engine: 28.5.2

_vendor/modules.txt

@@ -1,7 +1,7 @@
-# github.com/moby/moby v28.5.1+incompatible
+# github.com/moby/moby v28.5.2+incompatible
 # github.com/moby/buildkit v0.25.1
 # github.com/docker/buildx v0.29.1
-# github.com/docker/cli v28.5.1+incompatible
+# github.com/docker/cli v28.5.2+incompatible
 # github.com/docker/compose/v2 v2.40.3
 # github.com/docker/model-runner/cmd/cli v0.1.44
 # github.com/docker/mcp-gateway v0.22.0

content/manuals/engine/release-notes/28.md

@@ -27,6 +27,40 @@ For more information about:
 - Deprecated and removed features, see [Deprecated Engine Features](../deprecated.md).
 - Changes to the Engine API, see [Engine API version history](/reference/api/engine/version-history.md).
 
+## 28.5.2
+
+{{< release-date date="2025-11-05" >}}
+
+For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
+
+- [docker/cli, 28.5.2 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.5.2)
+- [moby/moby, 28.5.2 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.5.2)
+
+> [!CAUTION]
+> This release contains fixes for three high-severity security vulnerabilities in runc:
+> - [CVE-2025-31133](https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2)
+> - [CVE-2025-52565](https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r)
+> - [CVE-2025-52881](https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm)
+> 
+> All three vulnerabilities ultimately allow (through different methods) for full container breakouts by bypassing runc's restrictions for writing to arbitrary `/proc` files.
+
+### Bug fixes and enhancements
+
+- dockerd-rootless.sh: if slirp4netns is not installed, try using pasta (passt). [moby/moby#51162](https://github.com/moby/moby/pull/51162)
+
+### Packaging updates
+
+- Update BuildKit to [v0.25.2](https://github.com/moby/buildkit/releases/tag/v0.25.2). [moby/moby#51398](https://github.com/moby/moby/pull/51398)
+- Update Go runtime to [1.24.9](https://go.dev/doc/devel/release#go1.24.9). [moby/moby#51387](https://github.com/moby/moby/pull/51387), [docker/cli#6613](https://github.com/docker/cli/pull/6613)
+- Update runc to [v1.3.3](https://github.com/opencontainers/runc/releases/tag/v1.3.3). [moby/moby#51394](https://github.com/moby/moby/pull/51394)
+
+### Deprecations
+
+- Go-SDK: cli/command/image/build: deprecate `DefaultDockerfileName`, `DetectArchiveReader`, `WriteTempDockerfile`, `ResolveAndValidateContextPath`. These utilities were only used internally and will be removed in the next release. [docker/cli#6610](https://github.com/docker/cli/pull/6610)
+- Go-SDK: cli/command/image/build: deprecate IsArchive utility. [docker/cli#6560](https://github.com/docker/cli/pull/6560)
+- Go-SDK: opts: deprecate `ValidateMACAddress`. [docker/cli#6560](https://github.com/docker/cli/pull/6560)
+- Go-SDK: opts: deprecate ListOpts.Delete(). [docker/cli#6560](https://github.com/docker/cli/pull/6560)
+
 ## 28.5.1
 
 {{< release-date date="2025-10-08" >}}

content/reference/api/engine/_index.md

@@ -73,21 +73,21 @@ To see the highest version of the API your Docker daemon and client support, use
 ```console
 $ docker version
 Client: Docker Engine - Community
- Version:           28.5.1
+ Version:           28.5.2
  API version:       1.51
- Go version:        go1.24.8
- Git commit:        e180ab8
- Built:             Wed Oct  8 12:18:19 2025
+ Go version:        go1.25.3
+ Git commit:        ecc6942
+ Built:             Wed Nov  5 14:44:01 2025
  OS/Arch:           linux/arm64
  Context:           default
 
 Server: Docker Engine - Community
  Engine:
-  Version:          28.5.1
+  Version:          28.5.2
   API version:      1.51 (minimum version 1.24)
-  Go version:       go1.24.8
-  Git commit:       f8215cc
-  Built:            Wed Oct  8 12:18:19 2025
+  Go version:       go1.25.3
+  Git commit:       89c5e8f
+  Built:            Wed Nov  5 14:44:01 2025
   OS/Arch:          linux/arm64
   ...
 ```

go.mod

@@ -4,22 +4,22 @@ go 1.24.9
 
 require (
 	github.com/docker/buildx v0.29.1 // indirect
-	github.com/docker/cli v28.5.1+incompatible // indirect; see "replace" rule at the bottom for actual version
+	github.com/docker/cli v28.5.2+incompatible // indirect; see "replace" rule at the bottom for actual version
 	github.com/docker/compose/v2 v2.40.3 // indirect
 	github.com/docker/mcp-gateway v0.22.0 // indirect
 	github.com/docker/model-runner/cmd/cli v0.1.44 // indirect
 	github.com/docker/scout-cli v1.18.4 // indirect
 	github.com/moby/buildkit v0.25.1 // indirect
-	github.com/moby/moby v28.5.1+incompatible // indirect; see "replace" rule at the bottom for actual version
+	github.com/moby/moby v28.5.2+incompatible // indirect; see "replace" rule at the bottom for actual version
 )
 
 replace (
 	github.com/docker/buildx => github.com/docker/buildx v0.29.1
-	github.com/docker/cli => github.com/docker/cli v28.5.1+incompatible
+	github.com/docker/cli => github.com/docker/cli v28.5.2+incompatible
 	github.com/docker/compose/v2 => github.com/docker/compose/v2 v2.40.3
 	github.com/docker/mcp-gateway => github.com/docker/mcp-gateway v0.22.0
 	github.com/docker/model-runner/cmd/cli => github.com/docker/model-runner/cmd/cli v0.1.44
 	github.com/docker/scout-cli => github.com/docker/scout-cli v1.18.4
 	github.com/moby/buildkit => github.com/moby/buildkit v0.25.1
-	github.com/moby/moby => github.com/moby/moby v28.5.1+incompatible
+	github.com/moby/moby => github.com/moby/moby v28.5.2+incompatible
 )

go.sum

@@ -2,6 +2,8 @@ github.com/docker/buildx v0.29.1 h1:58hxM5Z4mnNje3G5NKfULT9xCr8ooM8XFtlfUK9bKaA=
 github.com/docker/buildx v0.29.1/go.mod h1:J4EFv6oxlPiV1MjO0VyJx2u5tLM7ImDEl9zyB8d4wPI=
 github.com/docker/cli v28.5.1+incompatible h1:ESutzBALAD6qyCLqbQSEf1a/U8Ybms5agw59yGVc+yY=
 github.com/docker/cli v28.5.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v28.5.2+incompatible h1:XmG99IHcBmIAoC1PPg9eLBZPlTrNUAijsHLm8PjhBlg=
+github.com/docker/cli v28.5.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/compose/v2 v2.40.3 h1:XeYkQu1svDtyfZPv5nTwFryQ25ZJMkIlc4pz9HalMPI=
 github.com/docker/compose/v2 v2.40.3/go.mod h1:iNY1tvoHTyN3C3QHCuWAgj3OjR2T6mGkk/qxfbBF/4M=
 github.com/docker/mcp-gateway v0.22.0 h1:l4t+HRNHxR7Jn545KDeXaeiEEhkCDBeWMTyuCaXVH7A=
@@ -14,3 +16,5 @@ github.com/moby/buildkit v0.25.1 h1:j7IlVkeNbEo+ZLoxdudYCHpmTsbwKvhgc/6UJ/mY/o8=
 github.com/moby/buildkit v0.25.1/go.mod h1:phM8sdqnvgK2y1dPDnbwI6veUCXHOZ6KFSl6E164tkc=
 github.com/moby/moby v28.5.1+incompatible h1:JD8lBdCDBF2oiHWLqIRofPqI8qvkppRjMJ6EnwrhvX0=
 github.com/moby/moby v28.5.1+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
+github.com/moby/moby v28.5.2+incompatible h1:hIn6qcenb3JY1E3STwqEbBvJ8bha+u1LpqjX4CBvNCk=
+github.com/moby/moby v28.5.2+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=

hugo.yaml

@@ -135,10 +135,10 @@ params:
   # Latest version of the Docker Engine API
   latest_engine_api_version: "1.51"
   # Latest version of Docker Engine
-  docker_ce_version: "28.5.1"
+  docker_ce_version: "28.5.2"
   # Previous version of the Docker Engine
   # (Used to show e.g., "latest" and "latest"-1 in engine install examples
-  docker_ce_version_prev: "28.5.0"
+  docker_ce_version_prev: "28.5.1"
   # Latest Docker Compose version
   compose_version: "v2.40.3"
   # Latest BuildKit version