fix(deps): update module github.com/moby/buildkit to v0.28.1 [security]#873
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
fix(deps): update module github.com/moby/buildkit to v0.28.1 [security]#873renovate[bot] wants to merge 1 commit intomainfrom
renovate[bot] wants to merge 1 commit intomainfrom
Conversation
Generated by renovateBot
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.26.2→v0.28.1GitHub Vulnerability Alerts
CVE-2026-33747
Impact
When using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context.
Patches
The issue has been fixed in v0.28.1+
Workarounds
Issue requires using an untrusted BuildKit frontend set with
#syntaxor--build-arg BUILDKIT_SYNTAX. Using these options with a well-known frontend image likedocker/dockerfileis not affected.CVE-2026-33748
Impact
Insufficient validation of Git URL fragment subdir components (
<url>#<ref>:<subdir>, docs) may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem.Patches
The issue has been fixed in version v0.28.1
Workarounds
The issue affects only builds that use Git URLs with a subpath component. Avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.
Release Notes
moby/buildkit (github.com/moby/buildkit)
v0.28.1Compare Source
Welcome to the v0.28.1 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
#ref:subdirfragments that could allow access to restricted files outside the checked-out repository root. GHSA-4vrq-3vrq-g6gg.dockerignorepatterns duringCOPY. #6610 moby/patternmatcher#9Dependency Changes
Previous release can be found at v0.28.0
v0.28.0Compare Source
buildkit 0.28.0
Welcome to the v0.28.0 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
versionattribute. #6526docker-image+blob://andoci-layout+blob://. #4286InvocationIDhas changed toInvocationIdto strictly follow the SLSA spec. This change doesn't affect BuildKit/Buildx Golang tooling, but could affect 3rd party tools if they are using case-sensitive JSON parsing. #6533Dependency Changes
eeebf1a->824747bb5fe07a-> v1.1.4f26f940->ff82c1bf26f940->0a764e5Previous release can be found at v0.27.1
v0.27.1Compare Source
Welcome to the v0.27.1 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
Dependency Changes
9fcc1a9->eeebf1aPrevious release can be found at v0.27.0
v0.27.0Compare Source
buildkit 0.27.0
Welcome to the v0.27.0 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
AuthConfigproviders in client #6408Dependency Changes
a9d515anew19d51d7new3a137a8new220c5c2newa468a5bnewbcaa71c->9fcc1a90ea5ed0->edf4cb3b5fe07anew586307a->a2aa163378c5ed->54bc28c404c0d5newc5933d9->f26f940c5933d9->f26f940Previous release can be found at v0.26.3
v0.26.3Compare Source
Welcome to the v0.26.3 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
Dependency Changes
Previous release can be found at v0.26.2
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.