chore(deps): bump github.com/moby/buildkit from 0.10.4 to 0.11.4

Open dependabot[bot] opened this issue 2 years ago • 0 comments

Bumps github.com/moby/buildkit from 0.10.4 to 0.11.4.

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.11.4

https://hub.docker.com/r/moby/buildkit

Notable changes:

This release contains two security fixes.

Fix the issue where credentials inlined to Git URLs could end up in provenance attestation https://github.com/moby/buildkit/security/advisories/GHSA-gc89-7gcr-jxqc

Containerd has been updated to 1.6.18 , fixing issue with supplementary groups not being set up properly https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p #3651

Other updates

Fix possible panic with writing annotations #3670

Fix possible panic with passing nil frontend input #3659

Fix file capabilities in merged snapshots by changing chown order #3671

v0.11.3

Welcome to the 0.11.3 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Notable Changes

Builtin Dockerfile frontend updated to v1.5.2

Fix not mounting optional secrets missing from build requests #3561

Fix an issue with Github cache backend that could cause invalid range requests #3618

Fix possible cache loading error when loading local cache created by BuildKit releases older than v0.10 #3605

Fix issues with missing layer metadata in SBOMs in latest releases #3594

Fix possible "digest not found" error on exporting build results #3566

Make sure timezones are dropped on handling SOURCE_DATE_EPOCH #3559

Dependency Changes

github.com/containerd/containerd 1709cfe273d9 -> v1.6.16

Previous release can be found at v0.11.2

v0.11.2

Welcome to the 0.11.2 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Notable changes

Update containerd patches to fix regression in handling push errors #3531

... (truncated)

Commits

3abd1ef Merge pull request from GHSA-gc89-7gcr-jxqc
7d45f99 provenance: ensure URLs are redacted before written
218e934 Merge pull request #3676 from vvoland/sbomsupplements-hang-011
e344f3a test/client: Close buildkit client
0df0faa Merge pull request #3614 from crazy-max/v0.11_deprecate-buildinfo
2590f95 Merge pull request #3673 from tonistiigi/v0.11.4-picks
97b37f9 diffapply: do chown before xattrs
17401b5 Fix buildkitd panic when frontend input is nil.
99aaa10 fix a possible panic on cache
837b4b2 buildinfo: add BUILDKIT_BUILDINFO build arg
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Mar 07 '23 20:03 dependabot[bot]