Update module github.com/moby/buildkit to v0.31.1 [SECURITY] - #391
Open
trap-renovate[bot] wants to merge 1 commit into
Open
Update module github.com/moby/buildkit to v0.31.1 [SECURITY]#391trap-renovate[bot] wants to merge 1 commit into
trap-renovate[bot] wants to merge 1 commit into
Conversation
Contributor
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.28.1→v0.31.1BuildKit: Custom frontend could bypass Seccomp/AppArmor
CVE-2026-61711 / GHSA-7236-3392-c5c6
More information
Details
Impact
A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the
security.insecureentitlement. Other security measures, like Linux capabilities were still applied to these containers.Patches
Problem has been fixed in versions v0.31.1+
Workarounds
Only use BuildKit frontends from trusted providers.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
BuildKit has a possible runtime DoS via unbounded group parsing
CVE-2026-61712 / GHSA-72x6-4j93-7w86
More information
Details
Impact
Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the buildkitd process.
Patches
Issue is fixed in BuildKit v0.31.1+
Workarounds
Use trusted build sources.
References
This is BuildKit variant of containerd advisory GHSA-jpcc-p29g-p8mq
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
moby/buildkit (github.com/moby/buildkit)
v0.31.1Compare Source
buildkit 0.31.1
Welcome to the v0.31.1 release of buildkit!
This is a security patch release with two low severity security fixes.
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
Dependency Changes
This release has no dependency changes
Previous release can be found at v0.31.0
v0.31.0Compare Source
buildkit 0.31.0
Welcome to the v0.31.0 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
mode=deleteattribute which will replace the destination directory with the contents of the build result instead of merging it. Similar to the--deleteflag in rsync. #6561 #6864state.Requires()client helper can be used to define such dependencies in the build graph. #6829oci-mediatypes=falsecan be used for legacy Docker media types. This change raises the compatibility version of BuildKit v0.31.0 to 30. #6824resetoption to clear the unreferenced existing cache. #6612buildctlcompletion scripts flag--generate-bash-completionis no longer supported and has been replaced with--generate-shell-completion. #6848Dependency Changes
f64d9cf->545e8a4a39d601->d5411a9fc52b725d098a2a2aa163->0257b33404c0d5-> v0.1.1a2c0da2newdf92998->055de636f92a3b->3dc84a46f92a3b->3dc84a4Previous release can be found at v0.30.0
v0.30.0Compare Source
Welcome to the v0.30.0 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
fetch-by-commitoption where commit is fetched by the SHA and then associated with the reference. This is useful when checking out mutable referencesrefs/NR/mergewhere the commit SHA may change during invocation and cause checksum mismatch error #6708retry_modeandretry_max_attemptsto configure retry behavior of S3 client #6657disable_accept_encodingoption for GCS interoperability #6642Dependency Changes
b7c0b99->a39d6018636f87->6f92a3b8636f87->6f92a3bPrevious release can be found at v0.29.0
v0.29.0Compare Source
Welcome to the v0.29.0 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
SOURCE_DATE_EPOCHwith result metadata that can be used by exporters #6601Dependency Changes
824747b->b7c0b99ff82c1b->8636f870a764e5->8636f87Previous release can be found at v0.28.1
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.