alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
3,673 Commits 1 Branch 1 Tag
027fa165d0f7d07ae23f8966efb3f253ceadf172
Commit Graph
3673 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Sebastiaan van Stijn 027fa165d0 vendor: golang.org/x/crypto v0.45.0 
full diff: https://github.com/golang/crypto/compare/v0.44.0...v0.45.0

Hello gophers,

We have tagged version v0.45.0 of golang.org/x/crypto in order to address two
security issues.

This version fixes a vulnerability in the golang.org/x/crypto/ssh package and a
vulnerability in the golang.org/x/crypto/ssh/agent package which could cause
programs to consume unbounded memory or panic respectively.

SSH servers parsing GSSAPI authentication requests don't validate the number of
mechanisms specified in the request, allowing an attacker to cause unbounded
memory consumption.

Thanks to Jakub Ciolek for reporting this issue.

This is CVE-2025-58181 and Go issue https://go.dev/issue/76363.

SSH Agent servers do not validate the size of messages when processing new
identity requests, which may cause the program to panic if the message is
malformed due to an out of bounds read.

Thanks to Jakub Ciolek for reporting this issue.

This is CVE-2025-47914 and Go issue https://go.dev/issue/76364.

Cheers, Go Security team

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2025-11-27 19:17:06 +01:00
Sebastiaan van Stijn a2a2819d7d vendor: golang.org/x/net v0.47.0 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2025-11-27 19:13:50 +01:00
Sebastiaan van Stijn ae3eed7b80 vendor: golang.org/x/text v0.31.0 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2025-11-27 19:12:17 +01:00
Sebastiaan van Stijn 3f5c571f69 golang.org/x/term v0.37.0 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2025-11-27 19:09:59 +01:00
Sebastiaan van Stijn b20a9ecf67 vendor: golang.org/x/sync v0.18.0 
full diff: https://github.com/golang/sync/compare/v0.17.0...v0.18.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2025-11-27 18:47:50 +01:00
Sebastiaan van Stijn 3858752e0a vendor: golang.org/x/sys v0.38.0 
- cpu: add HPDS, LOR, PAN detection for arm64
- cpu: also use MRS instruction in getmmfr1
- cpu: use MRS instruction to read arm64 system registers
- unix: add consts for ELF handling
- unix: add SetMemPolicy and its mode/flag values
- unix: add SizeofNhmsg and SizeofNexthopGrp
- windows: add iphlpapi routing functions

full diff: https://github.com/golang/sys/compare/v0.37.0...v0.38.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2025-11-27 18:45:58 +01:00
CrazyMaxandGitHub f1a0fc5d63 Merge pull request #3535 from docker/dependabot/github_actions/peter-evans/create-pull-request-7.0.9 
build(deps): bump peter-evans/create-pull-request from 7.0.8 to 7.0.9
 2025-11-25 18:37:22 +01:00
dependabot[bot]andGitHub b1c71b29c4 build(deps): bump peter-evans/create-pull-request from 7.0.8 to 7.0.9 
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 7.0.8 to 7.0.9.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](https://github.com/peter-evans/create-pull-request/compare/271a8d0340265f705b14b6d32b9829c1cb33d45e...84ae59a2cdc2258d6fa0732dd66352dddae2a412)

---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-11-25 17:16:34 +00:00
Tõnis TiigiandGitHub e084a7f6b6 Merge pull request #3536 from crazy-max/fix-provnance-metadata 
fix empty provenance metadata for multi-platform builds
 2025-11-25 09:10:36 -08:00
CrazyMax 1b9791f6fe fix empty provenance metadata for multi-platform builds 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2025-11-25 17:39:46 +01:00
Tõnis TiigiandGitHub 1aa6b6cad9 Merge pull request #3538 from crazy-max/update-freebsd-box 
ci: switch to bento/freebsd-14 vagrant box
 2025-11-25 08:14:15 -08:00
CrazyMax 2625451e61 ci: switch to bento/freebsd-14 vagrant box 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2025-11-25 11:36:20 +01:00
CrazyMaxandGitHub 5fd9e1a88c Merge pull request #3533 from docker/dependabot/github_actions/actions/checkout-6 
build(deps): bump actions/checkout from 5 to 6
 2025-11-25 11:21:49 +01:00
dependabot[bot]andGitHub 168ceb2395 build(deps): bump actions/checkout from 5 to 6 
Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-11-20 18:03:39 +00:00
CrazyMaxandGitHub 4826295631 Merge pull request #3532 from crazy-max/buildkit-0.26.2 
dockerfile: update buildkit to v0.26.2
 2025-11-20 16:27:26 +01:00
CrazyMax 686591444d dockerfile: update buildkit to v0.26.2 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2025-11-20 15:00:38 +01:00
Tõnis TiigiandGitHub 3c9cd19e54 Merge pull request #3529 from tonistiigi/vendor-v0.26.1 
vendor: update buildkit to v0.26.1
 2025-11-17 16:30:12 +00:00
CrazyMaxandGitHub 05ada34368 Merge pull request #3527 from dvdksn/docs-fix-stdlib-anchors 
docs: remove unnecessary custom anchors and heading in bake stdlib
 2025-11-17 17:10:05 +01:00
Tonis Tiigi 42a2be1c4b vendor: update buildkit to v0.26.1 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2025-11-17 16:07:17 +00:00
Tõnis TiigiandGitHub dd0cd08119 Merge pull request #3524 from crazy-max/containerd-update 
vendor: update containerd to efd86f2b0bc2 (release/2.2)
 2025-11-17 16:02:42 +00:00
David Karlsson 8f883df6de docs: remove unnecessary custom anchors and heading in bake stdlib 
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
 2025-11-17 11:20:01 +01:00
CrazyMaxandGitHub c403ba3710 Merge pull request #3526 from thaJeztah/bump_cli 
vendor: github.com/docker/cli v29.0.1
 2025-11-17 03:53:41 +01:00
Sebastiaan van Stijn 2f462a4945 vendor: github.com/docker/cli v29.0.1 
full diff: https://github.com/docker/cli/compare/v29.0.0...v29.0.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2025-11-16 23:20:52 +01:00
Sebastiaan van Stijn b0b2a4e1ef vendor: github.com/docker/docker-credential-helpers v0.9.4 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2025-11-16 23:20:44 +01:00
CrazyMaxandGitHub 823e824baf Merge pull request #3498 from crazy-max/docker-29 
dockerfile: update to docker v29.0.0
 2025-11-15 11:22:42 +01:00
CrazyMax c034ddfbde vendor: update containerd to efd86f2b0bc2 (release/2.2) 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2025-11-15 10:40:44 +01:00
CrazyMaxandGitHub 45731b8902 Merge pull request #3507 from docker/dependabot/github_actions/softprops/action-gh-release-2.4.2 
build(deps): bump softprops/action-gh-release from 2.4.1 to 2.4.2
 2025-11-13 15:05:32 +01:00
CrazyMaxandGitHub ee0bcd2f5f Merge pull request #3518 from jsternberg/dockerfile-buildkit-update 
dockerfile: buildkit v0.26.0
 2025-11-13 15:04:53 +01:00
CrazyMax 2d4fa3c84c dockerfile: update to docker v29.0.0 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2025-11-13 15:03:42 +01:00
Justin ChadwellandGitHub 1c7e6e7209 Merge pull request #3509 from jedevc/docs-syntax-build-context 
docs: document using build contexts to override syntax directive
 2025-11-13 13:59:24 +00:00
Jonathan A. Sternberg b1cc133cd9 dockerfile: buildkit v0.26.0 
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
 2025-11-12 16:08:34 -06:00
Jonathan A. SternbergandGitHub a2cf0edfb4 Merge pull request #3516 from jsternberg/vendor-buildkit 
vendor: github.com/moby/buildkit v0.26.0
 2025-11-12 13:03:44 -06:00
Jonathan A. Sternberg fd8b77f36b vendor: github.com/moby/buildkit v0.26.0 
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
 2025-11-12 12:38:10 -06:00
dependabot[bot]andGitHub 9093489fac build(deps): bump softprops/action-gh-release from 2.4.1 to 2.4.2 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.4.1 to 2.4.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/6da8fa9354ddfdc4aeace5fc48d7f679b5214090...5be0e66d93ac7ed76da52eca8bb058f665c3a5fe)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 2.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-11-12 10:55:20 +00:00
CrazyMaxandGitHub 5234ee9e5c Merge pull request #3326 from thaJeztah/migrate_moby_modules 
vendor: github.com/moby/moby/api v1.52.0, moby/client v0.1.0
 2025-11-12 11:50:30 +01:00
Sebastiaan van Stijn 18dc2e088a vendor: github.com/moby/moby/api v1.52.0, moby/client v0.1.0 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2025-11-12 01:30:02 +01:00
Jonathan A. SternbergandGitHub c1fbb49e9b Merge pull request #3511 from tonistiigi/bake-nil-panic 
build: avoid panic on linking to nil target
 2025-11-11 15:36:05 -06:00
Jonathan A. SternbergandGitHub 8e8054f1d9 Merge pull request #3510 from tonistiigi/fix-mediatype-concurrency 
imagetools: fix concurrent map write from containerd issue
 2025-11-11 15:35:29 -06:00
Jonathan A. SternbergandGitHub c9b2da6ba4 Merge pull request #3513 from jsternberg/vendor-buildkit 
vendor: update buildkit v0.26.0-rc2
 2025-11-11 15:31:33 -06:00
Jonathan A. Sternberg 1651da02d9 vendor: update buildkit v0.26.0-rc2 
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
 2025-11-11 14:14:36 -06:00
Tonis Tiigi 1fae6f4c2a build: avoid panic on linking to nil target 
Note that nil targets still do not work as buildkit
does not currently support build inputs with nil values.

But this gives cleaner error from buildkit instead of
panic on the client side.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2025-11-11 11:28:53 -08:00
Tonis Tiigi e9804322f8 imagetools: fix concurrent map write from containerd issue 
Workaround for containerd issue that can cause concurrent map
write when WithMediaTypeKeyPrefix is called in parallel
goroutines for context that originated from same base context.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2025-11-11 10:43:54 -08:00
Justin Chadwell a516d3fb37 docs: document using build contexts to override syntax directive 
Signed-off-by: Justin Chadwell <me@jedevc.com>
 2025-11-11 16:15:47 +00:00
CrazyMaxandGitHub 606e9d1f48 Merge pull request #3502 from tonistiigi/update-buildkitd-v0.26.0-rc1 
vendor: update buildkit v0.26.0-rc1
 2025-11-06 17:38:36 +01:00
CrazyMaxandGitHub 6a9de94e51 Merge pull request #3495 from rcastellotti/fix-typo 
docs: fix typo in bake reference
 2025-11-06 09:18:36 +01:00
Tõnis TiigiandGitHub 484a32f259 Merge pull request #3478 from crazy-max/fix-tar-output 
build: create parent directories for tar output in lazy writer
 2025-11-05 16:42:44 -08:00
Tonis Tiigi cc2a26c146 vendor: update buildkit v0.26.0-rc1 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2025-11-05 15:55:57 -08:00
Tõnis TiigiandGitHub 3ca6a43808 Merge pull request #3433 from tonistiigi/imagetools-create-referrers 
imagetools: support for creating attestations/signatures
 2025-11-05 15:35:09 -08:00
Tonis Tiigi 79b6474639 imagetools: add sigstore bundle v3 to supported referrer formats 
This was added after the initial version was written.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2025-11-05 14:00:05 -08:00
Tonis Tiigi e13cd5c9df imagetools: support for creating attestations/signatures 
Persist attestation manifest and any manifest cosign-based
signatures when creating new images.

When creating index from single-arch manifests where attestation
manifest is not inlined, it can be loaded from referrers API.
Note that for this to work the attestation manifest needs to be
in artifact type when image was built.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit aab8171f824d13d703e869107e1720ad71d24bff)
 2025-11-05 12:59:27 -08:00