alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
4,274 Commits 1 Branch 1 Tag
e1e5963dae4038491ec43dede7bb80eac4aa5945
Commit Graph
4274 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Sebastiaan van Stijn e1e5963dae vendor: github.com/containerd/containerd/v2 v2.2.5 
- full diff: https://github.com/containerd/containerd/compare/v2.2.4...v2.2.5
- release notes: https://github.com/containerd/containerd/releases/tag/v2.2.5

The fifth patch release for containerd 2.2 contains various fixes
and updates including security patches.

-  CVE-2026-50195 / [GHSA-cvxm-645q-p574] CRI: checkpoint import allows local image tag poisoning
-  CVE-2026-53488 / [GHSA-xhf5-7wjv-pqxp] CRI: image-config LABEL flows to host-root command execution from an image pull
-  CVE-2026-53492 / [GHSA-33vj-92qq-66hc] CRI: CDI annotation smuggling during CRI checkpoint restore
-  CVE-2026-53489 / [GHSA-rgh6-rfwx-v388] CRI: Arbitrary host file read via symlink following in CRI checkpoint restore
-  CVE-2026-47262 / [GHSA-jpcc-p29g-p8mq] containerd image-triggered runtime DoS via unbounded group parsing

[GHSA-cvxm-645q-p574]: https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574
[GHSA-xhf5-7wjv-pqxp]: https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp
[GHSA-33vj-92qq-66hc]: https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc
[GHSA-rgh6-rfwx-v388]: https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388
[GHSA-jpcc-p29g-p8mq]: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-23 09:27:04 +02:00
Tõnis TiigiandGitHub 1d805d2ea2 Merge pull request #3907 from thaJeztah/bump_x_deps 
vendor: update golang.org/x/* dependencies
 2026-06-22 23:38:25 -07:00
Tõnis TiigiandGitHub c31d110db4 Merge pull request #3909 from thaJeztah/bump_engine 
Dockerfile: update to docker v29.6
 2026-06-22 23:37:58 -07:00
Sebastiaan van Stijn 962c4d1780 vendor: golang.org/x/tools v0.46.0 
full diff: https://github.com/golang/tools/compare/v0.45.0...v0.46.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:50 +02:00
Sebastiaan van Stijn 04c24b93df vendor: golang.org/x/net v0.56.0 
full diff: https://github.com/golang/net/compare/v0.55.0...v0.56.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:50 +02:00
Sebastiaan van Stijn a271da13ea vendor: golang.org/x/crypto v0.53.0 
full diff: https://github.com/golang/crypto/compare/v0.52.0...v0.53.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:50 +02:00
Sebastiaan van Stijn 7609bf8845 vendor: golang.org/x/text v0.38.0 
full diff: https://github.com/golang/text/compare/v0.37.0...v0.38.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:50 +02:00
Sebastiaan van Stijn d551a606e9 vendor: golang.org/x/sync v0.21.0 
full diff: https://github.com/golang/sync/compare/v0.20.0...v0.21.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:50 +02:00
Sebastiaan van Stijn ad0a622e24 vendor: golang.org/x/mod v0.37.0 
full diff: https://github.com/golang/mod/compare/v0.36.0...v0.37.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:49 +02:00
Sebastiaan van Stijn 8d182fad32 vendor: golang.org/x/term v0.44.0 
full diff: https://github.com/golang/term/compare/v0.43.0...v0.44.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:49 +02:00
Sebastiaan van Stijn d2a2999949 vendor: golang.org/x/sys v0.46.0 
full diff: https://github.com/golang/sys/compare/v0.45.0...v0.46.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-19 17:12:49 +02:00
Tõnis TiigiandGitHub f30ef86d21 Merge pull request #3914 from thaJeztah/policy_no_deprecated 
policy: remove uses of deprecated WithBuiltins
 2026-06-18 18:10:06 -07:00
Sebastiaan van Stijn 7487502115 Dockerfile: update to docker v29.6 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-18 22:55:20 +02:00
Tõnis TiigiandGitHub 209f90c18c Merge pull request #3915 from tonistiigi/update-buildkit-v0.31.0 
vendor: update buildkit to v0.31.0
 2026-06-17 12:39:48 -07:00
Tonis Tiigi af83612e3f vendor: update buildkit to v0.31.0 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-06-17 11:51:42 -07:00
Sebastiaan van Stijn 8b1d06a0ec policy: remove uses of deprecated WithBuiltins 
The WithBuiltins method was deprecated in opa v0.23.0 ([opa@afc8c5e]) in
favor of WithCapabilities, but the deprecation didn't use the standard
format, causing it not being detected as deprecated. OPA v1.1.0 corrected
the deprecation in [opa@622434d].

This patch replaces uses of the deprecated functions.

[opa@afc8c5e]: https://github.com/open-policy-agent/opa/commit/afc8c5e2a22878086067821f24e15d060594227a
[opa@622434d]: https://github.com/open-policy-agent/opa/commit/622434d11386c7b12aee703d7c1eedea34a27c7b

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-16 15:11:37 +02:00
Tõnis TiigiandGitHub 230fb952bb Merge pull request #3908 from thaJeztah/align_otel_exporters 
vendor: go.opentelemetry.io/otel/exporters v1.44.0
 2026-06-15 10:52:11 -07:00
Sebastiaan van Stijn 68fd340247 vendor: go.opentelemetry.io/otel/exporters v1.44.0 
removes the semconv v1.40.0 dependency

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-15 14:13:52 +02:00
Tõnis TiigiandGitHub b4b3437a30 Merge pull request #3898 from crazy-max/compose-go-2.11.0 
vendor: update compose-go to v2.11.0
 2026-06-12 15:40:38 -07:00
CrazyMaxandGitHub 51b977c3ae Merge pull request #3904 from crazy-max/dockerfile-buildkit-0.31.0-rc2 
dockerfile: update buildkit to v0.31.0-rc2
 2026-06-12 15:29:05 +02:00
CrazyMax c1ea48adc6 dockerfile: update buildkit to v0.31.0-rc2 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-06-12 14:54:24 +02:00
CrazyMaxandGitHub 73e56595aa Merge pull request #3903 from crazy-max/buildkit-0.31.0-rc2 
vendor: update buildkit to v0.31.0-rc2
 2026-06-12 14:02:55 +02:00
CrazyMax 268dcf5917 vendor: update buildkit to v0.31.0-rc2 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-06-12 13:46:40 +02:00
CrazyMaxandGitHub d1c298cd85 Merge pull request #3899 from crazy-max/remove-bake-path-shim 
bake: remove stale path evaluation shim
 2026-06-12 10:51:41 +02:00
CrazyMaxandGitHub edb063cb21 Merge pull request #3900 from jirimoravcik/fix/minor-resource-limits-adjustments 
build: improve resource limits output and docs
 2026-06-12 10:03:06 +02:00
CrazyMaxandGitHub 4149c242ab Merge pull request #3902 from crazy-max/github-builder-1.12.0 
ci: update docker/github-builder to v1.12.0
 2026-06-11 18:27:31 +02:00
CrazyMax 548e583d81 ci: update docker/github-builder to v1.12.0 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-06-11 17:39:34 +02:00
CrazyMaxandGitHub 8e59d65b5a Merge pull request #3896 from docker/dependabot/github_actions/codecov/codecov-action-7.0.0 
build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0
 2026-06-11 14:53:16 +02:00
Jiří Moravčík 9b37d78c89 build: improve resource limits output and docs 
Signed-off-by: Jiří Moravčík <jiri.moravcik@gmail.com>
 2026-06-11 11:18:35 +02:00
CrazyMax 803403710a vendor: update compose-go to v2.11.0 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-06-11 11:13:52 +02:00
CrazyMax bdb9077ef6 bake: remove stale path evaluation shim 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-06-11 00:07:27 +02:00
Tõnis TiigiandGitHub 89b455a9e3 Merge pull request #3897 from tonistiigi/update-buildkit-v0.31.0-rc1 
vendor: update buildkit to v0.31.0-rc1
 2026-06-10 14:58:01 -07:00
Tonis Tiigi b5cf212276 vendor: update buildkit to v0.31.0-rc1 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-06-10 14:19:03 -07:00
Tõnis TiigiandGitHub dd388bf70e Merge pull request #3883 from crazy-max/local-output-delete 
support BuildKit local output delete mode
 2026-06-10 14:14:12 -07:00
Tõnis TiigiandGitHub 4fa5bb2396 Merge pull request #3895 from tonistiigi/exec-proxy-support 
policy: enable proxy network from source policy caps
 2026-06-10 14:09:56 -07:00
dependabot[bot]andGitHub 786a5433c2 build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 6.0.1 to 7.0.0.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/v6.0.1...fb8b3582c8e4def4969c97caa2f19720cb33a72f)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-10 18:34:30 +00:00
Tonis Tiigi 25db0fb050 tests: verify exec traffic is policy-checked in caps proxy test 
Extend testBuildPolicyCapsProxy so that instead of only checking that
the network proxy was enabled, the build runs a command that makes an
HTTP request to a local test server. The policy denies that URL as an
HTTP source, so the test now verifies that exec traffic actually flows
through the proxy and is subject to source policy, including the deny
message and DENY decision in the build output.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-06-10 08:58:48 -07:00
CrazyMax b6e1b7328f build: gate local delete outputs 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-06-10 16:41:10 +02:00
CrazyMaxandCrazyMax 473c6ef306 bake: requires explicit allow for local output delete mode 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-06-10 16:41:09 +02:00
CrazyMax 1916210ddc vendor: update buildkit to f449174742bf 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-06-10 16:41:09 +02:00
Tonis TiigiandCrazyMax 4da04e3bf4 policy: enable proxy network from source policy caps 
Evaluate source policy caps before solve requests so policies can enable
BuildKit proxy networking. Policy can return caps {"exec.proxy": true}
during the caps request to enable proxy network
support for the solve.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-06-10 15:04:23 +02:00
CrazyMaxandGitHub 2fcfce0e71 Merge pull request #3894 from tonistiigi/0609-update-buildkit 
vendor: update buildkit to 41c29fffe299
 2026-06-10 13:33:47 +02:00
Tonis Tiigi 58a5a2cd60 vendor: update buildkit to 41c29fffe299 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-06-09 19:44:00 -07:00
Tõnis TiigiandGitHub 76703de985 Merge pull request #3876 from jirimoravcik/feat/per-step-resource-limits 
build: Add per-step CPU and memory resource limits
 2026-06-09 17:49:21 -07:00
CrazyMaxandGitHub 3a6e4e5e88 Merge pull request #3887 from crazy-max/codecov-test-results 
ci: upload test results to codecov
 2026-06-09 21:16:29 +02:00
Tõnis TiigiandGitHub b0d201a941 Merge pull request #3888 from crazy-max/fix-oci-mediatypes 
build: handle buildkit defaulting to oci mediatypes
 2026-06-09 11:37:05 -07:00
CrazyMax 8191e19d94 build: handle buildkit defaulting to oci mediatypes 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-06-09 19:43:48 +02:00
CrazyMaxandGitHub 0b358c7637 Merge pull request #3889 from docker/dependabot/github_actions/crazy-max-dot-github-a6a0ecf511 
build(deps): bump the crazy-max-dot-github group with 2 updates
 2026-06-09 15:55:32 +02:00
CrazyMaxandGitHub bad76e04fa Merge pull request #3890 from docker/dependabot/github_actions/github/codeql-action-4.36.2 
build(deps): bump github/codeql-action from 4.36.1 to 4.36.2
 2026-06-09 15:55:06 +02:00
CrazyMaxandGitHub fa085de627 Merge pull request #3891 from docker/dependabot/github_actions/docker/github-builder/dot-github/workflows/bake.yml-1.11.0 
build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.10.0 to 1.11.0
 2026-06-09 15:54:41 +02:00