Skip to content

chore(deps): Bump github.com/moby/buildkit from 0.25.1 to 0.28.1 in /mcv - #117

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/mcv/github.com/moby/buildkit-0.28.1
Open

chore(deps): Bump github.com/moby/buildkit from 0.25.1 to 0.28.1 in /mcv#117
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/mcv/github.com/moby/buildkit-0.28.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 2, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/moby/buildkit from 0.25.1 to 0.28.1.

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.28.1

Welcome to the v0.28.1 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

  • Tõnis Tiigi
  • CrazyMax
  • Sebastiaan van Stijn

Notable Changes

  • Fix insufficient validation of Git URL #ref:subdir fragments that could allow access to restricted files outside the checked-out repository root. GHSA-4vrq-3vrq-g6gg
  • Fix a vulnerability where an untrusted custom frontend could cause files to be written outside the BuildKit state directory. GHSA-4c29-8rgm-jvjj
  • Fix a panic when processing invalid .dockerignore patterns during COPY. #6610 moby/patternmatcher#9

Dependency Changes

  • github.com/moby/patternmatcher v0.6.0 -> v0.6.1

Previous release can be found at v0.28.0

v0.28.0

buildkit 0.28.0

Welcome to the v0.28.0 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

  • Tõnis Tiigi
  • CrazyMax
  • Sebastiaan van Stijn
  • Jonathan A. Sternberg
  • Akihiro Suda
  • Amr Mahdi
  • Dan Duvall
  • David Karlsson
  • Jonas Geiler
  • Kevin L.
  • rsteube

... (truncated)

Commits
  • 45b038c git: normalize and validate subdir paths
  • f5462c2 git: harden ref arg handling
  • 71577a5 source: extract SafeFileName into shared pathutil package
  • df43783 source/http: use os.Root for saved file operations
  • 9ce6f62 source/http: sanitize downloaded filenames
  • 099cf80 executor: validate container IDs centrally
  • 2642113 Merge pull request #6610 from thaJeztah/0.28_backport_bump_patternmatcher
  • 802da78 vendor: github.com/moby/patternmatcher v0.6.1
  • 5245d86 Merge pull request #6551 from tonistiigi/v0.28-cherry-picks
  • 90ee5de vendor: update x/net to v0.51.0
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Apr 2, 2026
@maryamtahhan

Copy link
Copy Markdown
Collaborator

@dependabot help

@maryamtahhan

Copy link
Copy Markdown
Collaborator

@dependabot recreate

@dependabot
dependabot Bot force-pushed the dependabot/go_modules/mcv/github.com/moby/buildkit-0.28.1 branch from 45d9351 to 95c1260 Compare April 15, 2026 14:20
@maryamtahhan

Copy link
Copy Markdown
Collaborator

https://github.com/dependabot recreate

@dependabot
dependabot Bot force-pushed the dependabot/go_modules/mcv/github.com/moby/buildkit-0.28.1 branch from 95c1260 to 4b5349a Compare April 17, 2026 09:10
@maryamtahhan
maryamtahhan force-pushed the dependabot/go_modules/mcv/github.com/moby/buildkit-0.28.1 branch 2 times, most recently from 3b8aebd to eb4327c Compare April 21, 2026 14:22
@maryamtahhan
maryamtahhan force-pushed the dependabot/go_modules/mcv/github.com/moby/buildkit-0.28.1 branch 9 times, most recently from d419908 to 51a82aa Compare July 29, 2026 16:29
Upgrade buildah, podman, and storage across MCV and GKM instead of
downgrading dependencies or patching vendor imports. Storage v1.63.0
uses pathrs-lite natively, resolving the filepath-securejoin v0.6.x
break from buildkit 0.28.1 without sed workarounds.

Co-authored-by: Cursor <cursoragent@cursor.com>
@maryamtahhan
maryamtahhan force-pushed the dependabot/go_modules/mcv/github.com/moby/buildkit-0.28.1 branch from 51a82aa to 5f36e74 Compare July 30, 2026 08:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant