path from the image. [docker/cli#5755](https://redirect.github.com/docker/cli/pull/5755)\n-
          `docker images --tree` now shows metadata badges. [docker/cli#5744](https://redirect.github.com/docker/cli/pull/5744)\n-
          `docker load`, `docker save`, and `docker history` now support a `--platform`
          flag allowing you to choose a specific platform for single-platform operations
          on multi-platform images. [docker/cli#5331](https://redirect.github.com/docker/cli/pull/5331)\n-
          Add `OOMScoreAdj` to `docker service create` and `docker stack`. [docker/cli#5145](https://redirect.github.com/docker/cli/pull/5145)\n-
          `docker buildx prune` now supports `reserved-space`, `max-used-space`, `min-free-space`
          and `keep-bytes` filters. [moby/moby#48720](https://redirect.github.com/moby/moby/pull/48720)\n-
          Windows: Add support for running containerd as a child process of the daemon,
          instead of using a system-installed containerd. [moby/moby#47955](https://redirect.github.com/moby/moby/pull/47955)\n\n####
          Networking\n\n- The `docker-proxy` binary has been updated, older versions
          will not work with the updated `dockerd`. [moby/moby#48132](https://redirect.github.com/moby/moby/pull/48132)\n
          \ - Close a window in which the userland proxy (`docker-proxy`) could accept
          TCP connections, that would then fail after `iptables` NAT rules were set
          up.\n  - The executable `rootlesskit-docker-proxy` is no longer used, it
          has been removed from the build and distribution.\n- DNS nameservers read
          from the host's `/etc/resolv.conf` are now always accessed from the host's
          network namespace. [moby/moby#48290](https://redirect.github.com/moby/moby/pull/48290)\n
          \ - When the host's `/etc/resolv.conf` contains no nameservers and there
          are no `--dns` overrides, Google's DNS servers are no longer used, apart
          from by the default bridge network and in build containers.\n- Container
          interfaces in bridge and macvlan networks now use randomly generated MAC
          addresses. [moby/moby#48808](https://redirect.github.com/moby/moby/pull/48808)\n
          \ - Gratuitous ARP / Neighbour Advertisement messages will be sent when
          the interfaces are started so that, when IP addresses are reused, they're
          associated with the newly generated MAC address.\n  - IPv6 addresses in
          the default bridge network are now IPAM-assigned, rather than being derived
          from the MAC address.\n- The deprecated OCI `prestart` hook is now only
          used by build containers. For other containers, network interfaces are added
          to the network namespace after task creation is complete, before the container
          task is started. [moby/moby#47406](https://redirect.github.com/moby/moby/pull/47406)\n-
          Add a new `gw-priority` option to `docker run`, `docker container create`,
          and `docker network connect`. This option will be used by the Engine to
          determine which network provides the default gateway for a container. On
          `docker run`, this option is only available through the extended `--network`
          syntax. [docker/cli#5664](https://redirect.github.com/docker/cli/pull/5664)\n-
          Add a new netlabel `com.docker.network.endpoint.ifname` to customize the
          interface name used when connecting a container to a network. It's supported
          by all built-in network drivers on Linux. [moby/moby#49155](https://redirect.github.com/moby/moby/pull/49155)\n
          \ - When a container is created with multiple networks specified, there's
          no guarantee on the order networks will be connected to the container. So,
          if a custom interface name uses the same prefix as the auto-generated names,
          for example `eth`, the container might fail to start.\n  - The recommended
          practice is to use a different prefix, for example `en0`, or a numerical
          suffix high enough to never collide, for example `eth100`.\n  - This label
          can be specified on `docker network connect` via the `--driver-opt` flag,
          for example `docker network connect --driver-opt=com.docker.network.endpoint.ifname=foobar
          \u2026`.\n  - Or via the long-form `--network` flag on `docker run`, for
          example `docker run --network=name=bridge,driver-opt=com.docker.network.endpoint.ifname=foobar
          \u2026`\n- If a custom network driver reports capability `GwAllocChecker`
          then, before a network is created, it will get a `GwAllocCheckerRequest`
          with the network's options. The custom driver may then reply that no gateway
          IP address should be allocated. [moby/moby#49372](https://redirect.github.com/moby/moby/pull/49372)\n\n####
          Port publishing in bridge networks\n\n- `dockerd` now requires `ipset` support
          in the Linux kernel. [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n
          \ - The `iptables` and `ip6tables` rules used to implement port publishing
          and network isolation have been extensively modified. This enables some
          of the following functional changes, and is a first step in refactoring
          to enable native `nftables` support in a future release. [moby/moby#48815](https://redirect.github.com/moby/moby/issues/48815)\n
          \ - If it becomes necessary to downgrade to an earlier version of the daemon,
          some manual cleanup of the new rules will be necessary. The simplest and
          surest approach is to reboot the host, or use `iptables -F` and `ip6tables
          -F` to flush all existing `iptables` rules from the `filter` table before
          starting the older version of the daemon. When that is not possible, run
          the following commands as root:\n    - `iptables -D FORWARD -m set --match-set
          docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED -j
          ACCEPT; ip6tables -D FORWARD -m set --match-set docker-ext-bridges-v6 dst
          -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT`\n    - `iptables -D
          FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER; ip6tables
          -D FORWARD -m set --match-set docker-ext-bridges-v6 dst -j DOCKER`\n    -
          If you were previously running with the iptables filter-FORWARD policy set
          to `ACCEPT` and need to restore access to unpublished ports, also delete
          per-bridge-network rules from the `DOCKER` chains. For example, `iptables
          -D DOCKER ! -i docker0 -o docker0 -j DROP`.\n- Fix a security issue that
          was allowing remote hosts to connect directly to a container on its published
          ports. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
          Fix a security issue that was allowing neighbor hosts to connect to ports
          mapped on a loopback address. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
          Fix an issue that prevented port publishing to link-local addresses. [moby/moby#48570](https://redirect.github.com/moby/moby/pull/48570)\n-
          UDP ports published by a container are now reliably accessible by containers
          on other networks, via the host's public IP address. [moby/moby#48571](https://redirect.github.com/moby/moby/pull/48571)\n-
          Docker will now only set the `ip6tables` policy for the `FORWARD` chain
          in the `filter` table to `DROP` if it enables IP forwarding on the host
          itself (sysctls `net.ipv6.conf.all.forwarding` and `net.ipv6.conf.default.forwarding`).
          This is now aligned with existing IPv4 behaviour. [moby/moby#48594](https://redirect.github.com/moby/moby/pull/48594)\n
          \ - If IPv6 forwarding is enabled on your host, but you were depending on
          Docker to set the ip6tables filter-FORWARD policy to `DROP`, you may need
          to update your host's configuration to make sure it is secure.\n- Direct
          routed access to container ports that are not exposed using `p`/`-publish`
          is now blocked in the `DOCKER` iptables chain. [moby/moby#48724](https://redirect.github.com/moby/moby/pull/48724)\n
          \ - If the default iptables filter-FORWARD policy was previously left at
          `ACCEPT` on your host, and direct routed access to a container's unpublished
          ports from a remote host is still required, options are:\n    - Publish
          the ports you need.\n    - Use the new `gateway_mode_ipv[46]=nat-unprotected`,
          described below.\n  - Container ports published to host addresses will continue
          to be accessible via those host addresses, using NAT or the userland proxy.\n
          \ - Unpublished container ports continue to be directly accessible from
          the Docker host via the container's IP address.\n- Networks created with
          `gateway_mode_ipv[46]=routed` are now accessible from other bridge networks
          running on the same Docker host, as well as from outside the host. [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n-
          Bridge driver options `com.docker.network.bridge.gateway_mode_ipv4` and
          `com.docker.network.bridge.gateway_mode_ipv6` now accept mode `nat-unprotected`.
          [moby/moby#48597](https://redirect.github.com/moby/moby/pull/48597)\n  -
          `nat-unprotected` is similar to the default `nat` mode, but no per port/protocol
          rules are set up. This means any port on a container can be accessed by
          direct-routing from a remote host.\n- Bridge driver options `com.docker.network.bridge.gateway_mode_ipv4`
          and `com.docker.network.bridge.gateway_mode_ipv6` now accept mode `isolated`,
          when the network is also `internal`. [moby/moby#49262](https://redirect.github.com/moby/moby/pull/49262)\n
          \ - An address is normally assigned to the bridge device in an `internal`
          network. So, processes on the Docker host can access the network, and containers
          in the network can access host services listening on that bridge address
          (including services listening on \"any\" host address, `0.0.0.0` or `::`).\n
          \ - An `internal` bridge network created with gateway mode `isolated` does
          not have an address on the Docker host.\n- When a port mapping includes
          a host IP address or port number that cannot be used because NAT from the
          host is disabled using `--gateway_mode_ipv[46]`, container creation will
          no longer fail. The unused fields may be needed if the gateway endpoint
          changes when networks are connected or disconnected. A message about the
          unused fields will be logged. [moby/moby#48575](https://redirect.github.com/moby/moby/pull/48575)\n-
          Do not create iptables nat-POSTROUTING masquerade rules for a container's
          own published ports, when the userland proxy is enabled. [moby/moby#48854](https://redirect.github.com/moby/moby/pull/48854)\n\n####
          IPv6\n\n- Add `docker network create` option `--ipv4`. To disable IPv4 address
          assignment for a network, use `docker network create --ipv4=false [...]`.
          [docker/cli#5599](https://redirect.github.com/docker/cli/pull/5599)\n- Daemon
          option `--ipv6` (`\"ipv6\": true` in `daemon.json`) can now be used without
          `fixed-cidr-v6`. [moby/moby#48319](https://redirect.github.com/moby/moby/pull/48319)\n-
          IPAM now handles subnets bigger than \"/64\". [moby/moby#49223](https://redirect.github.com/moby/moby/pull/49223)\n-
          Duplicate address detection (DAD) is now disabled for addresses assigned
          to the bridges belonging to bridge networks. [moby/moby#48609](https://redirect.github.com/moby/moby/pull/48609)\n-
          Modifications to `host-gateway`, for compatibility with IPv6-only networks.
          [moby/moby#48807](https://redirect.github.com/moby/moby/pull/48807)\n  -
          When special value `host-gateway` is used in an `--add-host` option in place
          of an address, it's replaced by an address on the Docker host to make it
          possible to refer to the host by name. The address used belongs to the default
          bridge (normally `docker0`). Until now it's always been an IPv4 address,
          because all containers on bridge networks had IPv4 addresses.\n  - Now,
          if IPv6 is enabled on the default bridge network, `/etc/hosts` entries will
          be created for IPv4 and IPv6 addresses. So, a container that's only connected
          to IPv6-only networks can access the host by name.\n  - The `--host-gateway-ip`
          option overrides the address used to replace `host-gateway`. Two of these
          options are now allowed on the command line, for one IPv4 gateway and one
          IPv6.\n  - In the `daemon.json` file, to provide two addresses, use `\"host-gateway-ips\"`.
          For example, `\"host-gateway-ips\": [\"192.0.2.1\", \"2001:db8::1111\"]`.\n\n####
          Bug fixes and enhancements\n\n- Add IPv6 loopback address as an insecure
          registry by default. [moby/moby#48540](https://redirect.github.com/moby/moby/pull/48540)\n-
          Add support for Cobra-generated completion scripts for `dockerd`. [moby/moby#49339](https://redirect.github.com/moby/moby/pull/49339)\n-
          Fix DNS queries failing when containers are launched via `systemd` auto-start
          on boot [moby/moby#48812](htt\n\n</details>\n\n---\n\n### Configuration\n\n\U0001F4C5
          **Schedule**: Branch creation - At any time (no schedule defined), Automerge
          - At any time (no schedule defined).\n\n\U0001F6A6 **Automerge**: Disabled
          by config. Please merge this manually once you are satisfied.\n\n\u267B
          **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry
          checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded
          about this update again.\n\n---\n\n - [ ] <!-- rebase-check -->If you want
          to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated
          by [Mend Renovate](https://mend.io/renovate/). View the [repository job
          log](https://developer.mend.io/github/osism/ci-image).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQwLjYyLjEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbInJlbm92YXRlIl19-->\n"
        change_url: https://github.com/osism/ci-image/pull/57
        commit_id: 5782a1d08cb7c618372f9c0486e17f9ea793d5c1
        patchset: 5782a1d08cb7c618372f9c0486e17f9ea793d5c1
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ci-image
          name: osism/ci-image
          short_name: ci-image
        src_dir: src/github.com/osism/ci-image
        topic: null
      change: '57'
      change_message: "chore(deps): update dependency moby/moby to v28\n\nThis PR
        contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
        [moby/moby](https://redirect.github.com/moby/moby) | major | `27.5.1` -> `28.3.0`
        |\n\n---\n\n### Release Notes\n\n<details>\n<summary>moby/moby (moby/moby)</summary>\n\n###
        [`v28.3.0`](https://redirect.github.com/moby/moby/releases/tag/v28.3.0): 28.3.0\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.2.2...v28.3.0)\n\n####
        28.3.0\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n- [docker/cli, 28.3.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.3.0)\n-
        [moby/moby, 28.3.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.3.0)\n-
        Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.3.0/docs/deprecated.md).\n-
        Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.3.0/docs/api/version-history.md).\n\n#####
        New\n\n- Add support for AMD GPUs in `docker run --gpus`. [moby/moby#49952](https://redirect.github.com/moby/moby/pull/49952)\n-
        Use `DOCKER_AUTH_CONFIG` as a credential store. [docker/cli#6008](https://redirect.github.com/docker/cli/pull/6008)\n\n#####
        Bug fixes and enhancements\n\n- Ensure that the state of the container in
        the daemon database (used by [/containers/json](https://docs.docker.com/reference/api/engine/version/v1.49/#tag/Container/operation/ContainerList)
        API) is up to date when the container is stopped using the [/containers/{id}/stop](https://docs.docker.com/reference/api/engine/version/v1.49/#tag/Container/operation/ContainerStop)
        API (before response of API). [moby/moby#50136](https://redirect.github.com/moby/moby/pull/50136)\n-
        Fix `docker image inspect inspect` omitting empty fields. [moby/moby#50135](https://redirect.github.com/moby/moby/pull/50135)\n-
        Fix `docker images --tree` not marking images as in-use when the containerd
        image store is disabled. [docker/cli#6140](https://redirect.github.com/docker/cli/pull/6140)\n-
        Fix `docker pull/push` hang in non-interactive when authentication is required
        caused by prompting for login credentials. [docker/cli#6141](https://redirect.github.com/docker/cli/pull/6141)\n-
        Fix a potential resource leak when a node leaves a Swarm. [moby/moby#50115](https://redirect.github.com/moby/moby/pull/50115)\n-
        Fix a regression where a login prompt on `docker pull` would show Docker Hub-specific
        hints when logging in on other registries. [docker/cli#6135](https://redirect.github.com/docker/cli/pull/6135)\n-
        Fix an issue where all new tasks in the Swarm could get stuck in the PENDING
        state forever after scaling up a service with placement preferences. [moby/moby#50211](https://redirect.github.com/moby/moby/pull/50211)\n-
        Remove an undocumented, hidden, top-level `docker remove` command that was
        accidentally introduced in Docker 23.0. [docker/cli#6144](https://redirect.github.com/docker/cli/pull/6144)\n-
        Validate registry-mirrors configuration as part of `dockerd --validate` and
        improve error messages for invalid mirrors. [moby/moby#50240](https://redirect.github.com/moby/moby/pull/50240)\n-
        `dockerd-rootless-setuptool.sh`: Fix the script from silently returning with
        no error message when subuid/subgid system requirements are not satisfied.
        [moby/moby#50059](https://redirect.github.com/moby/moby/pull/50059)\n- containerd
        image store: Fix `docker push` not creating a tag on the remote repository.
        [moby/moby#50199](https://redirect.github.com/moby/moby/pull/50199)\n- containerd
        image store: Improve handling of errors returned by the token server during
        `docker pull/push`. [moby/moby#50176](https://redirect.github.com/moby/moby/pull/50176)\n\n#####
        Packaging updates\n\n- Allow customizing containerd service name for OpenRC.
        [moby/moby#50156](https://redirect.github.com/moby/moby/pull/50156)\n- Update
        BuildKit to [v0.23.1](https://redirect.github.com/moby/buildkit/releases/tag/v0.23.1).
        [moby/moby#50243](https://redirect.github.com/moby/moby/pull/50243)\n- Update
        Buildx to [v0.25.0](https://redirect.github.com/docker/buildx/releases/tag/v0.25.0).
        [docker/docker-ce-packaging#1217](https://redirect.github.com/docker/docker-ce-packaging/pull/1217)\n-
        Update Compose to [v2.37.2](https://redirect.github.com/docker/compose/releases/tag/v2.37.2).
        [docker/docker-ce-packaging#1219](https://redirect.github.com/docker/docker-ce-packaging/pull/1219)\n-
        Update Docker Model CLI plugin to [v0.1.30](https://redirect.github.com/docker/model-cli/releases/tag/v0.1.30).
        [docker/docker-ce-packaging#1218](https://redirect.github.com/docker/docker-ce-packaging/pull/1218)\n-
        Update Go runtime to [1.24.4](https://go.dev/doc/devel/release#go1.24.4).
        [docker/docker-ce-packaging#1213](https://redirect.github.com/docker/docker-ce-packaging/pull/1213),
        [moby/moby#50153](https://redirect.github.com/moby/moby/pull/50153), [docker/cli#6124](https://redirect.github.com/docker/cli/pull/6124)\n\n#####
        Networking\n\n- Revert Swarm related changes added in 28.2.x builds, due to
        a regression reported in [https://github.com/moby/moby/issues/50129](https://redirect.github.com/moby/moby/issues/50129).
        [moby/moby#50169](https://redirect.github.com/moby/moby/pull/50169)\n  - Revert:
        Fix an issue where `docker network inspect --verbose` could sometimes crash
        the daemon ([https://github.com/moby/moby/pull/49937](https://redirect.github.com/moby/moby/pull/49937)).\n
        \ - Revert: Fix an issue where the load-balancer IP address for an overlay
        network would not be released in certain cases if the Swarm was lacking an
        ingress network ([https://github.com/moby/moby/pull/49948](https://redirect.github.com/moby/moby/pull/49948)).\n
        \ - Revert: Improve the reliability of NetworkDB in busy clusters and lossy
        networks ([https://github.com/moby/moby/pull/49932](https://redirect.github.com/moby/moby/pull/49932)).\n
        \ - Revert: Improvements to the reliability and convergence speed of NetworkDB
        ([https://github.com/moby/moby/pull/49939](https://redirect.github.com/moby/moby/pull/49939)).\n-
        Fix an issue that could cause container startup to fail, or lead to failed
        UDP port mappings, when some container ports are mapped to `0.0.0.0` and others
        are mapped to specific host addresses. [moby/moby#50054](https://redirect.github.com/moby/moby/pull/50054)\n-
        The `network inspect` response for an overlay network now reports that `EnableIPv4`
        is true. [moby/moby#50147](https://redirect.github.com/moby/moby/pull/50147)\n-
        Windows: Improve daemon startup time in cases where the host has networks
        of type `\"Mirrored\"`. [moby/moby#50155](https://redirect.github.com/moby/moby/pull/50155)\n-
        Windows: Make sure `docker system prune` and `docker network prune` only remove
        networks created by Docker. [moby/moby#50154](https://redirect.github.com/moby/moby/pull/50154)\n\n#####
        API\n\n- Update API version to 1.51. [moby/moby#50145](https://redirect.github.com/moby/moby/pull/50145)\n-
        `GET /images/json` now sets the value of the `Containers` field for all images
        to the count of containers using the image. [moby/moby#50146](https://redirect.github.com/moby/moby/pull/50146)\n\n#####
        Deprecations\n\n- Empty/nil image config fields in the `GET /images/{name}/json`
        response are now deprecated and will be removed in v29.0. [docker/cli#6129](https://redirect.github.com/docker/cli/pull/6129)\n-
        api/types/container: deprecate `ExecOptions.Detach`. This field is not used,
        and will be removed in a future release. [moby/moby#50219](https://redirect.github.com/moby/moby/pull/50219)\n-
        pkg/idtools: deprecate `IdentityMapping` and `Identity.Chown`. [moby/moby#50210](https://redirect.github.com/moby/moby/pull/50210)\n\n###
        [`v28.2.2`](https://redirect.github.com/moby/moby/releases/tag/v28.2.2): 28.2.2\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.2.1...v28.2.2)\n\n####
        28.2.2\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n- [docker/cli, 28.2.2 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.2.2)\n-
        [moby/moby, 28.2.2 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.2.2)\n\n#####
        Bug fixes and enhancements\n\n- containerd image store: Fix a regression causing
        `docker build --push` to fail. This reverts [the fix](https://redirect.github.com/moby/moby/pull/49702)
        for `docker build` not persisting overridden images as dangling. [moby/moby#50105](https://redirect.github.com/moby/moby/pull/50105)\n\n#####
        Networking\n\n- When creating the iptables `DOCKER-USER` chain, do not add
        an explicit `RETURN` rule, allowing users to append as well as insert their
        own rules. Existing rules are not removed on upgrade, but it won't be replaced
        after a reboot. [moby/moby#50098](https://redirect.github.com/moby/moby/pull/50098)\n\n###
        [`v28.2.1`](https://redirect.github.com/moby/moby/releases/tag/v28.2.1): 28.2.1\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.2.0...v28.2.1)\n\n####
        28.2.1\n\n#### Packaging updates\n\n- Fix packaging regression in [v28.2.0](https://redirect.github.com/moby/moby/releases/tag/v28.2.0)
        which broke creating the `docker` group/user on fresh installations. [docker-ce-packaging#1209](https://redirect.github.com/docker/docker-ce-packaging/issues/1209)\n\n###
        [`v28.2.0`](https://redirect.github.com/moby/moby/releases/tag/v28.2.0): 28.2.0\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.1.1...v28.2.0)\n\n####
        28.2.0\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n- [docker/cli, 28.2.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.2.0)\n-
        [moby/moby, 28.2.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.2.0)\n-
        Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.2.0/docs/deprecated.md).\n-
        Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.2.0/docs/api/version-history.md).\n\n>
        \\[!NOTE]\n> RHEL packages are currently not available and will be released
        later.\n\n##### New\n\n- Add `{{.Platform}}` as formatting option for `docker
        ps` to show the platform of the image the container is running. [docker/cli#6042](https://redirect.github.com/docker/cli/pull/6042)\n-
        Add support for relative parent paths (`../`) on bind mount sources when using
        `docker run/create` with `-v/--volume` or `--mount type=bind` options. [docker/cli#4966](https://redirect.github.com/docker/cli/pull/4966)\n-
        CDI is now enabled by default. [moby/moby#49963](https://redirect.github.com/moby/moby/pull/49963)\n-
        Show discovered CDI devices in `docker info`. [docker/cli#6078](https://redirect.github.com/docker/cli/pull/6078)\n-
        `docker image rm`: add `--platform` option to remove a variant from multi-platform
        images. [docker/cli#6109](https://redirect.github.com/docker/cli/pull/6109)\n-
        containerd image store: Initial BuildKit support for building Windows container
        images on Windows (requires an opt-in with `DOCKER_BUILDKIT=1`). [moby/moby#49740](https://redirect.github.com/moby/moby/pull/49740)\n\n#####
        Bug fixes and enhancements\n\n- Add a new log option for fluentd log driver
        (`fluentd-write-timeout`), which enables specifying write timeouts for fluentd
        connections. [moby/moby#49911](https://redirect.github.com/moby/moby/pull/49911)\n-
        Add support for `DOCKER_AUTH_CONFIG` for the experimental `--use-api-socket`
        option. [docker/cli#6019](https://redirect.github.com/docker/cli/pull/6019)\n-
        Fix `docker exec` waiting for 10 seconds if a non-existing user or group was
        specified. [moby/moby#49868](https://redirect.github.com/moby/moby/pull/49868)\n-
        Fix `docker swarm init` ignoring `cacert` option of `--external-ca`. [docker/cli#5995](https://redirect.github.com/docker/cli/pull/5995)\n-
        Fix an issue where the CLI would not correctly save the configuration file
        (`~/.docker/config.json`) if it was a relative symbolic link. [docker/cli#5282](https://redirect.github.com/docker/cli/pull/5282)\n-
        Fix containers with `--restart always` policy using CDI devices failing to
        start on daemon restart. [moby/moby#49990](https://redirect.github.com/moby/moby/pull/49990)\n-
        Fix shell-completion to only complete some flags once, even though they can
        be set multiple times. [docker/cli#6030](https://redirect.github.com/docker/cli/pull/6030)\n-
        Fix the `plugin does not implement PluginAddr interface` error for Swarm CSI
        drivers. [moby/moby#49961](https://redirect.github.com/moby/moby/pull/49961)\n-
        Improve `docker login` error messages for invalid options. [docker/cli#6036](https://redirect.github.com/docker/cli/pull/6036)\n-
        Make sure the terminal state is restored if the CLI is forcefully terminated.
        [docker/cli#6058](https://redirect.github.com/docker/cli/pull/6058)\n- Update
        the default seccomp profile to match the libseccomp v2.6.0. The new syscalls
        are: `listmount`, `statmount`, `lsm_get_self_attr`, `lsm_list_modules`, `lsm_set_self_attr`,
        `mseal`, `uretprobe`, `riscv_hwprobe`, `getxattrat`, `listxattrat`, `removexattrat`,
        and `setxattrat`. This prevents containers from receiving EPERM errors when
        using them. [moby/moby#50077](https://redirect.github.com/moby/moby/pull/50077)\n-
        `docker inspect`: add shell completion, improve flag-description for `--type`
        and improve validation. [docker/cli#6052](https://redirect.github.com/docker/cli/pull/6052)\n-
        containerd image store: Enable BuildKit garbage collector by default. [moby/moby#49899](https://redirect.github.com/moby/moby/pull/49899)\n-
        containerd image store: Fix `docker build` not persisting overridden images
        as dangling. [moby/moby#49702](https://redirect.github.com/moby/moby/pull/49702)\n-
        containerd image store: Fix `docker system df` reporting a negative reclaimable
        space amount. [moby/moby#49707](https://redirect.github.com/moby/moby/pull/49707)\n-
        containerd image store: Fix duplicate `PUT` requests when pushing a multi-platform
        image. [moby/moby#49949](https://redirect.github.com/moby/moby/pull/49949)\n\n#####
        Packaging updates\n\n- Drop Ubuntu 20.04 \"Focal\" packages as it reached
        end of life. [docker/docker-ce-packaging#1200](https://redirect.github.com/docker/docker-ce-packaging/pull/1200)\n-
        Fix install location for RPM-based `docker-ce` man-pages. [docker/docker-ce-packaging#1203](https://redirect.github.com/docker/docker-ce-packaging/pull/1203)\n-
        Update BuildKit to [v0.22.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.22.0).
        [moby/moby#50046](https://redirect.github.com/moby/moby/pull/50046)\n- Update
        Buildx to [v0.24.0](https://redirect.github.com/docker/buildx/releases/tag/v0.24.0).
        [docker/docker-ce-packaging#1205](https://redirect.github.com/docker/docker-ce-packaging/pull/1205)\n-
        Update Compose to [v2.36.2](https://redirect.github.com/docker/compose/releases/tag/v2.36.2).
        [docker/docker-ce-packaging#1208](https://redirect.github.com/docker/docker-ce-packaging/pull/1208)\n-
        Update Go runtime to [1.24.3](https://go.dev/doc/devel/release#go1.24.3).
        [docker/docker-ce-packaging#1192](https://redirect.github.com/docker/docker-ce-packaging/pull/1192),
        [docker/cli#6060](https://redirect.github.com/docker/cli/pull/6060), [moby/moby#49174](https://redirect.github.com/moby/moby/pull/49174)\n\n#####
        Networking\n\n- Add bridge network option `\"com.docker.network.bridge.trusted_host_interfaces\"`,
        accepting a colon-separated list of interface names. These interfaces have
        direct access to published ports on container IP addresses. [moby/moby#49832](https://redirect.github.com/moby/moby/pull/49832)\n-
        Add daemon option `\"allow-direct-routing\"` to disable filtering of packets
        from outside the host addressed directly to containers. [moby/moby#49832](https://redirect.github.com/moby/moby/pull/49832)\n-
        Do not display network options `com.docker.network.enable_ipv4` or `com.docker.network.enable_ipv6`
        in inspect output if they have been overridden by `EnableIPv4` or `EnableIPv6`
        in the network create request. [moby/moby#49866](https://redirect.github.com/moby/moby/pull/49866)\n-
        Fix an issue that could cause network deletion to fail after a daemon restart,
        with error \"has active endpoints\" listing empty endpoint names. [moby/moby#49901](https://redirect.github.com/moby/moby/pull/49901)\n-
        Fix an issue where `docker network inspect --verbose` could sometimes crash
        the daemon. [moby/moby#49937](https://redirect.github.com/moby/moby/pull/49937)\n-
        Fix an issue where the load-balancer IP address for an overlay network would
        not be released in certain cases if the Swarm was lacking an ingress network.
        [moby/moby#49948](https://redirect.github.com/moby/moby/pull/49948)\n- Improve
        the reliability of NetworkDB in busy clusters and lossy networks. [moby/moby#49932](https://redirect.github.com/moby/moby/pull/49932)\n-
        Improvements to the reliability and convergence speed of NetworkDB. [moby/moby#49939](https://redirect.github.com/moby/moby/pull/49939)\n\n#####
        API\n\n- Update API version to `1.50`.\n- `DELETE /images/{name}` now supports
        a `platforms` query parameter. It accepts an array of JSON-encoded OCI Platform
        objects, allowing for selecting a specific platforms to delete content for.
        [moby/moby#49982](https://redirect.github.com/moby/moby/pull/49982)\n- `GET
        /info` now includes a `DiscoveredDevices` field. This is an array of `DeviceInfo`
        objects, each providing details about a device discovered by a device driver.
        [moby/moby#49980](https://redirect.github.com/moby/moby/pull/49980)\n\n#####
        Go SDK\n\n- `api/types/container`: add `ContainerState` and constants for
        container state. [moby/moby#49965](https://redirect.github.com/moby/moby/pull/49965)\n-
        `api/types/container`: change `Summary.State` to a `ContainerState`. [moby/moby#49991](https://redirect.github.com/moby/moby/pull/49991)\n-
        `api/types/container`: define `HealthStatus` type for health-status constants.
        [moby/moby#49876](https://redirect.github.com/moby/moby/pull/49876)\n- `api/types`:
        deprecate `BuildResult`, `ImageBuildOptions`, `ImageBuildOutput`, `ImageBuildResponse`,
        `BuilderVersion`, `BuilderV1`, and `BuilderBuildKi` which were moved to `api/types/build`.
        [moby/moby#50025](https://redirect.github.com/moby/moby/pull/50025)\n\n#####
        Deprecations\n\n- API: Deprecated: `GET /images/{name}/json` no longer returns
        the following fields: `Config`, `Hostname`, `Domainname`, `AttachStdin`, `AttachStdout`,
        `AttachStderr`, `Tty`, `OpenStdin`, `StdinOnce`, `Image`, `NetworkDisabled`
        (already omitted unless set), `MacAddress` (already omitted unless set), `StopTimeout`
        (already omitted unless set). These additional fields were included in the
        response due to an implementation detail but not part of the image's Configuration,
        were marked deprecated in API v1.46, and are now omitted. [moby/moby#48457](https://redirect.github.com/moby/moby/pull/48457)\n-
        Go-SDK: Deprecate builder/remotecontext.Rel(). This function was needed on
        older versions of Go, but can now be replaced by `filepath.Rel()`. [moby/moby#49843](https://redirect.github.com/moby/moby/pull/49843)\n-
        Go-SDK: api/types: deprecate `BuildCachePruneOptions` in favor of `api/types/builder.CachePruneOptions`.
        [moby/moby#50015](https://redirect.github.com/moby/moby/pull/50015)\n- Go-SDK:
        api/types: deprecate `BuildCachePruneReport` in favor of `api/types/builder.CachePruneReport`.
        [moby/moby#50015](https://redirect.github.com/moby/moby/pull/50015)\n- Go-SDK:
        api/types: deprecate `NodeListOptions`, `NodeRemoveOptions`, `ServiceCreateOptions`,
        `ServiceUpdateOptions`, `RegistryAuthFromSpec`, `RegistryAuthFromPreviousSpec`,
        `ServiceListOptions`, `ServiceInspectOptions`, and `SwarmUnlockKeyResponse`
        which were moved to `api/types/swarm`. [moby/moby#50027](https://redirect.github.com/moby/moby/pull/50027)\n-
        Go-SDK: api/types: deprecate `SecretCreateResponse`, `SecretListOptions`,
        `ConfigCreateResponse`, `ConfigListOptions` which were moved to api/types/swarm.
        [moby/moby#50024](https://redirect.github.com/moby/moby/pull/50024)\n- Go-SDK:
        client: deprecate `IsErrNotFound`. [moby/moby#50012](https://redirect.github.com/moby/moby/pull/50012)\n-
        Go-SDK: container: deprecate `IsValidHealthString` in favor of `api/types/container.ValidateHealthStatus`.
        [moby/moby#49893](https://redirect.github.com/moby/moby/pull/49893)\n- Go-SDK:
        container: deprecate `StateStatus`, `WaitCondition`, and the related  `WaitConditionNotRunning`,
        `WaitConditionNextExit`, and `WaitConditionRemoved` consts in favor of their
        equivalents in `api/types/container`. [moby/moby#49874](https://redirect.github.com/moby/moby/pull/49874)\n-
        Go-SDK: opts: deprecate `ListOpts.GetAll` in favor of `ListOpts.GetSlice`.
        [docker/cli#6032](https://redirect.github.com/docker/cli/pull/6032)\n- Remove
        deprecated `IsAutomated` formatting placeholder from `docker search`. [docker/cli#6091](https://redirect.github.com/docker/cli/pull/6091)\n-
        Remove fallback for pulling images from non-OCI-compliant `docker.pkg.github.com`
        registry. [moby/moby#50094](https://redirect.github.com/moby/moby/pull/50094)\n-
        Remove support for pulling legacy v2, schema 1 images and remove `DOCKER_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE`
        environment-variable. [moby/moby#50036](https://redirect.github.com/moby/moby/pull/50036),
        [moby/moby#42300](https://redirect.github.com/moby/moby/pull/42300)\n- The
        `BridgeNfIptables` and `BridgeNfIp6tables` fields in the `GET /info` response
        were deprecated in API v1.48, and are now omitted in API v1.50. [moby/moby#49904](https://redirect.github.com/moby/moby/pull/49904)\n-
        errdefs: Deprecate `errdefs.FromStatusCode`. Use containerd's `errhttp.ToNative`
        instead. [moby/moby#50030](https://redirect.github.com/moby/moby/pull/50030)\n\n###
        [`v28.1.1`](https://redirect.github.com/moby/moby/releases/tag/v28.1.1)\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.1.0...v28.1.1)\n\n####
        28.1.1\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n- [docker/cli, 28.1.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.1)\n-
        [moby/moby, 28.1.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.1)\n\n#####
        Bug fixes and enhancements\n\n- Fix `dockerd-rootless-setuptool.sh` incorrectly
        reporting missing `iptables`. [moby/moby#49833](https://redirect.github.com/moby/moby/pull/49833)\n-
        containerd image store: Fix a potential daemon crash when using `docker load`
        with archives containing zero-size tar headers. [moby/moby#49837](https://redirect.github.com/moby/moby/pull/49837)\n\n#####
        Packaging updates\n\n- Update Buildx to [v0.23.0](https://redirect.github.com/docker/buildx/releases/tag/v0.23.0).
        [docker/docker-ce-packaging#1185](https://redirect.github.com/docker/docker-ce-packaging/pull/1185)\n-
        Update Compose to [v2.35.1](https://redirect.github.com/docker/compose/releases/tag/v2.35.1).
        [docker/docker-ce-packaging#1188](https://redirect.github.com/docker/docker-ce-packaging/pull/1188)\n\n#####
        Networking\n\n- Add a warning to a container's `/etc/resolv.conf` when no
        upstream DNS servers were found. [moby/moby#49827](https://redirect.github.com/moby/moby/pull/49827)\n\n###
        [`v28.1.0`](https://redirect.github.com/moby/moby/releases/tag/v28.1.0)\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.0.4...v28.1.0)\n\n####
        28.1.0\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n- [docker/cli, 28.1.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
        [moby/moby, 28.1.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
        Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.1.0/docs/api/version-history.md).\n\n#####
        New\n\n- Add `docker bake` sub-command as alias for `docker buildx bake`.
        [docker/cli#5947](https://redirect.github.com/docker/cli/pull/5947)\n- Experimental:
        add a new `--use-api-socket` flag on `docker run` and `docker create` to enable
        access to Docker socket from inside a container and to share credentials from
        the host with the container. [docker/cli#5858](https://redirect.github.com/docker/cli/pull/5858)\n-
        `docker image inspect` now supports a `--platform` flag to inspect a specific
        platform of a multi-platform image. [docker/cli#5934](https://redirect.github.com/docker/cli/pull/5934)\n\n#####
        Bug fixes and enhancements\n\n- Add CLI shell-completion for context names.
        [docker/cli#6016](https://redirect.github.com/docker/cli/pull/6016)\n- Fix
        `docker images --tree` not including non-container images content size in
        the total image content size. [docker/cli#6000](https://redirect.github.com/docker/cli/pull/6000)\n-
        Fix `docker load` not preserving replaced images. [moby/moby#49650](https://redirect.github.com/moby/moby/pull/49650)\n-
        Fix `docker login` hints when logging in to a custom registry. [docker/cli#6015](https://redirect.github.com/docker/cli/pull/6015)\n-
        Fix `docker stats` not working properly on machines with high CPU core count.
        [moby/moby#49734](https://redirect.github.com/moby/moby/pull/49734)\n- Fix
        a regression causing `docker pull/push` to fail when interacting with a private
        repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n-
        Fix an issue preventing rootless Docker setup on a host with no `ip_tables`
        kernel module. [moby/moby#49727](https://redirect.github.com/moby/moby/pull/49727)\n-
        Fix an issue that could lead to unwanted iptables rules being restored and
        never deleted following a firewalld reload. [moby/moby#49728](https://redirect.github.com/moby/moby/pull/49728)\n-
        Improve CLI completion of `docker service scale`. [docker/cli#5968](https://redirect.github.com/docker/cli/pull/5968)\n-
        `docker images --tree` now hides both untagged and dangling images by default.
        [docker/cli#5924](https://redirect.github.com/docker/cli/pull/5924)\n- `docker
        system info` will provide an exit code if a connection cannot be established
        to the Docker daemon. [docker/cli#5918](https://redirect.github.com/docker/cli/pull/5918)\n-
        containerd image store: Fix `image tag` event not being emitted when building
        with BuildKit. [moby/moby#49678](https://redirect.github.com/moby/moby/pull/49678)\n-
        containerd image store: Improve `docker push/pull` handling of remote registry
        errors. [moby/moby#49770](https://redirect.github.com/moby/moby/pull/49770)\n-
        containerd image store: Show pull progress for non-layer image blobs. [moby/moby#49746](https://redirect.github.com/moby/moby/pull/49746)\n\n#####
        Packaging updates\n\n- Add Debian \"Trixie\" packages. [docker/docker-ce-packaging#1181](https://redirect.github.com/docker/docker-ce-packaging/pull/1181)\n-
        Add Fedora 42 packages. [docker/containerd-packaging#418](https://redirect.github.com/docker/containerd-packaging/pull/418),
        [docker/docker-ce-packaging#1169](https://redirect.github.com/docker/docker-ce-packaging/pull/1169)\n-
        Add Ubuntu 25.04 \"Plucky Puffin\" packages. [docker/containerd-packaging#419](https://redirect.github.com/docker/containerd-packaging/pull/419),
        [docker/docker-ce-packaging#1177](https://redirect.github.com/docker/docker-ce-packaging/pull/1177)\n-
        Update BuildKit to [v0.21.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.21.0).
        [moby/moby#49809](https://redirect.github.com/moby/moby/pull/49809)\n- Update
        Compose to [v2.35.0](https://redirect.github.com/docker/compose/releases/tag/v2.35.0).
        [docker/docker-ce-packaging#1183](https://redirect.github.com/docker/docker-ce-packaging/pull/1183)\n-
        Update Go runtime to [1.23.8](https://go.dev/doc/devel/release#go1.23.8).
        [docker/cli#5986](https://redirect.github.com/docker/cli/pull/5986), [docker/docker-ce-packaging#1180](https://redirect.github.com/docker/docker-ce-packaging/pull/1180),
        [moby/moby#49737](https://redirect.github.com/moby/moby/pull/49737)\n\n#####
        Networking\n\n- Fix a bug causing host port-mappings on Swarm containers to
        be duplicated on `docker ps` and `docker inspect`. [moby/moby#49724](https://redirect.github.com/moby/moby/pull/49724)\n-
        Fix an issue that caused container network attachment to fail with error \"Bridge
        port not forwarding\". [moby/moby#49705](https://redirect.github.com/moby/moby/pull/49705)\n-
        Fix an issue with removal of a `--link` from a container in the default bridge
        network. [moby/moby#49778](https://redirect.github.com/moby/moby/pull/49778)\n-
        Improve how network-endpoint relationships are tracked to reduce the chance
        of the \"has active endpoints\" error to be wrongfully returned. [moby/moby#49736](https://redirect.github.com/moby/moby/pull/49736)\n-
        Improve the \"has active endpoints\" error message by including the name of
        endpoints still connected to the network being deleted. [moby/moby#49773](https://redirect.github.com/moby/moby/pull/49773)\n\n#####
        API\n\n- Update API version to [v1.49](https://docs.docker.com/engine/api/v1.49/).
        [moby/moby#49718](https://redirect.github.com/moby/moby/pull/49718)\n- `GET
        /image/{name}/json` now supports a `platform` parameter allowing to specify
        which platform variant of a multi-platform image to inspect. [moby/moby#49586](https://redirect.github.com/moby/moby/pull/49586)\n-
        `GET /info` now returns a `FirewallBackend` containing information about the
        daemon's firewalling configuration. [moby/moby#49761](https://redirect.github.com/moby/moby/pull/49761)\n\n#####
        Go SDK\n\n- Update minimum required Go version to go1.23. [docker/cli#5868](https://redirect.github.com/docker/cli/pull/5868)\n-
        cli/command/context: remove temporary `ContextType` field from JSON output.
        [docker/cli#5981](https://redirect.github.com/docker/cli/pull/5981)\n- client:
        Keep image references in canonical format where possible. [moby/moby#49609](https://redirect.github.com/moby/moby/pull/49609)\n\n#####
        Deprecations\n\n- API: Deprecated `AllowNondistributableArtifactsCIDRs` and
        `AllowNondistributableArtifactsHostnames` fields in the `RegistryConfig` struct
        in the `GET /info` response are omitted in API v1.49. [moby/moby#49749](https://redirect.github.com/moby/moby/pull/49749)\n-
        API: Deprecated: The `ContainerdCommit.Expected`, `RuncCommit.Expected`, and
        `InitCommit.Expected` fields in the `GET /info` endpoint were deprecated in
        API v1.48, and are now omitted in API v1.49. [moby/moby#48556](https://redirect.github.com/moby/moby/pull/48556)\n-
        Go-SDK: cli/command/image: Deprecate `RunPull`: this function was only used
        internally and will be removed in the next release. [docker/cli#5975](https://redirect.github.com/docker/cli/pull/5975)\n-
        Go-SDK: cli/config/configfile: deprecate `ConfigFile.Experimental` field.
        Experimental CLI features are always enabled since version v20.10 and this
        field is no longer used. Use `ConfigFile.Features` instead for optional features.
        This field will be removed in a future release. [docker/cli#5977](https://redirect.github.com/docker/cli/pull/5977)\n-
        Go-SDK: deprecate `pkg/archive`, which was migrated to `github.com/moby/go-archive`.
        [moby/moby#49743](https://redirect.github.com/moby/moby/pull/49743)\n- Go-SDK:
        deprecate `pkg/atomicwriter`, which was migrated to `github.com/moby/sys/atomicwriter`.
        [moby/moby#49748](https://redirect.github.com/moby/moby/pull/49748)\n- Go-SDK:
        opts: remove deprecated `PortOpt`, `ConfigOpt`, `SecretOpt` aliases. [docker/cli#5953](https://redirect.github.com/docker/cli/pull/5953)\n-
        Go-SDK: registry: deprecate `APIEndpoint.Official` field. [moby/moby#49706](https://redirect.github.com/moby/moby/pull/49706)\n\n###
        [`v28.0.4`](https://redirect.github.com/moby/moby/releases/tag/v28.0.4)\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.0.3...v28.0.4)\n\n####
        28.0.4\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.4 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.4)\n-
        [moby/moby, 28.0.4 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.4)\n\n#####
        Bug fixes and enhancements\n\n- Fix a regression causing `docker pull/push`
        to fail when interacting with a private repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n\n###
        [`v28.0.3`](https://redirect.github.com/moby/moby/releases/tag/v28.0.3)\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.0.2...v28.0.3)\n\n####
        28.0.3\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.3 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.3)\n-
        [moby/moby, 28.0.3 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.3)\n\n#####
        Bug fixes and enhancements\n\n- Fix `docker run` truncating the `STDOUT`/`STDERR`
        prematurely when the container exits before the data is consumed. [docker/cli#5957](https://redirect.github.com/docker/cli/pull/5957)\n\n#####
        Packaging updates\n\n- Update BuildKit to [v0.20.2](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.2).
        [moby/moby#49698](https://redirect.github.com/moby/moby/pull/49698)\n- Update
        `runc` to [v1.2.6](https://redirect.github.com/opencontainers/runc/releases/tag/v1.2.6)
        (static packages only). [moby/moby#49682](https://redirect.github.com/moby/moby/pull/49682)\n-
        Update containerd to [v1.7.26](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.26).
        [docker/containerd-packaging#409](https://redirect.github.com/docker/containerd-packaging/pull/409)\n\n###
        [`v28.0.2`](https://redirect.github.com/moby/moby/releases/tag/v28.0.2)\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.0.1...v28.0.2)\n\n####
        28.0.2\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.2 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.2)\n-
        [moby/moby, 28.0.2 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.2)\n\n#####
        Bug fixes and enhancements\n\n- Fix CLI-specific attributes (`docker.cli.*`)
        being unintentionally passed to downstream OTel services. [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n-
        Fix an issue where user-specified `OTEL_RESOURCE_ATTRIBUTES` were being overridden
        by CLI's internal telemetry attributes. The CLI now properly merges user-specified
        attributes with internal ones, allowing both to coexist. [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n-
        Fix daemon failing to start on Windows when a container created before v28.0.0
        was present. [moby/moby#49626](https://redirect.github.com/moby/moby/pull/49626)\n-
        Fix possible error on `docker buildx prune` with the `--min-free-space`. [moby/moby#49623](https://redirect.github.com/moby/moby/pull/49623)\n-
        Fix spurious `io: read/write on closed pipe` error in the daemon log when
        closing container. [moby/moby#49590](https://redirect.github.com/moby/moby/pull/49590)\n-
        Fix the Docker daemon failing too early if the containerd socket isn't immediately
        available. [moby/moby#49603](https://redirect.github.com/moby/moby/pull/49603)\n-
        Mask Linux thermal interrupt info in a container's `/proc` and `/sys` by default.
        [moby/moby#49560](https://redirect.github.com/moby/moby/pull/49560)\n- Update
        `contrib/check-config.sh` to check for more kernel modules related to iptables.
        [moby/moby#49622](https://redirect.github.com/moby/moby/pull/49622)\n- containerd
        image store: Fix integer overflow in User ID handling passed via `--user`.
        [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n- containerd
        image store: Fix spurious `reference for unknown type: application/vnd.in-toto+json`
        warning being logged to the daemon's log. [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n-
        containerd image store: Improve performance of `docker ps` when running large
        number of containers. [moby/moby#49365](https://redirect.github.com/moby/moby/pull/49365)\n\n#####
        Packaging updates\n\n- Update BuildKit to [v0.20.1](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.1).
        [moby/moby#49587](https://redirect.github.com/moby/moby/pull/49587)\n- Update
        Buildx to [v0.22.0](https://redirect.github.com/docker/buildx/releases/tag/v0.22.0).
        [docker/docker-ce-packaging#1175](https://redirect.github.com/docker/docker-ce-packaging/pull/1175)\n-
        Update Compose to [v2.34.0](https://redirect.github.com/docker/compose/releases/tag/v2.34.0).
        [docker/docker-ce-packaging#1172](https://redirect.github.com/docker/docker-ce-packaging/pull/1172)\n-
        Update Go runtime to [1.23.7](https://go.dev/doc/devel/release#go1.23.7).
        [docker/cli#5890](https://redirect.github.com/docker/cli/pull/5890), [docker/docker-ce-packaging#1171](https://redirect.github.com/docker/docker-ce-packaging/pull/1171),
        [moby/moby#49580](https://redirect.github.com/moby/moby/pull/49580)\n- Update
        RootlessKit to [v2.3.4](https://redirect.github.com/rootless-containers/rootlesskit/releases/tag/v2.3.4).
        [moby/moby#49614](https://redirect.github.com/moby/moby/pull/49614)\n- Update
        containerd (static binaries only) to [v1.7.27](https://www.github.com/containerd/containerd/releases/tag/v1.7.27).
        [moby/moby#49656](https://redirect.github.com/moby/moby/pull/49656)\n\n#####
        Networking\n\n- Add environment variable `DOCKER_INSECURE_NO_IPTABLES_RAW=1`
        to allow Docker to run on systems where the Linux kernel can't provide `CONFIG_IP_NF_RAW`
        support. When enabled, Docker will not create rules in the iptables `raw`
        table. Warning: This is not recommended for production environments as it
        reduces security by allowing other hosts on the local network to route to
        ports published to host addresses, even when they are published to `127.0.0.1.`
        This option bypasses some of the security hardening introduced in Docker Engine
        28.0.0. [moby/moby#49621](https://redirect.github.com/moby/moby/pull/49621)\n-
        Allow container startup when an endpoint is attached to a macvlan network
        where the parent interface is down. [moby/moby#49630](https://redirect.github.com/moby/moby/pull/49630)\n-
        Do not skip DNAT for packets originating in a gateway\\_mode=routed network.
        [moby/moby#49577](https://redirect.github.com/moby/moby/pull/49577)\n- Fix
        a bug causing `docker ps` to inconsistently report dual-stack port mappings.
        [moby/moby#49657](https://redirect.github.com/moby/moby/pull/49657)\n- Fix
        a bug that could cause `docker-proxy` to stop forwarding UDP datagrams to
        containers. [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n-
        Fix a bug that was causing `docker-proxy` to close UDP connections to containers
        eagerly and resulting in the source address to change needlessly. [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n\n#####
        Go SDK\n\n- Move various types and consts from `cli-plugins/manager` to a
        separate package. [docker/cli#5902](https://redirect.github.com/docker/cli/pull/5902)\n-
        Update minimum required Go version to go1.23. [moby/moby#49541](https://redirect.github.com/moby/moby/pull/49541)\n-
        `cli/command`: Move `PrettyPrint` utility to `cli/command/formatter`. [docker/cli#5916](https://redirect.github.com/docker/cli/pull/5916)\n-
        runconfig/errors: split `ErrConflictHostNetwork` into `ErrConflictConnectToHostNetwork`
        and `ErrConflictDisconnectFromHostNetwork`. [moby/moby#49605](https://redirect.github.com/moby/moby/pull/49605)\n\n#####
        Deprecations\n\n- Go-SDK: Deprecate `cli-plugins/manager.ResourceAttributesEnvvar`
        constant. It was used internally, but holds the `OTEL_RESOURCE_ATTRIBUTES`
        name, which is part of the OpenTelemetry specification. Users of this constant
        should define their own. It will be removed in the next release. [docker/cli#5881](https://redirect.github.com/docker/cli/pull/5881)\n-
        Go-SDK: Deprecate `opts.PortOpt`, `opts.ConfigOpt` and `opts.SecretOpt`. These
        types were moved to the `opts/swarmopts` package. [docker/cli#5907](https://redirect.github.com/docker/cli/pull/5907)\n-
        Go-SDK: Remove `service/logs` package. [docker/cli#5910](https://redirect.github.com/docker/cli/pull/5910)\n-
        Go-SDK: `cli/command/image`: Deprecate `PushTrustedReference` and move to
        `cli/trust`. [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-
        Go-SDK: `cli/command/image`: Deprecate and internalize `TrustedPush`. [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-
        Go-SDK: `cli/command`: deprecate `Cli.NotaryClient`: use [`trust.GetNotaryRepository`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/trust#GetNotaryRepository)
        instead. This method is no longer used and will be removed in the next release.
        [docker/cli#5885](https://redirect.github.com/docker/cli/pull/5885)\n- Go-SDK:
        `cli/command`: deprecate `Cli.RegistryClient`. This method was only used internally
        and will be removed in the next release. Use [`client.NewRegistryClient`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/registry/client#NewRegistryClient)
        instead. [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889),
        [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889)\n- Go-SDK:
        `registry`: Deprecate `RepositoryInfo.Official` field. [moby/moby#49567](https://redirect.github.com/moby/moby/pull/49567)\n-
        Go-SDK: `registry`: deprecate `HostCertsDir`: this function was only used
        internally and will be removed in the next release. [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n-
        Go-SDK: `registry`: deprecate `SetCertsDir`: the cert-directory is now automatically
        selected when running with RootlessKit, and should no longer be set manually.
        [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n\n###
        [`v28.0.1`](https://redirect.github.com/moby/moby/releases/tag/v28.0.1)\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v28.0.0...v28.0.1)\n\n###
        28.0.1\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.1)\n-
        [moby/moby, 28.0.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.1)\n\n####
        Networking\n\n- Remove dependency on kernel modules `ip_set`, `ip_set_hash_net`
        and `netfilter_xt_set`.\n  - The dependency was introduced in release 28.0.0
        but proved too disruptive. The iptables rules using these modules have been
        replaced. [moby/moby#49530](https://redirect.github.com/moby/moby/pull/49530)\n-
        Allow daemon startup on a host with IPv6 disabled without requiring `--ip6tables=false`.
        [moby/moby#49525](https://redirect.github.com/moby/moby/pull/49525)\n- Fix
        a bug that was causing containers with `--restart=always` and a published
        port already in use to restart in a tight loop. [moby/moby#49507](https://redirect.github.com/moby/moby/pull/49507)\n-
        Fix an issue with Swarm ingress, caused by incorrect ordering of iptables
        rules. [moby/moby#49538](https://redirect.github.com/moby/moby/pull/49538)\n-
        Fix creation of a swarm-scoped network from a `--config-only` network. [moby/moby#49521](https://redirect.github.com/moby/moby/pull/49521)\n-
        Fix `docker network inspect` reporting an IPv6 gateway with CIDR suffix for
        a newly created network with no specific IPAM config, until a daemon restart.
        [moby/moby#49520](https://redirect.github.com/moby/moby/pull/49520)\n- Improve
        the error reported when kernel modules `ip_set`, `ip_set_hash_net` and `netilter_xt_set`
        are not available. [moby/moby#49524](https://redirect.github.com/moby/moby/pull/49524)\n-
        Move most of Docker's iptables rules out of the filter-FORWARD chain, so that
        other applications are free to append rules that must follow Docker's rules.
        [moby/moby#49518](https://redirect.github.com/moby/moby/pull/49518)\n- Update
        `--help` output and man page lo state which options only apply to the default
        bridge network. [moby/moby#49522](https://redirect.github.com/moby/moby/pull/49522)\n\n####
        Bug fixes and enhancements\n\n- Fix `docker context create` always returning
        an error when using the `\"skip-tls-verify\"` option. [docker/cli#5850](https://redirect.github.com/docker/cli/pull/5850)\n-
        Fix shell completion suggesting IDs instead of names for services and nodes.
        [docker/cli#5848](https://redirect.github.com/docker/cli/pull/5848)\n- Fix
        unintentionally printing exit status to standard error output when `docker
        exec/run` returns a non-zero status. [docker/cli#5854](https://redirect.github.com/docker/cli/pull/5854)\n-
        Fix regression `protocol \"tcp\" is not supported by the RootlessKit port
        driver \"slirp4netns\"`. [moby/moby#49514](https://redirect.github.com/moby/moby/pull/49514)\n-
        containerd image store: Fix `docker inspect` not being able to show multi-platform
        images with missing layers for all platforms. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
        containerd image store: Fix `docker images --tree` reporting wrong content
        size. [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n-
        Fix compilation on i386 [moby/moby#49526](https://redirect.github.com/moby/moby/pull/49526)\n\n####
        Packaging updates\n\n- Update `github.com/go-jose/go-jose/v4` to v4.0.5 to
        address. [GHSA-c6gw-w398-hv78](https://redirect.github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78)
        / [CVE-2025-27144](https://www.cve.org/CVERecord?id=CVE-2025-27144) [docker/cli#5867](https://redirect.github.com/docker/cli/pull/5867)\n-
        Update Buildx to [v0.21.1](https://redirect.github.com/docker/buildx/releases/tag/v0.21.1).
        [docker/docker-ce-packaging#1167](https://redirect.github.com/docker/docker-ce-packaging/pull/1167)\n-
        Update Compose to [v2.33.1](https://redirect.github.com/docker/compose/releases/tag/v2.33.1).
        [docker/docker-ce-packaging#1168](https://redirect.github.com/docker/docker-ce-packaging/pull/1168)\n\n####
        API\n\n- containerd image store: Fix `GET /images/json?manifests=1` not filling
        `Manifests` for index-only images. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
        containerd image store: Fix `GET /images/json and /images/<name>/json` `Size.Content`
        field including the size of content that's not available locally. [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n\n###
        [`v28.0.0`](https://redirect.github.com/moby/moby/releases/tag/v28.0.0)\n\n[Compare
        Source](https://redirect.github.com/moby/moby/compare/v27.5.1...v28.0.0)\n\n###
        28.0.0\n\nFor a full list of pull requests and changes in this release, refer
        to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
        [moby/moby, 28.0.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
        Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.0.0/docs/deprecated.md).\n-
        Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.0.0/docs/api/version-history.md).\n\n####
        New\n\n- Add ability to mount an image inside a container via `--mount type=image`.
        [moby/moby#48798](https://redirect.github.com/moby/moby/pull/48798)\n  - You
        can also specify `--mount type=image,image-subpath=[subpath],...` option to
        mount a specific path from the image. [docker/cli#5755](https://redirect.github.com/docker/cli/pull/5755)\n-
        `docker images --tree` now shows metadata badges. [docker/cli#5744](https://redirect.github.com/docker/cli/pull/5744)\n-
        `docker load`, `docker save`, and `docker history` now support a `--platform`
        flag allowing you to choose a specific platform for single-platform operations
        on multi-platform images. [docker/cli#5331](https://redirect.github.com/docker/cli/pull/5331)\n-
        Add `OOMScoreAdj` to `docker service create` and `docker stack`. [docker/cli#5145](https://redirect.github.com/docker/cli/pull/5145)\n-
        `docker buildx prune` now supports `reserved-space`, `max-used-space`, `min-free-space`
        and `keep-bytes` filters. [moby/moby#48720](https://redirect.github.com/moby/moby/pull/48720)\n-
        Windows: Add support for running containerd as a child process of the daemon,
        instead of using a system-installed containerd. [moby/moby#47955](https://redirect.github.com/moby/moby/pull/47955)\n\n####
        Networking\n\n- The `docker-proxy` binary has been updated, older versions
        will not work with the updated `dockerd`. [moby/moby#48132](https://redirect.github.com/moby/moby/pull/48132)\n
        \ - Close a window in which the userland proxy (`docker-proxy`) could accept
        TCP connections, that would then fail after `iptables` NAT rules were set
        up.\n  - The executable `rootlesskit-docker-proxy` is no longer used, it has
        been removed from the build and distribution.\n- DNS nameservers read from
        the host's `/etc/resolv.conf` are now always accessed from the host's network
        namespace. [moby/moby#48290](https://redirect.github.com/moby/moby/pull/48290)\n
        \ - When the host's `/etc/resolv.conf` contains no nameservers and there are
        no `--dns` overrides, Google's DNS servers are no longer used, apart from
        by the default bridge network and in build containers.\n- Container interfaces
        in bridge and macvlan networks now use randomly generated MAC addresses. [moby/moby#48808](https://redirect.github.com/moby/moby/pull/48808)\n
        \ - Gratuitous ARP / Neighbour Advertisement messages will be sent when the
        interfaces are started so that, when IP addresses are reused, they're associated
        with the newly generated MAC address.\n  - IPv6 addresses in the default bridge
        network are now IPAM-assigned, rather than being derived from the MAC address.\n-
        The deprecated OCI `prestart` hook is now only used by build containers. For
        other containers, network interfaces are added to the network namespace after
        task creation is complete, before the container task is started. [moby/moby#47406](https://redirect.github.com/moby/moby/pull/47406)\n-
        Add a new `gw-priority` option to `docker run`, `docker container create`,
        and `docker network connect`. This option will be used by the Engine to determine
        which network provides the default gateway for a container. On `docker run`,
        this option is only available through the extended `--network` syntax. [docker/cli#5664](https://redirect.github.com/docker/cli/pull/5664)\n-
        Add a new netlabel `com.docker.network.endpoint.ifname` to customize the interface
        name used when connecting a container to a network. It's supported by all
        built-in network drivers on Linux. [moby/moby#49155](https://redirect.github.com/moby/moby/pull/49155)\n
        \ - When a container is created with multiple networks specified, there's
        no guarantee on the order networks will be connected to the container. So,
        if a custom interface name uses the same prefix as the auto-generated names,
        for example `eth`, the container might fail to start.\n  - The recommended
        practice is to use a different prefix, for example `en0`, or a numerical suffix
        high enough to never collide, for example `eth100`.\n  - This label can be
        specified on `docker network connect` via the `--driver-opt` flag, for example
        `docker network connect --driver-opt=com.docker.network.endpoint.ifname=foobar
        \u2026`.\n  - Or via the long-form `--network` flag on `docker run`, for example
        `docker run --network=name=bridge,driver-opt=com.docker.network.endpoint.ifname=foobar
        \u2026`\n- If a custom network driver reports capability `GwAllocChecker`
        then, before a network is created, it will get a `GwAllocCheckerRequest` with
        the network's options. The custom driver may then reply that no gateway IP
        address should be allocated. [moby/moby#49372](https://redirect.github.com/moby/moby/pull/49372)\n\n####
        Port publishing in bridge networks\n\n- `dockerd` now requires `ipset` support
        in the Linux kernel. [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n
        \ - The `iptables` and `ip6tables` rules used to implement port publishing
        and network isolation have been extensively modified. This enables some of
        the following functional changes, and is a first step in refactoring to enable
        native `nftables` support in a future release. [moby/moby#48815](https://redirect.github.com/moby/moby/issues/48815)\n
        \ - If it becomes necessary to downgrade to an earlier version of the daemon,
        some manual cleanup of the new rules will be necessary. The simplest and surest
        approach is to reboot the host, or use `iptables -F` and `ip6tables -F` to
        flush all existing `iptables` rules from the `filter` table before starting
        the older version of the daemon. When that is not possible, run the following
        commands as root:\n    - `iptables -D FORWARD -m set --match-set docker-ext-bridges-v4
        dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT; ip6tables -D FORWARD
        -m set --match-set docker-ext-bridges-v6 dst -m conntrack --ctstate RELATED,ESTABLISHED
        -j ACCEPT`\n    - `iptables -D FORWARD -m set --match-set docker-ext-bridges-v4
        dst -j DOCKER; ip6tables -D FORWARD -m set --match-set docker-ext-bridges-v6
        dst -j DOCKER`\n    - If you were previously running with the iptables filter-FORWARD
        policy set to `ACCEPT` and need to restore access to unpublished ports, also
        delete per-bridge-network rules from the `DOCKER` chains. For example, `iptables
        -D DOCKER ! -i docker0 -o docker0 -j DROP`.\n- Fix a security issue that was
        allowing remote hosts to connect directly to a container on its published
        ports. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
        Fix a security issue that was allowing neighbor hosts to connect to ports
        mapped on a loopback address. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
        Fix an issue that prevented port publishing to link-local addresses. [moby/moby#48570](https://redirect.github.com/moby/moby/pull/48570)\n-
        UDP ports published by a container are now reliably accessible by containers
        on other networks, via the host's public IP address. [moby/moby#48571](https://redirect.github.com/moby/moby/pull/48571)\n-
        Docker will now only set the `ip6tables` policy for the `FORWARD` chain in
        the `filter` table to `DROP` if it enables IP forwarding on the host itself
        (sysctls `net.ipv6.conf.all.forwarding` and `net.ipv6.conf.default.forwarding`).
        This is now aligned with existing IPv4 behaviour. [moby/moby#48594](https://redirect.github.com/moby/moby/pull/48594)\n
        \ - If IPv6 forwarding is enabled on your host, but you were depending on
        Docker to set the ip6tables filter-FORWARD policy to `DROP`, you may need
        to update your host's configuration to make sure it is secure.\n- Direct routed
        access to container ports that are not exposed using `p`/`-publish` is now
        blocked in the `DOCKER` iptables chain. [moby/moby#48724](https://redirect.github.com/moby/moby/pull/48724)\n
        \ - If the default iptables filter-FORWARD policy was previously left at `ACCEPT`
        on your host, and direct routed access to a container's unpublished ports
        from a remote host is still required, options are:\n    - Publish the ports
        you need.\n    - Use the new `gateway_mode_ipv[46]=nat-unprotected`, described
        below.\n  - Container ports published to host addresses will continue to be
        accessible via those host addresses, using NAT or the userland proxy.\n  -
        Unpublished container ports continue to be directly accessible from the Docker
        host via the container's IP address.\n- Networks created with `gateway_mode_ipv[46]=routed`
        are now accessible from other bridge networks running on the same Docker host,
        as well as from outside the host. [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n-
        Bridge driver options `com.docker.network.bridge.gateway_mode_ipv4` and `com.docker.network.bridge.gateway_mode_ipv6`
        now accept mode `nat-unprotected`. [moby/moby#48597](https://redirect.github.com/moby/moby/pull/48597)\n
        \ - `nat-unprotected` is similar to the default `nat` mode, but no per port/protocol
        rules are set up. This means any port on a container can be accessed by direct-routing
        from a remote host.\n- Bridge driver options `com.docker.network.bridge.gateway_mode_ipv4`
        and `com.docker.network.bridge.gateway_mode_ipv6` now accept mode `isolated`,
        when the network is also `internal`. [moby/moby#49262](https://redirect.github.com/moby/moby/pull/49262)\n
        \ - An address is normally assigned to the bridge device in an `internal`
        network. So, processes on the Docker host can access the network, and containers
        in the network can access host services listening on that bridge address (including
        services listening on \"any\" host address, `0.0.0.0` or `::`).\n  - An `internal`
        bridge network created with gateway mode `isolated` does not have an address
        on the Docker host.\n- When a port mapping includes a host IP address or port
        number that cannot be used because NAT from the host is disabled using `--gateway_mode_ipv[46]`,
        container creation will no longer fail. The unused fields may be needed if
        the gateway endpoint changes when networks are connected or disconnected.
        A message about the unused fields will be logged. [moby/moby#48575](https://redirect.github.com/moby/moby/pull/48575)\n-
        Do not create iptables nat-POSTROUTING masquerade rules for a container's
        own published ports, when the userland proxy is enabled. [moby/moby#48854](https://redirect.github.com/moby/moby/pull/48854)\n\n####
        IPv6\n\n- Add `docker network create` option `--ipv4`. To disable IPv4 address
        assignment for a network, use `docker network create --ipv4=false [...]`.
        [docker/cli#5599](https://redirect.github.com/docker/cli/pull/5599)\n- Daemon
        option `--ipv6` (`\"ipv6\": true` in `daemon.json`) can now be used without
        `fixed-cidr-v6`. [moby/moby#48319](https://redirect.github.com/moby/moby/pull/48319)\n-
        IPAM now handles subnets bigger than \"/64\". [moby/moby#49223](https://redirect.github.com/moby/moby/pull/49223)\n-
        Duplicate address detection (DAD) is now disabled for addresses assigned to
        the bridges belonging to bridge networks. [moby/moby#48609](https://redirect.github.com/moby/moby/pull/48609)\n-
        Modifications to `host-gateway`, for compatibility with IPv6-only networks.
        [moby/moby#48807](https://redirect.github.com/moby/moby/pull/48807)\n  - When
        special value `host-gateway` is used in an `--add-host` option in place of
        an address, it's replaced by an address on the Docker host to make it possible
        to refer to the host by name. The address used belongs to the default bridge
        (normally `docker0`). Until now it's always been an IPv4 address, because
        all containers on bridge networks had IPv4 addresses.\n  - Now, if IPv6 is
        enabled on the default bridge network, `/etc/hosts` entries will be created
        for IPv4 and IPv6 addresses. So, a container that's only connected to IPv6-only
        networks can access the host by name.\n  - The `--host-gateway-ip` option
        overrides the address used to replace `host-gateway`. Two of these options
        are now allowed on the command line, for one IPv4 gateway and one IPv6.\n
        \ - In the `daemon.json` file, to provide two addresses, use `\"host-gateway-ips\"`.
        For example, `\"host-gateway-ips\": [\"192.0.2.1\", \"2001:db8::1111\"]`.\n\n####
        Bug fixes and enhancements\n\n- Add IPv6 loopback address as an insecure registry
        by default. [moby/moby#48540](https://redirect.github.com/moby/moby/pull/48540)\n-
        Add support for Cobra-generated completion scripts for `dockerd`. [moby/moby#49339](https://redirect.github.com/moby/moby/pull/49339)\n-
        Fix DNS queries failing when containers are launched via `systemd` auto-start
        on boot [moby/moby#48812](htt\n\n</details>\n\n---\n\n### Configuration\n\n\U0001F4C5
        **Schedule**: Branch creation - At any time (no schedule defined), Automerge
        - At any time (no schedule defined).\n\n\U0001F6A6 **Automerge**: Disabled
        by config. Please merge this manually once you are satisfied.\n\n\u267B **Rebasing**:
        Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515
        **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n
        - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
        box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
        View the [repository job log](https://developer.mend.io/github/osism/ci-image).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQwLjYyLjEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbInJlbm92YXRlIl19-->\n"
      change_url: https://github.com/osism/ci-image/pull/57
      child_jobs: []
      commit_id: 5782a1d08cb7c618372f9c0486e17f9ea793d5c1
      event_id: 732ef790-5165-11f0-87c8-4360db6cac6a
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/fcc33139265148e499b918c0cb53e293/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/fcc33139265148e499b918c0cb53e293/work/logs
        result_data_file: /var/lib/zuul/builds/fcc33139265148e499b918c0cb53e293/work/results.json
        src_root: /var/lib/zuul/builds/fcc33139265148e499b918c0cb53e293/work/src
        work_root: /var/lib/zuul/builds/fcc33139265148e499b918c0cb53e293/work
      include_vars: []
      items:
      - branch: main
        change: '57'
        change_message: "chore(deps): update dependency moby/moby to v28\n\nThis PR
          contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
          [moby/moby](https://redirect.github.com/moby/moby) | major | `27.5.1` ->
          `28.3.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>moby/moby
          (moby/moby)</summary>\n\n### [`v28.3.0`](https://redirect.github.com/moby/moby/releases/tag/v28.3.0):
          28.3.0\n\n[Compare Source](https://redirect.github.com/moby/moby/compare/v28.2.2...v28.3.0)\n\n####
          28.3.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.3.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.3.0)\n-
          [moby/moby, 28.3.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.3.0)\n-
          Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.3.0/docs/deprecated.md).\n-
          Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.3.0/docs/api/version-history.md).\n\n#####
          New\n\n- Add support for AMD GPUs in `docker run --gpus`. [moby/moby#49952](https://redirect.github.com/moby/moby/pull/49952)\n-
          Use `DOCKER_AUTH_CONFIG` as a credential store. [docker/cli#6008](https://redirect.github.com/docker/cli/pull/6008)\n\n#####
          Bug fixes and enhancements\n\n- Ensure that the state of the container in
          the daemon database (used by [/containers/json](https://docs.docker.com/reference/api/engine/version/v1.49/#tag/Container/operation/ContainerList)
          API) is up to date when the container is stopped using the [/containers/{id}/stop](https://docs.docker.com/reference/api/engine/version/v1.49/#tag/Container/operation/ContainerStop)
          API (before response of API). [moby/moby#50136](https://redirect.github.com/moby/moby/pull/50136)\n-
          Fix `docker image inspect inspect` omitting empty fields. [moby/moby#50135](https://redirect.github.com/moby/moby/pull/50135)\n-
          Fix `docker images --tree` not marking images as in-use when the containerd
          image store is disabled. [docker/cli#6140](https://redirect.github.com/docker/cli/pull/6140)\n-
          Fix `docker pull/push` hang in non-interactive when authentication is required
          caused by prompting for login credentials. [docker/cli#6141](https://redirect.github.com/docker/cli/pull/6141)\n-
          Fix a potential resource leak when a node leaves a Swarm. [moby/moby#50115](https://redirect.github.com/moby/moby/pull/50115)\n-
          Fix a regression where a login prompt on `docker pull` would show Docker
          Hub-specific hints when logging in on other registries. [docker/cli#6135](https://redirect.github.com/docker/cli/pull/6135)\n-
          Fix an issue where all new tasks in the Swarm could get stuck in the PENDING
          state forever after scaling up a service with placement preferences. [moby/moby#50211](https://redirect.github.com/moby/moby/pull/50211)\n-
          Remove an undocumented, hidden, top-level `docker remove` command that was
          accidentally introduced in Docker 23.0. [docker/cli#6144](https://redirect.github.com/docker/cli/pull/6144)\n-
          Validate registry-mirrors configuration as part of `dockerd --validate`
          and improve error messages for invalid mirrors. [moby/moby#50240](https://redirect.github.com/moby/moby/pull/50240)\n-
          `dockerd-rootless-setuptool.sh`: Fix the script from silently returning
          with no error message when subuid/subgid system requirements are not satisfied.
          [moby/moby#50059](https://redirect.github.com/moby/moby/pull/50059)\n- containerd
          image store: Fix `docker push` not creating a tag on the remote repository.
          [moby/moby#50199](https://redirect.github.com/moby/moby/pull/50199)\n- containerd
          image store: Improve handling of errors returned by the token server during
          `docker pull/push`. [moby/moby#50176](https://redirect.github.com/moby/moby/pull/50176)\n\n#####
          Packaging updates\n\n- Allow customizing containerd service name for OpenRC.
          [moby/moby#50156](https://redirect.github.com/moby/moby/pull/50156)\n- Update
          BuildKit to [v0.23.1](https://redirect.github.com/moby/buildkit/releases/tag/v0.23.1).
          [moby/moby#50243](https://redirect.github.com/moby/moby/pull/50243)\n- Update
          Buildx to [v0.25.0](https://redirect.github.com/docker/buildx/releases/tag/v0.25.0).
          [docker/docker-ce-packaging#1217](https://redirect.github.com/docker/docker-ce-packaging/pull/1217)\n-
          Update Compose to [v2.37.2](https://redirect.github.com/docker/compose/releases/tag/v2.37.2).
          [docker/docker-ce-packaging#1219](https://redirect.github.com/docker/docker-ce-packaging/pull/1219)\n-
          Update Docker Model CLI plugin to [v0.1.30](https://redirect.github.com/docker/model-cli/releases/tag/v0.1.30).
          [docker/docker-ce-packaging#1218](https://redirect.github.com/docker/docker-ce-packaging/pull/1218)\n-
          Update Go runtime to [1.24.4](https://go.dev/doc/devel/release#go1.24.4).
          [docker/docker-ce-packaging#1213](https://redirect.github.com/docker/docker-ce-packaging/pull/1213),
          [moby/moby#50153](https://redirect.github.com/moby/moby/pull/50153), [docker/cli#6124](https://redirect.github.com/docker/cli/pull/6124)\n\n#####
          Networking\n\n- Revert Swarm related changes added in 28.2.x builds, due
          to a regression reported in [https://github.com/moby/moby/issues/50129](https://redirect.github.com/moby/moby/issues/50129).
          [moby/moby#50169](https://redirect.github.com/moby/moby/pull/50169)\n  -
          Revert: Fix an issue where `docker network inspect --verbose` could sometimes
          crash the daemon ([https://github.com/moby/moby/pull/49937](https://redirect.github.com/moby/moby/pull/49937)).\n
          \ - Revert: Fix an issue where the load-balancer IP address for an overlay
          network would not be released in certain cases if the Swarm was lacking
          an ingress network ([https://github.com/moby/moby/pull/49948](https://redirect.github.com/moby/moby/pull/49948)).\n
          \ - Revert: Improve the reliability of NetworkDB in busy clusters and lossy
          networks ([https://github.com/moby/moby/pull/49932](https://redirect.github.com/moby/moby/pull/49932)).\n
          \ - Revert: Improvements to the reliability and convergence speed of NetworkDB
          ([https://github.com/moby/moby/pull/49939](https://redirect.github.com/moby/moby/pull/49939)).\n-
          Fix an issue that could cause container startup to fail, or lead to failed
          UDP port mappings, when some container ports are mapped to `0.0.0.0` and
          others are mapped to specific host addresses. [moby/moby#50054](https://redirect.github.com/moby/moby/pull/50054)\n-
          The `network inspect` response for an overlay network now reports that `EnableIPv4`
          is true. [moby/moby#50147](https://redirect.github.com/moby/moby/pull/50147)\n-
          Windows: Improve daemon startup time in cases where the host has networks
          of type `\"Mirrored\"`. [moby/moby#50155](https://redirect.github.com/moby/moby/pull/50155)\n-
          Windows: Make sure `docker system prune` and `docker network prune` only
          remove networks created by Docker. [moby/moby#50154](https://redirect.github.com/moby/moby/pull/50154)\n\n#####
          API\n\n- Update API version to 1.51. [moby/moby#50145](https://redirect.github.com/moby/moby/pull/50145)\n-
          `GET /images/json` now sets the value of the `Containers` field for all
          images to the count of containers using the image. [moby/moby#50146](https://redirect.github.com/moby/moby/pull/50146)\n\n#####
          Deprecations\n\n- Empty/nil image config fields in the `GET /images/{name}/json`
          response are now deprecated and will be removed in v29.0. [docker/cli#6129](https://redirect.github.com/docker/cli/pull/6129)\n-
          api/types/container: deprecate `ExecOptions.Detach`. This field is not used,
          and will be removed in a future release. [moby/moby#50219](https://redirect.github.com/moby/moby/pull/50219)\n-
          pkg/idtools: deprecate `IdentityMapping` and `Identity.Chown`. [moby/moby#50210](https://redirect.github.com/moby/moby/pull/50210)\n\n###
          [`v28.2.2`](https://redirect.github.com/moby/moby/releases/tag/v28.2.2):
          28.2.2\n\n[Compare Source](https://redirect.github.com/moby/moby/compare/v28.2.1...v28.2.2)\n\n####
          28.2.2\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.2.2 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.2.2)\n-
          [moby/moby, 28.2.2 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.2.2)\n\n#####
          Bug fixes and enhancements\n\n- containerd image store: Fix a regression
          causing `docker build --push` to fail. This reverts [the fix](https://redirect.github.com/moby/moby/pull/49702)
          for `docker build` not persisting overridden images as dangling. [moby/moby#50105](https://redirect.github.com/moby/moby/pull/50105)\n\n#####
          Networking\n\n- When creating the iptables `DOCKER-USER` chain, do not add
          an explicit `RETURN` rule, allowing users to append as well as insert their
          own rules. Existing rules are not removed on upgrade, but it won't be replaced
          after a reboot. [moby/moby#50098](https://redirect.github.com/moby/moby/pull/50098)\n\n###
          [`v28.2.1`](https://redirect.github.com/moby/moby/releases/tag/v28.2.1):
          28.2.1\n\n[Compare Source](https://redirect.github.com/moby/moby/compare/v28.2.0...v28.2.1)\n\n####
          28.2.1\n\n#### Packaging updates\n\n- Fix packaging regression in [v28.2.0](https://redirect.github.com/moby/moby/releases/tag/v28.2.0)
          which broke creating the `docker` group/user on fresh installations. [docker-ce-packaging#1209](https://redirect.github.com/docker/docker-ce-packaging/issues/1209)\n\n###
          [`v28.2.0`](https://redirect.github.com/moby/moby/releases/tag/v28.2.0):
          28.2.0\n\n[Compare Source](https://redirect.github.com/moby/moby/compare/v28.1.1...v28.2.0)\n\n####
          28.2.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.2.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.2.0)\n-
          [moby/moby, 28.2.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.2.0)\n-
          Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.2.0/docs/deprecated.md).\n-
          Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.2.0/docs/api/version-history.md).\n\n>
          \\[!NOTE]\n> RHEL packages are currently not available and will be released
          later.\n\n##### New\n\n- Add `{{.Platform}}` as formatting option for `docker
          ps` to show the platform of the image the container is running. [docker/cli#6042](https://redirect.github.com/docker/cli/pull/6042)\n-
          Add support for relative parent paths (`../`) on bind mount sources when
          using `docker run/create` with `-v/--volume` or `--mount type=bind` options.
          [docker/cli#4966](https://redirect.github.com/docker/cli/pull/4966)\n- CDI
          is now enabled by default. [moby/moby#49963](https://redirect.github.com/moby/moby/pull/49963)\n-
          Show discovered CDI devices in `docker info`. [docker/cli#6078](https://redirect.github.com/docker/cli/pull/6078)\n-
          `docker image rm`: add `--platform` option to remove a variant from multi-platform
          images. [docker/cli#6109](https://redirect.github.com/docker/cli/pull/6109)\n-
          containerd image store: Initial BuildKit support for building Windows container
          images on Windows (requires an opt-in with `DOCKER_BUILDKIT=1`). [moby/moby#49740](https://redirect.github.com/moby/moby/pull/49740)\n\n#####
          Bug fixes and enhancements\n\n- Add a new log option for fluentd log driver
          (`fluentd-write-timeout`), which enables specifying write timeouts for fluentd
          connections. [moby/moby#49911](https://redirect.github.com/moby/moby/pull/49911)\n-
          Add support for `DOCKER_AUTH_CONFIG` for the experimental `--use-api-socket`
          option. [docker/cli#6019](https://redirect.github.com/docker/cli/pull/6019)\n-
          Fix `docker exec` waiting for 10 seconds if a non-existing user or group
          was specified. [moby/moby#49868](https://redirect.github.com/moby/moby/pull/49868)\n-
          Fix `docker swarm init` ignoring `cacert` option of `--external-ca`. [docker/cli#5995](https://redirect.github.com/docker/cli/pull/5995)\n-
          Fix an issue where the CLI would not correctly save the configuration file
          (`~/.docker/config.json`) if it was a relative symbolic link. [docker/cli#5282](https://redirect.github.com/docker/cli/pull/5282)\n-
          Fix containers with `--restart always` policy using CDI devices failing
          to start on daemon restart. [moby/moby#49990](https://redirect.github.com/moby/moby/pull/49990)\n-
          Fix shell-completion to only complete some flags once, even though they
          can be set multiple times. [docker/cli#6030](https://redirect.github.com/docker/cli/pull/6030)\n-
          Fix the `plugin does not implement PluginAddr interface` error for Swarm
          CSI drivers. [moby/moby#49961](https://redirect.github.com/moby/moby/pull/49961)\n-
          Improve `docker login` error messages for invalid options. [docker/cli#6036](https://redirect.github.com/docker/cli/pull/6036)\n-
          Make sure the terminal state is restored if the CLI is forcefully terminated.
          [docker/cli#6058](https://redirect.github.com/docker/cli/pull/6058)\n- Update
          the default seccomp profile to match the libseccomp v2.6.0. The new syscalls
          are: `listmount`, `statmount`, `lsm_get_self_attr`, `lsm_list_modules`,
          `lsm_set_self_attr`, `mseal`, `uretprobe`, `riscv_hwprobe`, `getxattrat`,
          `listxattrat`, `removexattrat`, and `setxattrat`. This prevents containers
          from receiving EPERM errors when using them. [moby/moby#50077](https://redirect.github.com/moby/moby/pull/50077)\n-
          `docker inspect`: add shell completion, improve flag-description for `--type`
          and improve validation. [docker/cli#6052](https://redirect.github.com/docker/cli/pull/6052)\n-
          containerd image store: Enable BuildKit garbage collector by default. [moby/moby#49899](https://redirect.github.com/moby/moby/pull/49899)\n-
          containerd image store: Fix `docker build` not persisting overridden images
          as dangling. [moby/moby#49702](https://redirect.github.com/moby/moby/pull/49702)\n-
          containerd image store: Fix `docker system df` reporting a negative reclaimable
          space amount. [moby/moby#49707](https://redirect.github.com/moby/moby/pull/49707)\n-
          containerd image store: Fix duplicate `PUT` requests when pushing a multi-platform
          image. [moby/moby#49949](https://redirect.github.com/moby/moby/pull/49949)\n\n#####
          Packaging updates\n\n- Drop Ubuntu 20.04 \"Focal\" packages as it reached
          end of life. [docker/docker-ce-packaging#1200](https://redirect.github.com/docker/docker-ce-packaging/pull/1200)\n-
          Fix install location for RPM-based `docker-ce` man-pages. [docker/docker-ce-packaging#1203](https://redirect.github.com/docker/docker-ce-packaging/pull/1203)\n-
          Update BuildKit to [v0.22.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.22.0).
          [moby/moby#50046](https://redirect.github.com/moby/moby/pull/50046)\n- Update
          Buildx to [v0.24.0](https://redirect.github.com/docker/buildx/releases/tag/v0.24.0).
          [docker/docker-ce-packaging#1205](https://redirect.github.com/docker/docker-ce-packaging/pull/1205)\n-
          Update Compose to [v2.36.2](https://redirect.github.com/docker/compose/releases/tag/v2.36.2).
          [docker/docker-ce-packaging#1208](https://redirect.github.com/docker/docker-ce-packaging/pull/1208)\n-
          Update Go runtime to [1.24.3](https://go.dev/doc/devel/release#go1.24.3).
          [docker/docker-ce-packaging#1192](https://redirect.github.com/docker/docker-ce-packaging/pull/1192),
          [docker/cli#6060](https://redirect.github.com/docker/cli/pull/6060), [moby/moby#49174](https://redirect.github.com/moby/moby/pull/49174)\n\n#####
          Networking\n\n- Add bridge network option `\"com.docker.network.bridge.trusted_host_interfaces\"`,
          accepting a colon-separated list of interface names. These interfaces have
          direct access to published ports on container IP addresses. [moby/moby#49832](https://redirect.github.com/moby/moby/pull/49832)\n-
          Add daemon option `\"allow-direct-routing\"` to disable filtering of packets
          from outside the host addressed directly to containers. [moby/moby#49832](https://redirect.github.com/moby/moby/pull/49832)\n-
          Do not display network options `com.docker.network.enable_ipv4` or `com.docker.network.enable_ipv6`
          in inspect output if they have been overridden by `EnableIPv4` or `EnableIPv6`
          in the network create request. [moby/moby#49866](https://redirect.github.com/moby/moby/pull/49866)\n-
          Fix an issue that could cause network deletion to fail after a daemon restart,
          with error \"has active endpoints\" listing empty endpoint names. [moby/moby#49901](https://redirect.github.com/moby/moby/pull/49901)\n-
          Fix an issue where `docker network inspect --verbose` could sometimes crash
          the daemon. [moby/moby#49937](https://redirect.github.com/moby/moby/pull/49937)\n-
          Fix an issue where the load-balancer IP address for an overlay network would
          not be released in certain cases if the Swarm was lacking an ingress network.
          [moby/moby#49948](https://redirect.github.com/moby/moby/pull/49948)\n- Improve
          the reliability of NetworkDB in busy clusters and lossy networks. [moby/moby#49932](https://redirect.github.com/moby/moby/pull/49932)\n-
          Improvements to the reliability and convergence speed of NetworkDB. [moby/moby#49939](https://redirect.github.com/moby/moby/pull/49939)\n\n#####
          API\n\n- Update API version to `1.50`.\n- `DELETE /images/{name}` now supports
          a `platforms` query parameter. It accepts an array of JSON-encoded OCI Platform
          objects, allowing for selecting a specific platforms to delete content for.
          [moby/moby#49982](https://redirect.github.com/moby/moby/pull/49982)\n- `GET
          /info` now includes a `DiscoveredDevices` field. This is an array of `DeviceInfo`
          objects, each providing details about a device discovered by a device driver.
          [moby/moby#49980](https://redirect.github.com/moby/moby/pull/49980)\n\n#####
          Go SDK\n\n- `api/types/container`: add `ContainerState` and constants for
          container state. [moby/moby#49965](https://redirect.github.com/moby/moby/pull/49965)\n-
          `api/types/container`: change `Summary.State` to a `ContainerState`. [moby/moby#49991](https://redirect.github.com/moby/moby/pull/49991)\n-
          `api/types/container`: define `HealthStatus` type for health-status constants.
          [moby/moby#49876](https://redirect.github.com/moby/moby/pull/49876)\n- `api/types`:
          deprecate `BuildResult`, `ImageBuildOptions`, `ImageBuildOutput`, `ImageBuildResponse`,
          `BuilderVersion`, `BuilderV1`, and `BuilderBuildKi` which were moved to
          `api/types/build`. [moby/moby#50025](https://redirect.github.com/moby/moby/pull/50025)\n\n#####
          Deprecations\n\n- API: Deprecated: `GET /images/{name}/json` no longer returns
          the following fields: `Config`, `Hostname`, `Domainname`, `AttachStdin`,
          `AttachStdout`, `AttachStderr`, `Tty`, `OpenStdin`, `StdinOnce`, `Image`,
          `NetworkDisabled` (already omitted unless set), `MacAddress` (already omitted
          unless set), `StopTimeout` (already omitted unless set). These additional
          fields were included in the response due to an implementation detail but
          not part of the image's Configuration, were marked deprecated in API v1.46,
          and are now omitted. [moby/moby#48457](https://redirect.github.com/moby/moby/pull/48457)\n-
          Go-SDK: Deprecate builder/remotecontext.Rel(). This function was needed
          on older versions of Go, but can now be replaced by `filepath.Rel()`. [moby/moby#49843](https://redirect.github.com/moby/moby/pull/49843)\n-
          Go-SDK: api/types: deprecate `BuildCachePruneOptions` in favor of `api/types/builder.CachePruneOptions`.
          [moby/moby#50015](https://redirect.github.com/moby/moby/pull/50015)\n- Go-SDK:
          api/types: deprecate `BuildCachePruneReport` in favor of `api/types/builder.CachePruneReport`.
          [moby/moby#50015](https://redirect.github.com/moby/moby/pull/50015)\n- Go-SDK:
          api/types: deprecate `NodeListOptions`, `NodeRemoveOptions`, `ServiceCreateOptions`,
          `ServiceUpdateOptions`, `RegistryAuthFromSpec`, `RegistryAuthFromPreviousSpec`,
          `ServiceListOptions`, `ServiceInspectOptions`, and `SwarmUnlockKeyResponse`
          which were moved to `api/types/swarm`. [moby/moby#50027](https://redirect.github.com/moby/moby/pull/50027)\n-
          Go-SDK: api/types: deprecate `SecretCreateResponse`, `SecretListOptions`,
          `ConfigCreateResponse`, `ConfigListOptions` which were moved to api/types/swarm.
          [moby/moby#50024](https://redirect.github.com/moby/moby/pull/50024)\n- Go-SDK:
          client: deprecate `IsErrNotFound`. [moby/moby#50012](https://redirect.github.com/moby/moby/pull/50012)\n-
          Go-SDK: container: deprecate `IsValidHealthString` in favor of `api/types/container.ValidateHealthStatus`.
          [moby/moby#49893](https://redirect.github.com/moby/moby/pull/49893)\n- Go-SDK:
          container: deprecate `StateStatus`, `WaitCondition`, and the related  `WaitConditionNotRunning`,
          `WaitConditionNextExit`, and `WaitConditionRemoved` consts in favor of their
          equivalents in `api/types/container`. [moby/moby#49874](https://redirect.github.com/moby/moby/pull/49874)\n-
          Go-SDK: opts: deprecate `ListOpts.GetAll` in favor of `ListOpts.GetSlice`.
          [docker/cli#6032](https://redirect.github.com/docker/cli/pull/6032)\n- Remove
          deprecated `IsAutomated` formatting placeholder from `docker search`. [docker/cli#6091](https://redirect.github.com/docker/cli/pull/6091)\n-
          Remove fallback for pulling images from non-OCI-compliant `docker.pkg.github.com`
          registry. [moby/moby#50094](https://redirect.github.com/moby/moby/pull/50094)\n-
          Remove support for pulling legacy v2, schema 1 images and remove `DOCKER_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE`
          environment-variable. [moby/moby#50036](https://redirect.github.com/moby/moby/pull/50036),
          [moby/moby#42300](https://redirect.github.com/moby/moby/pull/42300)\n- The
          `BridgeNfIptables` and `BridgeNfIp6tables` fields in the `GET /info` response
          were deprecated in API v1.48, and are now omitted in API v1.50. [moby/moby#49904](https://redirect.github.com/moby/moby/pull/49904)\n-
          errdefs: Deprecate `errdefs.FromStatusCode`. Use containerd's `errhttp.ToNative`
          instead. [moby/moby#50030](https://redirect.github.com/moby/moby/pull/50030)\n\n###
          [`v28.1.1`](https://redirect.github.com/moby/moby/releases/tag/v28.1.1)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.1.0...v28.1.1)\n\n####
          28.1.1\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.1.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.1)\n-
          [moby/moby, 28.1.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.1)\n\n#####
          Bug fixes and enhancements\n\n- Fix `dockerd-rootless-setuptool.sh` incorrectly
          reporting missing `iptables`. [moby/moby#49833](https://redirect.github.com/moby/moby/pull/49833)\n-
          containerd image store: Fix a potential daemon crash when using `docker
          load` with archives containing zero-size tar headers. [moby/moby#49837](https://redirect.github.com/moby/moby/pull/49837)\n\n#####
          Packaging updates\n\n- Update Buildx to [v0.23.0](https://redirect.github.com/docker/buildx/releases/tag/v0.23.0).
          [docker/docker-ce-packaging#1185](https://redirect.github.com/docker/docker-ce-packaging/pull/1185)\n-
          Update Compose to [v2.35.1](https://redirect.github.com/docker/compose/releases/tag/v2.35.1).
          [docker/docker-ce-packaging#1188](https://redirect.github.com/docker/docker-ce-packaging/pull/1188)\n\n#####
          Networking\n\n- Add a warning to a container's `/etc/resolv.conf` when no
          upstream DNS servers were found. [moby/moby#49827](https://redirect.github.com/moby/moby/pull/49827)\n\n###
          [`v28.1.0`](https://redirect.github.com/moby/moby/releases/tag/v28.1.0)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.4...v28.1.0)\n\n####
          28.1.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.1.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
          [moby/moby, 28.1.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.1.0)\n-
          Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.1.0/docs/api/version-history.md).\n\n#####
          New\n\n- Add `docker bake` sub-command as alias for `docker buildx bake`.
          [docker/cli#5947](https://redirect.github.com/docker/cli/pull/5947)\n- Experimental:
          add a new `--use-api-socket` flag on `docker run` and `docker create` to
          enable access to Docker socket from inside a container and to share credentials
          from the host with the container. [docker/cli#5858](https://redirect.github.com/docker/cli/pull/5858)\n-
          `docker image inspect` now supports a `--platform` flag to inspect a specific
          platform of a multi-platform image. [docker/cli#5934](https://redirect.github.com/docker/cli/pull/5934)\n\n#####
          Bug fixes and enhancements\n\n- Add CLI shell-completion for context names.
          [docker/cli#6016](https://redirect.github.com/docker/cli/pull/6016)\n- Fix
          `docker images --tree` not including non-container images content size in
          the total image content size. [docker/cli#6000](https://redirect.github.com/docker/cli/pull/6000)\n-
          Fix `docker load` not preserving replaced images. [moby/moby#49650](https://redirect.github.com/moby/moby/pull/49650)\n-
          Fix `docker login` hints when logging in to a custom registry. [docker/cli#6015](https://redirect.github.com/docker/cli/pull/6015)\n-
          Fix `docker stats` not working properly on machines with high CPU core count.
          [moby/moby#49734](https://redirect.github.com/moby/moby/pull/49734)\n- Fix
          a regression causing `docker pull/push` to fail when interacting with a
          private repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n-
          Fix an issue preventing rootless Docker setup on a host with no `ip_tables`
          kernel module. [moby/moby#49727](https://redirect.github.com/moby/moby/pull/49727)\n-
          Fix an issue that could lead to unwanted iptables rules being restored and
          never deleted following a firewalld reload. [moby/moby#49728](https://redirect.github.com/moby/moby/pull/49728)\n-
          Improve CLI completion of `docker service scale`. [docker/cli#5968](https://redirect.github.com/docker/cli/pull/5968)\n-
          `docker images --tree` now hides both untagged and dangling images by default.
          [docker/cli#5924](https://redirect.github.com/docker/cli/pull/5924)\n- `docker
          system info` will provide an exit code if a connection cannot be established
          to the Docker daemon. [docker/cli#5918](https://redirect.github.com/docker/cli/pull/5918)\n-
          containerd image store: Fix `image tag` event not being emitted when building
          with BuildKit. [moby/moby#49678](https://redirect.github.com/moby/moby/pull/49678)\n-
          containerd image store: Improve `docker push/pull` handling of remote registry
          errors. [moby/moby#49770](https://redirect.github.com/moby/moby/pull/49770)\n-
          containerd image store: Show pull progress for non-layer image blobs. [moby/moby#49746](https://redirect.github.com/moby/moby/pull/49746)\n\n#####
          Packaging updates\n\n- Add Debian \"Trixie\" packages. [docker/docker-ce-packaging#1181](https://redirect.github.com/docker/docker-ce-packaging/pull/1181)\n-
          Add Fedora 42 packages. [docker/containerd-packaging#418](https://redirect.github.com/docker/containerd-packaging/pull/418),
          [docker/docker-ce-packaging#1169](https://redirect.github.com/docker/docker-ce-packaging/pull/1169)\n-
          Add Ubuntu 25.04 \"Plucky Puffin\" packages. [docker/containerd-packaging#419](https://redirect.github.com/docker/containerd-packaging/pull/419),
          [docker/docker-ce-packaging#1177](https://redirect.github.com/docker/docker-ce-packaging/pull/1177)\n-
          Update BuildKit to [v0.21.0](https://redirect.github.com/moby/buildkit/releases/tag/v0.21.0).
          [moby/moby#49809](https://redirect.github.com/moby/moby/pull/49809)\n- Update
          Compose to [v2.35.0](https://redirect.github.com/docker/compose/releases/tag/v2.35.0).
          [docker/docker-ce-packaging#1183](https://redirect.github.com/docker/docker-ce-packaging/pull/1183)\n-
          Update Go runtime to [1.23.8](https://go.dev/doc/devel/release#go1.23.8).
          [docker/cli#5986](https://redirect.github.com/docker/cli/pull/5986), [docker/docker-ce-packaging#1180](https://redirect.github.com/docker/docker-ce-packaging/pull/1180),
          [moby/moby#49737](https://redirect.github.com/moby/moby/pull/49737)\n\n#####
          Networking\n\n- Fix a bug causing host port-mappings on Swarm containers
          to be duplicated on `docker ps` and `docker inspect`. [moby/moby#49724](https://redirect.github.com/moby/moby/pull/49724)\n-
          Fix an issue that caused container network attachment to fail with error
          \"Bridge port not forwarding\". [moby/moby#49705](https://redirect.github.com/moby/moby/pull/49705)\n-
          Fix an issue with removal of a `--link` from a container in the default
          bridge network. [moby/moby#49778](https://redirect.github.com/moby/moby/pull/49778)\n-
          Improve how network-endpoint relationships are tracked to reduce the chance
          of the \"has active endpoints\" error to be wrongfully returned. [moby/moby#49736](https://redirect.github.com/moby/moby/pull/49736)\n-
          Improve the \"has active endpoints\" error message by including the name
          of endpoints still connected to the network being deleted. [moby/moby#49773](https://redirect.github.com/moby/moby/pull/49773)\n\n#####
          API\n\n- Update API version to [v1.49](https://docs.docker.com/engine/api/v1.49/).
          [moby/moby#49718](https://redirect.github.com/moby/moby/pull/49718)\n- `GET
          /image/{name}/json` now supports a `platform` parameter allowing to specify
          which platform variant of a multi-platform image to inspect. [moby/moby#49586](https://redirect.github.com/moby/moby/pull/49586)\n-
          `GET /info` now returns a `FirewallBackend` containing information about
          the daemon's firewalling configuration. [moby/moby#49761](https://redirect.github.com/moby/moby/pull/49761)\n\n#####
          Go SDK\n\n- Update minimum required Go version to go1.23. [docker/cli#5868](https://redirect.github.com/docker/cli/pull/5868)\n-
          cli/command/context: remove temporary `ContextType` field from JSON output.
          [docker/cli#5981](https://redirect.github.com/docker/cli/pull/5981)\n- client:
          Keep image references in canonical format where possible. [moby/moby#49609](https://redirect.github.com/moby/moby/pull/49609)\n\n#####
          Deprecations\n\n- API: Deprecated `AllowNondistributableArtifactsCIDRs`
          and `AllowNondistributableArtifactsHostnames` fields in the `RegistryConfig`
          struct in the `GET /info` response are omitted in API v1.49. [moby/moby#49749](https://redirect.github.com/moby/moby/pull/49749)\n-
          API: Deprecated: The `ContainerdCommit.Expected`, `RuncCommit.Expected`,
          and `InitCommit.Expected` fields in the `GET /info` endpoint were deprecated
          in API v1.48, and are now omitted in API v1.49. [moby/moby#48556](https://redirect.github.com/moby/moby/pull/48556)\n-
          Go-SDK: cli/command/image: Deprecate `RunPull`: this function was only used
          internally and will be removed in the next release. [docker/cli#5975](https://redirect.github.com/docker/cli/pull/5975)\n-
          Go-SDK: cli/config/configfile: deprecate `ConfigFile.Experimental` field.
          Experimental CLI features are always enabled since version v20.10 and this
          field is no longer used. Use `ConfigFile.Features` instead for optional
          features. This field will be removed in a future release. [docker/cli#5977](https://redirect.github.com/docker/cli/pull/5977)\n-
          Go-SDK: deprecate `pkg/archive`, which was migrated to `github.com/moby/go-archive`.
          [moby/moby#49743](https://redirect.github.com/moby/moby/pull/49743)\n- Go-SDK:
          deprecate `pkg/atomicwriter`, which was migrated to `github.com/moby/sys/atomicwriter`.
          [moby/moby#49748](https://redirect.github.com/moby/moby/pull/49748)\n- Go-SDK:
          opts: remove deprecated `PortOpt`, `ConfigOpt`, `SecretOpt` aliases. [docker/cli#5953](https://redirect.github.com/docker/cli/pull/5953)\n-
          Go-SDK: registry: deprecate `APIEndpoint.Official` field. [moby/moby#49706](https://redirect.github.com/moby/moby/pull/49706)\n\n###
          [`v28.0.4`](https://redirect.github.com/moby/moby/releases/tag/v28.0.4)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.3...v28.0.4)\n\n####
          28.0.4\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.4 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.4)\n-
          [moby/moby, 28.0.4 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.4)\n\n#####
          Bug fixes and enhancements\n\n- Fix a regression causing `docker pull/push`
          to fail when interacting with a private repository. [docker/cli#5964](https://redirect.github.com/docker/cli/pull/5964)\n\n###
          [`v28.0.3`](https://redirect.github.com/moby/moby/releases/tag/v28.0.3)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.2...v28.0.3)\n\n####
          28.0.3\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.3 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.3)\n-
          [moby/moby, 28.0.3 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.3)\n\n#####
          Bug fixes and enhancements\n\n- Fix `docker run` truncating the `STDOUT`/`STDERR`
          prematurely when the container exits before the data is consumed. [docker/cli#5957](https://redirect.github.com/docker/cli/pull/5957)\n\n#####
          Packaging updates\n\n- Update BuildKit to [v0.20.2](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.2).
          [moby/moby#49698](https://redirect.github.com/moby/moby/pull/49698)\n- Update
          `runc` to [v1.2.6](https://redirect.github.com/opencontainers/runc/releases/tag/v1.2.6)
          (static packages only). [moby/moby#49682](https://redirect.github.com/moby/moby/pull/49682)\n-
          Update containerd to [v1.7.26](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.26).
          [docker/containerd-packaging#409](https://redirect.github.com/docker/containerd-packaging/pull/409)\n\n###
          [`v28.0.2`](https://redirect.github.com/moby/moby/releases/tag/v28.0.2)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.1...v28.0.2)\n\n####
          28.0.2\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.2 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.2)\n-
          [moby/moby, 28.0.2 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.2)\n\n#####
          Bug fixes and enhancements\n\n- Fix CLI-specific attributes (`docker.cli.*`)
          being unintentionally passed to downstream OTel services. [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n-
          Fix an issue where user-specified `OTEL_RESOURCE_ATTRIBUTES` were being
          overridden by CLI's internal telemetry attributes. The CLI now properly
          merges user-specified attributes with internal ones, allowing both to coexist.
          [docker/cli#5842](https://redirect.github.com/docker/cli/pull/5842)\n- Fix
          daemon failing to start on Windows when a container created before v28.0.0
          was present. [moby/moby#49626](https://redirect.github.com/moby/moby/pull/49626)\n-
          Fix possible error on `docker buildx prune` with the `--min-free-space`.
          [moby/moby#49623](https://redirect.github.com/moby/moby/pull/49623)\n- Fix
          spurious `io: read/write on closed pipe` error in the daemon log when closing
          container. [moby/moby#49590](https://redirect.github.com/moby/moby/pull/49590)\n-
          Fix the Docker daemon failing too early if the containerd socket isn't immediately
          available. [moby/moby#49603](https://redirect.github.com/moby/moby/pull/49603)\n-
          Mask Linux thermal interrupt info in a container's `/proc` and `/sys` by
          default. [moby/moby#49560](https://redirect.github.com/moby/moby/pull/49560)\n-
          Update `contrib/check-config.sh` to check for more kernel modules related
          to iptables. [moby/moby#49622](https://redirect.github.com/moby/moby/pull/49622)\n-
          containerd image store: Fix integer overflow in User ID handling passed
          via `--user`. [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n-
          containerd image store: Fix spurious `reference for unknown type: application/vnd.in-toto+json`
          warning being logged to the daemon's log. [moby/moby#49652](https://redirect.github.com/moby/moby/pull/49652)\n-
          containerd image store: Improve performance of `docker ps` when running
          large number of containers. [moby/moby#49365](https://redirect.github.com/moby/moby/pull/49365)\n\n#####
          Packaging updates\n\n- Update BuildKit to [v0.20.1](https://redirect.github.com/moby/buildkit/releases/tag/v0.20.1).
          [moby/moby#49587](https://redirect.github.com/moby/moby/pull/49587)\n- Update
          Buildx to [v0.22.0](https://redirect.github.com/docker/buildx/releases/tag/v0.22.0).
          [docker/docker-ce-packaging#1175](https://redirect.github.com/docker/docker-ce-packaging/pull/1175)\n-
          Update Compose to [v2.34.0](https://redirect.github.com/docker/compose/releases/tag/v2.34.0).
          [docker/docker-ce-packaging#1172](https://redirect.github.com/docker/docker-ce-packaging/pull/1172)\n-
          Update Go runtime to [1.23.7](https://go.dev/doc/devel/release#go1.23.7).
          [docker/cli#5890](https://redirect.github.com/docker/cli/pull/5890), [docker/docker-ce-packaging#1171](https://redirect.github.com/docker/docker-ce-packaging/pull/1171),
          [moby/moby#49580](https://redirect.github.com/moby/moby/pull/49580)\n- Update
          RootlessKit to [v2.3.4](https://redirect.github.com/rootless-containers/rootlesskit/releases/tag/v2.3.4).
          [moby/moby#49614](https://redirect.github.com/moby/moby/pull/49614)\n- Update
          containerd (static binaries only) to [v1.7.27](https://www.github.com/containerd/containerd/releases/tag/v1.7.27).
          [moby/moby#49656](https://redirect.github.com/moby/moby/pull/49656)\n\n#####
          Networking\n\n- Add environment variable `DOCKER_INSECURE_NO_IPTABLES_RAW=1`
          to allow Docker to run on systems where the Linux kernel can't provide `CONFIG_IP_NF_RAW`
          support. When enabled, Docker will not create rules in the iptables `raw`
          table. Warning: This is not recommended for production environments as it
          reduces security by allowing other hosts on the local network to route to
          ports published to host addresses, even when they are published to `127.0.0.1.`
          This option bypasses some of the security hardening introduced in Docker
          Engine 28.0.0. [moby/moby#49621](https://redirect.github.com/moby/moby/pull/49621)\n-
          Allow container startup when an endpoint is attached to a macvlan network
          where the parent interface is down. [moby/moby#49630](https://redirect.github.com/moby/moby/pull/49630)\n-
          Do not skip DNAT for packets originating in a gateway\\_mode=routed network.
          [moby/moby#49577](https://redirect.github.com/moby/moby/pull/49577)\n- Fix
          a bug causing `docker ps` to inconsistently report dual-stack port mappings.
          [moby/moby#49657](https://redirect.github.com/moby/moby/pull/49657)\n- Fix
          a bug that could cause `docker-proxy` to stop forwarding UDP datagrams to
          containers. [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n-
          Fix a bug that was causing `docker-proxy` to close UDP connections to containers
          eagerly and resulting in the source address to change needlessly. [moby/moby#49649](https://redirect.github.com/moby/moby/pull/49649)\n\n#####
          Go SDK\n\n- Move various types and consts from `cli-plugins/manager` to
          a separate package. [docker/cli#5902](https://redirect.github.com/docker/cli/pull/5902)\n-
          Update minimum required Go version to go1.23. [moby/moby#49541](https://redirect.github.com/moby/moby/pull/49541)\n-
          `cli/command`: Move `PrettyPrint` utility to `cli/command/formatter`. [docker/cli#5916](https://redirect.github.com/docker/cli/pull/5916)\n-
          runconfig/errors: split `ErrConflictHostNetwork` into `ErrConflictConnectToHostNetwork`
          and `ErrConflictDisconnectFromHostNetwork`. [moby/moby#49605](https://redirect.github.com/moby/moby/pull/49605)\n\n#####
          Deprecations\n\n- Go-SDK: Deprecate `cli-plugins/manager.ResourceAttributesEnvvar`
          constant. It was used internally, but holds the `OTEL_RESOURCE_ATTRIBUTES`
          name, which is part of the OpenTelemetry specification. Users of this constant
          should define their own. It will be removed in the next release. [docker/cli#5881](https://redirect.github.com/docker/cli/pull/5881)\n-
          Go-SDK: Deprecate `opts.PortOpt`, `opts.ConfigOpt` and `opts.SecretOpt`.
          These types were moved to the `opts/swarmopts` package. [docker/cli#5907](https://redirect.github.com/docker/cli/pull/5907)\n-
          Go-SDK: Remove `service/logs` package. [docker/cli#5910](https://redirect.github.com/docker/cli/pull/5910)\n-
          Go-SDK: `cli/command/image`: Deprecate `PushTrustedReference` and move to
          `cli/trust`. [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-
          Go-SDK: `cli/command/image`: Deprecate and internalize `TrustedPush`. [docker/cli#5894](https://redirect.github.com/docker/cli/pull/5894)\n-
          Go-SDK: `cli/command`: deprecate `Cli.NotaryClient`: use [`trust.GetNotaryRepository`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/trust#GetNotaryRepository)
          instead. This method is no longer used and will be removed in the next release.
          [docker/cli#5885](https://redirect.github.com/docker/cli/pull/5885)\n- Go-SDK:
          `cli/command`: deprecate `Cli.RegistryClient`. This method was only used
          internally and will be removed in the next release. Use [`client.NewRegistryClient`](https://pkg.go.dev/github.com/docker/cli@v28.0.1+incompatible/cli/registry/client#NewRegistryClient)
          instead. [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889),
          [docker/cli#5889](https://redirect.github.com/docker/cli/pull/5889)\n- Go-SDK:
          `registry`: Deprecate `RepositoryInfo.Official` field. [moby/moby#49567](https://redirect.github.com/moby/moby/pull/49567)\n-
          Go-SDK: `registry`: deprecate `HostCertsDir`: this function was only used
          internally and will be removed in the next release. [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n-
          Go-SDK: `registry`: deprecate `SetCertsDir`: the cert-directory is now automatically
          selected when running with RootlessKit, and should no longer be set manually.
          [moby/moby#49612](https://redirect.github.com/moby/moby/pull/49612)\n\n###
          [`v28.0.1`](https://redirect.github.com/moby/moby/releases/tag/v28.0.1)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v28.0.0...v28.0.1)\n\n###
          28.0.1\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.1 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.1)\n-
          [moby/moby, 28.0.1 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.1)\n\n####
          Networking\n\n- Remove dependency on kernel modules `ip_set`, `ip_set_hash_net`
          and `netfilter_xt_set`.\n  - The dependency was introduced in release 28.0.0
          but proved too disruptive. The iptables rules using these modules have been
          replaced. [moby/moby#49530](https://redirect.github.com/moby/moby/pull/49530)\n-
          Allow daemon startup on a host with IPv6 disabled without requiring `--ip6tables=false`.
          [moby/moby#49525](https://redirect.github.com/moby/moby/pull/49525)\n- Fix
          a bug that was causing containers with `--restart=always` and a published
          port already in use to restart in a tight loop. [moby/moby#49507](https://redirect.github.com/moby/moby/pull/49507)\n-
          Fix an issue with Swarm ingress, caused by incorrect ordering of iptables
          rules. [moby/moby#49538](https://redirect.github.com/moby/moby/pull/49538)\n-
          Fix creation of a swarm-scoped network from a `--config-only` network. [moby/moby#49521](https://redirect.github.com/moby/moby/pull/49521)\n-
          Fix `docker network inspect` reporting an IPv6 gateway with CIDR suffix
          for a newly created network with no specific IPAM config, until a daemon
          restart. [moby/moby#49520](https://redirect.github.com/moby/moby/pull/49520)\n-
          Improve the error reported when kernel modules `ip_set`, `ip_set_hash_net`
          and `netilter_xt_set` are not available. [moby/moby#49524](https://redirect.github.com/moby/moby/pull/49524)\n-
          Move most of Docker's iptables rules out of the filter-FORWARD chain, so
          that other applications are free to append rules that must follow Docker's
          rules. [moby/moby#49518](https://redirect.github.com/moby/moby/pull/49518)\n-
          Update `--help` output and man page lo state which options only apply to
          the default bridge network. [moby/moby#49522](https://redirect.github.com/moby/moby/pull/49522)\n\n####
          Bug fixes and enhancements\n\n- Fix `docker context create` always returning
          an error when using the `\"skip-tls-verify\"` option. [docker/cli#5850](https://redirect.github.com/docker/cli/pull/5850)\n-
          Fix shell completion suggesting IDs instead of names for services and nodes.
          [docker/cli#5848](https://redirect.github.com/docker/cli/pull/5848)\n- Fix
          unintentionally printing exit status to standard error output when `docker
          exec/run` returns a non-zero status. [docker/cli#5854](https://redirect.github.com/docker/cli/pull/5854)\n-
          Fix regression `protocol \"tcp\" is not supported by the RootlessKit port
          driver \"slirp4netns\"`. [moby/moby#49514](https://redirect.github.com/moby/moby/pull/49514)\n-
          containerd image store: Fix `docker inspect` not being able to show multi-platform
          images with missing layers for all platforms. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
          containerd image store: Fix `docker images --tree` reporting wrong content
          size. [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n-
          Fix compilation on i386 [moby/moby#49526](https://redirect.github.com/moby/moby/pull/49526)\n\n####
          Packaging updates\n\n- Update `github.com/go-jose/go-jose/v4` to v4.0.5
          to address. [GHSA-c6gw-w398-hv78](https://redirect.github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78)
          / [CVE-2025-27144](https://www.cve.org/CVERecord?id=CVE-2025-27144) [docker/cli#5867](https://redirect.github.com/docker/cli/pull/5867)\n-
          Update Buildx to [v0.21.1](https://redirect.github.com/docker/buildx/releases/tag/v0.21.1).
          [docker/docker-ce-packaging#1167](https://redirect.github.com/docker/docker-ce-packaging/pull/1167)\n-
          Update Compose to [v2.33.1](https://redirect.github.com/docker/compose/releases/tag/v2.33.1).
          [docker/docker-ce-packaging#1168](https://redirect.github.com/docker/docker-ce-packaging/pull/1168)\n\n####
          API\n\n- containerd image store: Fix `GET /images/json?manifests=1` not
          filling `Manifests` for index-only images. [moby/moby#49533](https://redirect.github.com/moby/moby/pull/49533)\n-
          containerd image store: Fix `GET /images/json and /images/<name>/json` `Size.Content`
          field including the size of content that's not available locally. [moby/moby#49535](https://redirect.github.com/moby/moby/pull/49535)\n\n###
          [`v28.0.0`](https://redirect.github.com/moby/moby/releases/tag/v28.0.0)\n\n[Compare
          Source](https://redirect.github.com/moby/moby/compare/v27.5.1...v28.0.0)\n\n###
          28.0.0\n\nFor a full list of pull requests and changes in this release,
          refer to the relevant GitHub milestones:\n\n- [docker/cli, 28.0.0 milestone](https://redirect.github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
          [moby/moby, 28.0.0 milestone](https://redirect.github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.0.0)\n-
          Deprecated and removed features, see [Deprecated Features](https://redirect.github.com/docker/cli/blob/v28.0.0/docs/deprecated.md).\n-
          Changes to the Engine API, see [API version history](https://redirect.github.com/moby/moby/blob/v28.0.0/docs/api/version-history.md).\n\n####
          New\n\n- Add ability to mount an image inside a container via `--mount type=image`.
          [moby/moby#48798](https://redirect.github.com/moby/moby/pull/48798)\n  -
          You can also specify `--mount type=image,image-subpath=[subpath],...` option
          to mount a specific path from the image. [docker/cli#5755](https://redirect.github.com/docker/cli/pull/5755)\n-
          `docker images --tree` now shows metadata badges. [docker/cli#5744](https://redirect.github.com/docker/cli/pull/5744)\n-
          `docker load`, `docker save`, and `docker history` now support a `--platform`
          flag allowing you to choose a specific platform for single-platform operations
          on multi-platform images. [docker/cli#5331](https://redirect.github.com/docker/cli/pull/5331)\n-
          Add `OOMScoreAdj` to `docker service create` and `docker stack`. [docker/cli#5145](https://redirect.github.com/docker/cli/pull/5145)\n-
          `docker buildx prune` now supports `reserved-space`, `max-used-space`, `min-free-space`
          and `keep-bytes` filters. [moby/moby#48720](https://redirect.github.com/moby/moby/pull/48720)\n-
          Windows: Add support for running containerd as a child process of the daemon,
          instead of using a system-installed containerd. [moby/moby#47955](https://redirect.github.com/moby/moby/pull/47955)\n\n####
          Networking\n\n- The `docker-proxy` binary has been updated, older versions
          will not work with the updated `dockerd`. [moby/moby#48132](https://redirect.github.com/moby/moby/pull/48132)\n
          \ - Close a window in which the userland proxy (`docker-proxy`) could accept
          TCP connections, that would then fail after `iptables` NAT rules were set
          up.\n  - The executable `rootlesskit-docker-proxy` is no longer used, it
          has been removed from the build and distribution.\n- DNS nameservers read
          from the host's `/etc/resolv.conf` are now always accessed from the host's
          network namespace. [moby/moby#48290](https://redirect.github.com/moby/moby/pull/48290)\n
          \ - When the host's `/etc/resolv.conf` contains no nameservers and there
          are no `--dns` overrides, Google's DNS servers are no longer used, apart
          from by the default bridge network and in build containers.\n- Container
          interfaces in bridge and macvlan networks now use randomly generated MAC
          addresses. [moby/moby#48808](https://redirect.github.com/moby/moby/pull/48808)\n
          \ - Gratuitous ARP / Neighbour Advertisement messages will be sent when
          the interfaces are started so that, when IP addresses are reused, they're
          associated with the newly generated MAC address.\n  - IPv6 addresses in
          the default bridge network are now IPAM-assigned, rather than being derived
          from the MAC address.\n- The deprecated OCI `prestart` hook is now only
          used by build containers. For other containers, network interfaces are added
          to the network namespace after task creation is complete, before the container
          task is started. [moby/moby#47406](https://redirect.github.com/moby/moby/pull/47406)\n-
          Add a new `gw-priority` option to `docker run`, `docker container create`,
          and `docker network connect`. This option will be used by the Engine to
          determine which network provides the default gateway for a container. On
          `docker run`, this option is only available through the extended `--network`
          syntax. [docker/cli#5664](https://redirect.github.com/docker/cli/pull/5664)\n-
          Add a new netlabel `com.docker.network.endpoint.ifname` to customize the
          interface name used when connecting a container to a network. It's supported
          by all built-in network drivers on Linux. [moby/moby#49155](https://redirect.github.com/moby/moby/pull/49155)\n
          \ - When a container is created with multiple networks specified, there's
          no guarantee on the order networks will be connected to the container. So,
          if a custom interface name uses the same prefix as the auto-generated names,
          for example `eth`, the container might fail to start.\n  - The recommended
          practice is to use a different prefix, for example `en0`, or a numerical
          suffix high enough to never collide, for example `eth100`.\n  - This label
          can be specified on `docker network connect` via the `--driver-opt` flag,
          for example `docker network connect --driver-opt=com.docker.network.endpoint.ifname=foobar
          \u2026`.\n  - Or via the long-form `--network` flag on `docker run`, for
          example `docker run --network=name=bridge,driver-opt=com.docker.network.endpoint.ifname=foobar
          \u2026`\n- If a custom network driver reports capability `GwAllocChecker`
          then, before a network is created, it will get a `GwAllocCheckerRequest`
          with the network's options. The custom driver may then reply that no gateway
          IP address should be allocated. [moby/moby#49372](https://redirect.github.com/moby/moby/pull/49372)\n\n####
          Port publishing in bridge networks\n\n- `dockerd` now requires `ipset` support
          in the Linux kernel. [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n
          \ - The `iptables` and `ip6tables` rules used to implement port publishing
          and network isolation have been extensively modified. This enables some
          of the following functional changes, and is a first step in refactoring
          to enable native `nftables` support in a future release. [moby/moby#48815](https://redirect.github.com/moby/moby/issues/48815)\n
          \ - If it becomes necessary to downgrade to an earlier version of the daemon,
          some manual cleanup of the new rules will be necessary. The simplest and
          surest approach is to reboot the host, or use `iptables -F` and `ip6tables
          -F` to flush all existing `iptables` rules from the `filter` table before
          starting the older version of the daemon. When that is not possible, run
          the following commands as root:\n    - `iptables -D FORWARD -m set --match-set
          docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED -j
          ACCEPT; ip6tables -D FORWARD -m set --match-set docker-ext-bridges-v6 dst
          -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT`\n    - `iptables -D
          FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER; ip6tables
          -D FORWARD -m set --match-set docker-ext-bridges-v6 dst -j DOCKER`\n    -
          If you were previously running with the iptables filter-FORWARD policy set
          to `ACCEPT` and need to restore access to unpublished ports, also delete
          per-bridge-network rules from the `DOCKER` chains. For example, `iptables
          -D DOCKER ! -i docker0 -o docker0 -j DROP`.\n- Fix a security issue that
          was allowing remote hosts to connect directly to a container on its published
          ports. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
          Fix a security issue that was allowing neighbor hosts to connect to ports
          mapped on a loopback address. [moby/moby#49325](https://redirect.github.com/moby/moby/pull/49325)\n-
          Fix an issue that prevented port publishing to link-local addresses. [moby/moby#48570](https://redirect.github.com/moby/moby/pull/48570)\n-
          UDP ports published by a container are now reliably accessible by containers
          on other networks, via the host's public IP address. [moby/moby#48571](https://redirect.github.com/moby/moby/pull/48571)\n-
          Docker will now only set the `ip6tables` policy for the `FORWARD` chain
          in the `filter` table to `DROP` if it enables IP forwarding on the host
          itself (sysctls `net.ipv6.conf.all.forwarding` and `net.ipv6.conf.default.forwarding`).
          This is now aligned with existing IPv4 behaviour. [moby/moby#48594](https://redirect.github.com/moby/moby/pull/48594)\n
          \ - If IPv6 forwarding is enabled on your host, but you were depending on
          Docker to set the ip6tables filter-FORWARD policy to `DROP`, you may need
          to update your host's configuration to make sure it is secure.\n- Direct
          routed access to container ports that are not exposed using `p`/`-publish`
          is now blocked in the `DOCKER` iptables chain. [moby/moby#48724](https://redirect.github.com/moby/moby/pull/48724)\n
          \ - If the default iptables filter-FORWARD policy was previously left at
          `ACCEPT` on your host, and direct routed access to a container's unpublished
          ports from a remote host is still required, options are:\n    - Publish
          the ports you need.\n    - Use the new `gateway_mode_ipv[46]=nat-unprotected`,
          described below.\n  - Container ports published to host addresses will continue
          to be accessible via those host addresses, using NAT or the userland proxy.\n
          \ - Unpublished container ports continue to be directly accessible from
          the Docker host via the container's IP address.\n- Networks created with
          `gateway_mode_ipv[46]=routed` are now accessible from other bridge networks
          running on the same Docker host, as well as from outside the host. [moby/moby#48596](https://redirect.github.com/moby/moby/pull/48596)\n-
          Bridge driver options `com.docker.network.bridge.gateway_mode_ipv4` and
          `com.docker.network.bridge.gateway_mode_ipv6` now accept mode `nat-unprotected`.
          [moby/moby#48597](https://redirect.github.com/moby/moby/pull/48597)\n  -
          `nat-unprotected` is similar to the default `nat` mode, but no per port/protocol
          rules are set up. This means any port on a container can be accessed by
          direct-routing from a remote host.\n- Bridge driver options `com.docker.network.bridge.gateway_mode_ipv4`
          and `com.docker.network.bridge.gateway_mode_ipv6` now accept mode `isolated`,
          when the network is also `internal`. [moby/moby#49262](https://redirect.github.com/moby/moby/pull/49262)\n
          \ - An address is normally assigned to the bridge device in an `internal`
          network. So, processes on the Docker host can access the network, and containers
          in the network can access host services listening on that bridge address
          (including services listening on \"any\" host address, `0.0.0.0` or `::`).\n
          \ - An `internal` bridge network created with gateway mode `isolated` does
          not have an address on the Docker host.\n- When a port mapping includes
          a host IP address or port number that cannot be used because NAT from the
          host is disabled using `--gateway_mode_ipv[46]`, container creation will
          no longer fail. The unused fields may be needed if the gateway endpoint
          changes when networks are connected or disconnected. A message about the
          unused fields will be logged. [moby/moby#48575](https://redirect.github.com/moby/moby/pull/48575)\n-
          Do not create iptables nat-POSTROUTING masquerade rules for a container's
          own published ports, when the userland proxy is enabled. [moby/moby#48854](https://redirect.github.com/moby/moby/pull/48854)\n\n####
          IPv6\n\n- Add `docker network create` option `--ipv4`. To disable IPv4 address
          assignment for a network, use `docker network create --ipv4=false [...]`.
          [docker/cli#5599](https://redirect.github.com/docker/cli/pull/5599)\n- Daemon
          option `--ipv6` (`\"ipv6\": true` in `daemon.json`) can now be used without
          `fixed-cidr-v6`. [moby/moby#48319](https://redirect.github.com/moby/moby/pull/48319)\n-
          IPAM now handles subnets bigger than \"/64\". [moby/moby#49223](https://redirect.github.com/moby/moby/pull/49223)\n-
          Duplicate address detection (DAD) is now disabled for addresses assigned
          to the bridges belonging to bridge networks. [moby/moby#48609](https://redirect.github.com/moby/moby/pull/48609)\n-
          Modifications to `host-gateway`, for compatibility with IPv6-only networks.
          [moby/moby#48807](https://redirect.github.com/moby/moby/pull/48807)\n  -
          When special value `host-gateway` is used in an `--add-host` option in place
          of an address, it's replaced by an address on the Docker host to make it
          possible to refer to the host by name. The address used belongs to the default
          bridge (normally `docker0`). Until now it's always been an IPv4 address,
          because all containers on bridge networks had IPv4 addresses.\n  - Now,
          if IPv6 is enabled on the default bridge network, `/etc/hosts` entries will
          be created for IPv4 and IPv6 addresses. So, a container that's only connected
          to IPv6-only networks can access the host by name.\n  - The `--host-gateway-ip`
          option overrides the address used to replace `host-gateway`. Two of these
          options are now allowed on the command line, for one IPv4 gateway and one
          IPv6.\n  - In the `daemon.json` file, to provide two addresses, use `\"host-gateway-ips\"`.
          For example, `\"host-gateway-ips\": [\"192.0.2.1\", \"2001:db8::1111\"]`.\n\n####
          Bug fixes and enhancements\n\n- Add IPv6 loopback address as an insecure
          registry by default. [moby/moby#48540](https://redirect.github.com/moby/moby/pull/48540)\n-
          Add support for Cobra-generated completion scripts for `dockerd`. [moby/moby#49339](https://redirect.github.com/moby/moby/pull/49339)\n-
          Fix DNS queries failing when containers are launched via `systemd` auto-start
          on boot [moby/moby#48812](htt\n\n</details>\n\n---\n\n### Configuration\n\n\U0001F4C5
          **Schedule**: Branch creation - At any time (no schedule defined), Automerge
          - At any time (no schedule defined).\n\n\U0001F6A6 **Automerge**: Disabled
          by config. Please merge this manually once you are satisfied.\n\n\u267B
          **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry
          checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded
          about this update again.\n\n---\n\n - [ ] <!-- rebase-check -->If you want
          to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated
          by [Mend Renovate](https://mend.io/renovate/). View the [repository job
          log](https://developer.mend.io/github/osism/ci-image).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQwLjYyLjEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbInJlbm92YXRlIl19-->\n"
        change_url: https://github.com/osism/ci-image/pull/57
        commit_id: 5782a1d08cb7c618372f9c0486e17f9ea793d5c1
        patchset: 5782a1d08cb7c618372f9c0486e17f9ea793d5c1
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ci-image
          name: osism/ci-image
          short_name: ci-image
          src_dir: src/github.com/osism/ci-image
        topic: null
      job: ansible-lint
      jobtags: []
      max_attempts: 3
      message: Y2hvcmUoZGVwcyk6IHVwZGF0ZSBkZXBlbmRlbmN5IG1vYnkvbW9ieSB0byB2MjgKClRoaXMgUFIgY29udGFpbnMgdGhlIGZvbGxvd2luZyB1cGRhdGVzOgoKfCBQYWNrYWdlIHwgVXBkYXRlIHwgQ2hhbmdlIHwKfC0tLXwtLS18LS0tfAp8IFttb2J5L21vYnldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkpIHwgbWFqb3IgfCBgMjcuNS4xYCAtPiBgMjguMy4wYCB8CgotLS0KCiMjIyBSZWxlYXNlIE5vdGVzCgo8ZGV0YWlscz4KPHN1bW1hcnk+bW9ieS9tb2J5IChtb2J5L21vYnkpPC9zdW1tYXJ5PgoKIyMjIFtgdjI4LjMuMGBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcmVsZWFzZXMvdGFnL3YyOC4zLjApOiAyOC4zLjAKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9jb21wYXJlL3YyOC4yLjIuLi52MjguMy4wKQoKIyMjIyAyOC4zLjAKCkZvciBhIGZ1bGwgbGlzdCBvZiBwdWxsIHJlcXVlc3RzIGFuZCBjaGFuZ2VzIGluIHRoaXMgcmVsZWFzZSwgcmVmZXIgdG8gdGhlIHJlbGV2YW50IEdpdEh1YiBtaWxlc3RvbmVzOgoKLSBbZG9ja2VyL2NsaSwgMjguMy4wIG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMy4wKQotIFttb2J5L21vYnksIDI4LjMuMCBtaWxlc3RvbmVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMy4wKQotIERlcHJlY2F0ZWQgYW5kIHJlbW92ZWQgZmVhdHVyZXMsIHNlZSBbRGVwcmVjYXRlZCBGZWF0dXJlc10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvYmxvYi92MjguMy4wL2RvY3MvZGVwcmVjYXRlZC5tZCkuCi0gQ2hhbmdlcyB0byB0aGUgRW5naW5lIEFQSSwgc2VlIFtBUEkgdmVyc2lvbiBoaXN0b3J5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L2Jsb2IvdjI4LjMuMC9kb2NzL2FwaS92ZXJzaW9uLWhpc3RvcnkubWQpLgoKIyMjIyMgTmV3CgotIEFkZCBzdXBwb3J0IGZvciBBTUQgR1BVcyBpbiBgZG9ja2VyIHJ1biAtLWdwdXNgLiBbbW9ieS9tb2J5IzQ5OTUyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk5NTIpCi0gVXNlIGBET0NLRVJfQVVUSF9DT05GSUdgIGFzIGEgY3JlZGVudGlhbCBzdG9yZS4gW2RvY2tlci9jbGkjNjAwOF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC82MDA4KQoKIyMjIyMgQnVnIGZpeGVzIGFuZCBlbmhhbmNlbWVudHMKCi0gRW5zdXJlIHRoYXQgdGhlIHN0YXRlIG9mIHRoZSBjb250YWluZXIgaW4gdGhlIGRhZW1vbiBkYXRhYmFzZSAodXNlZCBieSBbL2NvbnRhaW5lcnMvanNvbl0oaHR0cHM6Ly9kb2NzLmRvY2tlci5jb20vcmVmZXJlbmNlL2FwaS9lbmdpbmUvdmVyc2lvbi92MS40OS8jdGFnL0NvbnRhaW5lci9vcGVyYXRpb24vQ29udGFpbmVyTGlzdCkgQVBJKSBpcyB1cCB0byBkYXRlIHdoZW4gdGhlIGNvbnRhaW5lciBpcyBzdG9wcGVkIHVzaW5nIHRoZSBbL2NvbnRhaW5lcnMve2lkfS9zdG9wXShodHRwczovL2RvY3MuZG9ja2VyLmNvbS9yZWZlcmVuY2UvYXBpL2VuZ2luZS92ZXJzaW9uL3YxLjQ5LyN0YWcvQ29udGFpbmVyL29wZXJhdGlvbi9Db250YWluZXJTdG9wKSBBUEkgKGJlZm9yZSByZXNwb25zZSBvZiBBUEkpLiBbbW9ieS9tb2J5IzUwMTM2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNTAxMzYpCi0gRml4IGBkb2NrZXIgaW1hZ2UgaW5zcGVjdCBpbnNwZWN0YCBvbWl0dGluZyBlbXB0eSBmaWVsZHMuIFttb2J5L21vYnkjNTAxMzVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC81MDEzNSkKLSBGaXggYGRvY2tlciBpbWFnZXMgLS10cmVlYCBub3QgbWFya2luZyBpbWFnZXMgYXMgaW4tdXNlIHdoZW4gdGhlIGNvbnRhaW5lcmQgaW1hZ2Ugc3RvcmUgaXMgZGlzYWJsZWQuIFtkb2NrZXIvY2xpIzYxNDBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNjE0MCkKLSBGaXggYGRvY2tlciBwdWxsL3B1c2hgIGhhbmcgaW4gbm9uLWludGVyYWN0aXZlIHdoZW4gYXV0aGVudGljYXRpb24gaXMgcmVxdWlyZWQgY2F1c2VkIGJ5IHByb21wdGluZyBmb3IgbG9naW4gY3JlZGVudGlhbHMuIFtkb2NrZXIvY2xpIzYxNDFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNjE0MSkKLSBGaXggYSBwb3RlbnRpYWwgcmVzb3VyY2UgbGVhayB3aGVuIGEgbm9kZSBsZWF2ZXMgYSBTd2FybS4gW21vYnkvbW9ieSM1MDExNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzUwMTE1KQotIEZpeCBhIHJlZ3Jlc3Npb24gd2hlcmUgYSBsb2dpbiBwcm9tcHQgb24gYGRvY2tlciBwdWxsYCB3b3VsZCBzaG93IERvY2tlciBIdWItc3BlY2lmaWMgaGludHMgd2hlbiBsb2dnaW5nIGluIG9uIG90aGVyIHJlZ2lzdHJpZXMuIFtkb2NrZXIvY2xpIzYxMzVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNjEzNSkKLSBGaXggYW4gaXNzdWUgd2hlcmUgYWxsIG5ldyB0YXNrcyBpbiB0aGUgU3dhcm0gY291bGQgZ2V0IHN0dWNrIGluIHRoZSBQRU5ESU5HIHN0YXRlIGZvcmV2ZXIgYWZ0ZXIgc2NhbGluZyB1cCBhIHNlcnZpY2Ugd2l0aCBwbGFjZW1lbnQgcHJlZmVyZW5jZXMuIFttb2J5L21vYnkjNTAyMTFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC81MDIxMSkKLSBSZW1vdmUgYW4gdW5kb2N1bWVudGVkLCBoaWRkZW4sIHRvcC1sZXZlbCBgZG9ja2VyIHJlbW92ZWAgY29tbWFuZCB0aGF0IHdhcyBhY2NpZGVudGFsbHkgaW50cm9kdWNlZCBpbiBEb2NrZXIgMjMuMC4gW2RvY2tlci9jbGkjNjE0NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC82MTQ0KQotIFZhbGlkYXRlIHJlZ2lzdHJ5LW1pcnJvcnMgY29uZmlndXJhdGlvbiBhcyBwYXJ0IG9mIGBkb2NrZXJkIC0tdmFsaWRhdGVgIGFuZCBpbXByb3ZlIGVycm9yIG1lc3NhZ2VzIGZvciBpbnZhbGlkIG1pcnJvcnMuIFttb2J5L21vYnkjNTAyNDBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC81MDI0MCkKLSBgZG9ja2VyZC1yb290bGVzcy1zZXR1cHRvb2wuc2hgOiBGaXggdGhlIHNjcmlwdCBmcm9tIHNpbGVudGx5IHJldHVybmluZyB3aXRoIG5vIGVycm9yIG1lc3NhZ2Ugd2hlbiBzdWJ1aWQvc3ViZ2lkIHN5c3RlbSByZXF1aXJlbWVudHMgYXJlIG5vdCBzYXRpc2ZpZWQuIFttb2J5L21vYnkjNTAwNTldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC81MDA1OSkKLSBjb250YWluZXJkIGltYWdlIHN0b3JlOiBGaXggYGRvY2tlciBwdXNoYCBub3QgY3JlYXRpbmcgYSB0YWcgb24gdGhlIHJlbW90ZSByZXBvc2l0b3J5LiBbbW9ieS9tb2J5IzUwMTk5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNTAxOTkpCi0gY29udGFpbmVyZCBpbWFnZSBzdG9yZTogSW1wcm92ZSBoYW5kbGluZyBvZiBlcnJvcnMgcmV0dXJuZWQgYnkgdGhlIHRva2VuIHNlcnZlciBkdXJpbmcgYGRvY2tlciBwdWxsL3B1c2hgLiBbbW9ieS9tb2J5IzUwMTc2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNTAxNzYpCgojIyMjIyBQYWNrYWdpbmcgdXBkYXRlcwoKLSBBbGxvdyBjdXN0b21pemluZyBjb250YWluZXJkIHNlcnZpY2UgbmFtZSBmb3IgT3BlblJDLiBbbW9ieS9tb2J5IzUwMTU2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNTAxNTYpCi0gVXBkYXRlIEJ1aWxkS2l0IHRvIFt2MC4yMy4xXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9idWlsZGtpdC9yZWxlYXNlcy90YWcvdjAuMjMuMSkuIFttb2J5L21vYnkjNTAyNDNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC81MDI0MykKLSBVcGRhdGUgQnVpbGR4IHRvIFt2MC4yNS4wXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2J1aWxkeC9yZWxlYXNlcy90YWcvdjAuMjUuMCkuIFtkb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZyMxMjE3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcvcHVsbC8xMjE3KQotIFVwZGF0ZSBDb21wb3NlIHRvIFt2Mi4zNy4yXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NvbXBvc2UvcmVsZWFzZXMvdGFnL3YyLjM3LjIpLiBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTIxOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTIxOSkKLSBVcGRhdGUgRG9ja2VyIE1vZGVsIENMSSBwbHVnaW4gdG8gW3YwLjEuMzBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvbW9kZWwtY2xpL3JlbGVhc2VzL3RhZy92MC4xLjMwKS4gW2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nIzEyMThdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZy9wdWxsLzEyMTgpCi0gVXBkYXRlIEdvIHJ1bnRpbWUgdG8gWzEuMjQuNF0oaHR0cHM6Ly9nby5kZXYvZG9jL2RldmVsL3JlbGVhc2UjZ28xLjI0LjQpLiBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTIxM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTIxMyksIFttb2J5L21vYnkjNTAxNTNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC81MDE1MyksIFtkb2NrZXIvY2xpIzYxMjRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNjEyNCkKCiMjIyMjIE5ldHdvcmtpbmcKCi0gUmV2ZXJ0IFN3YXJtIHJlbGF0ZWQgY2hhbmdlcyBhZGRlZCBpbiAyOC4yLnggYnVpbGRzLCBkdWUgdG8gYSByZWdyZXNzaW9uIHJlcG9ydGVkIGluIFtodHRwczovL2dpdGh1Yi5jb20vbW9ieS9tb2J5L2lzc3Vlcy81MDEyOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9pc3N1ZXMvNTAxMjkpLiBbbW9ieS9tb2J5IzUwMTY5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNTAxNjkpCiAgLSBSZXZlcnQ6IEZpeCBhbiBpc3N1ZSB3aGVyZSBgZG9ja2VyIG5ldHdvcmsgaW5zcGVjdCAtLXZlcmJvc2VgIGNvdWxkIHNvbWV0aW1lcyBjcmFzaCB0aGUgZGFlbW9uIChbaHR0cHM6Ly9naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5OTM3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk5MzcpKS4KICAtIFJldmVydDogRml4IGFuIGlzc3VlIHdoZXJlIHRoZSBsb2FkLWJhbGFuY2VyIElQIGFkZHJlc3MgZm9yIGFuIG92ZXJsYXkgbmV0d29yayB3b3VsZCBub3QgYmUgcmVsZWFzZWQgaW4gY2VydGFpbiBjYXNlcyBpZiB0aGUgU3dhcm0gd2FzIGxhY2tpbmcgYW4gaW5ncmVzcyBuZXR3b3JrIChbaHR0cHM6Ly9naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5OTQ4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk5NDgpKS4KICAtIFJldmVydDogSW1wcm92ZSB0aGUgcmVsaWFiaWxpdHkgb2YgTmV0d29ya0RCIGluIGJ1c3kgY2x1c3RlcnMgYW5kIGxvc3N5IG5ldHdvcmtzIChbaHR0cHM6Ly9naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5OTMyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk5MzIpKS4KICAtIFJldmVydDogSW1wcm92ZW1lbnRzIHRvIHRoZSByZWxpYWJpbGl0eSBhbmQgY29udmVyZ2VuY2Ugc3BlZWQgb2YgTmV0d29ya0RCIChbaHR0cHM6Ly9naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5OTM5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk5MzkpKS4KLSBGaXggYW4gaXNzdWUgdGhhdCBjb3VsZCBjYXVzZSBjb250YWluZXIgc3RhcnR1cCB0byBmYWlsLCBvciBsZWFkIHRvIGZhaWxlZCBVRFAgcG9ydCBtYXBwaW5ncywgd2hlbiBzb21lIGNvbnRhaW5lciBwb3J0cyBhcmUgbWFwcGVkIHRvIGAwLjAuMC4wYCBhbmQgb3RoZXJzIGFyZSBtYXBwZWQgdG8gc3BlY2lmaWMgaG9zdCBhZGRyZXNzZXMuIFttb2J5L21vYnkjNTAwNTRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC81MDA1NCkKLSBUaGUgYG5ldHdvcmsgaW5zcGVjdGAgcmVzcG9uc2UgZm9yIGFuIG92ZXJsYXkgbmV0d29yayBub3cgcmVwb3J0cyB0aGF0IGBFbmFibGVJUHY0YCBpcyB0cnVlLiBbbW9ieS9tb2J5IzUwMTQ3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNTAxNDcpCi0gV2luZG93czogSW1wcm92ZSBkYWVtb24gc3RhcnR1cCB0aW1lIGluIGNhc2VzIHdoZXJlIHRoZSBob3N0IGhhcyBuZXR3b3JrcyBvZiB0eXBlIGAiTWlycm9yZWQiYC4gW21vYnkvbW9ieSM1MDE1NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzUwMTU1KQotIFdpbmRvd3M6IE1ha2Ugc3VyZSBgZG9ja2VyIHN5c3RlbSBwcnVuZWAgYW5kIGBkb2NrZXIgbmV0d29yayBwcnVuZWAgb25seSByZW1vdmUgbmV0d29ya3MgY3JlYXRlZCBieSBEb2NrZXIuIFttb2J5L21vYnkjNTAxNTRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC81MDE1NCkKCiMjIyMjIEFQSQoKLSBVcGRhdGUgQVBJIHZlcnNpb24gdG8gMS41MS4gW21vYnkvbW9ieSM1MDE0NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzUwMTQ1KQotIGBHRVQgL2ltYWdlcy9qc29uYCBub3cgc2V0cyB0aGUgdmFsdWUgb2YgdGhlIGBDb250YWluZXJzYCBmaWVsZCBmb3IgYWxsIGltYWdlcyB0byB0aGUgY291bnQgb2YgY29udGFpbmVycyB1c2luZyB0aGUgaW1hZ2UuIFttb2J5L21vYnkjNTAxNDZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC81MDE0NikKCiMjIyMjIERlcHJlY2F0aW9ucwoKLSBFbXB0eS9uaWwgaW1hZ2UgY29uZmlnIGZpZWxkcyBpbiB0aGUgYEdFVCAvaW1hZ2VzL3tuYW1lfS9qc29uYCByZXNwb25zZSBhcmUgbm93IGRlcHJlY2F0ZWQgYW5kIHdpbGwgYmUgcmVtb3ZlZCBpbiB2MjkuMC4gW2RvY2tlci9jbGkjNjEyOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC82MTI5KQotIGFwaS90eXBlcy9jb250YWluZXI6IGRlcHJlY2F0ZSBgRXhlY09wdGlvbnMuRGV0YWNoYC4gVGhpcyBmaWVsZCBpcyBub3QgdXNlZCwgYW5kIHdpbGwgYmUgcmVtb3ZlZCBpbiBhIGZ1dHVyZSByZWxlYXNlLiBbbW9ieS9tb2J5IzUwMjE5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNTAyMTkpCi0gcGtnL2lkdG9vbHM6IGRlcHJlY2F0ZSBgSWRlbnRpdHlNYXBwaW5nYCBhbmQgYElkZW50aXR5LkNob3duYC4gW21vYnkvbW9ieSM1MDIxMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzUwMjEwKQoKIyMjIFtgdjI4LjIuMmBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcmVsZWFzZXMvdGFnL3YyOC4yLjIpOiAyOC4yLjIKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9jb21wYXJlL3YyOC4yLjEuLi52MjguMi4yKQoKIyMjIyAyOC4yLjIKCkZvciBhIGZ1bGwgbGlzdCBvZiBwdWxsIHJlcXVlc3RzIGFuZCBjaGFuZ2VzIGluIHRoaXMgcmVsZWFzZSwgcmVmZXIgdG8gdGhlIHJlbGV2YW50IEdpdEh1YiBtaWxlc3RvbmVzOgoKLSBbZG9ja2VyL2NsaSwgMjguMi4yIG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMi4yKQotIFttb2J5L21vYnksIDI4LjIuMiBtaWxlc3RvbmVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMi4yKQoKIyMjIyMgQnVnIGZpeGVzIGFuZCBlbmhhbmNlbWVudHMKCi0gY29udGFpbmVyZCBpbWFnZSBzdG9yZTogRml4IGEgcmVncmVzc2lvbiBjYXVzaW5nIGBkb2NrZXIgYnVpbGQgLS1wdXNoYCB0byBmYWlsLiBUaGlzIHJldmVydHMgW3RoZSBmaXhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTcwMikgZm9yIGBkb2NrZXIgYnVpbGRgIG5vdCBwZXJzaXN0aW5nIG92ZXJyaWRkZW4gaW1hZ2VzIGFzIGRhbmdsaW5nLiBbbW9ieS9tb2J5IzUwMTA1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNTAxMDUpCgojIyMjIyBOZXR3b3JraW5nCgotIFdoZW4gY3JlYXRpbmcgdGhlIGlwdGFibGVzIGBET0NLRVItVVNFUmAgY2hhaW4sIGRvIG5vdCBhZGQgYW4gZXhwbGljaXQgYFJFVFVSTmAgcnVsZSwgYWxsb3dpbmcgdXNlcnMgdG8gYXBwZW5kIGFzIHdlbGwgYXMgaW5zZXJ0IHRoZWlyIG93biBydWxlcy4gRXhpc3RpbmcgcnVsZXMgYXJlIG5vdCByZW1vdmVkIG9uIHVwZ3JhZGUsIGJ1dCBpdCB3b24ndCBiZSByZXBsYWNlZCBhZnRlciBhIHJlYm9vdC4gW21vYnkvbW9ieSM1MDA5OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzUwMDk4KQoKIyMjIFtgdjI4LjIuMWBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcmVsZWFzZXMvdGFnL3YyOC4yLjEpOiAyOC4yLjEKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9jb21wYXJlL3YyOC4yLjAuLi52MjguMi4xKQoKIyMjIyAyOC4yLjEKCiMjIyMgUGFja2FnaW5nIHVwZGF0ZXMKCi0gRml4IHBhY2thZ2luZyByZWdyZXNzaW9uIGluIFt2MjguMi4wXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3JlbGVhc2VzL3RhZy92MjguMi4wKSB3aGljaCBicm9rZSBjcmVhdGluZyB0aGUgYGRvY2tlcmAgZ3JvdXAvdXNlciBvbiBmcmVzaCBpbnN0YWxsYXRpb25zLiBbZG9ja2VyLWNlLXBhY2thZ2luZyMxMjA5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcvaXNzdWVzLzEyMDkpCgojIyMgW2B2MjguMi4wYF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9yZWxlYXNlcy90YWcvdjI4LjIuMCk6IDI4LjIuMAoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L2NvbXBhcmUvdjI4LjEuMS4uLnYyOC4yLjApCgojIyMjIDI4LjIuMAoKRm9yIGEgZnVsbCBsaXN0IG9mIHB1bGwgcmVxdWVzdHMgYW5kIGNoYW5nZXMgaW4gdGhpcyByZWxlYXNlLCByZWZlciB0byB0aGUgcmVsZXZhbnQgR2l0SHViIG1pbGVzdG9uZXM6CgotIFtkb2NrZXIvY2xpLCAyOC4yLjAgbWlsZXN0b25lXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9pc3N1ZXM/cT1pcyUzQWNsb3NlZCttaWxlc3RvbmUlM0EyOC4yLjApCi0gW21vYnkvbW9ieSwgMjguMi4wIG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9pc3N1ZXM/cT1pcyUzQWNsb3NlZCttaWxlc3RvbmUlM0EyOC4yLjApCi0gRGVwcmVjYXRlZCBhbmQgcmVtb3ZlZCBmZWF0dXJlcywgc2VlIFtEZXByZWNhdGVkIEZlYXR1cmVzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9ibG9iL3YyOC4yLjAvZG9jcy9kZXByZWNhdGVkLm1kKS4KLSBDaGFuZ2VzIHRvIHRoZSBFbmdpbmUgQVBJLCBzZWUgW0FQSSB2ZXJzaW9uIGhpc3RvcnldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvYmxvYi92MjguMi4wL2RvY3MvYXBpL3ZlcnNpb24taGlzdG9yeS5tZCkuCgo+IFxbIU5PVEVdCj4gUkhFTCBwYWNrYWdlcyBhcmUgY3VycmVudGx5IG5vdCBhdmFpbGFibGUgYW5kIHdpbGwgYmUgcmVsZWFzZWQgbGF0ZXIuCgojIyMjIyBOZXcKCi0gQWRkIGB7ey5QbGF0Zm9ybX19YCBhcyBmb3JtYXR0aW5nIG9wdGlvbiBmb3IgYGRvY2tlciBwc2AgdG8gc2hvdyB0aGUgcGxhdGZvcm0gb2YgdGhlIGltYWdlIHRoZSBjb250YWluZXIgaXMgcnVubmluZy4gW2RvY2tlci9jbGkjNjA0Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC82MDQyKQotIEFkZCBzdXBwb3J0IGZvciByZWxhdGl2ZSBwYXJlbnQgcGF0aHMgKGAuLi9gKSBvbiBiaW5kIG1vdW50IHNvdXJjZXMgd2hlbiB1c2luZyBgZG9ja2VyIHJ1bi9jcmVhdGVgIHdpdGggYC12Ly0tdm9sdW1lYCBvciBgLS1tb3VudCB0eXBlPWJpbmRgIG9wdGlvbnMuIFtkb2NrZXIvY2xpIzQ5NjZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNDk2NikKLSBDREkgaXMgbm93IGVuYWJsZWQgYnkgZGVmYXVsdC4gW21vYnkvbW9ieSM0OTk2M10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5OTYzKQotIFNob3cgZGlzY292ZXJlZCBDREkgZGV2aWNlcyBpbiBgZG9ja2VyIGluZm9gLiBbZG9ja2VyL2NsaSM2MDc4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzYwNzgpCi0gYGRvY2tlciBpbWFnZSBybWA6IGFkZCBgLS1wbGF0Zm9ybWAgb3B0aW9uIHRvIHJlbW92ZSBhIHZhcmlhbnQgZnJvbSBtdWx0aS1wbGF0Zm9ybSBpbWFnZXMuIFtkb2NrZXIvY2xpIzYxMDldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNjEwOSkKLSBjb250YWluZXJkIGltYWdlIHN0b3JlOiBJbml0aWFsIEJ1aWxkS2l0IHN1cHBvcnQgZm9yIGJ1aWxkaW5nIFdpbmRvd3MgY29udGFpbmVyIGltYWdlcyBvbiBXaW5kb3dzIChyZXF1aXJlcyBhbiBvcHQtaW4gd2l0aCBgRE9DS0VSX0JVSUxES0lUPTFgKS4gW21vYnkvbW9ieSM0OTc0MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NzQwKQoKIyMjIyMgQnVnIGZpeGVzIGFuZCBlbmhhbmNlbWVudHMKCi0gQWRkIGEgbmV3IGxvZyBvcHRpb24gZm9yIGZsdWVudGQgbG9nIGRyaXZlciAoYGZsdWVudGQtd3JpdGUtdGltZW91dGApLCB3aGljaCBlbmFibGVzIHNwZWNpZnlpbmcgd3JpdGUgdGltZW91dHMgZm9yIGZsdWVudGQgY29ubmVjdGlvbnMuIFttb2J5L21vYnkjNDk5MTFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTkxMSkKLSBBZGQgc3VwcG9ydCBmb3IgYERPQ0tFUl9BVVRIX0NPTkZJR2AgZm9yIHRoZSBleHBlcmltZW50YWwgYC0tdXNlLWFwaS1zb2NrZXRgIG9wdGlvbi4gW2RvY2tlci9jbGkjNjAxOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC82MDE5KQotIEZpeCBgZG9ja2VyIGV4ZWNgIHdhaXRpbmcgZm9yIDEwIHNlY29uZHMgaWYgYSBub24tZXhpc3RpbmcgdXNlciBvciBncm91cCB3YXMgc3BlY2lmaWVkLiBbbW9ieS9tb2J5IzQ5ODY4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk4NjgpCi0gRml4IGBkb2NrZXIgc3dhcm0gaW5pdGAgaWdub3JpbmcgYGNhY2VydGAgb3B0aW9uIG9mIGAtLWV4dGVybmFsLWNhYC4gW2RvY2tlci9jbGkjNTk5NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81OTk1KQotIEZpeCBhbiBpc3N1ZSB3aGVyZSB0aGUgQ0xJIHdvdWxkIG5vdCBjb3JyZWN0bHkgc2F2ZSB0aGUgY29uZmlndXJhdGlvbiBmaWxlIChgfi8uZG9ja2VyL2NvbmZpZy5qc29uYCkgaWYgaXQgd2FzIGEgcmVsYXRpdmUgc3ltYm9saWMgbGluay4gW2RvY2tlci9jbGkjNTI4Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81MjgyKQotIEZpeCBjb250YWluZXJzIHdpdGggYC0tcmVzdGFydCBhbHdheXNgIHBvbGljeSB1c2luZyBDREkgZGV2aWNlcyBmYWlsaW5nIHRvIHN0YXJ0IG9uIGRhZW1vbiByZXN0YXJ0LiBbbW9ieS9tb2J5IzQ5OTkwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk5OTApCi0gRml4IHNoZWxsLWNvbXBsZXRpb24gdG8gb25seSBjb21wbGV0ZSBzb21lIGZsYWdzIG9uY2UsIGV2ZW4gdGhvdWdoIHRoZXkgY2FuIGJlIHNldCBtdWx0aXBsZSB0aW1lcy4gW2RvY2tlci9jbGkjNjAzMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC82MDMwKQotIEZpeCB0aGUgYHBsdWdpbiBkb2VzIG5vdCBpbXBsZW1lbnQgUGx1Z2luQWRkciBpbnRlcmZhY2VgIGVycm9yIGZvciBTd2FybSBDU0kgZHJpdmVycy4gW21vYnkvbW9ieSM0OTk2MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5OTYxKQotIEltcHJvdmUgYGRvY2tlciBsb2dpbmAgZXJyb3IgbWVzc2FnZXMgZm9yIGludmFsaWQgb3B0aW9ucy4gW2RvY2tlci9jbGkjNjAzNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC82MDM2KQotIE1ha2Ugc3VyZSB0aGUgdGVybWluYWwgc3RhdGUgaXMgcmVzdG9yZWQgaWYgdGhlIENMSSBpcyBmb3JjZWZ1bGx5IHRlcm1pbmF0ZWQuIFtkb2NrZXIvY2xpIzYwNThdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNjA1OCkKLSBVcGRhdGUgdGhlIGRlZmF1bHQgc2VjY29tcCBwcm9maWxlIHRvIG1hdGNoIHRoZSBsaWJzZWNjb21wIHYyLjYuMC4gVGhlIG5ldyBzeXNjYWxscyBhcmU6IGBsaXN0bW91bnRgLCBgc3RhdG1vdW50YCwgYGxzbV9nZXRfc2VsZl9hdHRyYCwgYGxzbV9saXN0X21vZHVsZXNgLCBgbHNtX3NldF9zZWxmX2F0dHJgLCBgbXNlYWxgLCBgdXJldHByb2JlYCwgYHJpc2N2X2h3cHJvYmVgLCBgZ2V0eGF0dHJhdGAsIGBsaXN0eGF0dHJhdGAsIGByZW1vdmV4YXR0cmF0YCwgYW5kIGBzZXR4YXR0cmF0YC4gVGhpcyBwcmV2ZW50cyBjb250YWluZXJzIGZyb20gcmVjZWl2aW5nIEVQRVJNIGVycm9ycyB3aGVuIHVzaW5nIHRoZW0uIFttb2J5L21vYnkjNTAwNzddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC81MDA3NykKLSBgZG9ja2VyIGluc3BlY3RgOiBhZGQgc2hlbGwgY29tcGxldGlvbiwgaW1wcm92ZSBmbGFnLWRlc2NyaXB0aW9uIGZvciBgLS10eXBlYCBhbmQgaW1wcm92ZSB2YWxpZGF0aW9uLiBbZG9ja2VyL2NsaSM2MDUyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzYwNTIpCi0gY29udGFpbmVyZCBpbWFnZSBzdG9yZTogRW5hYmxlIEJ1aWxkS2l0IGdhcmJhZ2UgY29sbGVjdG9yIGJ5IGRlZmF1bHQuIFttb2J5L21vYnkjNDk4OTldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTg5OSkKLSBjb250YWluZXJkIGltYWdlIHN0b3JlOiBGaXggYGRvY2tlciBidWlsZGAgbm90IHBlcnNpc3Rpbmcgb3ZlcnJpZGRlbiBpbWFnZXMgYXMgZGFuZ2xpbmcuIFttb2J5L21vYnkjNDk3MDJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTcwMikKLSBjb250YWluZXJkIGltYWdlIHN0b3JlOiBGaXggYGRvY2tlciBzeXN0ZW0gZGZgIHJlcG9ydGluZyBhIG5lZ2F0aXZlIHJlY2xhaW1hYmxlIHNwYWNlIGFtb3VudC4gW21vYnkvbW9ieSM0OTcwN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NzA3KQotIGNvbnRhaW5lcmQgaW1hZ2Ugc3RvcmU6IEZpeCBkdXBsaWNhdGUgYFBVVGAgcmVxdWVzdHMgd2hlbiBwdXNoaW5nIGEgbXVsdGktcGxhdGZvcm0gaW1hZ2UuIFttb2J5L21vYnkjNDk5NDldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTk0OSkKCiMjIyMjIFBhY2thZ2luZyB1cGRhdGVzCgotIERyb3AgVWJ1bnR1IDIwLjA0ICJGb2NhbCIgcGFja2FnZXMgYXMgaXQgcmVhY2hlZCBlbmQgb2YgbGlmZS4gW2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nIzEyMDBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZy9wdWxsLzEyMDApCi0gRml4IGluc3RhbGwgbG9jYXRpb24gZm9yIFJQTS1iYXNlZCBgZG9ja2VyLWNlYCBtYW4tcGFnZXMuIFtkb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZyMxMjAzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcvcHVsbC8xMjAzKQotIFVwZGF0ZSBCdWlsZEtpdCB0byBbdjAuMjIuMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvYnVpbGRraXQvcmVsZWFzZXMvdGFnL3YwLjIyLjApLiBbbW9ieS9tb2J5IzUwMDQ2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNTAwNDYpCi0gVXBkYXRlIEJ1aWxkeCB0byBbdjAuMjQuMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9idWlsZHgvcmVsZWFzZXMvdGFnL3YwLjI0LjApLiBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTIwNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTIwNSkKLSBVcGRhdGUgQ29tcG9zZSB0byBbdjIuMzYuMl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jb21wb3NlL3JlbGVhc2VzL3RhZy92Mi4zNi4yKS4gW2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nIzEyMDhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZy9wdWxsLzEyMDgpCi0gVXBkYXRlIEdvIHJ1bnRpbWUgdG8gWzEuMjQuM10oaHR0cHM6Ly9nby5kZXYvZG9jL2RldmVsL3JlbGVhc2UjZ28xLjI0LjMpLiBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTE5Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTE5MiksIFtkb2NrZXIvY2xpIzYwNjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNjA2MCksIFttb2J5L21vYnkjNDkxNzRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTE3NCkKCiMjIyMjIE5ldHdvcmtpbmcKCi0gQWRkIGJyaWRnZSBuZXR3b3JrIG9wdGlvbiBgImNvbS5kb2NrZXIubmV0d29yay5icmlkZ2UudHJ1c3RlZF9ob3N0X2ludGVyZmFjZXMiYCwgYWNjZXB0aW5nIGEgY29sb24tc2VwYXJhdGVkIGxpc3Qgb2YgaW50ZXJmYWNlIG5hbWVzLiBUaGVzZSBpbnRlcmZhY2VzIGhhdmUgZGlyZWN0IGFjY2VzcyB0byBwdWJsaXNoZWQgcG9ydHMgb24gY29udGFpbmVyIElQIGFkZHJlc3Nlcy4gW21vYnkvbW9ieSM0OTgzMl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5ODMyKQotIEFkZCBkYWVtb24gb3B0aW9uIGAiYWxsb3ctZGlyZWN0LXJvdXRpbmciYCB0byBkaXNhYmxlIGZpbHRlcmluZyBvZiBwYWNrZXRzIGZyb20gb3V0c2lkZSB0aGUgaG9zdCBhZGRyZXNzZWQgZGlyZWN0bHkgdG8gY29udGFpbmVycy4gW21vYnkvbW9ieSM0OTgzMl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5ODMyKQotIERvIG5vdCBkaXNwbGF5IG5ldHdvcmsgb3B0aW9ucyBgY29tLmRvY2tlci5uZXR3b3JrLmVuYWJsZV9pcHY0YCBvciBgY29tLmRvY2tlci5uZXR3b3JrLmVuYWJsZV9pcHY2YCBpbiBpbnNwZWN0IG91dHB1dCBpZiB0aGV5IGhhdmUgYmVlbiBvdmVycmlkZGVuIGJ5IGBFbmFibGVJUHY0YCBvciBgRW5hYmxlSVB2NmAgaW4gdGhlIG5ldHdvcmsgY3JlYXRlIHJlcXVlc3QuIFttb2J5L21vYnkjNDk4NjZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTg2NikKLSBGaXggYW4gaXNzdWUgdGhhdCBjb3VsZCBjYXVzZSBuZXR3b3JrIGRlbGV0aW9uIHRvIGZhaWwgYWZ0ZXIgYSBkYWVtb24gcmVzdGFydCwgd2l0aCBlcnJvciAiaGFzIGFjdGl2ZSBlbmRwb2ludHMiIGxpc3RpbmcgZW1wdHkgZW5kcG9pbnQgbmFtZXMuIFttb2J5L21vYnkjNDk5MDFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTkwMSkKLSBGaXggYW4gaXNzdWUgd2hlcmUgYGRvY2tlciBuZXR3b3JrIGluc3BlY3QgLS12ZXJib3NlYCBjb3VsZCBzb21ldGltZXMgY3Jhc2ggdGhlIGRhZW1vbi4gW21vYnkvbW9ieSM0OTkzN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5OTM3KQotIEZpeCBhbiBpc3N1ZSB3aGVyZSB0aGUgbG9hZC1iYWxhbmNlciBJUCBhZGRyZXNzIGZvciBhbiBvdmVybGF5IG5ldHdvcmsgd291bGQgbm90IGJlIHJlbGVhc2VkIGluIGNlcnRhaW4gY2FzZXMgaWYgdGhlIFN3YXJtIHdhcyBsYWNraW5nIGFuIGluZ3Jlc3MgbmV0d29yay4gW21vYnkvbW9ieSM0OTk0OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5OTQ4KQotIEltcHJvdmUgdGhlIHJlbGlhYmlsaXR5IG9mIE5ldHdvcmtEQiBpbiBidXN5IGNsdXN0ZXJzIGFuZCBsb3NzeSBuZXR3b3Jrcy4gW21vYnkvbW9ieSM0OTkzMl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5OTMyKQotIEltcHJvdmVtZW50cyB0byB0aGUgcmVsaWFiaWxpdHkgYW5kIGNvbnZlcmdlbmNlIHNwZWVkIG9mIE5ldHdvcmtEQi4gW21vYnkvbW9ieSM0OTkzOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5OTM5KQoKIyMjIyMgQVBJCgotIFVwZGF0ZSBBUEkgdmVyc2lvbiB0byBgMS41MGAuCi0gYERFTEVURSAvaW1hZ2VzL3tuYW1lfWAgbm93IHN1cHBvcnRzIGEgYHBsYXRmb3Jtc2AgcXVlcnkgcGFyYW1ldGVyLiBJdCBhY2NlcHRzIGFuIGFycmF5IG9mIEpTT04tZW5jb2RlZCBPQ0kgUGxhdGZvcm0gb2JqZWN0cywgYWxsb3dpbmcgZm9yIHNlbGVjdGluZyBhIHNwZWNpZmljIHBsYXRmb3JtcyB0byBkZWxldGUgY29udGVudCBmb3IuIFttb2J5L21vYnkjNDk5ODJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTk4MikKLSBgR0VUIC9pbmZvYCBub3cgaW5jbHVkZXMgYSBgRGlzY292ZXJlZERldmljZXNgIGZpZWxkLiBUaGlzIGlzIGFuIGFycmF5IG9mIGBEZXZpY2VJbmZvYCBvYmplY3RzLCBlYWNoIHByb3ZpZGluZyBkZXRhaWxzIGFib3V0IGEgZGV2aWNlIGRpc2NvdmVyZWQgYnkgYSBkZXZpY2UgZHJpdmVyLiBbbW9ieS9tb2J5IzQ5OTgwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk5ODApCgojIyMjIyBHbyBTREsKCi0gYGFwaS90eXBlcy9jb250YWluZXJgOiBhZGQgYENvbnRhaW5lclN0YXRlYCBhbmQgY29uc3RhbnRzIGZvciBjb250YWluZXIgc3RhdGUuIFttb2J5L21vYnkjNDk5NjVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTk2NSkKLSBgYXBpL3R5cGVzL2NvbnRhaW5lcmA6IGNoYW5nZSBgU3VtbWFyeS5TdGF0ZWAgdG8gYSBgQ29udGFpbmVyU3RhdGVgLiBbbW9ieS9tb2J5IzQ5OTkxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk5OTEpCi0gYGFwaS90eXBlcy9jb250YWluZXJgOiBkZWZpbmUgYEhlYWx0aFN0YXR1c2AgdHlwZSBmb3IgaGVhbHRoLXN0YXR1cyBjb25zdGFudHMuIFttb2J5L21vYnkjNDk4NzZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTg3NikKLSBgYXBpL3R5cGVzYDogZGVwcmVjYXRlIGBCdWlsZFJlc3VsdGAsIGBJbWFnZUJ1aWxkT3B0aW9uc2AsIGBJbWFnZUJ1aWxkT3V0cHV0YCwgYEltYWdlQnVpbGRSZXNwb25zZWAsIGBCdWlsZGVyVmVyc2lvbmAsIGBCdWlsZGVyVjFgLCBhbmQgYEJ1aWxkZXJCdWlsZEtpYCB3aGljaCB3ZXJlIG1vdmVkIHRvIGBhcGkvdHlwZXMvYnVpbGRgLiBbbW9ieS9tb2J5IzUwMDI1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNTAwMjUpCgojIyMjIyBEZXByZWNhdGlvbnMKCi0gQVBJOiBEZXByZWNhdGVkOiBgR0VUIC9pbWFnZXMve25hbWV9L2pzb25gIG5vIGxvbmdlciByZXR1cm5zIHRoZSBmb2xsb3dpbmcgZmllbGRzOiBgQ29uZmlnYCwgYEhvc3RuYW1lYCwgYERvbWFpbm5hbWVgLCBgQXR0YWNoU3RkaW5gLCBgQXR0YWNoU3Rkb3V0YCwgYEF0dGFjaFN0ZGVycmAsIGBUdHlgLCBgT3BlblN0ZGluYCwgYFN0ZGluT25jZWAsIGBJbWFnZWAsIGBOZXR3b3JrRGlzYWJsZWRgIChhbHJlYWR5IG9taXR0ZWQgdW5sZXNzIHNldCksIGBNYWNBZGRyZXNzYCAoYWxyZWFkeSBvbWl0dGVkIHVubGVzcyBzZXQpLCBgU3RvcFRpbWVvdXRgIChhbHJlYWR5IG9taXR0ZWQgdW5sZXNzIHNldCkuIFRoZXNlIGFkZGl0aW9uYWwgZmllbGRzIHdlcmUgaW5jbHVkZWQgaW4gdGhlIHJlc3BvbnNlIGR1ZSB0byBhbiBpbXBsZW1lbnRhdGlvbiBkZXRhaWwgYnV0IG5vdCBwYXJ0IG9mIHRoZSBpbWFnZSdzIENvbmZpZ3VyYXRpb24sIHdlcmUgbWFya2VkIGRlcHJlY2F0ZWQgaW4gQVBJIHYxLjQ2LCBhbmQgYXJlIG5vdyBvbWl0dGVkLiBbbW9ieS9tb2J5IzQ4NDU3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg0NTcpCi0gR28tU0RLOiBEZXByZWNhdGUgYnVpbGRlci9yZW1vdGVjb250ZXh0LlJlbCgpLiBUaGlzIGZ1bmN0aW9uIHdhcyBuZWVkZWQgb24gb2xkZXIgdmVyc2lvbnMgb2YgR28sIGJ1dCBjYW4gbm93IGJlIHJlcGxhY2VkIGJ5IGBmaWxlcGF0aC5SZWwoKWAuIFttb2J5L21vYnkjNDk4NDNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTg0MykKLSBHby1TREs6IGFwaS90eXBlczogZGVwcmVjYXRlIGBCdWlsZENhY2hlUHJ1bmVPcHRpb25zYCBpbiBmYXZvciBvZiBgYXBpL3R5cGVzL2J1aWxkZXIuQ2FjaGVQcnVuZU9wdGlvbnNgLiBbbW9ieS9tb2J5IzUwMDE1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNTAwMTUpCi0gR28tU0RLOiBhcGkvdHlwZXM6IGRlcHJlY2F0ZSBgQnVpbGRDYWNoZVBydW5lUmVwb3J0YCBpbiBmYXZvciBvZiBgYXBpL3R5cGVzL2J1aWxkZXIuQ2FjaGVQcnVuZVJlcG9ydGAuIFttb2J5L21vYnkjNTAwMTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC81MDAxNSkKLSBHby1TREs6IGFwaS90eXBlczogZGVwcmVjYXRlIGBOb2RlTGlzdE9wdGlvbnNgLCBgTm9kZVJlbW92ZU9wdGlvbnNgLCBgU2VydmljZUNyZWF0ZU9wdGlvbnNgLCBgU2VydmljZVVwZGF0ZU9wdGlvbnNgLCBgUmVnaXN0cnlBdXRoRnJvbVNwZWNgLCBgUmVnaXN0cnlBdXRoRnJvbVByZXZpb3VzU3BlY2AsIGBTZXJ2aWNlTGlzdE9wdGlvbnNgLCBgU2VydmljZUluc3BlY3RPcHRpb25zYCwgYW5kIGBTd2FybVVubG9ja0tleVJlc3BvbnNlYCB3aGljaCB3ZXJlIG1vdmVkIHRvIGBhcGkvdHlwZXMvc3dhcm1gLiBbbW9ieS9tb2J5IzUwMDI3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNTAwMjcpCi0gR28tU0RLOiBhcGkvdHlwZXM6IGRlcHJlY2F0ZSBgU2VjcmV0Q3JlYXRlUmVzcG9uc2VgLCBgU2VjcmV0TGlzdE9wdGlvbnNgLCBgQ29uZmlnQ3JlYXRlUmVzcG9uc2VgLCBgQ29uZmlnTGlzdE9wdGlvbnNgIHdoaWNoIHdlcmUgbW92ZWQgdG8gYXBpL3R5cGVzL3N3YXJtLiBbbW9ieS9tb2J5IzUwMDI0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNTAwMjQpCi0gR28tU0RLOiBjbGllbnQ6IGRlcHJlY2F0ZSBgSXNFcnJOb3RGb3VuZGAuIFttb2J5L21vYnkjNTAwMTJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC81MDAxMikKLSBHby1TREs6IGNvbnRhaW5lcjogZGVwcmVjYXRlIGBJc1ZhbGlkSGVhbHRoU3RyaW5nYCBpbiBmYXZvciBvZiBgYXBpL3R5cGVzL2NvbnRhaW5lci5WYWxpZGF0ZUhlYWx0aFN0YXR1c2AuIFttb2J5L21vYnkjNDk4OTNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTg5MykKLSBHby1TREs6IGNvbnRhaW5lcjogZGVwcmVjYXRlIGBTdGF0ZVN0YXR1c2AsIGBXYWl0Q29uZGl0aW9uYCwgYW5kIHRoZSByZWxhdGVkICBgV2FpdENvbmRpdGlvbk5vdFJ1bm5pbmdgLCBgV2FpdENvbmRpdGlvbk5leHRFeGl0YCwgYW5kIGBXYWl0Q29uZGl0aW9uUmVtb3ZlZGAgY29uc3RzIGluIGZhdm9yIG9mIHRoZWlyIGVxdWl2YWxlbnRzIGluIGBhcGkvdHlwZXMvY29udGFpbmVyYC4gW21vYnkvbW9ieSM0OTg3NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5ODc0KQotIEdvLVNESzogb3B0czogZGVwcmVjYXRlIGBMaXN0T3B0cy5HZXRBbGxgIGluIGZhdm9yIG9mIGBMaXN0T3B0cy5HZXRTbGljZWAuIFtkb2NrZXIvY2xpIzYwMzJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNjAzMikKLSBSZW1vdmUgZGVwcmVjYXRlZCBgSXNBdXRvbWF0ZWRgIGZvcm1hdHRpbmcgcGxhY2Vob2xkZXIgZnJvbSBgZG9ja2VyIHNlYXJjaGAuIFtkb2NrZXIvY2xpIzYwOTFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNjA5MSkKLSBSZW1vdmUgZmFsbGJhY2sgZm9yIHB1bGxpbmcgaW1hZ2VzIGZyb20gbm9uLU9DSS1jb21wbGlhbnQgYGRvY2tlci5wa2cuZ2l0aHViLmNvbWAgcmVnaXN0cnkuIFttb2J5L21vYnkjNTAwOTRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC81MDA5NCkKLSBSZW1vdmUgc3VwcG9ydCBmb3IgcHVsbGluZyBsZWdhY3kgdjIsIHNjaGVtYSAxIGltYWdlcyBhbmQgcmVtb3ZlIGBET0NLRVJfRU5BQkxFX0RFUFJFQ0FURURfUFVMTF9TQ0hFTUFfMV9JTUFHRWAgZW52aXJvbm1lbnQtdmFyaWFibGUuIFttb2J5L21vYnkjNTAwMzZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC81MDAzNiksIFttb2J5L21vYnkjNDIzMDBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80MjMwMCkKLSBUaGUgYEJyaWRnZU5mSXB0YWJsZXNgIGFuZCBgQnJpZGdlTmZJcDZ0YWJsZXNgIGZpZWxkcyBpbiB0aGUgYEdFVCAvaW5mb2AgcmVzcG9uc2Ugd2VyZSBkZXByZWNhdGVkIGluIEFQSSB2MS40OCwgYW5kIGFyZSBub3cgb21pdHRlZCBpbiBBUEkgdjEuNTAuIFttb2J5L21vYnkjNDk5MDRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTkwNCkKLSBlcnJkZWZzOiBEZXByZWNhdGUgYGVycmRlZnMuRnJvbVN0YXR1c0NvZGVgLiBVc2UgY29udGFpbmVyZCdzIGBlcnJodHRwLlRvTmF0aXZlYCBpbnN0ZWFkLiBbbW9ieS9tb2J5IzUwMDMwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNTAwMzApCgojIyMgW2B2MjguMS4xYF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9yZWxlYXNlcy90YWcvdjI4LjEuMSkKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9jb21wYXJlL3YyOC4xLjAuLi52MjguMS4xKQoKIyMjIyAyOC4xLjEKCkZvciBhIGZ1bGwgbGlzdCBvZiBwdWxsIHJlcXVlc3RzIGFuZCBjaGFuZ2VzIGluIHRoaXMgcmVsZWFzZSwgcmVmZXIgdG8gdGhlIHJlbGV2YW50IEdpdEh1YiBtaWxlc3RvbmVzOgoKLSBbZG9ja2VyL2NsaSwgMjguMS4xIG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMS4xKQotIFttb2J5L21vYnksIDI4LjEuMSBtaWxlc3RvbmVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMS4xKQoKIyMjIyMgQnVnIGZpeGVzIGFuZCBlbmhhbmNlbWVudHMKCi0gRml4IGBkb2NrZXJkLXJvb3RsZXNzLXNldHVwdG9vbC5zaGAgaW5jb3JyZWN0bHkgcmVwb3J0aW5nIG1pc3NpbmcgYGlwdGFibGVzYC4gW21vYnkvbW9ieSM0OTgzM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5ODMzKQotIGNvbnRhaW5lcmQgaW1hZ2Ugc3RvcmU6IEZpeCBhIHBvdGVudGlhbCBkYWVtb24gY3Jhc2ggd2hlbiB1c2luZyBgZG9ja2VyIGxvYWRgIHdpdGggYXJjaGl2ZXMgY29udGFpbmluZyB6ZXJvLXNpemUgdGFyIGhlYWRlcnMuIFttb2J5L21vYnkjNDk4MzddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTgzNykKCiMjIyMjIFBhY2thZ2luZyB1cGRhdGVzCgotIFVwZGF0ZSBCdWlsZHggdG8gW3YwLjIzLjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvYnVpbGR4L3JlbGVhc2VzL3RhZy92MC4yMy4wKS4gW2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nIzExODVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZy9wdWxsLzExODUpCi0gVXBkYXRlIENvbXBvc2UgdG8gW3YyLjM1LjFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY29tcG9zZS9yZWxlYXNlcy90YWcvdjIuMzUuMSkuIFtkb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZyMxMTg4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcvcHVsbC8xMTg4KQoKIyMjIyMgTmV0d29ya2luZwoKLSBBZGQgYSB3YXJuaW5nIHRvIGEgY29udGFpbmVyJ3MgYC9ldGMvcmVzb2x2LmNvbmZgIHdoZW4gbm8gdXBzdHJlYW0gRE5TIHNlcnZlcnMgd2VyZSBmb3VuZC4gW21vYnkvbW9ieSM0OTgyN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5ODI3KQoKIyMjIFtgdjI4LjEuMGBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcmVsZWFzZXMvdGFnL3YyOC4xLjApCgpbQ29tcGFyZSBTb3VyY2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvY29tcGFyZS92MjguMC40Li4udjI4LjEuMCkKCiMjIyMgMjguMS4wCgpGb3IgYSBmdWxsIGxpc3Qgb2YgcHVsbCByZXF1ZXN0cyBhbmQgY2hhbmdlcyBpbiB0aGlzIHJlbGVhc2UsIHJlZmVyIHRvIHRoZSByZWxldmFudCBHaXRIdWIgbWlsZXN0b25lczoKCi0gW2RvY2tlci9jbGksIDI4LjEuMCBtaWxlc3RvbmVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL2lzc3Vlcz9xPWlzJTNBY2xvc2VkK21pbGVzdG9uZSUzQTI4LjEuMCkKLSBbbW9ieS9tb2J5LCAyOC4xLjAgbWlsZXN0b25lXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L2lzc3Vlcz9xPWlzJTNBY2xvc2VkK21pbGVzdG9uZSUzQTI4LjEuMCkKLSBDaGFuZ2VzIHRvIHRoZSBFbmdpbmUgQVBJLCBzZWUgW0FQSSB2ZXJzaW9uIGhpc3RvcnldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvYmxvYi92MjguMS4wL2RvY3MvYXBpL3ZlcnNpb24taGlzdG9yeS5tZCkuCgojIyMjIyBOZXcKCi0gQWRkIGBkb2NrZXIgYmFrZWAgc3ViLWNvbW1hbmQgYXMgYWxpYXMgZm9yIGBkb2NrZXIgYnVpbGR4IGJha2VgLiBbZG9ja2VyL2NsaSM1OTQ3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5NDcpCi0gRXhwZXJpbWVudGFsOiBhZGQgYSBuZXcgYC0tdXNlLWFwaS1zb2NrZXRgIGZsYWcgb24gYGRvY2tlciBydW5gIGFuZCBgZG9ja2VyIGNyZWF0ZWAgdG8gZW5hYmxlIGFjY2VzcyB0byBEb2NrZXIgc29ja2V0IGZyb20gaW5zaWRlIGEgY29udGFpbmVyIGFuZCB0byBzaGFyZSBjcmVkZW50aWFscyBmcm9tIHRoZSBob3N0IHdpdGggdGhlIGNvbnRhaW5lci4gW2RvY2tlci9jbGkjNTg1OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81ODU4KQotIGBkb2NrZXIgaW1hZ2UgaW5zcGVjdGAgbm93IHN1cHBvcnRzIGEgYC0tcGxhdGZvcm1gIGZsYWcgdG8gaW5zcGVjdCBhIHNwZWNpZmljIHBsYXRmb3JtIG9mIGEgbXVsdGktcGxhdGZvcm0gaW1hZ2UuIFtkb2NrZXIvY2xpIzU5MzRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTkzNCkKCiMjIyMjIEJ1ZyBmaXhlcyBhbmQgZW5oYW5jZW1lbnRzCgotIEFkZCBDTEkgc2hlbGwtY29tcGxldGlvbiBmb3IgY29udGV4dCBuYW1lcy4gW2RvY2tlci9jbGkjNjAxNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC82MDE2KQotIEZpeCBgZG9ja2VyIGltYWdlcyAtLXRyZWVgIG5vdCBpbmNsdWRpbmcgbm9uLWNvbnRhaW5lciBpbWFnZXMgY29udGVudCBzaXplIGluIHRoZSB0b3RhbCBpbWFnZSBjb250ZW50IHNpemUuIFtkb2NrZXIvY2xpIzYwMDBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNjAwMCkKLSBGaXggYGRvY2tlciBsb2FkYCBub3QgcHJlc2VydmluZyByZXBsYWNlZCBpbWFnZXMuIFttb2J5L21vYnkjNDk2NTBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTY1MCkKLSBGaXggYGRvY2tlciBsb2dpbmAgaGludHMgd2hlbiBsb2dnaW5nIGluIHRvIGEgY3VzdG9tIHJlZ2lzdHJ5LiBbZG9ja2VyL2NsaSM2MDE1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzYwMTUpCi0gRml4IGBkb2NrZXIgc3RhdHNgIG5vdCB3b3JraW5nIHByb3Blcmx5IG9uIG1hY2hpbmVzIHdpdGggaGlnaCBDUFUgY29yZSBjb3VudC4gW21vYnkvbW9ieSM0OTczNF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NzM0KQotIEZpeCBhIHJlZ3Jlc3Npb24gY2F1c2luZyBgZG9ja2VyIHB1bGwvcHVzaGAgdG8gZmFpbCB3aGVuIGludGVyYWN0aW5nIHdpdGggYSBwcml2YXRlIHJlcG9zaXRvcnkuIFtkb2NrZXIvY2xpIzU5NjRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTk2NCkKLSBGaXggYW4gaXNzdWUgcHJldmVudGluZyByb290bGVzcyBEb2NrZXIgc2V0dXAgb24gYSBob3N0IHdpdGggbm8gYGlwX3RhYmxlc2Aga2VybmVsIG1vZHVsZS4gW21vYnkvbW9ieSM0OTcyN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NzI3KQotIEZpeCBhbiBpc3N1ZSB0aGF0IGNvdWxkIGxlYWQgdG8gdW53YW50ZWQgaXB0YWJsZXMgcnVsZXMgYmVpbmcgcmVzdG9yZWQgYW5kIG5ldmVyIGRlbGV0ZWQgZm9sbG93aW5nIGEgZmlyZXdhbGxkIHJlbG9hZC4gW21vYnkvbW9ieSM0OTcyOF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NzI4KQotIEltcHJvdmUgQ0xJIGNvbXBsZXRpb24gb2YgYGRvY2tlciBzZXJ2aWNlIHNjYWxlYC4gW2RvY2tlci9jbGkjNTk2OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81OTY4KQotIGBkb2NrZXIgaW1hZ2VzIC0tdHJlZWAgbm93IGhpZGVzIGJvdGggdW50YWdnZWQgYW5kIGRhbmdsaW5nIGltYWdlcyBieSBkZWZhdWx0LiBbZG9ja2VyL2NsaSM1OTI0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5MjQpCi0gYGRvY2tlciBzeXN0ZW0gaW5mb2Agd2lsbCBwcm92aWRlIGFuIGV4aXQgY29kZSBpZiBhIGNvbm5lY3Rpb24gY2Fubm90IGJlIGVzdGFibGlzaGVkIHRvIHRoZSBEb2NrZXIgZGFlbW9uLiBbZG9ja2VyL2NsaSM1OTE4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5MTgpCi0gY29udGFpbmVyZCBpbWFnZSBzdG9yZTogRml4IGBpbWFnZSB0YWdgIGV2ZW50IG5vdCBiZWluZyBlbWl0dGVkIHdoZW4gYnVpbGRpbmcgd2l0aCBCdWlsZEtpdC4gW21vYnkvbW9ieSM0OTY3OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5Njc4KQotIGNvbnRhaW5lcmQgaW1hZ2Ugc3RvcmU6IEltcHJvdmUgYGRvY2tlciBwdXNoL3B1bGxgIGhhbmRsaW5nIG9mIHJlbW90ZSByZWdpc3RyeSBlcnJvcnMuIFttb2J5L21vYnkjNDk3NzBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTc3MCkKLSBjb250YWluZXJkIGltYWdlIHN0b3JlOiBTaG93IHB1bGwgcHJvZ3Jlc3MgZm9yIG5vbi1sYXllciBpbWFnZSBibG9icy4gW21vYnkvbW9ieSM0OTc0Nl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NzQ2KQoKIyMjIyMgUGFja2FnaW5nIHVwZGF0ZXMKCi0gQWRkIERlYmlhbiAiVHJpeGllIiBwYWNrYWdlcy4gW2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nIzExODFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZy9wdWxsLzExODEpCi0gQWRkIEZlZG9yYSA0MiBwYWNrYWdlcy4gW2RvY2tlci9jb250YWluZXJkLXBhY2thZ2luZyM0MThdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY29udGFpbmVyZC1wYWNrYWdpbmcvcHVsbC80MTgpLCBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTE2OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTE2OSkKLSBBZGQgVWJ1bnR1IDI1LjA0ICJQbHVja3kgUHVmZmluIiBwYWNrYWdlcy4gW2RvY2tlci9jb250YWluZXJkLXBhY2thZ2luZyM0MTldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY29udGFpbmVyZC1wYWNrYWdpbmcvcHVsbC80MTkpLCBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTE3N10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTE3NykKLSBVcGRhdGUgQnVpbGRLaXQgdG8gW3YwLjIxLjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L2J1aWxka2l0L3JlbGVhc2VzL3RhZy92MC4yMS4wKS4gW21vYnkvbW9ieSM0OTgwOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5ODA5KQotIFVwZGF0ZSBDb21wb3NlIHRvIFt2Mi4zNS4wXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NvbXBvc2UvcmVsZWFzZXMvdGFnL3YyLjM1LjApLiBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTE4M10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTE4MykKLSBVcGRhdGUgR28gcnVudGltZSB0byBbMS4yMy44XShodHRwczovL2dvLmRldi9kb2MvZGV2ZWwvcmVsZWFzZSNnbzEuMjMuOCkuIFtkb2NrZXIvY2xpIzU5ODZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTk4NiksIFtkb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZyMxMTgwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcvcHVsbC8xMTgwKSwgW21vYnkvbW9ieSM0OTczN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NzM3KQoKIyMjIyMgTmV0d29ya2luZwoKLSBGaXggYSBidWcgY2F1c2luZyBob3N0IHBvcnQtbWFwcGluZ3Mgb24gU3dhcm0gY29udGFpbmVycyB0byBiZSBkdXBsaWNhdGVkIG9uIGBkb2NrZXIgcHNgIGFuZCBgZG9ja2VyIGluc3BlY3RgLiBbbW9ieS9tb2J5IzQ5NzI0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk3MjQpCi0gRml4IGFuIGlzc3VlIHRoYXQgY2F1c2VkIGNvbnRhaW5lciBuZXR3b3JrIGF0dGFjaG1lbnQgdG8gZmFpbCB3aXRoIGVycm9yICJCcmlkZ2UgcG9ydCBub3QgZm9yd2FyZGluZyIuIFttb2J5L21vYnkjNDk3MDVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTcwNSkKLSBGaXggYW4gaXNzdWUgd2l0aCByZW1vdmFsIG9mIGEgYC0tbGlua2AgZnJvbSBhIGNvbnRhaW5lciBpbiB0aGUgZGVmYXVsdCBicmlkZ2UgbmV0d29yay4gW21vYnkvbW9ieSM0OTc3OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5Nzc4KQotIEltcHJvdmUgaG93IG5ldHdvcmstZW5kcG9pbnQgcmVsYXRpb25zaGlwcyBhcmUgdHJhY2tlZCB0byByZWR1Y2UgdGhlIGNoYW5jZSBvZiB0aGUgImhhcyBhY3RpdmUgZW5kcG9pbnRzIiBlcnJvciB0byBiZSB3cm9uZ2Z1bGx5IHJldHVybmVkLiBbbW9ieS9tb2J5IzQ5NzM2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk3MzYpCi0gSW1wcm92ZSB0aGUgImhhcyBhY3RpdmUgZW5kcG9pbnRzIiBlcnJvciBtZXNzYWdlIGJ5IGluY2x1ZGluZyB0aGUgbmFtZSBvZiBlbmRwb2ludHMgc3RpbGwgY29ubmVjdGVkIHRvIHRoZSBuZXR3b3JrIGJlaW5nIGRlbGV0ZWQuIFttb2J5L21vYnkjNDk3NzNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTc3MykKCiMjIyMjIEFQSQoKLSBVcGRhdGUgQVBJIHZlcnNpb24gdG8gW3YxLjQ5XShodHRwczovL2RvY3MuZG9ja2VyLmNvbS9lbmdpbmUvYXBpL3YxLjQ5LykuIFttb2J5L21vYnkjNDk3MThdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTcxOCkKLSBgR0VUIC9pbWFnZS97bmFtZX0vanNvbmAgbm93IHN1cHBvcnRzIGEgYHBsYXRmb3JtYCBwYXJhbWV0ZXIgYWxsb3dpbmcgdG8gc3BlY2lmeSB3aGljaCBwbGF0Zm9ybSB2YXJpYW50IG9mIGEgbXVsdGktcGxhdGZvcm0gaW1hZ2UgdG8gaW5zcGVjdC4gW21vYnkvbW9ieSM0OTU4Nl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTg2KQotIGBHRVQgL2luZm9gIG5vdyByZXR1cm5zIGEgYEZpcmV3YWxsQmFja2VuZGAgY29udGFpbmluZyBpbmZvcm1hdGlvbiBhYm91dCB0aGUgZGFlbW9uJ3MgZmlyZXdhbGxpbmcgY29uZmlndXJhdGlvbi4gW21vYnkvbW9ieSM0OTc2MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NzYxKQoKIyMjIyMgR28gU0RLCgotIFVwZGF0ZSBtaW5pbXVtIHJlcXVpcmVkIEdvIHZlcnNpb24gdG8gZ28xLjIzLiBbZG9ja2VyL2NsaSM1ODY4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU4NjgpCi0gY2xpL2NvbW1hbmQvY29udGV4dDogcmVtb3ZlIHRlbXBvcmFyeSBgQ29udGV4dFR5cGVgIGZpZWxkIGZyb20gSlNPTiBvdXRwdXQuIFtkb2NrZXIvY2xpIzU5ODFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTk4MSkKLSBjbGllbnQ6IEtlZXAgaW1hZ2UgcmVmZXJlbmNlcyBpbiBjYW5vbmljYWwgZm9ybWF0IHdoZXJlIHBvc3NpYmxlLiBbbW9ieS9tb2J5IzQ5NjA5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2MDkpCgojIyMjIyBEZXByZWNhdGlvbnMKCi0gQVBJOiBEZXByZWNhdGVkIGBBbGxvd05vbmRpc3RyaWJ1dGFibGVBcnRpZmFjdHNDSURSc2AgYW5kIGBBbGxvd05vbmRpc3RyaWJ1dGFibGVBcnRpZmFjdHNIb3N0bmFtZXNgIGZpZWxkcyBpbiB0aGUgYFJlZ2lzdHJ5Q29uZmlnYCBzdHJ1Y3QgaW4gdGhlIGBHRVQgL2luZm9gIHJlc3BvbnNlIGFyZSBvbWl0dGVkIGluIEFQSSB2MS40OS4gW21vYnkvbW9ieSM0OTc0OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NzQ5KQotIEFQSTogRGVwcmVjYXRlZDogVGhlIGBDb250YWluZXJkQ29tbWl0LkV4cGVjdGVkYCwgYFJ1bmNDb21taXQuRXhwZWN0ZWRgLCBhbmQgYEluaXRDb21taXQuRXhwZWN0ZWRgIGZpZWxkcyBpbiB0aGUgYEdFVCAvaW5mb2AgZW5kcG9pbnQgd2VyZSBkZXByZWNhdGVkIGluIEFQSSB2MS40OCwgYW5kIGFyZSBub3cgb21pdHRlZCBpbiBBUEkgdjEuNDkuIFttb2J5L21vYnkjNDg1NTZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODU1NikKLSBHby1TREs6IGNsaS9jb21tYW5kL2ltYWdlOiBEZXByZWNhdGUgYFJ1blB1bGxgOiB0aGlzIGZ1bmN0aW9uIHdhcyBvbmx5IHVzZWQgaW50ZXJuYWxseSBhbmQgd2lsbCBiZSByZW1vdmVkIGluIHRoZSBuZXh0IHJlbGVhc2UuIFtkb2NrZXIvY2xpIzU5NzVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTk3NSkKLSBHby1TREs6IGNsaS9jb25maWcvY29uZmlnZmlsZTogZGVwcmVjYXRlIGBDb25maWdGaWxlLkV4cGVyaW1lbnRhbGAgZmllbGQuIEV4cGVyaW1lbnRhbCBDTEkgZmVhdHVyZXMgYXJlIGFsd2F5cyBlbmFibGVkIHNpbmNlIHZlcnNpb24gdjIwLjEwIGFuZCB0aGlzIGZpZWxkIGlzIG5vIGxvbmdlciB1c2VkLiBVc2UgYENvbmZpZ0ZpbGUuRmVhdHVyZXNgIGluc3RlYWQgZm9yIG9wdGlvbmFsIGZlYXR1cmVzLiBUaGlzIGZpZWxkIHdpbGwgYmUgcmVtb3ZlZCBpbiBhIGZ1dHVyZSByZWxlYXNlLiBbZG9ja2VyL2NsaSM1OTc3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5NzcpCi0gR28tU0RLOiBkZXByZWNhdGUgYHBrZy9hcmNoaXZlYCwgd2hpY2ggd2FzIG1pZ3JhdGVkIHRvIGBnaXRodWIuY29tL21vYnkvZ28tYXJjaGl2ZWAuIFttb2J5L21vYnkjNDk3NDNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTc0MykKLSBHby1TREs6IGRlcHJlY2F0ZSBgcGtnL2F0b21pY3dyaXRlcmAsIHdoaWNoIHdhcyBtaWdyYXRlZCB0byBgZ2l0aHViLmNvbS9tb2J5L3N5cy9hdG9taWN3cml0ZXJgLiBbbW9ieS9tb2J5IzQ5NzQ4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk3NDgpCi0gR28tU0RLOiBvcHRzOiByZW1vdmUgZGVwcmVjYXRlZCBgUG9ydE9wdGAsIGBDb25maWdPcHRgLCBgU2VjcmV0T3B0YCBhbGlhc2VzLiBbZG9ja2VyL2NsaSM1OTUzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5NTMpCi0gR28tU0RLOiByZWdpc3RyeTogZGVwcmVjYXRlIGBBUElFbmRwb2ludC5PZmZpY2lhbGAgZmllbGQuIFttb2J5L21vYnkjNDk3MDZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTcwNikKCiMjIyBbYHYyOC4wLjRgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3JlbGVhc2VzL3RhZy92MjguMC40KQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L2NvbXBhcmUvdjI4LjAuMy4uLnYyOC4wLjQpCgojIyMjIDI4LjAuNAoKRm9yIGEgZnVsbCBsaXN0IG9mIHB1bGwgcmVxdWVzdHMgYW5kIGNoYW5nZXMgaW4gdGhpcyByZWxlYXNlLCByZWZlciB0byB0aGUgcmVsZXZhbnQgR2l0SHViIG1pbGVzdG9uZXM6CgotIFtkb2NrZXIvY2xpLCAyOC4wLjQgbWlsZXN0b25lXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9pc3N1ZXM/cT1pcyUzQWNsb3NlZCttaWxlc3RvbmUlM0EyOC4wLjQpCi0gW21vYnkvbW9ieSwgMjguMC40IG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9pc3N1ZXM/cT1pcyUzQWNsb3NlZCttaWxlc3RvbmUlM0EyOC4wLjQpCgojIyMjIyBCdWcgZml4ZXMgYW5kIGVuaGFuY2VtZW50cwoKLSBGaXggYSByZWdyZXNzaW9uIGNhdXNpbmcgYGRvY2tlciBwdWxsL3B1c2hgIHRvIGZhaWwgd2hlbiBpbnRlcmFjdGluZyB3aXRoIGEgcHJpdmF0ZSByZXBvc2l0b3J5LiBbZG9ja2VyL2NsaSM1OTY0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5NjQpCgojIyMgW2B2MjguMC4zYF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9yZWxlYXNlcy90YWcvdjI4LjAuMykKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9jb21wYXJlL3YyOC4wLjIuLi52MjguMC4zKQoKIyMjIyAyOC4wLjMKCkZvciBhIGZ1bGwgbGlzdCBvZiBwdWxsIHJlcXVlc3RzIGFuZCBjaGFuZ2VzIGluIHRoaXMgcmVsZWFzZSwgcmVmZXIgdG8gdGhlIHJlbGV2YW50IEdpdEh1YiBtaWxlc3RvbmVzOgoKLSBbZG9ja2VyL2NsaSwgMjguMC4zIG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMC4zKQotIFttb2J5L21vYnksIDI4LjAuMyBtaWxlc3RvbmVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMC4zKQoKIyMjIyMgQnVnIGZpeGVzIGFuZCBlbmhhbmNlbWVudHMKCi0gRml4IGBkb2NrZXIgcnVuYCB0cnVuY2F0aW5nIHRoZSBgU1RET1VUYC9gU1RERVJSYCBwcmVtYXR1cmVseSB3aGVuIHRoZSBjb250YWluZXIgZXhpdHMgYmVmb3JlIHRoZSBkYXRhIGlzIGNvbnN1bWVkLiBbZG9ja2VyL2NsaSM1OTU3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5NTcpCgojIyMjIyBQYWNrYWdpbmcgdXBkYXRlcwoKLSBVcGRhdGUgQnVpbGRLaXQgdG8gW3YwLjIwLjJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L2J1aWxka2l0L3JlbGVhc2VzL3RhZy92MC4yMC4yKS4gW21vYnkvbW9ieSM0OTY5OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5Njk4KQotIFVwZGF0ZSBgcnVuY2AgdG8gW3YxLjIuNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL29wZW5jb250YWluZXJzL3J1bmMvcmVsZWFzZXMvdGFnL3YxLjIuNikgKHN0YXRpYyBwYWNrYWdlcyBvbmx5KS4gW21vYnkvbW9ieSM0OTY4Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NjgyKQotIFVwZGF0ZSBjb250YWluZXJkIHRvIFt2MS43LjI2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY29udGFpbmVyZC9jb250YWluZXJkL3JlbGVhc2VzL3RhZy92MS43LjI2KS4gW2RvY2tlci9jb250YWluZXJkLXBhY2thZ2luZyM0MDldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY29udGFpbmVyZC1wYWNrYWdpbmcvcHVsbC80MDkpCgojIyMgW2B2MjguMC4yYF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9yZWxlYXNlcy90YWcvdjI4LjAuMikKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9jb21wYXJlL3YyOC4wLjEuLi52MjguMC4yKQoKIyMjIyAyOC4wLjIKCkZvciBhIGZ1bGwgbGlzdCBvZiBwdWxsIHJlcXVlc3RzIGFuZCBjaGFuZ2VzIGluIHRoaXMgcmVsZWFzZSwgcmVmZXIgdG8gdGhlIHJlbGV2YW50IEdpdEh1YiBtaWxlc3RvbmVzOgoKLSBbZG9ja2VyL2NsaSwgMjguMC4yIG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMC4yKQotIFttb2J5L21vYnksIDI4LjAuMiBtaWxlc3RvbmVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMC4yKQoKIyMjIyMgQnVnIGZpeGVzIGFuZCBlbmhhbmNlbWVudHMKCi0gRml4IENMSS1zcGVjaWZpYyBhdHRyaWJ1dGVzIChgZG9ja2VyLmNsaS4qYCkgYmVpbmcgdW5pbnRlbnRpb25hbGx5IHBhc3NlZCB0byBkb3duc3RyZWFtIE9UZWwgc2VydmljZXMuIFtkb2NrZXIvY2xpIzU4NDJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTg0MikKLSBGaXggYW4gaXNzdWUgd2hlcmUgdXNlci1zcGVjaWZpZWQgYE9URUxfUkVTT1VSQ0VfQVRUUklCVVRFU2Agd2VyZSBiZWluZyBvdmVycmlkZGVuIGJ5IENMSSdzIGludGVybmFsIHRlbGVtZXRyeSBhdHRyaWJ1dGVzLiBUaGUgQ0xJIG5vdyBwcm9wZXJseSBtZXJnZXMgdXNlci1zcGVjaWZpZWQgYXR0cmlidXRlcyB3aXRoIGludGVybmFsIG9uZXMsIGFsbG93aW5nIGJvdGggdG8gY29leGlzdC4gW2RvY2tlci9jbGkjNTg0Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81ODQyKQotIEZpeCBkYWVtb24gZmFpbGluZyB0byBzdGFydCBvbiBXaW5kb3dzIHdoZW4gYSBjb250YWluZXIgY3JlYXRlZCBiZWZvcmUgdjI4LjAuMCB3YXMgcHJlc2VudC4gW21vYnkvbW9ieSM0OTYyNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NjI2KQotIEZpeCBwb3NzaWJsZSBlcnJvciBvbiBgZG9ja2VyIGJ1aWxkeCBwcnVuZWAgd2l0aCB0aGUgYC0tbWluLWZyZWUtc3BhY2VgLiBbbW9ieS9tb2J5IzQ5NjIzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2MjMpCi0gRml4IHNwdXJpb3VzIGBpbzogcmVhZC93cml0ZSBvbiBjbG9zZWQgcGlwZWAgZXJyb3IgaW4gdGhlIGRhZW1vbiBsb2cgd2hlbiBjbG9zaW5nIGNvbnRhaW5lci4gW21vYnkvbW9ieSM0OTU5MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTkwKQotIEZpeCB0aGUgRG9ja2VyIGRhZW1vbiBmYWlsaW5nIHRvbyBlYXJseSBpZiB0aGUgY29udGFpbmVyZCBzb2NrZXQgaXNuJ3QgaW1tZWRpYXRlbHkgYXZhaWxhYmxlLiBbbW9ieS9tb2J5IzQ5NjAzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2MDMpCi0gTWFzayBMaW51eCB0aGVybWFsIGludGVycnVwdCBpbmZvIGluIGEgY29udGFpbmVyJ3MgYC9wcm9jYCBhbmQgYC9zeXNgIGJ5IGRlZmF1bHQuIFttb2J5L21vYnkjNDk1NjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTU2MCkKLSBVcGRhdGUgYGNvbnRyaWIvY2hlY2stY29uZmlnLnNoYCB0byBjaGVjayBmb3IgbW9yZSBrZXJuZWwgbW9kdWxlcyByZWxhdGVkIHRvIGlwdGFibGVzLiBbbW9ieS9tb2J5IzQ5NjIyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2MjIpCi0gY29udGFpbmVyZCBpbWFnZSBzdG9yZTogRml4IGludGVnZXIgb3ZlcmZsb3cgaW4gVXNlciBJRCBoYW5kbGluZyBwYXNzZWQgdmlhIGAtLXVzZXJgLiBbbW9ieS9tb2J5IzQ5NjUyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2NTIpCi0gY29udGFpbmVyZCBpbWFnZSBzdG9yZTogRml4IHNwdXJpb3VzIGByZWZlcmVuY2UgZm9yIHVua25vd24gdHlwZTogYXBwbGljYXRpb24vdm5kLmluLXRvdG8ranNvbmAgd2FybmluZyBiZWluZyBsb2dnZWQgdG8gdGhlIGRhZW1vbidzIGxvZy4gW21vYnkvbW9ieSM0OTY1Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NjUyKQotIGNvbnRhaW5lcmQgaW1hZ2Ugc3RvcmU6IEltcHJvdmUgcGVyZm9ybWFuY2Ugb2YgYGRvY2tlciBwc2Agd2hlbiBydW5uaW5nIGxhcmdlIG51bWJlciBvZiBjb250YWluZXJzLiBbbW9ieS9tb2J5IzQ5MzY1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkzNjUpCgojIyMjIyBQYWNrYWdpbmcgdXBkYXRlcwoKLSBVcGRhdGUgQnVpbGRLaXQgdG8gW3YwLjIwLjFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L2J1aWxka2l0L3JlbGVhc2VzL3RhZy92MC4yMC4xKS4gW21vYnkvbW9ieSM0OTU4N10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTg3KQotIFVwZGF0ZSBCdWlsZHggdG8gW3YwLjIyLjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvYnVpbGR4L3JlbGVhc2VzL3RhZy92MC4yMi4wKS4gW2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nIzExNzVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZy9wdWxsLzExNzUpCi0gVXBkYXRlIENvbXBvc2UgdG8gW3YyLjM0LjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY29tcG9zZS9yZWxlYXNlcy90YWcvdjIuMzQuMCkuIFtkb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZyMxMTcyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcvcHVsbC8xMTcyKQotIFVwZGF0ZSBHbyBydW50aW1lIHRvIFsxLjIzLjddKGh0dHBzOi8vZ28uZGV2L2RvYy9kZXZlbC9yZWxlYXNlI2dvMS4yMy43KS4gW2RvY2tlci9jbGkjNTg5MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81ODkwKSwgW2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nIzExNzFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZy9wdWxsLzExNzEpLCBbbW9ieS9tb2J5IzQ5NTgwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk1ODApCi0gVXBkYXRlIFJvb3RsZXNzS2l0IHRvIFt2Mi4zLjRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9yb290bGVzcy1jb250YWluZXJzL3Jvb3RsZXNza2l0L3JlbGVhc2VzL3RhZy92Mi4zLjQpLiBbbW9ieS9tb2J5IzQ5NjE0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2MTQpCi0gVXBkYXRlIGNvbnRhaW5lcmQgKHN0YXRpYyBiaW5hcmllcyBvbmx5KSB0byBbdjEuNy4yN10oaHR0cHM6Ly93d3cuZ2l0aHViLmNvbS9jb250YWluZXJkL2NvbnRhaW5lcmQvcmVsZWFzZXMvdGFnL3YxLjcuMjcpLiBbbW9ieS9tb2J5IzQ5NjU2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2NTYpCgojIyMjIyBOZXR3b3JraW5nCgotIEFkZCBlbnZpcm9ubWVudCB2YXJpYWJsZSBgRE9DS0VSX0lOU0VDVVJFX05PX0lQVEFCTEVTX1JBVz0xYCB0byBhbGxvdyBEb2NrZXIgdG8gcnVuIG9uIHN5c3RlbXMgd2hlcmUgdGhlIExpbnV4IGtlcm5lbCBjYW4ndCBwcm92aWRlIGBDT05GSUdfSVBfTkZfUkFXYCBzdXBwb3J0LiBXaGVuIGVuYWJsZWQsIERvY2tlciB3aWxsIG5vdCBjcmVhdGUgcnVsZXMgaW4gdGhlIGlwdGFibGVzIGByYXdgIHRhYmxlLiBXYXJuaW5nOiBUaGlzIGlzIG5vdCByZWNvbW1lbmRlZCBmb3IgcHJvZHVjdGlvbiBlbnZpcm9ubWVudHMgYXMgaXQgcmVkdWNlcyBzZWN1cml0eSBieSBhbGxvd2luZyBvdGhlciBob3N0cyBvbiB0aGUgbG9jYWwgbmV0d29yayB0byByb3V0ZSB0byBwb3J0cyBwdWJsaXNoZWQgdG8gaG9zdCBhZGRyZXNzZXMsIGV2ZW4gd2hlbiB0aGV5IGFyZSBwdWJsaXNoZWQgdG8gYDEyNy4wLjAuMS5gIFRoaXMgb3B0aW9uIGJ5cGFzc2VzIHNvbWUgb2YgdGhlIHNlY3VyaXR5IGhhcmRlbmluZyBpbnRyb2R1Y2VkIGluIERvY2tlciBFbmdpbmUgMjguMC4wLiBbbW9ieS9tb2J5IzQ5NjIxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2MjEpCi0gQWxsb3cgY29udGFpbmVyIHN0YXJ0dXAgd2hlbiBhbiBlbmRwb2ludCBpcyBhdHRhY2hlZCB0byBhIG1hY3ZsYW4gbmV0d29yayB3aGVyZSB0aGUgcGFyZW50IGludGVyZmFjZSBpcyBkb3duLiBbbW9ieS9tb2J5IzQ5NjMwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2MzApCi0gRG8gbm90IHNraXAgRE5BVCBmb3IgcGFja2V0cyBvcmlnaW5hdGluZyBpbiBhIGdhdGV3YXlcX21vZGU9cm91dGVkIG5ldHdvcmsuIFttb2J5L21vYnkjNDk1NzddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTU3NykKLSBGaXggYSBidWcgY2F1c2luZyBgZG9ja2VyIHBzYCB0byBpbmNvbnNpc3RlbnRseSByZXBvcnQgZHVhbC1zdGFjayBwb3J0IG1hcHBpbmdzLiBbbW9ieS9tb2J5IzQ5NjU3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2NTcpCi0gRml4IGEgYnVnIHRoYXQgY291bGQgY2F1c2UgYGRvY2tlci1wcm94eWAgdG8gc3RvcCBmb3J3YXJkaW5nIFVEUCBkYXRhZ3JhbXMgdG8gY29udGFpbmVycy4gW21vYnkvbW9ieSM0OTY0OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NjQ5KQotIEZpeCBhIGJ1ZyB0aGF0IHdhcyBjYXVzaW5nIGBkb2NrZXItcHJveHlgIHRvIGNsb3NlIFVEUCBjb25uZWN0aW9ucyB0byBjb250YWluZXJzIGVhZ2VybHkgYW5kIHJlc3VsdGluZyBpbiB0aGUgc291cmNlIGFkZHJlc3MgdG8gY2hhbmdlIG5lZWRsZXNzbHkuIFttb2J5L21vYnkjNDk2NDldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTY0OSkKCiMjIyMjIEdvIFNESwoKLSBNb3ZlIHZhcmlvdXMgdHlwZXMgYW5kIGNvbnN0cyBmcm9tIGBjbGktcGx1Z2lucy9tYW5hZ2VyYCB0byBhIHNlcGFyYXRlIHBhY2thZ2UuIFtkb2NrZXIvY2xpIzU5MDJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTkwMikKLSBVcGRhdGUgbWluaW11bSByZXF1aXJlZCBHbyB2ZXJzaW9uIHRvIGdvMS4yMy4gW21vYnkvbW9ieSM0OTU0MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTQxKQotIGBjbGkvY29tbWFuZGA6IE1vdmUgYFByZXR0eVByaW50YCB1dGlsaXR5IHRvIGBjbGkvY29tbWFuZC9mb3JtYXR0ZXJgLiBbZG9ja2VyL2NsaSM1OTE2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5MTYpCi0gcnVuY29uZmlnL2Vycm9yczogc3BsaXQgYEVyckNvbmZsaWN0SG9zdE5ldHdvcmtgIGludG8gYEVyckNvbmZsaWN0Q29ubmVjdFRvSG9zdE5ldHdvcmtgIGFuZCBgRXJyQ29uZmxpY3REaXNjb25uZWN0RnJvbUhvc3ROZXR3b3JrYC4gW21vYnkvbW9ieSM0OTYwNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NjA1KQoKIyMjIyMgRGVwcmVjYXRpb25zCgotIEdvLVNESzogRGVwcmVjYXRlIGBjbGktcGx1Z2lucy9tYW5hZ2VyLlJlc291cmNlQXR0cmlidXRlc0VudnZhcmAgY29uc3RhbnQuIEl0IHdhcyB1c2VkIGludGVybmFsbHksIGJ1dCBob2xkcyB0aGUgYE9URUxfUkVTT1VSQ0VfQVRUUklCVVRFU2AgbmFtZSwgd2hpY2ggaXMgcGFydCBvZiB0aGUgT3BlblRlbGVtZXRyeSBzcGVjaWZpY2F0aW9uLiBVc2VycyBvZiB0aGlzIGNvbnN0YW50IHNob3VsZCBkZWZpbmUgdGhlaXIgb3duLiBJdCB3aWxsIGJlIHJlbW92ZWQgaW4gdGhlIG5leHQgcmVsZWFzZS4gW2RvY2tlci9jbGkjNTg4MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81ODgxKQotIEdvLVNESzogRGVwcmVjYXRlIGBvcHRzLlBvcnRPcHRgLCBgb3B0cy5Db25maWdPcHRgIGFuZCBgb3B0cy5TZWNyZXRPcHRgLiBUaGVzZSB0eXBlcyB3ZXJlIG1vdmVkIHRvIHRoZSBgb3B0cy9zd2FybW9wdHNgIHBhY2thZ2UuIFtkb2NrZXIvY2xpIzU5MDddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTkwNykKLSBHby1TREs6IFJlbW92ZSBgc2VydmljZS9sb2dzYCBwYWNrYWdlLiBbZG9ja2VyL2NsaSM1OTEwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU5MTApCi0gR28tU0RLOiBgY2xpL2NvbW1hbmQvaW1hZ2VgOiBEZXByZWNhdGUgYFB1c2hUcnVzdGVkUmVmZXJlbmNlYCBhbmQgbW92ZSB0byBgY2xpL3RydXN0YC4gW2RvY2tlci9jbGkjNTg5NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81ODk0KQotIEdvLVNESzogYGNsaS9jb21tYW5kL2ltYWdlYDogRGVwcmVjYXRlIGFuZCBpbnRlcm5hbGl6ZSBgVHJ1c3RlZFB1c2hgLiBbZG9ja2VyL2NsaSM1ODk0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU4OTQpCi0gR28tU0RLOiBgY2xpL2NvbW1hbmRgOiBkZXByZWNhdGUgYENsaS5Ob3RhcnlDbGllbnRgOiB1c2UgW2B0cnVzdC5HZXROb3RhcnlSZXBvc2l0b3J5YF0oaHR0cHM6Ly9wa2cuZ28uZGV2L2dpdGh1Yi5jb20vZG9ja2VyL2NsaUB2MjguMC4xK2luY29tcGF0aWJsZS9jbGkvdHJ1c3QjR2V0Tm90YXJ5UmVwb3NpdG9yeSkgaW5zdGVhZC4gVGhpcyBtZXRob2QgaXMgbm8gbG9uZ2VyIHVzZWQgYW5kIHdpbGwgYmUgcmVtb3ZlZCBpbiB0aGUgbmV4dCByZWxlYXNlLiBbZG9ja2VyL2NsaSM1ODg1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU4ODUpCi0gR28tU0RLOiBgY2xpL2NvbW1hbmRgOiBkZXByZWNhdGUgYENsaS5SZWdpc3RyeUNsaWVudGAuIFRoaXMgbWV0aG9kIHdhcyBvbmx5IHVzZWQgaW50ZXJuYWxseSBhbmQgd2lsbCBiZSByZW1vdmVkIGluIHRoZSBuZXh0IHJlbGVhc2UuIFVzZSBbYGNsaWVudC5OZXdSZWdpc3RyeUNsaWVudGBdKGh0dHBzOi8vcGtnLmdvLmRldi9naXRodWIuY29tL2RvY2tlci9jbGlAdjI4LjAuMStpbmNvbXBhdGlibGUvY2xpL3JlZ2lzdHJ5L2NsaWVudCNOZXdSZWdpc3RyeUNsaWVudCkgaW5zdGVhZC4gW2RvY2tlci9jbGkjNTg4OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81ODg5KSwgW2RvY2tlci9jbGkjNTg4OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81ODg5KQotIEdvLVNESzogYHJlZ2lzdHJ5YDogRGVwcmVjYXRlIGBSZXBvc2l0b3J5SW5mby5PZmZpY2lhbGAgZmllbGQuIFttb2J5L21vYnkjNDk1NjddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTU2NykKLSBHby1TREs6IGByZWdpc3RyeWA6IGRlcHJlY2F0ZSBgSG9zdENlcnRzRGlyYDogdGhpcyBmdW5jdGlvbiB3YXMgb25seSB1c2VkIGludGVybmFsbHkgYW5kIHdpbGwgYmUgcmVtb3ZlZCBpbiB0aGUgbmV4dCByZWxlYXNlLiBbbW9ieS9tb2J5IzQ5NjEyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk2MTIpCi0gR28tU0RLOiBgcmVnaXN0cnlgOiBkZXByZWNhdGUgYFNldENlcnRzRGlyYDogdGhlIGNlcnQtZGlyZWN0b3J5IGlzIG5vdyBhdXRvbWF0aWNhbGx5IHNlbGVjdGVkIHdoZW4gcnVubmluZyB3aXRoIFJvb3RsZXNzS2l0LCBhbmQgc2hvdWxkIG5vIGxvbmdlciBiZSBzZXQgbWFudWFsbHkuIFttb2J5L21vYnkjNDk2MTJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTYxMikKCiMjIyBbYHYyOC4wLjFgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3JlbGVhc2VzL3RhZy92MjguMC4xKQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L2NvbXBhcmUvdjI4LjAuMC4uLnYyOC4wLjEpCgojIyMgMjguMC4xCgpGb3IgYSBmdWxsIGxpc3Qgb2YgcHVsbCByZXF1ZXN0cyBhbmQgY2hhbmdlcyBpbiB0aGlzIHJlbGVhc2UsIHJlZmVyIHRvIHRoZSByZWxldmFudCBHaXRIdWIgbWlsZXN0b25lczoKCi0gW2RvY2tlci9jbGksIDI4LjAuMSBtaWxlc3RvbmVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL2lzc3Vlcz9xPWlzJTNBY2xvc2VkK21pbGVzdG9uZSUzQTI4LjAuMSkKLSBbbW9ieS9tb2J5LCAyOC4wLjEgbWlsZXN0b25lXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L2lzc3Vlcz9xPWlzJTNBY2xvc2VkK21pbGVzdG9uZSUzQTI4LjAuMSkKCiMjIyMgTmV0d29ya2luZwoKLSBSZW1vdmUgZGVwZW5kZW5jeSBvbiBrZXJuZWwgbW9kdWxlcyBgaXBfc2V0YCwgYGlwX3NldF9oYXNoX25ldGAgYW5kIGBuZXRmaWx0ZXJfeHRfc2V0YC4KICAtIFRoZSBkZXBlbmRlbmN5IHdhcyBpbnRyb2R1Y2VkIGluIHJlbGVhc2UgMjguMC4wIGJ1dCBwcm92ZWQgdG9vIGRpc3J1cHRpdmUuIFRoZSBpcHRhYmxlcyBydWxlcyB1c2luZyB0aGVzZSBtb2R1bGVzIGhhdmUgYmVlbiByZXBsYWNlZC4gW21vYnkvbW9ieSM0OTUzMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTMwKQotIEFsbG93IGRhZW1vbiBzdGFydHVwIG9uIGEgaG9zdCB3aXRoIElQdjYgZGlzYWJsZWQgd2l0aG91dCByZXF1aXJpbmcgYC0taXA2dGFibGVzPWZhbHNlYC4gW21vYnkvbW9ieSM0OTUyNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTI1KQotIEZpeCBhIGJ1ZyB0aGF0IHdhcyBjYXVzaW5nIGNvbnRhaW5lcnMgd2l0aCBgLS1yZXN0YXJ0PWFsd2F5c2AgYW5kIGEgcHVibGlzaGVkIHBvcnQgYWxyZWFkeSBpbiB1c2UgdG8gcmVzdGFydCBpbiBhIHRpZ2h0IGxvb3AuIFttb2J5L21vYnkjNDk1MDddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTUwNykKLSBGaXggYW4gaXNzdWUgd2l0aCBTd2FybSBpbmdyZXNzLCBjYXVzZWQgYnkgaW5jb3JyZWN0IG9yZGVyaW5nIG9mIGlwdGFibGVzIHJ1bGVzLiBbbW9ieS9tb2J5IzQ5NTM4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk1MzgpCi0gRml4IGNyZWF0aW9uIG9mIGEgc3dhcm0tc2NvcGVkIG5ldHdvcmsgZnJvbSBhIGAtLWNvbmZpZy1vbmx5YCBuZXR3b3JrLiBbbW9ieS9tb2J5IzQ5NTIxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk1MjEpCi0gRml4IGBkb2NrZXIgbmV0d29yayBpbnNwZWN0YCByZXBvcnRpbmcgYW4gSVB2NiBnYXRld2F5IHdpdGggQ0lEUiBzdWZmaXggZm9yIGEgbmV3bHkgY3JlYXRlZCBuZXR3b3JrIHdpdGggbm8gc3BlY2lmaWMgSVBBTSBjb25maWcsIHVudGlsIGEgZGFlbW9uIHJlc3RhcnQuIFttb2J5L21vYnkjNDk1MjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTUyMCkKLSBJbXByb3ZlIHRoZSBlcnJvciByZXBvcnRlZCB3aGVuIGtlcm5lbCBtb2R1bGVzIGBpcF9zZXRgLCBgaXBfc2V0X2hhc2hfbmV0YCBhbmQgYG5ldGlsdGVyX3h0X3NldGAgYXJlIG5vdCBhdmFpbGFibGUuIFttb2J5L21vYnkjNDk1MjRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTUyNCkKLSBNb3ZlIG1vc3Qgb2YgRG9ja2VyJ3MgaXB0YWJsZXMgcnVsZXMgb3V0IG9mIHRoZSBmaWx0ZXItRk9SV0FSRCBjaGFpbiwgc28gdGhhdCBvdGhlciBhcHBsaWNhdGlvbnMgYXJlIGZyZWUgdG8gYXBwZW5kIHJ1bGVzIHRoYXQgbXVzdCBmb2xsb3cgRG9ja2VyJ3MgcnVsZXMuIFttb2J5L21vYnkjNDk1MThdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTUxOCkKLSBVcGRhdGUgYC0taGVscGAgb3V0cHV0IGFuZCBtYW4gcGFnZSBsbyBzdGF0ZSB3aGljaCBvcHRpb25zIG9ubHkgYXBwbHkgdG8gdGhlIGRlZmF1bHQgYnJpZGdlIG5ldHdvcmsuIFttb2J5L21vYnkjNDk1MjJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTUyMikKCiMjIyMgQnVnIGZpeGVzIGFuZCBlbmhhbmNlbWVudHMKCi0gRml4IGBkb2NrZXIgY29udGV4dCBjcmVhdGVgIGFsd2F5cyByZXR1cm5pbmcgYW4gZXJyb3Igd2hlbiB1c2luZyB0aGUgYCJza2lwLXRscy12ZXJpZnkiYCBvcHRpb24uIFtkb2NrZXIvY2xpIzU4NTBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTg1MCkKLSBGaXggc2hlbGwgY29tcGxldGlvbiBzdWdnZXN0aW5nIElEcyBpbnN0ZWFkIG9mIG5hbWVzIGZvciBzZXJ2aWNlcyBhbmQgbm9kZXMuIFtkb2NrZXIvY2xpIzU4NDhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTg0OCkKLSBGaXggdW5pbnRlbnRpb25hbGx5IHByaW50aW5nIGV4aXQgc3RhdHVzIHRvIHN0YW5kYXJkIGVycm9yIG91dHB1dCB3aGVuIGBkb2NrZXIgZXhlYy9ydW5gIHJldHVybnMgYSBub24temVybyBzdGF0dXMuIFtkb2NrZXIvY2xpIzU4NTRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTg1NCkKLSBGaXggcmVncmVzc2lvbiBgcHJvdG9jb2wgInRjcCIgaXMgbm90IHN1cHBvcnRlZCBieSB0aGUgUm9vdGxlc3NLaXQgcG9ydCBkcml2ZXIgInNsaXJwNG5ldG5zImAuIFttb2J5L21vYnkjNDk1MTRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTUxNCkKLSBjb250YWluZXJkIGltYWdlIHN0b3JlOiBGaXggYGRvY2tlciBpbnNwZWN0YCBub3QgYmVpbmcgYWJsZSB0byBzaG93IG11bHRpLXBsYXRmb3JtIGltYWdlcyB3aXRoIG1pc3NpbmcgbGF5ZXJzIGZvciBhbGwgcGxhdGZvcm1zLiBbbW9ieS9tb2J5IzQ5NTMzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDk1MzMpCi0gY29udGFpbmVyZCBpbWFnZSBzdG9yZTogRml4IGBkb2NrZXIgaW1hZ2VzIC0tdHJlZWAgcmVwb3J0aW5nIHdyb25nIGNvbnRlbnQgc2l6ZS4gW21vYnkvbW9ieSM0OTUzNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTM1KQotIEZpeCBjb21waWxhdGlvbiBvbiBpMzg2IFttb2J5L21vYnkjNDk1MjZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTUyNikKCiMjIyMgUGFja2FnaW5nIHVwZGF0ZXMKCi0gVXBkYXRlIGBnaXRodWIuY29tL2dvLWpvc2UvZ28tam9zZS92NGAgdG8gdjQuMC41IHRvIGFkZHJlc3MuIFtHSFNBLWM2Z3ctdzM5OC1odjc4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ28tam9zZS9nby1qb3NlL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS1jNmd3LXczOTgtaHY3OCkgLyBbQ1ZFLTIwMjUtMjcxNDRdKGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVjb3JkP2lkPUNWRS0yMDI1LTI3MTQ0KSBbZG9ja2VyL2NsaSM1ODY3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzU4NjcpCi0gVXBkYXRlIEJ1aWxkeCB0byBbdjAuMjEuMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9idWlsZHgvcmVsZWFzZXMvdGFnL3YwLjIxLjEpLiBbZG9ja2VyL2RvY2tlci1jZS1wYWNrYWdpbmcjMTE2N10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nL3B1bGwvMTE2NykKLSBVcGRhdGUgQ29tcG9zZSB0byBbdjIuMzMuMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jb21wb3NlL3JlbGVhc2VzL3RhZy92Mi4zMy4xKS4gW2RvY2tlci9kb2NrZXItY2UtcGFja2FnaW5nIzExNjhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvZG9ja2VyLWNlLXBhY2thZ2luZy9wdWxsLzExNjgpCgojIyMjIEFQSQoKLSBjb250YWluZXJkIGltYWdlIHN0b3JlOiBGaXggYEdFVCAvaW1hZ2VzL2pzb24/bWFuaWZlc3RzPTFgIG5vdCBmaWxsaW5nIGBNYW5pZmVzdHNgIGZvciBpbmRleC1vbmx5IGltYWdlcy4gW21vYnkvbW9ieSM0OTUzM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTMzKQotIGNvbnRhaW5lcmQgaW1hZ2Ugc3RvcmU6IEZpeCBgR0VUIC9pbWFnZXMvanNvbiBhbmQgL2ltYWdlcy88bmFtZT4vanNvbmAgYFNpemUuQ29udGVudGAgZmllbGQgaW5jbHVkaW5nIHRoZSBzaXplIG9mIGNvbnRlbnQgdGhhdCdzIG5vdCBhdmFpbGFibGUgbG9jYWxseS4gW21vYnkvbW9ieSM0OTUzNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5NTM1KQoKIyMjIFtgdjI4LjAuMGBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcmVsZWFzZXMvdGFnL3YyOC4wLjApCgpbQ29tcGFyZSBTb3VyY2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvY29tcGFyZS92MjcuNS4xLi4udjI4LjAuMCkKCiMjIyAyOC4wLjAKCkZvciBhIGZ1bGwgbGlzdCBvZiBwdWxsIHJlcXVlc3RzIGFuZCBjaGFuZ2VzIGluIHRoaXMgcmVsZWFzZSwgcmVmZXIgdG8gdGhlIHJlbGV2YW50IEdpdEh1YiBtaWxlc3RvbmVzOgoKLSBbZG9ja2VyL2NsaSwgMjguMC4wIG1pbGVzdG9uZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMC4wKQotIFttb2J5L21vYnksIDI4LjAuMCBtaWxlc3RvbmVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvaXNzdWVzP3E9aXMlM0FjbG9zZWQrbWlsZXN0b25lJTNBMjguMC4wKQotIERlcHJlY2F0ZWQgYW5kIHJlbW92ZWQgZmVhdHVyZXMsIHNlZSBbRGVwcmVjYXRlZCBGZWF0dXJlc10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvYmxvYi92MjguMC4wL2RvY3MvZGVwcmVjYXRlZC5tZCkuCi0gQ2hhbmdlcyB0byB0aGUgRW5naW5lIEFQSSwgc2VlIFtBUEkgdmVyc2lvbiBoaXN0b3J5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L2Jsb2IvdjI4LjAuMC9kb2NzL2FwaS92ZXJzaW9uLWhpc3RvcnkubWQpLgoKIyMjIyBOZXcKCi0gQWRkIGFiaWxpdHkgdG8gbW91bnQgYW4gaW1hZ2UgaW5zaWRlIGEgY29udGFpbmVyIHZpYSBgLS1tb3VudCB0eXBlPWltYWdlYC4gW21vYnkvbW9ieSM0ODc5OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4Nzk4KQogIC0gWW91IGNhbiBhbHNvIHNwZWNpZnkgYC0tbW91bnQgdHlwZT1pbWFnZSxpbWFnZS1zdWJwYXRoPVtzdWJwYXRoXSwuLi5gIG9wdGlvbiB0byBtb3VudCBhIHNwZWNpZmljIHBhdGggZnJvbSB0aGUgaW1hZ2UuIFtkb2NrZXIvY2xpIzU3NTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTc1NSkKLSBgZG9ja2VyIGltYWdlcyAtLXRyZWVgIG5vdyBzaG93cyBtZXRhZGF0YSBiYWRnZXMuIFtkb2NrZXIvY2xpIzU3NDRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kb2NrZXIvY2xpL3B1bGwvNTc0NCkKLSBgZG9ja2VyIGxvYWRgLCBgZG9ja2VyIHNhdmVgLCBhbmQgYGRvY2tlciBoaXN0b3J5YCBub3cgc3VwcG9ydCBhIGAtLXBsYXRmb3JtYCBmbGFnIGFsbG93aW5nIHlvdSB0byBjaG9vc2UgYSBzcGVjaWZpYyBwbGF0Zm9ybSBmb3Igc2luZ2xlLXBsYXRmb3JtIG9wZXJhdGlvbnMgb24gbXVsdGktcGxhdGZvcm0gaW1hZ2VzLiBbZG9ja2VyL2NsaSM1MzMxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzUzMzEpCi0gQWRkIGBPT01TY29yZUFkamAgdG8gYGRvY2tlciBzZXJ2aWNlIGNyZWF0ZWAgYW5kIGBkb2NrZXIgc3RhY2tgLiBbZG9ja2VyL2NsaSM1MTQ1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZG9ja2VyL2NsaS9wdWxsLzUxNDUpCi0gYGRvY2tlciBidWlsZHggcHJ1bmVgIG5vdyBzdXBwb3J0cyBgcmVzZXJ2ZWQtc3BhY2VgLCBgbWF4LXVzZWQtc3BhY2VgLCBgbWluLWZyZWUtc3BhY2VgIGFuZCBga2VlcC1ieXRlc2AgZmlsdGVycy4gW21vYnkvbW9ieSM0ODcyMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4NzIwKQotIFdpbmRvd3M6IEFkZCBzdXBwb3J0IGZvciBydW5uaW5nIGNvbnRhaW5lcmQgYXMgYSBjaGlsZCBwcm9jZXNzIG9mIHRoZSBkYWVtb24sIGluc3RlYWQgb2YgdXNpbmcgYSBzeXN0ZW0taW5zdGFsbGVkIGNvbnRhaW5lcmQuIFttb2J5L21vYnkjNDc5NTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80Nzk1NSkKCiMjIyMgTmV0d29ya2luZwoKLSBUaGUgYGRvY2tlci1wcm94eWAgYmluYXJ5IGhhcyBiZWVuIHVwZGF0ZWQsIG9sZGVyIHZlcnNpb25zIHdpbGwgbm90IHdvcmsgd2l0aCB0aGUgdXBkYXRlZCBgZG9ja2VyZGAuIFttb2J5L21vYnkjNDgxMzJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODEzMikKICAtIENsb3NlIGEgd2luZG93IGluIHdoaWNoIHRoZSB1c2VybGFuZCBwcm94eSAoYGRvY2tlci1wcm94eWApIGNvdWxkIGFjY2VwdCBUQ1AgY29ubmVjdGlvbnMsIHRoYXQgd291bGQgdGhlbiBmYWlsIGFmdGVyIGBpcHRhYmxlc2AgTkFUIHJ1bGVzIHdlcmUgc2V0IHVwLgogIC0gVGhlIGV4ZWN1dGFibGUgYHJvb3RsZXNza2l0LWRvY2tlci1wcm94eWAgaXMgbm8gbG9uZ2VyIHVzZWQsIGl0IGhhcyBiZWVuIHJlbW92ZWQgZnJvbSB0aGUgYnVpbGQgYW5kIGRpc3RyaWJ1dGlvbi4KLSBETlMgbmFtZXNlcnZlcnMgcmVhZCBmcm9tIHRoZSBob3N0J3MgYC9ldGMvcmVzb2x2LmNvbmZgIGFyZSBub3cgYWx3YXlzIGFjY2Vzc2VkIGZyb20gdGhlIGhvc3QncyBuZXR3b3JrIG5hbWVzcGFjZS4gW21vYnkvbW9ieSM0ODI5MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4MjkwKQogIC0gV2hlbiB0aGUgaG9zdCdzIGAvZXRjL3Jlc29sdi5jb25mYCBjb250YWlucyBubyBuYW1lc2VydmVycyBhbmQgdGhlcmUgYXJlIG5vIGAtLWRuc2Agb3ZlcnJpZGVzLCBHb29nbGUncyBETlMgc2VydmVycyBhcmUgbm8gbG9uZ2VyIHVzZWQsIGFwYXJ0IGZyb20gYnkgdGhlIGRlZmF1bHQgYnJpZGdlIG5ldHdvcmsgYW5kIGluIGJ1aWxkIGNvbnRhaW5lcnMuCi0gQ29udGFpbmVyIGludGVyZmFjZXMgaW4gYnJpZGdlIGFuZCBtYWN2bGFuIG5ldHdvcmtzIG5vdyB1c2UgcmFuZG9tbHkgZ2VuZXJhdGVkIE1BQyBhZGRyZXNzZXMuIFttb2J5L21vYnkjNDg4MDhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODgwOCkKICAtIEdyYXR1aXRvdXMgQVJQIC8gTmVpZ2hib3VyIEFkdmVydGlzZW1lbnQgbWVzc2FnZXMgd2lsbCBiZSBzZW50IHdoZW4gdGhlIGludGVyZmFjZXMgYXJlIHN0YXJ0ZWQgc28gdGhhdCwgd2hlbiBJUCBhZGRyZXNzZXMgYXJlIHJldXNlZCwgdGhleSdyZSBhc3NvY2lhdGVkIHdpdGggdGhlIG5ld2x5IGdlbmVyYXRlZCBNQUMgYWRkcmVzcy4KICAtIElQdjYgYWRkcmVzc2VzIGluIHRoZSBkZWZhdWx0IGJyaWRnZSBuZXR3b3JrIGFyZSBub3cgSVBBTS1hc3NpZ25lZCwgcmF0aGVyIHRoYW4gYmVpbmcgZGVyaXZlZCBmcm9tIHRoZSBNQUMgYWRkcmVzcy4KLSBUaGUgZGVwcmVjYXRlZCBPQ0kgYHByZXN0YXJ0YCBob29rIGlzIG5vdyBvbmx5IHVzZWQgYnkgYnVpbGQgY29udGFpbmVycy4gRm9yIG90aGVyIGNvbnRhaW5lcnMsIG5ldHdvcmsgaW50ZXJmYWNlcyBhcmUgYWRkZWQgdG8gdGhlIG5ldHdvcmsgbmFtZXNwYWNlIGFmdGVyIHRhc2sgY3JlYXRpb24gaXMgY29tcGxldGUsIGJlZm9yZSB0aGUgY29udGFpbmVyIHRhc2sgaXMgc3RhcnRlZC4gW21vYnkvbW9ieSM0NzQwNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ3NDA2KQotIEFkZCBhIG5ldyBgZ3ctcHJpb3JpdHlgIG9wdGlvbiB0byBgZG9ja2VyIHJ1bmAsIGBkb2NrZXIgY29udGFpbmVyIGNyZWF0ZWAsIGFuZCBgZG9ja2VyIG5ldHdvcmsgY29ubmVjdGAuIFRoaXMgb3B0aW9uIHdpbGwgYmUgdXNlZCBieSB0aGUgRW5naW5lIHRvIGRldGVybWluZSB3aGljaCBuZXR3b3JrIHByb3ZpZGVzIHRoZSBkZWZhdWx0IGdhdGV3YXkgZm9yIGEgY29udGFpbmVyLiBPbiBgZG9ja2VyIHJ1bmAsIHRoaXMgb3B0aW9uIGlzIG9ubHkgYXZhaWxhYmxlIHRocm91Z2ggdGhlIGV4dGVuZGVkIGAtLW5ldHdvcmtgIHN5bnRheC4gW2RvY2tlci9jbGkjNTY2NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81NjY0KQotIEFkZCBhIG5ldyBuZXRsYWJlbCBgY29tLmRvY2tlci5uZXR3b3JrLmVuZHBvaW50LmlmbmFtZWAgdG8gY3VzdG9taXplIHRoZSBpbnRlcmZhY2UgbmFtZSB1c2VkIHdoZW4gY29ubmVjdGluZyBhIGNvbnRhaW5lciB0byBhIG5ldHdvcmsuIEl0J3Mgc3VwcG9ydGVkIGJ5IGFsbCBidWlsdC1pbiBuZXR3b3JrIGRyaXZlcnMgb24gTGludXguIFttb2J5L21vYnkjNDkxNTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80OTE1NSkKICAtIFdoZW4gYSBjb250YWluZXIgaXMgY3JlYXRlZCB3aXRoIG11bHRpcGxlIG5ldHdvcmtzIHNwZWNpZmllZCwgdGhlcmUncyBubyBndWFyYW50ZWUgb24gdGhlIG9yZGVyIG5ldHdvcmtzIHdpbGwgYmUgY29ubmVjdGVkIHRvIHRoZSBjb250YWluZXIuIFNvLCBpZiBhIGN1c3RvbSBpbnRlcmZhY2UgbmFtZSB1c2VzIHRoZSBzYW1lIHByZWZpeCBhcyB0aGUgYXV0by1nZW5lcmF0ZWQgbmFtZXMsIGZvciBleGFtcGxlIGBldGhgLCB0aGUgY29udGFpbmVyIG1pZ2h0IGZhaWwgdG8gc3RhcnQuCiAgLSBUaGUgcmVjb21tZW5kZWQgcHJhY3RpY2UgaXMgdG8gdXNlIGEgZGlmZmVyZW50IHByZWZpeCwgZm9yIGV4YW1wbGUgYGVuMGAsIG9yIGEgbnVtZXJpY2FsIHN1ZmZpeCBoaWdoIGVub3VnaCB0byBuZXZlciBjb2xsaWRlLCBmb3IgZXhhbXBsZSBgZXRoMTAwYC4KICAtIFRoaXMgbGFiZWwgY2FuIGJlIHNwZWNpZmllZCBvbiBgZG9ja2VyIG5ldHdvcmsgY29ubmVjdGAgdmlhIHRoZSBgLS1kcml2ZXItb3B0YCBmbGFnLCBmb3IgZXhhbXBsZSBgZG9ja2VyIG5ldHdvcmsgY29ubmVjdCAtLWRyaXZlci1vcHQ9Y29tLmRvY2tlci5uZXR3b3JrLmVuZHBvaW50LmlmbmFtZT1mb29iYXIg4oCmYC4KICAtIE9yIHZpYSB0aGUgbG9uZy1mb3JtIGAtLW5ldHdvcmtgIGZsYWcgb24gYGRvY2tlciBydW5gLCBmb3IgZXhhbXBsZSBgZG9ja2VyIHJ1biAtLW5ldHdvcms9bmFtZT1icmlkZ2UsZHJpdmVyLW9wdD1jb20uZG9ja2VyLm5ldHdvcmsuZW5kcG9pbnQuaWZuYW1lPWZvb2JhciDigKZgCi0gSWYgYSBjdXN0b20gbmV0d29yayBkcml2ZXIgcmVwb3J0cyBjYXBhYmlsaXR5IGBHd0FsbG9jQ2hlY2tlcmAgdGhlbiwgYmVmb3JlIGEgbmV0d29yayBpcyBjcmVhdGVkLCBpdCB3aWxsIGdldCBhIGBHd0FsbG9jQ2hlY2tlclJlcXVlc3RgIHdpdGggdGhlIG5ldHdvcmsncyBvcHRpb25zLiBUaGUgY3VzdG9tIGRyaXZlciBtYXkgdGhlbiByZXBseSB0aGF0IG5vIGdhdGV3YXkgSVAgYWRkcmVzcyBzaG91bGQgYmUgYWxsb2NhdGVkLiBbbW9ieS9tb2J5IzQ5MzcyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkzNzIpCgojIyMjIFBvcnQgcHVibGlzaGluZyBpbiBicmlkZ2UgbmV0d29ya3MKCi0gYGRvY2tlcmRgIG5vdyByZXF1aXJlcyBgaXBzZXRgIHN1cHBvcnQgaW4gdGhlIExpbnV4IGtlcm5lbC4gW21vYnkvbW9ieSM0ODU5Nl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4NTk2KQogIC0gVGhlIGBpcHRhYmxlc2AgYW5kIGBpcDZ0YWJsZXNgIHJ1bGVzIHVzZWQgdG8gaW1wbGVtZW50IHBvcnQgcHVibGlzaGluZyBhbmQgbmV0d29yayBpc29sYXRpb24gaGF2ZSBiZWVuIGV4dGVuc2l2ZWx5IG1vZGlmaWVkLiBUaGlzIGVuYWJsZXMgc29tZSBvZiB0aGUgZm9sbG93aW5nIGZ1bmN0aW9uYWwgY2hhbmdlcywgYW5kIGlzIGEgZmlyc3Qgc3RlcCBpbiByZWZhY3RvcmluZyB0byBlbmFibGUgbmF0aXZlIGBuZnRhYmxlc2Agc3VwcG9ydCBpbiBhIGZ1dHVyZSByZWxlYXNlLiBbbW9ieS9tb2J5IzQ4ODE1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L2lzc3Vlcy80ODgxNSkKICAtIElmIGl0IGJlY29tZXMgbmVjZXNzYXJ5IHRvIGRvd25ncmFkZSB0byBhbiBlYXJsaWVyIHZlcnNpb24gb2YgdGhlIGRhZW1vbiwgc29tZSBtYW51YWwgY2xlYW51cCBvZiB0aGUgbmV3IHJ1bGVzIHdpbGwgYmUgbmVjZXNzYXJ5LiBUaGUgc2ltcGxlc3QgYW5kIHN1cmVzdCBhcHByb2FjaCBpcyB0byByZWJvb3QgdGhlIGhvc3QsIG9yIHVzZSBgaXB0YWJsZXMgLUZgIGFuZCBgaXA2dGFibGVzIC1GYCB0byBmbHVzaCBhbGwgZXhpc3RpbmcgYGlwdGFibGVzYCBydWxlcyBmcm9tIHRoZSBgZmlsdGVyYCB0YWJsZSBiZWZvcmUgc3RhcnRpbmcgdGhlIG9sZGVyIHZlcnNpb24gb2YgdGhlIGRhZW1vbi4gV2hlbiB0aGF0IGlzIG5vdCBwb3NzaWJsZSwgcnVuIHRoZSBmb2xsb3dpbmcgY29tbWFuZHMgYXMgcm9vdDoKICAgIC0gYGlwdGFibGVzIC1EIEZPUldBUkQgLW0gc2V0IC0tbWF0Y2gtc2V0IGRvY2tlci1leHQtYnJpZGdlcy12NCBkc3QgLW0gY29ubnRyYWNrIC0tY3RzdGF0ZSBSRUxBVEVELEVTVEFCTElTSEVEIC1qIEFDQ0VQVDsgaXA2dGFibGVzIC1EIEZPUldBUkQgLW0gc2V0IC0tbWF0Y2gtc2V0IGRvY2tlci1leHQtYnJpZGdlcy12NiBkc3QgLW0gY29ubnRyYWNrIC0tY3RzdGF0ZSBSRUxBVEVELEVTVEFCTElTSEVEIC1qIEFDQ0VQVGAKICAgIC0gYGlwdGFibGVzIC1EIEZPUldBUkQgLW0gc2V0IC0tbWF0Y2gtc2V0IGRvY2tlci1leHQtYnJpZGdlcy12NCBkc3QgLWogRE9DS0VSOyBpcDZ0YWJsZXMgLUQgRk9SV0FSRCAtbSBzZXQgLS1tYXRjaC1zZXQgZG9ja2VyLWV4dC1icmlkZ2VzLXY2IGRzdCAtaiBET0NLRVJgCiAgICAtIElmIHlvdSB3ZXJlIHByZXZpb3VzbHkgcnVubmluZyB3aXRoIHRoZSBpcHRhYmxlcyBmaWx0ZXItRk9SV0FSRCBwb2xpY3kgc2V0IHRvIGBBQ0NFUFRgIGFuZCBuZWVkIHRvIHJlc3RvcmUgYWNjZXNzIHRvIHVucHVibGlzaGVkIHBvcnRzLCBhbHNvIGRlbGV0ZSBwZXItYnJpZGdlLW5ldHdvcmsgcnVsZXMgZnJvbSB0aGUgYERPQ0tFUmAgY2hhaW5zLiBGb3IgZXhhbXBsZSwgYGlwdGFibGVzIC1EIERPQ0tFUiAhIC1pIGRvY2tlcjAgLW8gZG9ja2VyMCAtaiBEUk9QYC4KLSBGaXggYSBzZWN1cml0eSBpc3N1ZSB0aGF0IHdhcyBhbGxvd2luZyByZW1vdGUgaG9zdHMgdG8gY29ubmVjdCBkaXJlY3RseSB0byBhIGNvbnRhaW5lciBvbiBpdHMgcHVibGlzaGVkIHBvcnRzLiBbbW9ieS9tb2J5IzQ5MzI1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkzMjUpCi0gRml4IGEgc2VjdXJpdHkgaXNzdWUgdGhhdCB3YXMgYWxsb3dpbmcgbmVpZ2hib3IgaG9zdHMgdG8gY29ubmVjdCB0byBwb3J0cyBtYXBwZWQgb24gYSBsb29wYmFjayBhZGRyZXNzLiBbbW9ieS9tb2J5IzQ5MzI1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDkzMjUpCi0gRml4IGFuIGlzc3VlIHRoYXQgcHJldmVudGVkIHBvcnQgcHVibGlzaGluZyB0byBsaW5rLWxvY2FsIGFkZHJlc3Nlcy4gW21vYnkvbW9ieSM0ODU3MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4NTcwKQotIFVEUCBwb3J0cyBwdWJsaXNoZWQgYnkgYSBjb250YWluZXIgYXJlIG5vdyByZWxpYWJseSBhY2Nlc3NpYmxlIGJ5IGNvbnRhaW5lcnMgb24gb3RoZXIgbmV0d29ya3MsIHZpYSB0aGUgaG9zdCdzIHB1YmxpYyBJUCBhZGRyZXNzLiBbbW9ieS9tb2J5IzQ4NTcxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg1NzEpCi0gRG9ja2VyIHdpbGwgbm93IG9ubHkgc2V0IHRoZSBgaXA2dGFibGVzYCBwb2xpY3kgZm9yIHRoZSBgRk9SV0FSRGAgY2hhaW4gaW4gdGhlIGBmaWx0ZXJgIHRhYmxlIHRvIGBEUk9QYCBpZiBpdCBlbmFibGVzIElQIGZvcndhcmRpbmcgb24gdGhlIGhvc3QgaXRzZWxmIChzeXNjdGxzIGBuZXQuaXB2Ni5jb25mLmFsbC5mb3J3YXJkaW5nYCBhbmQgYG5ldC5pcHY2LmNvbmYuZGVmYXVsdC5mb3J3YXJkaW5nYCkuIFRoaXMgaXMgbm93IGFsaWduZWQgd2l0aCBleGlzdGluZyBJUHY0IGJlaGF2aW91ci4gW21vYnkvbW9ieSM0ODU5NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4NTk0KQogIC0gSWYgSVB2NiBmb3J3YXJkaW5nIGlzIGVuYWJsZWQgb24geW91ciBob3N0LCBidXQgeW91IHdlcmUgZGVwZW5kaW5nIG9uIERvY2tlciB0byBzZXQgdGhlIGlwNnRhYmxlcyBmaWx0ZXItRk9SV0FSRCBwb2xpY3kgdG8gYERST1BgLCB5b3UgbWF5IG5lZWQgdG8gdXBkYXRlIHlvdXIgaG9zdCdzIGNvbmZpZ3VyYXRpb24gdG8gbWFrZSBzdXJlIGl0IGlzIHNlY3VyZS4KLSBEaXJlY3Qgcm91dGVkIGFjY2VzcyB0byBjb250YWluZXIgcG9ydHMgdGhhdCBhcmUgbm90IGV4cG9zZWQgdXNpbmcgYHBgL2AtcHVibGlzaGAgaXMgbm93IGJsb2NrZWQgaW4gdGhlIGBET0NLRVJgIGlwdGFibGVzIGNoYWluLiBbbW9ieS9tb2J5IzQ4NzI0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg3MjQpCiAgLSBJZiB0aGUgZGVmYXVsdCBpcHRhYmxlcyBmaWx0ZXItRk9SV0FSRCBwb2xpY3kgd2FzIHByZXZpb3VzbHkgbGVmdCBhdCBgQUNDRVBUYCBvbiB5b3VyIGhvc3QsIGFuZCBkaXJlY3Qgcm91dGVkIGFjY2VzcyB0byBhIGNvbnRhaW5lcidzIHVucHVibGlzaGVkIHBvcnRzIGZyb20gYSByZW1vdGUgaG9zdCBpcyBzdGlsbCByZXF1aXJlZCwgb3B0aW9ucyBhcmU6CiAgICAtIFB1Ymxpc2ggdGhlIHBvcnRzIHlvdSBuZWVkLgogICAgLSBVc2UgdGhlIG5ldyBgZ2F0ZXdheV9tb2RlX2lwdls0Nl09bmF0LXVucHJvdGVjdGVkYCwgZGVzY3JpYmVkIGJlbG93LgogIC0gQ29udGFpbmVyIHBvcnRzIHB1Ymxpc2hlZCB0byBob3N0IGFkZHJlc3NlcyB3aWxsIGNvbnRpbnVlIHRvIGJlIGFjY2Vzc2libGUgdmlhIHRob3NlIGhvc3QgYWRkcmVzc2VzLCB1c2luZyBOQVQgb3IgdGhlIHVzZXJsYW5kIHByb3h5LgogIC0gVW5wdWJsaXNoZWQgY29udGFpbmVyIHBvcnRzIGNvbnRpbnVlIHRvIGJlIGRpcmVjdGx5IGFjY2Vzc2libGUgZnJvbSB0aGUgRG9ja2VyIGhvc3QgdmlhIHRoZSBjb250YWluZXIncyBJUCBhZGRyZXNzLgotIE5ldHdvcmtzIGNyZWF0ZWQgd2l0aCBgZ2F0ZXdheV9tb2RlX2lwdls0Nl09cm91dGVkYCBhcmUgbm93IGFjY2Vzc2libGUgZnJvbSBvdGhlciBicmlkZ2UgbmV0d29ya3MgcnVubmluZyBvbiB0aGUgc2FtZSBEb2NrZXIgaG9zdCwgYXMgd2VsbCBhcyBmcm9tIG91dHNpZGUgdGhlIGhvc3QuIFttb2J5L21vYnkjNDg1OTZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODU5NikKLSBCcmlkZ2UgZHJpdmVyIG9wdGlvbnMgYGNvbS5kb2NrZXIubmV0d29yay5icmlkZ2UuZ2F0ZXdheV9tb2RlX2lwdjRgIGFuZCBgY29tLmRvY2tlci5uZXR3b3JrLmJyaWRnZS5nYXRld2F5X21vZGVfaXB2NmAgbm93IGFjY2VwdCBtb2RlIGBuYXQtdW5wcm90ZWN0ZWRgLiBbbW9ieS9tb2J5IzQ4NTk3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg1OTcpCiAgLSBgbmF0LXVucHJvdGVjdGVkYCBpcyBzaW1pbGFyIHRvIHRoZSBkZWZhdWx0IGBuYXRgIG1vZGUsIGJ1dCBubyBwZXIgcG9ydC9wcm90b2NvbCBydWxlcyBhcmUgc2V0IHVwLiBUaGlzIG1lYW5zIGFueSBwb3J0IG9uIGEgY29udGFpbmVyIGNhbiBiZSBhY2Nlc3NlZCBieSBkaXJlY3Qtcm91dGluZyBmcm9tIGEgcmVtb3RlIGhvc3QuCi0gQnJpZGdlIGRyaXZlciBvcHRpb25zIGBjb20uZG9ja2VyLm5ldHdvcmsuYnJpZGdlLmdhdGV3YXlfbW9kZV9pcHY0YCBhbmQgYGNvbS5kb2NrZXIubmV0d29yay5icmlkZ2UuZ2F0ZXdheV9tb2RlX2lwdjZgIG5vdyBhY2NlcHQgbW9kZSBgaXNvbGF0ZWRgLCB3aGVuIHRoZSBuZXR3b3JrIGlzIGFsc28gYGludGVybmFsYC4gW21vYnkvbW9ieSM0OTI2Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5MjYyKQogIC0gQW4gYWRkcmVzcyBpcyBub3JtYWxseSBhc3NpZ25lZCB0byB0aGUgYnJpZGdlIGRldmljZSBpbiBhbiBgaW50ZXJuYWxgIG5ldHdvcmsuIFNvLCBwcm9jZXNzZXMgb24gdGhlIERvY2tlciBob3N0IGNhbiBhY2Nlc3MgdGhlIG5ldHdvcmssIGFuZCBjb250YWluZXJzIGluIHRoZSBuZXR3b3JrIGNhbiBhY2Nlc3MgaG9zdCBzZXJ2aWNlcyBsaXN0ZW5pbmcgb24gdGhhdCBicmlkZ2UgYWRkcmVzcyAoaW5jbHVkaW5nIHNlcnZpY2VzIGxpc3RlbmluZyBvbiAiYW55IiBob3N0IGFkZHJlc3MsIGAwLjAuMC4wYCBvciBgOjpgKS4KICAtIEFuIGBpbnRlcm5hbGAgYnJpZGdlIG5ldHdvcmsgY3JlYXRlZCB3aXRoIGdhdGV3YXkgbW9kZSBgaXNvbGF0ZWRgIGRvZXMgbm90IGhhdmUgYW4gYWRkcmVzcyBvbiB0aGUgRG9ja2VyIGhvc3QuCi0gV2hlbiBhIHBvcnQgbWFwcGluZyBpbmNsdWRlcyBhIGhvc3QgSVAgYWRkcmVzcyBvciBwb3J0IG51bWJlciB0aGF0IGNhbm5vdCBiZSB1c2VkIGJlY2F1c2UgTkFUIGZyb20gdGhlIGhvc3QgaXMgZGlzYWJsZWQgdXNpbmcgYC0tZ2F0ZXdheV9tb2RlX2lwdls0Nl1gLCBjb250YWluZXIgY3JlYXRpb24gd2lsbCBubyBsb25nZXIgZmFpbC4gVGhlIHVudXNlZCBmaWVsZHMgbWF5IGJlIG5lZWRlZCBpZiB0aGUgZ2F0ZXdheSBlbmRwb2ludCBjaGFuZ2VzIHdoZW4gbmV0d29ya3MgYXJlIGNvbm5lY3RlZCBvciBkaXNjb25uZWN0ZWQuIEEgbWVzc2FnZSBhYm91dCB0aGUgdW51c2VkIGZpZWxkcyB3aWxsIGJlIGxvZ2dlZC4gW21vYnkvbW9ieSM0ODU3NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4NTc1KQotIERvIG5vdCBjcmVhdGUgaXB0YWJsZXMgbmF0LVBPU1RST1VUSU5HIG1hc3F1ZXJhZGUgcnVsZXMgZm9yIGEgY29udGFpbmVyJ3Mgb3duIHB1Ymxpc2hlZCBwb3J0cywgd2hlbiB0aGUgdXNlcmxhbmQgcHJveHkgaXMgZW5hYmxlZC4gW21vYnkvbW9ieSM0ODg1NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4ODU0KQoKIyMjIyBJUHY2CgotIEFkZCBgZG9ja2VyIG5ldHdvcmsgY3JlYXRlYCBvcHRpb24gYC0taXB2NGAuIFRvIGRpc2FibGUgSVB2NCBhZGRyZXNzIGFzc2lnbm1lbnQgZm9yIGEgbmV0d29yaywgdXNlIGBkb2NrZXIgbmV0d29yayBjcmVhdGUgLS1pcHY0PWZhbHNlIFsuLi5dYC4gW2RvY2tlci9jbGkjNTU5OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RvY2tlci9jbGkvcHVsbC81NTk5KQotIERhZW1vbiBvcHRpb24gYC0taXB2NmAgKGAiaXB2NiI6IHRydWVgIGluIGBkYWVtb24uanNvbmApIGNhbiBub3cgYmUgdXNlZCB3aXRob3V0IGBmaXhlZC1jaWRyLXY2YC4gW21vYnkvbW9ieSM0ODMxOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ4MzE5KQotIElQQU0gbm93IGhhbmRsZXMgc3VibmV0cyBiaWdnZXIgdGhhbiAiLzY0Ii4gW21vYnkvbW9ieSM0OTIyM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5MjIzKQotIER1cGxpY2F0ZSBhZGRyZXNzIGRldGVjdGlvbiAoREFEKSBpcyBub3cgZGlzYWJsZWQgZm9yIGFkZHJlc3NlcyBhc3NpZ25lZCB0byB0aGUgYnJpZGdlcyBiZWxvbmdpbmcgdG8gYnJpZGdlIG5ldHdvcmtzLiBbbW9ieS9tb2J5IzQ4NjA5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg2MDkpCi0gTW9kaWZpY2F0aW9ucyB0byBgaG9zdC1nYXRld2F5YCwgZm9yIGNvbXBhdGliaWxpdHkgd2l0aCBJUHY2LW9ubHkgbmV0d29ya3MuIFttb2J5L21vYnkjNDg4MDddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tb2J5L21vYnkvcHVsbC80ODgwNykKICAtIFdoZW4gc3BlY2lhbCB2YWx1ZSBgaG9zdC1nYXRld2F5YCBpcyB1c2VkIGluIGFuIGAtLWFkZC1ob3N0YCBvcHRpb24gaW4gcGxhY2Ugb2YgYW4gYWRkcmVzcywgaXQncyByZXBsYWNlZCBieSBhbiBhZGRyZXNzIG9uIHRoZSBEb2NrZXIgaG9zdCB0byBtYWtlIGl0IHBvc3NpYmxlIHRvIHJlZmVyIHRvIHRoZSBob3N0IGJ5IG5hbWUuIFRoZSBhZGRyZXNzIHVzZWQgYmVsb25ncyB0byB0aGUgZGVmYXVsdCBicmlkZ2UgKG5vcm1hbGx5IGBkb2NrZXIwYCkuIFVudGlsIG5vdyBpdCdzIGFsd2F5cyBiZWVuIGFuIElQdjQgYWRkcmVzcywgYmVjYXVzZSBhbGwgY29udGFpbmVycyBvbiBicmlkZ2UgbmV0d29ya3MgaGFkIElQdjQgYWRkcmVzc2VzLgogIC0gTm93LCBpZiBJUHY2IGlzIGVuYWJsZWQgb24gdGhlIGRlZmF1bHQgYnJpZGdlIG5ldHdvcmssIGAvZXRjL2hvc3RzYCBlbnRyaWVzIHdpbGwgYmUgY3JlYXRlZCBmb3IgSVB2NCBhbmQgSVB2NiBhZGRyZXNzZXMuIFNvLCBhIGNvbnRhaW5lciB0aGF0J3Mgb25seSBjb25uZWN0ZWQgdG8gSVB2Ni1vbmx5IG5ldHdvcmtzIGNhbiBhY2Nlc3MgdGhlIGhvc3QgYnkgbmFtZS4KICAtIFRoZSBgLS1ob3N0LWdhdGV3YXktaXBgIG9wdGlvbiBvdmVycmlkZXMgdGhlIGFkZHJlc3MgdXNlZCB0byByZXBsYWNlIGBob3N0LWdhdGV3YXlgLiBUd28gb2YgdGhlc2Ugb3B0aW9ucyBhcmUgbm93IGFsbG93ZWQgb24gdGhlIGNvbW1hbmQgbGluZSwgZm9yIG9uZSBJUHY0IGdhdGV3YXkgYW5kIG9uZSBJUHY2LgogIC0gSW4gdGhlIGBkYWVtb24uanNvbmAgZmlsZSwgdG8gcHJvdmlkZSB0d28gYWRkcmVzc2VzLCB1c2UgYCJob3N0LWdhdGV3YXktaXBzImAuIEZvciBleGFtcGxlLCBgImhvc3QtZ2F0ZXdheS1pcHMiOiBbIjE5Mi4wLjIuMSIsICIyMDAxOmRiODo6MTExMSJdYC4KCiMjIyMgQnVnIGZpeGVzIGFuZCBlbmhhbmNlbWVudHMKCi0gQWRkIElQdjYgbG9vcGJhY2sgYWRkcmVzcyBhcyBhbiBpbnNlY3VyZSByZWdpc3RyeSBieSBkZWZhdWx0LiBbbW9ieS9tb2J5IzQ4NTQwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbW9ieS9tb2J5L3B1bGwvNDg1NDApCi0gQWRkIHN1cHBvcnQgZm9yIENvYnJhLWdlbmVyYXRlZCBjb21wbGV0aW9uIHNjcmlwdHMgZm9yIGBkb2NrZXJkYC4gW21vYnkvbW9ieSM0OTMzOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL21vYnkvbW9ieS9wdWxsLzQ5MzM5KQotIEZpeCBETlMgcXVlcmllcyBmYWlsaW5nIHdoZW4gY29udGFpbmVycyBhcmUgbGF1bmNoZWQgdmlhIGBzeXN0ZW1kYCBhdXRvLXN0YXJ0IG9uIGJvb3QgW21vYnkvbW9ieSM0ODgxMl0oaHR0Cgo8L2RldGFpbHM+CgotLS0KCiMjIyBDb25maWd1cmF0aW9uCgrwn5OFICoqU2NoZWR1bGUqKjogQnJhbmNoIGNyZWF0aW9uIC0gQXQgYW55IHRpbWUgKG5vIHNjaGVkdWxlIGRlZmluZWQpLCBBdXRvbWVyZ2UgLSBBdCBhbnkgdGltZSAobm8gc2NoZWR1bGUgZGVmaW5lZCkuCgrwn5qmICoqQXV0b21lcmdlKio6IERpc2FibGVkIGJ5IGNvbmZpZy4gUGxlYXNlIG1lcmdlIHRoaXMgbWFudWFsbHkgb25jZSB5b3UgYXJlIHNhdGlzZmllZC4KCuKZuyAqKlJlYmFzaW5nKio6IFdoZW5ldmVyIFBSIGJlY29tZXMgY29uZmxpY3RlZCwgb3IgeW91IHRpY2sgdGhlIHJlYmFzZS9yZXRyeSBjaGVja2JveC4KCvCflJUgKipJZ25vcmUqKjogQ2xvc2UgdGhpcyBQUiBhbmQgeW91IHdvbid0IGJlIHJlbWluZGVkIGFib3V0IHRoaXMgdXBkYXRlIGFnYWluLgoKLS0tCgogLSBbIF0gPCEtLSByZWJhc2UtY2hlY2sgLS0+SWYgeW91IHdhbnQgdG8gcmViYXNlL3JldHJ5IHRoaXMgUFIsIGNoZWNrIHRoaXMgYm94CgotLS0KClRoaXMgUFIgd2FzIGdlbmVyYXRlZCBieSBbTWVuZCBSZW5vdmF0ZV0oaHR0cHM6Ly9tZW5kLmlvL3Jlbm92YXRlLykuIFZpZXcgdGhlIFtyZXBvc2l0b3J5IGpvYiBsb2ddKGh0dHBzOi8vZGV2ZWxvcGVyLm1lbmQuaW8vZ2l0aHViL29zaXNtL2NpLWltYWdlKS4KPCEtLXJlbm92YXRlLWRlYnVnOmV5SmpjbVZoZEdWa1NXNVdaWElpT2lJek9TNHhOek11TVNJc0luVndaR0YwWldSSmJsWmxjaUk2SWpRd0xqWXlMakVpTENKMFlYSm5aWFJDY21GdVkyZ2lPaUp0WVdsdUlpd2liR0ZpWld4eklqcGJJbkpsYm05MllYUmxJbDE5LS0+Cg==
      patchset: 5782a1d08cb7c618372f9c0486e17f9ea793d5c1
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: caa0df55ed55158f32903d317317ac95db4da6ce
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 397240f42127868e42e86e6aeb120c2cb092d117
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 95400903ba18e86e546004cbff0716a23812e65c
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: caa0df55ed55158f32903d317317ac95db4da6ce
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 397240f42127868e42e86e6aeb120c2cb092d117
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/ansible-lint/run.yaml
          roles:
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_0/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_0/zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/ci-image
        name: osism/ci-image
        short_name: ci-image
        src_dir: src/github.com/osism/ci-image
      projects:
        github.com/osism/ci-image:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ci-image
          checkout: main
          checkout_description: zuul branch
          commit: 2dee40581f12cef390fe8f159fc29d206da788f9
          name: osism/ci-image
          required: false
          short_name: ci-image
          src_dir: src/github.com/osism/ci-image
      ref: refs/pull/57/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
