From c6f9e4fdcec29d5cfd14ec880ab9ad3b0ecb2856 Mon Sep 17 00:00:00 2001
From: Zoltan Csizmadia <zcsizmadia@gmail.com>
Date: Fri, 16 Oct 2026 12:16:16 -0500
Subject: [PATCH] deps: docker CLI 29.9.1, Go 1.26.9 for the arm64 build

amd64 checksum computed from Docker's zip; arm64 is a placeholder until dockercli-v29.9.1 is built from main.
---
 CHANGELOG.md                        |  4 ++++
 internal/dockercli/manifest.json    | 10 +++++-----
 third_party/docker-cli/versions.env |  8 ++++----
 3 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1f10d74..e24780b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -62,6 +62,10 @@ useful than saying where the real one is.
   `skrog install` and `skrog target create`. Behaviour is unchanged.
 - The verified rootfs download is cached in the base state directory when installing a
   named engine, so a second engine does not download it again.
+- **The bundled docker CLI is 29.9.1**, from 29.8.2. amd64 is Docker's own zip, checksum
+  computed from the official download as before; the arm64 `docker.exe` is built from
+  docker/cli at commit `dfc520d`, pinned, with Go 1.26.9 to match the engine. Compose,
+  buildx and the credential helper are unchanged. The engine is still 29.9.0.
 
 ## [0.10.0] — 2026-10-12
 
diff --git a/internal/dockercli/manifest.json b/internal/dockercli/manifest.json
index ea8dd07..c57e4d9 100644
--- a/internal/dockercli/manifest.json
+++ b/internal/dockercli/manifest.json
@@ -39,20 +39,20 @@
   "components": [
     {
       "name": "docker",
-      "version": "29.8.2",
+      "version": "29.9.1",
       "role": "cli",
       "target": "docker.exe",
       "license": "Apache-2.0",
       "licenseURL": "https://raw.githubusercontent.com/docker/cli/master/LICENSE",
       "arch": {
         "amd64": {
-          "url": "https://download.docker.com/win/static/stable/x86_64/docker-29.8.2.zip",
-          "sha256": "e8a956a1f117764dd79f6b1964eca0bb451088fe2db5ecce93ed0e01e5d814b3",
+          "url": "https://download.docker.com/win/static/stable/x86_64/docker-29.9.1.zip",
+          "sha256": "5d9b66509390553fd97d590ec2ff0ce10b04c2ac653fa52f2abf2f05c4c197ca",
           "zipEntry": "docker/docker.exe"
         },
         "arm64": {
-          "url": "https://github.com/wslkit/skrog/releases/download/dockercli-v29.8.2/docker-29.8.2-windows-arm64.exe",
-          "sha256": "797ce56c8e76f00f57c3d74b443b175b5cb8a67443634050bd1edf9abd3a675a"
+          "url": "",
+          "sha256": ""
         }
       }
     },
diff --git a/third_party/docker-cli/versions.env b/third_party/docker-cli/versions.env
index bf13d13..17a8ed4 100644
--- a/third_party/docker-cli/versions.env
+++ b/third_party/docker-cli/versions.env
@@ -14,8 +14,8 @@
 # internal/dockercli/manifest.json -- the same binary is installed on both
 # architectures and reporting two different versions would be a support
 # nightmare. A test pins the two together.
-DOCKER_CLI_VERSION=29.8.2
-DOCKER_CLI_TAG=v29.8.2
+DOCKER_CLI_VERSION=29.9.1
+DOCKER_CLI_TAG=v29.9.1
 
 # The commit the tag must resolve to (#88). A git tag can be moved and a
 # source repository compromised, and the result is the binary every docker
@@ -23,9 +23,9 @@ DOCKER_CLI_TAG=v29.8.2
 #
 # This is the tag's dereferenced commit (refs/tags/<tag>^{}), not the tag
 # object's own hash.
-DOCKER_CLI_SHA=7fc2dff9bceb96b266a3b2c3117c0955a0d9e616
+DOCKER_CLI_SHA=dfc520dcc28994c4c699b9b219fd2f5a6bcec0ff
 
 # Toolchain. Bumping this changes the output, so it is pinned like everything
 # else. Kept in step with guest/rootfs/versions.env so the engine and the CLI
 # are built by the same compiler.
-GO_VERSION=1.26.8
+GO_VERSION=1.26.9