chore(deps): updated module github.com/moby/buildkit from v0.26.3 to v0.31.1 [security]

[paketo-bot]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
github.com/moby/buildkit	require	minor	v0.26.3 → v0.31.1

---

BuildKit's Malicious frontend can cause file escape outside of storage root

CVE-2026-33747 / GHSA-4c29-8rgm-jvjj

More information

Details

Impact

When using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context.

Patches

The issue has been fixed in v0.28.1+

Workarounds

Issue requires using an untrusted BuildKit frontend set with #syntax or --build-arg BUILDKIT_SYNTAX. Using these options with a well-known frontend image like docker/dockerfile is not affected.

Severity

• CVSS Score: 8.4 / 10 (High)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj
• https://github.com/moby/buildkit/releases/tag/v0.28.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-33747
• https://github.com/advisories/GHSA-4c29-8rgm-jvjj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

BuildKit Git URL subdir component can cause access to restricted files

CVE-2026-33748 / GHSA-4vrq-3vrq-g6gg

More information

Details

Impact

Insufficient validation of Git URL fragment subdir components (<url>#<ref>:<subdir>, docs) may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem.

Patches

The issue has been fixed in version v0.28.1

Workarounds

The issue affects only builds that use Git URLs with a subpath component. Avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg
• https://docs.docker.com/build/concepts/context/#url-fragments
• https://github.com/moby/buildkit/releases/tag/v0.28.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-33748
• https://github.com/advisories/GHSA-4vrq-3vrq-g6gg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

BuildKit: Custom frontend could bypass Seccomp/AppArmor

CVE-2026-61711 / GHSA-7236-3392-c5c6

More information

Details

Impact

A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers.

Patches

Problem has been fixed in versions v0.31.1+

Workarounds

Only use BuildKit frontends from trusted providers.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6
• https://github.com/advisories/GHSA-7236-3392-c5c6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

BuildKit has a possible runtime DoS via unbounded group parsing

CVE-2026-61712 / GHSA-72x6-4j93-7w86

More information

Details

Impact

Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the buildkitd process.

Patches

Issue is fixed in BuildKit v0.31.1+

Workarounds

Use trusted build sources.

References

This is BuildKit variant of containerd advisory GHSA-jpcc-p29g-p8mq

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86
• https://github.com/moby/buildkit/commit/408266e4ba254cecabedaacdad6905de4d2a75a1
• https://github.com/moby/buildkit/commit/69a3924648e485acb3faad3081e03a8554431255
• https://github.com/moby/buildkit/releases/tag/v0.31.1
• https://github.com/advisories/GHSA-72x6-4j93-7w86

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

moby/buildkit (github.com/moby/buildkit)

v0.31.1

Compare Source

buildkit 0.31.1

Welcome to the v0.31.1 release of buildkit!

This is a security patch release with two low severity security fixes.

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi

Notable Changes

• Custom frontend could bypass Seccomp/AppArmor restrictions GHSA-7236-3392-c5c6
• Possible runtime DoS via unbounded group parsing GHSA-72x6-4j93-7w86

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.31.0

v0.31.0

Compare Source

buildkit 0.31.0

Welcome to the v0.31.0 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Sebastiaan van Stijn
• Bjorn Neergaard
• Jonathan A. Sternberg
• Akihiro Suda
• Bryce Gibson
• Ava Barron
• Brian Goff
• Jiří Moravčík
• ZRHann
• Kevin NZUGUEM
• Maya Chen
• Natnael Gebremariam
• Sai Kiran Maggidi
• okhowang(王沛文)

Notable Changes

• Built-in Dockerfile frontend has been updated to v1.25.0 changelog
• Exec steps now support a network proxy feature where all container traffic will be routed through an HTTP proxy server. This allows capturing the network traffic for inspection in build progress and provenance attestation. Source policies can define the requests that build containers are allowed to make and the ones that should be blocked. Network proxy can be enabled for the whole BuildKit daemon or enabled on a per-build basis. #​6858 #​6816 #​6740 #​6863
• The local exporter now supports a mode=delete attribute which will replace the destination directory with the contents of the build result instead of merging it. Similar to the --delete flag in rsync. #​6561 #​6864
• LLB APIs now support per-step resource limits for CPU and memory. #​6569
• LLB APIs support a new Passthrough operation that allows defining dependency build graph branches that are required to be built but do not add any outputs to the final result. The state.Requires() client helper can be used to define such dependencies in the build graph. #​6829
• All image results now default to using OCI media types. Previously this was applied based on whether annotations or attestations were needed. oci-mediatypes=false can be used for legacy Docker media types. This change raises the compatibility version of BuildKit v0.31.0 to 30. #​6824
• Local cache exporter now supports the reset option to clear the unreferenced existing cache. #​6612
• The local build result outputs now use a new implementation with better security guarantees in case the destination directory is mutated externally during the transfer. #​6561
• New build metrics about build counts and durations have been added to the OTEL provider. #​6736
• Parallel request limits for registry connections can now be set via configuration file. #​6776
• In special modes where the client does not expose the session connection to transfer credentials, builds can now still fall back to anonymous registry auth instead of erroring. #​6760
• Embedded binfmt emulators in the release image have been updated to QEMU v10.2.3. #​6846
• Runc container runtime has been updated to v1.3.6
• Created attestations now use in-toto v1 statement format. #​6823
• Due to the upgraded CLI library, the internal buildctl completion scripts flag --generate-bash-completion is no longer supported and has been replaced with --generate-shell-completion. #​6848
• Fix an issue in default GC policy rules where the first rule for prioritizing releasing cache mounts and local sources did not apply. #​6856
• Fix an issue where parent directories could be created with incorrect permissions due to system umask when using BuildKit embedded in Dockerd. #​6828
• Fix possible segfault from race condition when HTTP server returned 401 error. #​6791
• Fix source policy exact match rules losing the destination value during conversion. #​6861
• Fix potential deadlock race conditions on stdin close. #​6810 #​6815
• Fix premature ref release possibly causing "snapshot does not exist" error. #​6821
• Fix OTLP shutdown stalling buildctl and buildkitd when the trace collector is unreachable. #​6757
• Fix possible reference counting issues. #​6820
• Fix possible hang in local progress writer. #​6811
• Fix a data race when reading worker platform information. #​6867
• Fix possible early release in case of cache computation error. #​6818
• Improve stability of how runc kills build container processes. #​6779

Dependency Changes

• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 -> v1.21.1
• github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 -> v1.12.0
• github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 -> v1.7.0
• github.com/aws/aws-sdk-go-v2 v1.41.7 -> v1.42.0
• github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 -> v1.7.13
• github.com/aws/aws-sdk-go-v2/config v1.32.17 -> v1.32.24
• github.com/aws/aws-sdk-go-v2/credentials v1.19.16 -> v1.19.23
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 -> v1.18.29
• github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.2.9 new
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 -> v1.4.29
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 -> v2.7.29
• github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 -> v1.4.30
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 -> v1.13.12
• github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.12 -> v1.9.22
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 -> v1.13.29
• github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.20 -> v1.19.29
• github.com/aws/aws-sdk-go-v2/service/s3 v1.89.1 -> v1.103.3
• github.com/aws/aws-sdk-go-v2/service/signin v1.0.11 -> v1.1.5
• github.com/aws/aws-sdk-go-v2/service/sso v1.30.17 -> v1.31.3
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 -> v1.36.6
• github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 -> v1.43.3
• github.com/aws/smithy-go v1.25.1 -> v1.27.2
• github.com/containerd/containerd/v2 v2.2.3 -> v2.2.4
• github.com/containerd/continuity v0.4.5 -> v0.5.0
• github.com/containerd/nydus-snapshotter v0.15.13 -> v0.15.15
• github.com/containerd/platforms v1.0.0-rc.2 -> v1.0.0-rc.4
• github.com/containerd/typeurl/v2 v2.2.3 -> v2.3.0
• github.com/docker/cli v29.4.3 -> v29.5.3
• github.com/docker/docker-credential-helpers v0.9.5 -> v0.9.8
• github.com/go-openapi/analysis v0.24.3 -> v0.25.2
• github.com/go-openapi/jsonpointer v0.22.5 -> v0.23.1
• github.com/go-openapi/jsonreference v0.21.5 -> v0.21.6
• github.com/go-openapi/runtime v0.29.3 -> v0.32.3
• github.com/go-openapi/runtime/server-middleware v0.30.0 new
• github.com/go-openapi/spec v0.22.4 -> v0.22.5
• github.com/go-openapi/strfmt v0.26.1 -> v0.26.3
• github.com/go-openapi/swag v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/cmdutils v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/conv v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/fileutils v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/jsonname v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/jsonutils v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/loading v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/mangling v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/netutils v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/stringutils v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/typeutils v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/yamlutils v0.25.5 -> v0.26.0
• github.com/go-openapi/validate v0.25.2 -> v0.25.3
• github.com/golang-jwt/jwt/v5 v5.3.0 -> v5.3.1
• github.com/google/certificate-transparency-go v1.3.2 -> v1.3.3
• github.com/google/go-containerregistry v0.20.7 -> v0.21.6
• github.com/google/pprof f64d9cf -> 545e8a4
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 -> v2.29.0
• github.com/in-toto/attestation v1.1.2 -> v1.2.0
• github.com/moby/policy-helpers a39d601 -> d5411a9
• github.com/moby/sys/mount v0.3.4 -> fc52b72
• github.com/moby/sys/sequential v0.6.0 -> v0.7.0
• github.com/opencontainers/selinux v1.13.1 -> v1.15.1
• github.com/pelletier/go-toml/v2 v2.2.4 -> v2.3.1
• github.com/prometheus/common v0.66.1 -> v0.67.5
• github.com/prometheus/otlptranslator v0.0.2 -> v1.0.0
• github.com/prometheus/procfs v0.17.0 -> v0.20.1
• github.com/secure-systems-lab/go-securesystemslib v0.10.0 -> v0.11.0
• github.com/sigstore/protobuf-specs v0.5.0 -> v0.5.1
• github.com/sigstore/rekor v1.5.0 -> v1.5.2
• github.com/sigstore/rekor-tiles/v2 v2.0.1 -> 5d098a2
• github.com/sigstore/sigstore v1.10.5 -> v1.10.8
• github.com/sigstore/sigstore-go v1.1.4 -> v1.2.1
• github.com/sigstore/timestamp-authority/v2 v2.0.6 -> v2.1.2
• github.com/theupdateframework/go-tuf/v2 v2.4.1 -> v2.4.2
• github.com/tonistiigi/fsutil a2aa163 -> 0257b33
• github.com/transparency-dev/formats 404c0d5 -> v0.1.1
• github.com/urfave/cli/v3 v3.9.0 new
• github.com/vbatts/tar-split v0.12.2 -> v0.12.3
• github.com/youmark/pkcs8 a2c0da2 new
• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 -> v0.69.0
• go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.68.0 -> v0.69.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 -> v0.69.0
• go.opentelemetry.io/otel v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/exporters/prometheus v0.60.0 -> v0.65.0
• go.opentelemetry.io/otel/metric v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/sdk v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/sdk/metric v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/trace v1.43.0 -> v1.44.0
• go.yaml.in/yaml/v2 v2.4.3 -> v2.4.4
• golang.org/x/exp df92998 -> 055de63
• google.golang.org/genproto/googleapis/api 6f92a3b -> 3dc84a4
• google.golang.org/genproto/googleapis/rpc 6f92a3b -> 3dc84a4
• google.golang.org/grpc v1.80.0 -> v1.81.1
• google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 -> v1.6.1
• k8s.io/klog/v2 v2.140.0 new

Previous release can be found at v0.30.0

v0.30.0

Compare Source

Welcome to the v0.30.0 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Sebastiaan van Stijn
• Jonathan A. Sternberg
• Natnael Gebremariam
• Akihiro Suda
• Dawei Wei
• Dmitrii Kostyrev
• Jiří Moravčík
• Vladimir Kuznichenkov

Notable Changes

• Builtin Dockerfile frontend has been updated to v1.24.0 changelog
• BuildKit now supports the concept of "compatibility version" for improved reproducible builds support across different BuildKit versions. This allows users to specify a version for which the build should be compatible with, and BuildKit will attempt to maintain compatibility with that version when possible. Compatibility version will be stored in the provenance attestation of the build and can be used to independently verify the artifacts of the build on other BuildKit versions. The current compatibility version and backward compatibility with old versions are defined in Build reproducibility docs #​6681
• Git sources now support fetch-by-commit option where commit is fetched by the SHA and then associated with the reference. This is useful when checking out mutable references refs/NR/merge where the commit SHA may change during invocation and cause checksum mismatch error #​6708
• The LLB API now supports Git bundle format. Git bundles can be loaded from registry or OCI layout blobs and Git sources can be checked out into bundle format for snapshotting #​6711
• Provenance attestations for multi-pass or chained builds now include request details for root requests and individual input requests, allowing full reconstruction of such complex builds #​6739
• The version of the built-in Dockerfile frontend that was used is now included in the provenance metadata and reported via worker info APIs. #​6705
• Improve error reporting for registry errors on cache export #​6762
• S3 cache now supports additional options retry_mode and retry_max_attempts to configure retry behavior of S3 client #​6657
• S3 cache now supports disable_accept_encoding option for GCS interoperability #​6642
• Reduce potential lock contention in gateway forwarder for improved performance on parallel builds #​6741
• A new log level option has been added to the buildkitd TOML configuration; previous "debug" and "trace" options have been deprecated #​6732
• Allow gateway frontend requests to forward to the built-in Dockerfile frontend the same way as to external frontends #​6643
• Session connection health checks have been improved to better detect loss of connectivity and avoid stuck builds #​6649
• Fix issue with Git subdirectory value not being included in ConfigSource section of SLSA provenance for builds from Git sources #​6724
• Avoid potential deadlock if the credential helper in the client is misbehaving and never returns credentials #​6709
• Fix possible data race in provenance computation on parallel builds #​6758
• Fix possible provenance capture race in concurrent no-cache builds that could leave source pins empty and fail with an invalid checksum digest error #​6764
• Fix possible data race in progress writer #​6679
• Fix data race in S3 cache reader #​6675
• Fix possible Git config lookup errors on Windows #​6639
• Fix build cancellation not working properly when blocked on credential callback #​6641

Dependency Changes

• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 -> v1.21.0
• github.com/Microsoft/hcsshim v0.14.0-rc.1 -> v0.14.1
• github.com/aws/aws-sdk-go-v2 v1.41.4 -> v1.41.7
• github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5 -> v1.7.8
• github.com/aws/aws-sdk-go-v2/config v1.32.12 -> v1.32.17
• github.com/aws/aws-sdk-go-v2/credentials v1.19.12 -> v1.19.16
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 -> v1.18.23
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 -> v1.4.23
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 -> v2.7.23
• github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.12 -> v1.4.24
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 -> v1.13.9
• github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.3 -> v1.9.12
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 -> v1.13.23
• github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.12 -> v1.19.20
• github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 -> v1.0.11
• github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 -> v1.30.17
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 -> v1.35.21
• github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 -> v1.42.1
• github.com/aws/smithy-go v1.24.2 -> v1.25.1
• github.com/containerd/containerd/v2 v2.2.2 -> v2.2.3
• github.com/docker/cli v29.3.1 -> v29.4.3
• github.com/go-openapi/runtime v0.29.2 -> v0.29.3
• github.com/go-openapi/swag v0.25.4 -> v0.25.5
• github.com/go-openapi/swag/cmdutils v0.25.4 -> v0.25.5
• github.com/go-openapi/swag/netutils v0.25.4 -> v0.25.5
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 -> v2.28.0
• github.com/in-toto/in-toto-golang v0.10.0 -> v0.11.0
• github.com/klauspost/compress v1.18.5 -> v1.18.6
• github.com/moby/policy-helpers b7c0b99 -> a39d601
• github.com/moby/profiles/seccomp v0.1.0 -> v0.2.3
• github.com/sigstore/sigstore v1.10.4 -> v1.10.5
• github.com/sigstore/timestamp-authority/v2 v2.0.3 -> v2.0.6
• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 -> v0.68.0
• go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.63.0 -> v0.68.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 -> v0.68.0
• go.opentelemetry.io/otel v1.40.0 -> v1.43.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.40.0 -> v1.43.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.40.0 -> v1.43.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 -> v1.43.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 -> v1.43.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.40.0 -> v1.43.0
• go.opentelemetry.io/otel/metric v1.40.0 -> v1.43.0
• go.opentelemetry.io/otel/sdk v1.40.0 -> v1.43.0
• go.opentelemetry.io/otel/sdk/metric v1.40.0 -> v1.43.0
• go.opentelemetry.io/otel/trace v1.40.0 -> v1.43.0
• go.opentelemetry.io/proto/otlp v1.9.0 -> v1.10.0
• golang.org/x/crypto v0.48.0 -> v0.50.0
• golang.org/x/mod v0.33.0 -> v0.34.0
• golang.org/x/net v0.51.0 -> v0.53.0
• golang.org/x/sync v0.19.0 -> v0.20.0
• golang.org/x/sys v0.42.0 -> v0.43.0
• golang.org/x/term v0.41.0 -> v0.42.0
• golang.org/x/text v0.34.0 -> v0.36.0
• golang.org/x/time v0.14.0 -> v0.15.0
• google.golang.org/genproto/googleapis/api 8636f87 -> 6f92a3b
• google.golang.org/genproto/googleapis/rpc 8636f87 -> 6f92a3b
• google.golang.org/grpc v1.79.3 -> v1.80.0
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.77 -> v1.2.78
• kernel.org/pub/linux/libs/security/libcap/psx v1.2.77 -> v1.2.78

Previous release can be found at v0.29.0

v0.29.0

Compare Source

Welcome to the v0.29.0 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• David Karlsson
• Akihiro Suda
• Sebastiaan van Stijn
• Brian Ristuccia
• Jonathan A. Sternberg
• Mateusz Gozdek
• Natnael Gebremariam

Notable Changes

• Builtin Dockerfile frontend has been updated to v1.23.0 changelog
• Git sources can now initialize all files from a Git checkout with commit time in the LLB API for better reproducibility. See Dockerfile changelog for how to enable this in the Dockerfile frontend #​6600
• Various file access operations in Git and HTTP sources have been hardened for improved security #​6613
• Frontends can now report updated SOURCE_DATE_EPOCH with result metadata that can be used by exporters #​6601
• Fix possible panic when listing build history after recent deletions #​6614
• Fix possible issue where builds from Git repositories could start to fail after submodule rename #​6563
• Fix possible process lifecycle event ordering issue in interactive container API that could cause deadlocks in the client #​6531
• Fix regression where build progress skipped the message about layers being pushed to the registry #​6587
• Fix possible cgroup initialization failure in BuildKit container image entrypoint on some environments #​6585
• Fix issue with resolving symlinks via file access methods of the Gateway API #​6559
• Fix possible "parent snapshot does not exist" error when exporting images in parallel #​6558
• Fix possible panic from zstd compression #​6599
• Fix issue where cache imports from an uninitialized local cache tag could fail the build #​6554
• Included CNI plugins have been updated to v1.9.1 #​6583
• Included QEMU emulator support has been updated to v10.2.1 #​6580
• Runc container runtime has been updated to v1.3.5 #​6625

Dependency Changes

• github.com/aws/aws-sdk-go-v2 v1.41.1 -> v1.41.4
• github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 -> v1.7.5
• github.com/aws/aws-sdk-go-v2/config v1.32.7 -> v1.32.12
• github.com/aws/aws-sdk-go-v2/credentials v1.19.7 -> v1.19.12
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 -> v1.18.20
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 -> v1.4.20
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 -> v2.7.20
• github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 -> v1.8.6
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 -> v1.13.7
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 -> v1.13.20
• github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 -> v1.0.8
• github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 -> v1.30.13
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 -> v1.35.17
• github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 -> v1.41.9
• github.com/aws/smithy-go v1.24.0 -> v1.24.2
• github.com/containerd/cgroups/v3 v3.1.2 -> v3.1.3
• github.com/containerd/containerd/v2 v2.2.1 -> v2.2.2
• github.com/containerd/nydus-snapshotter v0.15.11 -> v0.15.13
• github.com/containerd/ttrpc v1.2.7 -> v1.2.8
• github.com/containernetworking/plugins v1.9.0 -> v1.9.1
• github.com/docker/cli v29.2.1 -> v29.3.1
• github.com/go-openapi/analysis v0.24.1 -> v0.24.3
• github.com/go-openapi/errors v0.22.6 -> v0.22.7
• github.com/go-openapi/jsonpointer v0.22.4 -> v0.22.5
• github.com/go-openapi/jsonreference v0.21.4 -> v0.21.5
• github.com/go-openapi/loads v0.23.2 -> v0.23.3
• github.com/go-openapi/spec v0.22.3 -> v0.22.4
• github.com/go-openapi/strfmt v0.25.0 -> v0.26.1
• github.com/go-openapi/swag/conv v0.25.4 -> v0.25.5
• github.com/go-openapi/swag/fileutils v0.25.4 -> v0.25.5
• github.com/go-openapi/swag/jsonname v0.25.4 -> v0.25.5
• github.com/go-openapi/swag/jsonutils v0.25.4 -> v0.25.5
• github.com/go-openapi/swag/loading v0.25.4 -> v0.25.5
• github.com/go-openapi/swag/mangling v0.25.4 -> v0.25.5
• github.com/go-openapi/swag/stringutils v0.25.4 -> v0.25.5
• github.com/go-openapi/swag/typeutils v0.25.4 -> v0.25.5
• github.com/go-openapi/swag/yamlutils v0.25.4 -> v0.25.5
• github.com/go-openapi/validate v0.25.1 -> v0.25.2
• github.com/go-viper/mapstructure/v2 v2.4.0 -> v2.5.0
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 -> v2.27.7
• github.com/klauspost/compress v1.18.4 -> v1.18.5
• github.com/moby/policy-helpers 824747b -> b7c0b99
• github.com/oklog/ulid/v2 v2.1.1 new
• go.opentelemetry.io/otel v1.38.0 -> v1.40.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0 -> v1.40.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.38.0 -> v1.40.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 -> v1.40.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 -> v1.40.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 -> v1.40.0
• go.opentelemetry.io/otel/metric v1.38.0 -> v1.40.0
• go.opentelemetry.io/otel/sdk v1.38.0 -> v1.40.0
• go.opentelemetry.io/otel/sdk/metric v1.38.0 -> v1.40.0
• go.opentelemetry.io/otel/trace v1.38.0 -> v1.40.0
• go.opentelemetry.io/proto/otlp v1.7.1 -> v1.9.0
• golang.org/x/sys v0.41.0 -> v0.42.0
• golang.org/x/term v0.40.0 -> v0.41.0
• google.golang.org/genproto/googleapis/api ff82c1b -> 8636f87
• google.golang.org/genproto/googleapis/rpc 0a764e5 -> 8636f87
• google.golang.org/grpc v1.78.0 -> v1.79.3

Previous release can be found at v0.28.1

v0.28.1

Compare Source

Welcome to the v0.28.1 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Sebastiaan van Stijn

Notable Changes

• Fix insufficient validation of Git URL #ref:subdir fragments that could allow access to restricted files outside the checked-out repository root. GHSA-4vrq-3vrq-g6gg
• Fix a vulnerability where an untrusted custom frontend could cause files to be written outside the BuildKit state directory. GHSA-4c29-8rgm-jvjj
• Fix a panic when processing invalid .dockerignore patterns during COPY. #​6610 moby/patternmatcher#9

Dependency Changes

• github.com/moby/patternmatcher v0.6.0 -> v0.6.1

Previous release can be found at v0.28.0

v0.28.0

Compare Source

buildkit 0.28.0

Welcome to the v0.28.0 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Sebastiaan van Stijn
• Jonathan A. Sternberg
• Akihiro Suda
• Amr Mahdi
• Dan Duvall
• David Karlsson
• Jonas Geiler
• Kevin L.
• rsteube

Notable Changes

• Builtin Dockerfile frontend has been updated to v1.22.0 changelog
• The default provenance format has been switched to SLSA v1.0 from the previous v0.2. The old format can still be generated by setting the version attribute. #​6526
• Provenance attestation for an image can now be directly pulled via Source metadata request. #​6516 #​6514 #​6537
• Pushing result images and exporting build cache now happens in parallel, for better performance. #​6451
• LLB definition now supports two new Source types for accessing raw blobs from image registries and from OCI layouts. New sources use identifier protocols docker-image+blob:// and oci-layout+blob://. #​4286
• LLB API now supports custom checksum requests for HTTP sources, allowing fetching checksums for different algorithms than the default SHA256 and with optional suffixes. #​6527 #​6537
• LLB API now supports validating HTTP sources with PGP signatures, similarly to previous support for Git sources. #​6527
• With the update to a newer version of the in-toto library, the provenance attestation key InvocationID has changed to InvocationId to strictly follow the SLSA spec. This change doesn't affect BuildKit/Buildx Golang tooling, but could affect 3rd party tools if they are using case-sensitive JSON parsing. #​6533
• Embedded Qemu emulator support has been updated to v10.1.3 #​6524
• Update BuildKit Cgroups implementation to work in (Kubernetes) environments that don't have their own Cgroup namespace. #​6368
• Buildctl binary now supports bash completion. #​6474
• PGP signature verification now supports combined public keys as input for defining the required signer. #​6519
• Fix possible "failed to read expected number of bytes" error when reading attestation chains #​6520
• Fix possible error from race condition when creating images in parallel #​6477

Dependency Changes

• github.com/aws/aws-sdk-go-v2 v1.39.6 -> v1.41.1
• github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.2 -> v1.7.4
• github.com/aws/aws-sdk-go-v2/config v1.31.20 -> v1.32.7
• github.com/aws/aws-sdk-go-v2/credentials v1.18.24 -> v1.19.7
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.13 -> v1.18.17
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 -> v1.4.17
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 -> v2.7.17
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.3 -> v1.13.4
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.13 -> v1.13.17
• github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 new
• github.com/aws/aws-sdk-go-v2/service/sso v1.30.3 -> v1.30.9
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.7 -> v1.35.13
• github.com/aws/aws-sdk-go-v2/service/sts v1.40.2 -> v1.41.6
• github.com/aws/smithy-go v1.23.2 -> v1.24.0
• github.com/cloudflare/circl v1.6.1 -> v1.6.3
• github.com/containerd/nydus-snapshotter v0.15.10 -> v0.15.11
• github.com/containerd/stargz-snapshotter v0.17.0 -> v0.18.2
• github.com/containerd/stargz-snapshotter/estargz v0.17.0 -> v0.18.2
• github.com/coreos/go-systemd/v22 v22.6.0 -> v22.7.0
• github.com/docker/cli v29.1.4 -> v29.2.1
• github.com/go-openapi/errors v0.22.4 -> v0.22.6
• github.com/go-openapi/jsonpointer v0.22.1 -> v0.22.4
• github.com/go-openapi/jsonreference v0.21.3 -> v0.21.4
• github.com/go-openapi/spec v0.22.1 -> v0.22.3
• github.com/go-openapi/swag v0.25.3 -> v0.25.4
• github.com/go-openapi/swag/cmdutils v0.25.3 -> v0.25.4
• github.com/go-openapi/swag/conv v0.25.3 -> v0.25.4
• github.com/go-openapi/swag/fileutils v0.25.3 -> v0.25.4
• github.com/go-openapi/swag/jsonname v0.25.3 -> v0.25.4
• github.com/go-openapi/swag/jsonutils v0.25.3 -> v0.25.4
• github.com/go-openapi/swag/loading v0.25.3 -> v0.25.4
• github.com/go-openapi/swag/mangling v0.25.3 -> v0.25.4
• github.com/go-openapi/swag/netutils v0.25.3 -> v0.25.4
• github.com/go-openapi/swag/stringutils v0.25.3 -> v0.25.4
• github.com/go-openapi/swag/typeutils v0.25.3 -> v0.25.4
• github.com/go-openapi/swag/yamlutils v0.25.3 -> v0.25.4
• github.com/google/go-containerregistry v0.20.6 -> v0.20.7
• github.com/hanwen/go-fuse/v2 v2.8.0 -> v2.9.0
• github.com/in-toto/in-toto-golang v0.9.0 -> v0.10.0
• github.com/klauspost/compress v1.18.3 -> v1.18.4
• github.com/moby/policy-helpers eeebf1a -> 824747b
• github.com/morikuni/aec v1.0.0 -> v1.1.0
• github.com/pelletier/go-toml/v2 v2.2.4 new
• github.com/secure-systems-lab/go-securesystemslib v0.9.1 -> v0.10.0
• github.com/sigstore/rekor v1.4.3 -> v1.5.0
• github.com/sigstore/sigstore v1.10.0 -> v1.10.4
• github.com/sigstore/sigstore-go b5fe07a -> v1.1.4
• github.com/sigstore/timestamp-authority/v2 v2.0.2 -> v2.0.3
• github.com/theupdateframework/go-tuf/v2 v2.3.0 -> v2.4.1
• google.golang.org/genproto/googleapis/api f26f940 -> ff82c1b
• google.golang.org/genproto/googleapis/rpc f26f940 -> 0a764e5
• google.golang.org/grpc v1.76.0 -> v1.78.0

Previous release can be found at v0.27.1

v0.27.1

Compare Source

Welcome to the v0.27.1 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• CrazyMax
• Sebastiaan van Stijn
• Tõnis Tiigi

Notable Changes

• Fix possible panic when verifying signature of GitHub Actions cache moby/policy-helpers#21

Dependency Changes

• github.com/klauspost/compress v1.18.2 -> v1.18.3
• github.com/moby/policy-helpers 9fcc1a9 -> eeebf1a

Previous release can be found at v0.27.0

v0.27.0

[Compare Source

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[paketo-bot]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 44 additional dependencies were updated

Details:

Package	Change
github.com/aws/aws-sdk-go-v2	v1.41.5 -> v1.42.0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.7.8 -> v1.7.13
github.com/aws/aws-sdk-go-v2/config	v1.32.12 -> v1.32.24
github.com/aws/aws-sdk-go-v2/credentials	v1.19.12 -> v1.19.23
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	v1.18.20 -> v1.18.29
github.com/aws/aws-sdk-go-v2/internal/configsources	v1.4.21 -> v1.4.29
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	v2.7.21 -> v2.7.29
github.com/aws/aws-sdk-go-v2/internal/v4a	v1.4.22 -> v1.4.30
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	v1.13.7 -> v1.13.12
github.com/aws/aws-sdk-go-v2/service/internal/checksum	v1.9.13 -> v1.9.22
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	v1.13.21 -> v1.13.29
github.com/aws/aws-sdk-go-v2/service/internal/s3shared	v1.19.21 -> v1.19.29
github.com/aws/aws-sdk-go-v2/service/s3	v1.97.3 -> v1.103.3
github.com/aws/aws-sdk-go-v2/service/signin	v1.0.8 -> v1.1.5
github.com/aws/aws-sdk-go-v2/service/sso	v1.30.13 -> v1.31.3
github.com/aws/aws-sdk-go-v2/service/ssooidc	v1.35.17 -> v1.36.6
github.com/aws/aws-sdk-go-v2/service/sts	v1.41.9 -> v1.43.3
github.com/aws/smithy-go	v1.24.2 -> v1.27.2
github.com/cncf/xds/go	v0.0.0-20251210132809-ee656c7534f5 -> v0.0.0-20260202195803-dba9d589def2
github.com/containerd/typeurl/v2	v2.2.3 -> v2.3.0
github.com/docker/docker-credential-helpers	v0.9.5 -> v0.9.8
github.com/envoyproxy/go-control-plane/envoy	v1.36.0 -> v1.37.0
github.com/envoyproxy/protoc-gen-validate	v1.3.0 -> v1.3.3
github.com/google/pprof	v0.0.0-20260115054156-294ebfa9ad83 -> v0.0.0-20260402051712-545e8a4df936
github.com/grpc-ecosystem/grpc-gateway/v2	v2.28.0 -> v2.29.0
github.com/in-toto/in-toto-golang	v0.9.0 -> v0.11.0
github.com/morikuni/aec	v1.0.0 -> v1.1.0
github.com/prometheus/procfs	v0.19.2 -> v0.20.1
github.com/tonistiigi/fsutil	v0.0.0-20250605211040-586307ad452f -> v0.0.0-20260609091201-0257b3308df4
go.opentelemetry.io/contrib/detectors/gcp	v1.39.0 -> v1.42.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	v0.68.0 -> v0.69.0
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace	v0.61.0 -> v0.69.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.68.0 -> v0.69.0
go.opentelemetry.io/otel	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/metric	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/sdk	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/sdk/metric	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/trace	v1.43.0 -> v1.44.0
go.yaml.in/yaml/v2	v2.4.3 -> v2.4.4
golang.org/x/exp	v0.0.0-20260508232706-74f9aab9d74a -> v0.0.0-20260603202125-055de637280b
google.golang.org/genproto/googleapis/api	v0.0.0-20260401024825-9d38bb4040a9 -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260406210006-6f92a3bedf2d -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/grpc	v1.80.0 -> v1.81.1