chore(deps): update module github.com/moby/buildkit to v0.28.1 [security]#551
Open
renovate-sh-app[bot] wants to merge 1 commit intomainfrom
Open
chore(deps): update module github.com/moby/buildkit to v0.28.1 [security]#551renovate-sh-app[bot] wants to merge 1 commit intomainfrom
renovate-sh-app[bot] wants to merge 1 commit intomainfrom
Conversation
…ity] | datasource | package | from | to | | ---------- | ------------------------ | ------- | ------- | | go | github.com/moby/buildkit | v0.23.2 | v0.28.1 | Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
grafana-plugins-platform-bot
bot
moved this from 📬 Triage
to 🔬 In review
in Grafana Catalog Team
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.23.2→v0.28.1Warning
Some dependencies could not be looked up. Check the warning logs for more information.
GitHub Vulnerability Alerts
CVE-2026-33747
Impact
When using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context.
Patches
The issue has been fixed in v0.28.1+
Workarounds
Issue requires using an untrusted BuildKit frontend set with
#syntaxor--build-arg BUILDKIT_SYNTAX. Using these options with a well-known frontend image likedocker/dockerfileis not affected.CVE-2026-33748
Impact
Insufficient validation of Git URL fragment subdir components (
<url>#<ref>:<subdir>, docs) may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem.Patches
The issue has been fixed in version v0.28.1
Workarounds
The issue affects only builds that use Git URLs with a subpath component. Avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.
BuildKit's Malicious frontend can cause file escape outside of storage root
CVE-2026-33747 / GHSA-4c29-8rgm-jvjj / GO-2026-4858
More information
Details
Impact
When using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context.
Patches
The issue has been fixed in v0.28.1+
Workarounds
Issue requires using an untrusted BuildKit frontend set with
#syntaxor--build-arg BUILDKIT_SYNTAX. Using these options with a well-known frontend image likedocker/dockerfileis not affected.Severity
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
BuildKit Git URL subdir component can cause access to restricted files
CVE-2026-33748 / GHSA-4vrq-3vrq-g6gg / GO-2026-4859
More information
Details
Impact
Insufficient validation of Git URL fragment subdir components (
<url>#<ref>:<subdir>, docs) may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem.Patches
The issue has been fixed in version v0.28.1
Workarounds
The issue affects only builds that use Git URLs with a subpath component. Avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
BuildKit's Malicious frontend can cause file escape outside of storage root in github.com/moby/buildkit
CVE-2026-33747 / GHSA-4c29-8rgm-jvjj / GO-2026-4858
More information
Details
BuildKit's Malicious frontend can cause file escape outside of storage root in github.com/moby/buildkit
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
BuildKit Git URL subdir component can cause access to restricted files in github.com/moby/buildkit
CVE-2026-33748 / GHSA-4vrq-3vrq-g6gg / GO-2026-4859
More information
Details
BuildKit Git URL subdir component can cause access to restricted files in github.com/moby/buildkit
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Release Notes
moby/buildkit (github.com/moby/buildkit)
v0.28.1Compare Source
Welcome to the v0.28.1 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
#ref:subdirfragments that could allow access to restricted files outside the checked-out repository root. GHSA-4vrq-3vrq-g6gg.dockerignorepatterns duringCOPY. #6610 moby/patternmatcher#9Dependency Changes
Previous release can be found at v0.28.0
v0.28.0Compare Source
buildkit 0.28.0
Welcome to the v0.28.0 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
versionattribute. #6526docker-image+blob://andoci-layout+blob://. #4286InvocationIDhas changed toInvocationIdto strictly follow the SLSA spec. This change doesn't affect BuildKit/Buildx Golang tooling, but could affect 3rd party tools if they are using case-sensitive JSON parsing. #6533Dependency Changes
eeebf1a->824747bb5fe07a-> v1.1.4f26f940->ff82c1bf26f940->0a764e5Previous release can be found at v0.27.1
v0.27.1Compare Source
Welcome to the v0.27.1 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
Dependency Changes
9fcc1a9->eeebf1aPrevious release can be found at v0.27.0
v0.27.0Compare Source
buildkit 0.27.0
Welcome to the v0.27.0 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
AuthConfigproviders in client #6408Dependency Changes
a9d515anew19d51d7new3a137a8new220c5c2newa468a5bnewbcaa71c->9fcc1a90ea5ed0->edf4cb3b5fe07anew586307a->a2aa163378c5ed->54bc28c404c0d5newc5933d9->f26f940c5933d9->f26f940Previous release can be found at v0.26.3
v0.26.3Compare Source
Welcome to the v0.26.3 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
Dependency Changes
Previous release can be found at v0.26.2
v0.26.2Compare Source
Welcome to the v0.26.2 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
Dependency Changes
This release has no dependency changes
Previous release can be found at v0.26.1
v0.26.1Compare Source
Welcome to the v0.26.1 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
Dependency Changes
This release has no dependency changes
Previous release can be found at v0.26.0
v0.26.0Compare Source
buildkit 0.26.0
Welcome to the v0.26.0 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
ResolveSourceMeta, previously available for image sources, can now be performed for Git sources. This can be used to resolve Git commit and tag checksums and also to access the raw commit and tag objects for further verification. #6283ResolveSourceMeta, previously available for image sources, can now be performed for HTTP sources. This can be used to access artifact checksums, last-modified time etc. #6285contentutilpackage now supports moving referrer objects when usingCopyChainfunction. #6336ResolveImageConfigtype toResolveSourceMetadata. #6330 # probably not needed for changelogDependency Changes
41bb18b->2c02b8227863c8->f64d9cfbcaa71cnew2e043c6->0ea5ed07e4ce0a->df9299856aae31->c5933d956aae31->c5933d9Previous release can be found at v0.25.2
v0.25.2Compare Source
Welcome to the v0.25.2 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
Dependency Changes
This release has no dependency changes
Previous release can be found at v0.25.1
v0.25.1Compare Source
buildkit 0.25.1
Welcome to the v0.25.1 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
Dependency Changes
This release has no dependency changes
Previous release can be found at v0.25.0
v0.25.0Compare Source
buildkit 0.25.0
Welcome to the v0.25.0 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
Checksumhas been added tollb.Imageto specify verification digest of the image. Unlike the existing digest in the image reference, where digest overrides the tag if both are set, in this mode, the image is resolved by the tag and only verified by checksum. #6234/etc/buildkitd/provenance.ddirectory. #6210HyperVIsolationoption. #6224errors.Join. #6226materials=falsecould be incorrectly set in provenance attestation for a build that used frontend inputs. #6203Dependency Changes
Previous release can be found at v0.24.0
v0.24.0Compare Source
Welcome to the v0.24.0 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
--max-parallelismdaemon flag. #6105COPY --fromflag value. #6153Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
Need help?
You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.