alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
4,307 Commits 1 Branch 1 Tag
a21f0a4ffbab4343535e7dc09aee05de1fbba5e7
Commit Graph
4307 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tõnis TiigiandGitHub a21f0a4ffb Merge pull request #3933 from amarkdotdev/fix/imagetools-create-descriptor-validation 
imagetools: validate descriptor input for create -f
 2026-07-07 14:23:05 -07:00
Tõnis TiigiandGitHub d77ee9536e Merge pull request #3942 from crazy-max/group-codeql 
chore: group codeql dependabot updates
 2026-07-07 14:09:04 -07:00
CrazyMax c64aa31cc7 chore: group codeql dependabot updates 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-07-07 08:26:42 +02:00
CrazyMaxandGitHub 041dcec566 Merge pull request #3941 from docker/dependabot/github_actions/docker/setup-buildx-action-4.2.0 
build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0
 2026-07-07 08:12:11 +02:00
CrazyMaxandGitHub ea4b0f0c21 Merge pull request #3936 from docker/dependabot/github_actions/docker/login-action-4.4.0 
build(deps): bump docker/login-action from 4.2.0 to 4.4.0
 2026-07-07 08:11:49 +02:00
amarkdotdev ff1f2cbff6 imagetools: unmarshal descriptor JSON once in parseSource 
Parse schemaVersion and descriptor fields in a single pass instead of
calling json.Unmarshal twice.

Signed-off-by: amarkdotdev <amarkdotdev@users.noreply.github.com>
 2026-07-07 07:23:59 +03:00
Tõnis TiigiandGitHub 80b990a339 Merge pull request #3934 from crazy-max/fix-rm-broken-builders 
rm: handle broken builders during removal
 2026-07-06 16:29:24 -07:00
amarkdotdev 89ec9fe9b3 imagetools: validate descriptor input for create -f 
Return a clear error when -f contains a manifest or index instead of an OCI
content descriptor, and reject descriptors missing a valid digest. Avoids
a nil-pointer panic when piping inspect --raw output into imagetools create.

Fixes #2091


Signed-off-by: amarkdotdev <amarkdotdev@users.noreply.github.com>
 2026-07-06 23:23:25 +03:00
dependabot[bot]andGitHub a7dcfec891 build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.1.0 to 4.2.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5...bb05f3f5519dd87d3ba754cc423b652a5edd6d2c)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-06 18:39:02 +00:00
dependabot[bot]andGitHub 2bf0884e32 build(deps): bump docker/login-action from 4.2.0 to 4.4.0 
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.4.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-06 18:33:27 +00:00
CrazyMax 8db022122d rm: clean up all nodes before returning errors 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-07-06 12:14:11 +02:00
CrazyMax 4f6f49dd81 rm: allow removing builders with invalid config 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-07-06 12:04:37 +02:00
CrazyMaxandGitHub cd58eac2cb Merge pull request #3932 from docker/dependabot/github_actions/docker/bake-action/subaction/matrix-7.3.0 
build(deps): bump docker/bake-action/subaction/matrix from 7.2.0 to 7.3.0
 2026-07-06 10:21:10 +02:00
CrazyMaxandGitHub 33acfebf16 Merge pull request #3931 from docker/dependabot/github_actions/docker/bake-action-7.3.0 
build(deps): bump docker/bake-action from 7.2.0 to 7.3.0
 2026-07-06 10:20:46 +02:00
CrazyMaxandGitHub ce1e9b7bd7 Merge pull request #3930 from docker/dependabot/github_actions/docker/setup-qemu-action-4.2.0 
build(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0
 2026-07-06 10:20:21 +02:00
dependabot[bot]andGitHub 898b0c2337 build(deps): bump docker/bake-action/subaction/matrix 
Bumps [docker/bake-action/subaction/matrix](https://github.com/docker/bake-action) from 7.2.0 to 7.3.0.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/6614cfa25eff9a0b2b2697efb0b6159e7680d584...d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b)

---
updated-dependencies:
- dependency-name: docker/bake-action/subaction/matrix
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-03 18:35:33 +00:00
dependabot[bot]andGitHub 8717083bc3 build(deps): bump docker/bake-action from 7.2.0 to 7.3.0 
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 7.2.0 to 7.3.0.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/6614cfa25eff9a0b2b2697efb0b6159e7680d584...d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b)

---
updated-dependencies:
- dependency-name: docker/bake-action
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-03 18:35:24 +00:00
dependabot[bot]andGitHub b4ebd91998 build(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 4.1.0 to 4.2.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/06116385d9baf250c9f4dcb4858b16962ea869c3...96fe6ef7f33517b61c61be40b68a1882f3264fb8)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-03 18:32:51 +00:00
CrazyMaxandGitHub dc8fa3045b Merge pull request #3918 from s3onghyun/fix-bakeenvfiles-param 
bake: fix duplicated type in bakeEnvFiles lookup param
 2026-07-02 15:05:53 +02:00
CrazyMaxandGitHub 91659f60b8 Merge pull request #3929 from glours/bump-compose-go-v2.13.0 
bump compose-go to version v2.13.0
 2026-07-02 12:24:20 +02:00
Guillaume Lours 0492548633 bump compose-go to version v2.13.0 
Signed-off-by: Guillaume Lours <705411+glours@users.noreply.github.com>
 2026-07-02 11:46:15 +02:00
CrazyMaxandGitHub 9587b741bc Merge pull request #3912 from thaJeztah/bump_moby 
vendor: github.com/docker/cli v29.6.1
 2026-07-01 15:15:02 +02:00
CrazyMaxandGitHub 490fe96c24 Merge pull request #3920 from thaJeztah/bump_containerd 
vendor: github.com/containerd/containerd/v2 v2.2.5
 2026-07-01 15:14:20 +02:00
Sebastiaan van Stijn d27d845f75 vendor: github.com/docker/cli v29.6.1 
full diff: https://github.com/docker/cli/compare/v29.5.3...v29.6.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-01 14:43:19 +02:00
CrazyMaxandGitHub 5f67f9bcee Merge pull request #3927 from docker/dependabot/github_actions/actions/setup-go-6.5.0 
build(deps): bump actions/setup-go from 6.4.0 to 6.5.0
 2026-06-29 11:37:57 +02:00
CrazyMaxandGitHub acc081ba1f Merge pull request #3922 from docker/dependabot/github_actions/softprops/action-gh-release-3.0.1 
build(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1
 2026-06-29 11:37:34 +02:00
CrazyMaxandGitHub 9079f2d091 Merge pull request #3921 from docker/dependabot/github_actions/actions/checkout-7.0.0 
build(deps): bump actions/checkout from 6.0.3 to 7.0.0
 2026-06-29 11:37:14 +02:00
CrazyMaxandGitHub eae76a9b4d Merge pull request #3926 from docker/dependabot/github_actions/crazy-max-dot-github-8c77e18ee6 
build(deps): bump the crazy-max-dot-github group across 1 directory with 5 updates
 2026-06-29 11:36:47 +02:00
dependabot[bot]andGitHub 2e96ce7b8b build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.4.0 to 6.5.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/4a3601121dd01d1626a1e23e37211e3254c1c06c...924ae3a1cded613372ab5595356fb5720e22ba16)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-25 18:36:25 +00:00
dependabot[bot]andGitHub 7b7b1ab58f build(deps): bump the crazy-max-dot-github group across 1 directory with 5 updates 
Bumps the crazy-max-dot-github group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [crazy-max/.github/.github/actions/gotest-annotations](https://github.com/crazy-max/.github) | `1.10.0` | `1.10.1` |
| [crazy-max/.github/.github/actions/docker-scout](https://github.com/crazy-max/.github) | `1.10.0` | `1.10.1` |
| [crazy-max/.github/.github/actions/install-k3s](https://github.com/crazy-max/.github) | `1.10.0` | `1.10.1` |
| [crazy-max/.github/.github/workflows/pr-assign-author.yml](https://github.com/crazy-max/.github) | `1.10.0` | `1.10.1` |
| [crazy-max/.github/.github/workflows/zizmor.yml](https://github.com/crazy-max/.github) | `1.10.0` | `1.10.1` |



Updates `crazy-max/.github/.github/actions/gotest-annotations` from 1.10.0 to 1.10.1
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](https://github.com/crazy-max/.github/compare/716fd1c51a46c5d93a41d44a94b439c9ee802536...46267a6e61cd56aac2fc79943df180152f4c89d6)

Updates `crazy-max/.github/.github/actions/docker-scout` from 1.10.0 to 1.10.1
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](https://github.com/crazy-max/.github/compare/716fd1c51a46c5d93a41d44a94b439c9ee802536...46267a6e61cd56aac2fc79943df180152f4c89d6)

Updates `crazy-max/.github/.github/actions/install-k3s` from 1.10.0 to 1.10.1
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](https://github.com/crazy-max/.github/compare/716fd1c51a46c5d93a41d44a94b439c9ee802536...46267a6e61cd56aac2fc79943df180152f4c89d6)

Updates `crazy-max/.github/.github/workflows/pr-assign-author.yml` from 1.10.0 to 1.10.1
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](https://github.com/crazy-max/.github/compare/716fd1c51a46c5d93a41d44a94b439c9ee802536...46267a6e61cd56aac2fc79943df180152f4c89d6)

Updates `crazy-max/.github/.github/workflows/zizmor.yml` from 1.10.0 to 1.10.1
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](https://github.com/crazy-max/.github/compare/716fd1c51a46c5d93a41d44a94b439c9ee802536...46267a6e61cd56aac2fc79943df180152f4c89d6)

---
updated-dependencies:
- dependency-name: crazy-max/.github/.github/actions/gotest-annotations
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: crazy-max-dot-github
- dependency-name: crazy-max/.github/.github/actions/docker-scout
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: crazy-max-dot-github
- dependency-name: crazy-max/.github/.github/actions/install-k3s
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: crazy-max-dot-github
- dependency-name: crazy-max/.github/.github/workflows/pr-assign-author.yml
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: crazy-max-dot-github
- dependency-name: crazy-max/.github/.github/workflows/zizmor.yml
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: crazy-max-dot-github
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-25 18:32:55 +00:00
Sebastiaan van Stijn e1e5963dae vendor: github.com/containerd/containerd/v2 v2.2.5 
- full diff: https://github.com/containerd/containerd/compare/v2.2.4...v2.2.5
- release notes: https://github.com/containerd/containerd/releases/tag/v2.2.5

The fifth patch release for containerd 2.2 contains various fixes
and updates including security patches.

-  CVE-2026-50195 / [GHSA-cvxm-645q-p574] CRI: checkpoint import allows local image tag poisoning
-  CVE-2026-53488 / [GHSA-xhf5-7wjv-pqxp] CRI: image-config LABEL flows to host-root command execution from an image pull
-  CVE-2026-53492 / [GHSA-33vj-92qq-66hc] CRI: CDI annotation smuggling during CRI checkpoint restore
-  CVE-2026-53489 / [GHSA-rgh6-rfwx-v388] CRI: Arbitrary host file read via symlink following in CRI checkpoint restore
-  CVE-2026-47262 / [GHSA-jpcc-p29g-p8mq] containerd image-triggered runtime DoS via unbounded group parsing

[GHSA-cvxm-645q-p574]: https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574
[GHSA-xhf5-7wjv-pqxp]: https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp
[GHSA-33vj-92qq-66hc]: https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc
[GHSA-rgh6-rfwx-v388]: https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388
[GHSA-jpcc-p29g-p8mq]: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-23 09:27:04 +02:00
Tõnis TiigiandGitHub 1d805d2ea2 Merge pull request #3907 from thaJeztah/bump_x_deps 
vendor: update golang.org/x/* dependencies
 2026-06-22 23:38:25 -07:00
Tõnis TiigiandGitHub c31d110db4 Merge pull request #3909 from thaJeztah/bump_engine 
Dockerfile: update to docker v29.6
 2026-06-22 23:37:58 -07:00
dependabot[bot]andGitHub ab5d4f670e build(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-22 18:32:32 +00:00
dependabot[bot]andGitHub 1263b0fab6 build(deps): bump actions/checkout from 6.0.3 to 7.0.0 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-19 18:32:32 +00:00
Sebastiaan van Stijn 962c4d1780 vendor: golang.org/x/tools v0.46.0 
full diff: https://github.com/golang/tools/compare/v0.45.0...v0.46.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:50 +02:00
Sebastiaan van Stijn 04c24b93df vendor: golang.org/x/net v0.56.0 
full diff: https://github.com/golang/net/compare/v0.55.0...v0.56.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:50 +02:00
Sebastiaan van Stijn a271da13ea vendor: golang.org/x/crypto v0.53.0 
full diff: https://github.com/golang/crypto/compare/v0.52.0...v0.53.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:50 +02:00
Sebastiaan van Stijn 7609bf8845 vendor: golang.org/x/text v0.38.0 
full diff: https://github.com/golang/text/compare/v0.37.0...v0.38.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:50 +02:00
Sebastiaan van Stijn d551a606e9 vendor: golang.org/x/sync v0.21.0 
full diff: https://github.com/golang/sync/compare/v0.20.0...v0.21.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:50 +02:00
Sebastiaan van Stijn ad0a622e24 vendor: golang.org/x/mod v0.37.0 
full diff: https://github.com/golang/mod/compare/v0.36.0...v0.37.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:49 +02:00
Sebastiaan van Stijn 8d182fad32 vendor: golang.org/x/term v0.44.0 
full diff: https://github.com/golang/term/compare/v0.43.0...v0.44.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:49 +02:00
Sebastiaan van Stijn d2a2999949 vendor: golang.org/x/sys v0.46.0 
full diff: https://github.com/golang/sys/compare/v0.45.0...v0.46.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:49 +02:00
Tõnis TiigiandGitHub f30ef86d21 Merge pull request #3914 from thaJeztah/policy_no_deprecated 
policy: remove uses of deprecated WithBuiltins
 2026-06-18 18:10:06 -07:00
Sebastiaan van Stijn 7487502115 Dockerfile: update to docker v29.6 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-18 22:55:20 +02:00
s3onghyun c09ecf711e bake: fix duplicated type in bakeEnvFiles lookup param 
Signed-off-by: s3onghyun <s3onghyun.hong@gmail.com>
 2026-06-18 17:51:54 +09:00
Tõnis TiigiandGitHub 209f90c18c Merge pull request #3915 from tonistiigi/update-buildkit-v0.31.0 
vendor: update buildkit to v0.31.0
 2026-06-17 12:39:48 -07:00
Tonis Tiigi af83612e3f vendor: update buildkit to v0.31.0 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-06-17 11:51:42 -07:00
Sebastiaan van Stijn 8b1d06a0ec policy: remove uses of deprecated WithBuiltins 
The WithBuiltins method was deprecated in opa v0.23.0 ([opa@afc8c5e]) in
favor of WithCapabilities, but the deprecation didn't use the standard
format, causing it not being detected as deprecated. OPA v1.1.0 corrected
the deprecation in [opa@622434d].

This patch replaces uses of the deprecated functions.

[opa@afc8c5e]: https://github.com/open-policy-agent/opa/commit/afc8c5e2a22878086067821f24e15d060594227a
[opa@622434d]: https://github.com/open-policy-agent/opa/commit/622434d11386c7b12aee703d7c1eedea34a27c7b

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-16 15:11:37 +02:00
Tõnis TiigiandGitHub 230fb952bb Merge pull request #3908 from thaJeztah/align_otel_exporters 
vendor: go.opentelemetry.io/otel/exporters v1.44.0
 2026-06-15 10:52:11 -07:00