Skip to content

Bump github.com/moby/buildkit from 0.26.3 to 0.31.2#407

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/moby/buildkit-0.31.2
Closed

Bump github.com/moby/buildkit from 0.26.3 to 0.31.2#407
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/moby/buildkit-0.31.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps github.com/moby/buildkit from 0.26.3 to 0.31.2.

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.31.2

Welcome to the v0.31.2 release of buildkit!

This is a security patch release with four moderate and one low severity security fixes.

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

  • Tõnis Tiigi
  • CrazyMax
  • Dawei Wei

Notable Changes

  • Git source checkout from a bundle file could lead to command injection. GHSA-hw3h-2gp9-cxpv
  • Possible panic when incorrect parameters sent from frontend. GHSA-qx3x-mv6r-52p6
  • LLB file operation can be tricked to remove /tmp directory contents. GHSA-32pv-7hq5-qhwq
  • Malicious client can bypass destination directory validation on local sources upload. GHSA-g2h8-426c-7976
  • WCOW cache mount source selector resolves NTFS junctions outside of cache root. GHSA-388v-wmr2-g2v2
  • Fix possible buildctl failures after successful builds over slow connhelper transports. #6940
  • Fix possible daemon crash during concurrent builds. #6916

Dependency Changes

  • github.com/tonistiigi/fsutil 0257b3308df4 -> 30cd4fc5d911

Previous release can be found at v0.31.1

v0.31.1

buildkit 0.31.1

Welcome to the v0.31.1 release of buildkit!

This is a security patch release with two low severity security fixes.

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

  • Tõnis Tiigi

Notable Changes

... (truncated)

Commits
  • e42e1bf Merge pull request #6960 from tonistiigi/v0.31.2-picks
  • 1a32681 vendor: update github.com/tonistiigi/fsutil to 30cd4fc5d911
  • 0669f4b executor/oci: avoid delete access for WCOW pin
  • 44c0ed6 executor/oci: pin resolved WCOW cache source
  • 473663b executor/oci: pin WCOW cache mount source across mount realization
  • a9155a4 executor/oci: confine WCOW cache mount source within cache root
  • 3916124 fileop: contain rm parent traversal
  • 5aefc4a solver: reject negative LLB input indexes
  • 1659c30 solver: add tests for op input index validation
  • ed77788 solver: validate op input indices to avoid panics
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 16, 2026
@dependabot
Bump github.com/moby/buildkit from 0.26.3 to 0.31.2
1c65137 
Bumps [github.com/moby/buildkit](https://github.com/moby/buildkit) from 0.26.3 to 0.31.2.
- [Release notes](https://github.com/moby/buildkit/releases)
- [Commits](moby/buildkit@v0.26.3...v0.31.2)

---
updated-dependencies:
- dependency-name: github.com/moby/buildkit
  dependency-version: 0.31.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title bump github.com/moby/buildkit from 0.26.3 to 0.31.2 Bump github.com/moby/buildkit from 0.26.3 to 0.31.2 Jul 24, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/github.com/moby/buildkit-0.31.2 branch from 6f7fbe4 to 1c65137 Compare July 24, 2026 14:17
thepetk
thepetk approved these changes Jul 24, 2026
View reviewed changes

@thepetk thepetk left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci Bot added the lgtm label Jul 24, 2026
@openshift-ci

openshift-ci Bot commented Jul 24, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dependabot[bot], thepetk

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@thepetk thepetk closed this Jul 24, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/go_modules/github.com/moby/buildkit-0.31.2 branch July 24, 2026 14:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@thepetk thepetk thepetk approved these changes

Assignees

@thepetk thepetk

Labels

approved dependencies Pull requests that update a dependency file go Pull requests that update Go code lgtm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@thepetk