Skip to content

Chore(deps): Bump the go-dependencies group across 1 directory with 4 updates - #3729

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-bff08dcb29
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-bff08dcb29

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 8, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 4 updates in the / directory: github.com/docker/buildx, github.com/docker/cli, github.com/moby/buildkit and github.com/spf13/pflag.

Updates github.com/docker/buildx from 0.38.1 to 0.38.2

Release notes

Sourced from github.com/docker/buildx's releases.

v0.38.2

Welcome to the v0.38.2 release of buildx!

Please try out the release binaries and report any issues at https://github.com/docker/buildx/issues.

Contributors

  • CrazyMax
  • Tõnis Tiigi
  • Sebastiaan van Stijn

Notable Changes

  • Fix Bake filesystem entitlement checks when building multiple targets together so paths from every target are checked against the approved entitlements. GHSA-xg6v-cv2h-2w5h
  • Fix Bake filesystem entitlement path boundaries so paths under the same parent directory that share the current working directory's basename prefix cannot bypass fs.read approval. GHSA-rghq-x9hf-hc3r

Dependency Changes

  • github.com/containerd/containerd/v2 v2.4.1 -> v2.4.2
  • github.com/klauspost/compress v1.20.1 -> v1.20.2
  • github.com/moby/buildkit v0.34.0 -> v0.34.2
  • github.com/tonistiigi/fsutil 83cac42c1c52 -> a72de9dcf763
  • go.yaml.in/yaml/v3 v3.0.5 -> v3.0.6

Previous release can be found at v0.38.1

Commits
  • 3c4cbd3 Merge pull request #4185 from crazy-max/v0.38_picks_v0.38.2
  • 898c3b5 vendor: update buildkit v0.34.2
  • f39bd22 vendor: go.yaml.in/yaml/v3 v3.0.6
  • 1e781cb bake: fix filesystem entitlement path boundaries
  • c0f635b bake: fix fs entitlement check with multiple targets
  • See full diff in compare view

Updates github.com/docker/cli from 29.9.2+incompatible to 29.9.3+incompatible

Commits
  • 5457199 Merge pull request #7470 from thaJeztah/29.x_backport_bump_compress
  • cac50c5 vendor: github.com/klauspost/compress v1.20.2
  • 00d843b Merge pull request #7467 from thaJeztah/29.x_backport_bump_swarmkit
  • 64fe50b vendor: github.com/moby/swarmkit/v2 v2.1.3
  • 999ab16 Merge pull request #7464 from thaJeztah/29.x_backport_bump_jose2
  • bb485bc vendor: github.com/go-jose/go-jose/v4 v4.1.7
  • 86e51b4 Merge pull request #7461 from thaJeztah/29.x_backport_bump_yaml
  • d9bbcfc Merge pull request #7457 from thaJeztah/29.x_backport_bump_jose
  • 2e88626 Merge pull request #7458 from thaJeztah/29.x_bump_version
  • a4971d1 vendor: go.yaml.in/yaml/v3 v3.0.6
  • Additional commits viewable in compare view

Updates github.com/moby/buildkit from 0.34.1 to 0.34.2

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.34.2

Welcome to the v0.34.2 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

  • CrazyMax
  • Sebastiaan van Stijn
  • Tõnis Tiigi

Notable Changes

  • Fix a daemon panic caused by resolver cache poisoning when a build resolves metadata for the same Git source reference twice. GHSA-2fqp-xg6f-v7gj
  • Prevent malicious clients with access to the BuildKit control APIs from setting extended attributes on files outside the BuildKit state directory, potentially granting elevated privileges to programs on the host. GHSA-w26x-xg27-7qjc

Dependency Changes

  • github.com/containerd/containerd/v2 v2.4.1 -> v2.4.2
  • github.com/klauspost/compress v1.20.1 -> v1.20.2
  • github.com/tonistiigi/fsutil 83cac42c1c52 -> a72de9dcf763

Previous release can be found at v0.34.1

Commits
  • 8c57943 Merge pull request #7357 from crazy-max/v0.34_picks_v0.34.2
  • 190c6bb ci: pin runj package for freebsd tests
  • 3d80d2d ci: migrate vagrant to vmactions
  • 6558374 vendor: github.com/containerd/containerd/v2 v2.4.2
  • 90bfd2f util/contentutil: remove uses of "-1" sentinel value for sizes
  • a49020b vendor: github.com/klauspost/compress v1.20.2
  • 16c6856 source/git: fix daemon panic on resolver cache poisoning
  • d4bfe06 vendor: update fsutil to a72de9dcf763
  • See full diff in compare view

Updates github.com/spf13/pflag from 1.0.10 to 1.1.0

Release notes

Sourced from github.com/spf13/pflag's releases.

v1.1.0

It's been long enough, and enough things have been fixed, that it might be time to release a new version, even if there isn't any particular big new issue to market as the reason for this release.

If you notice anything breaking, it is entirely un-intentional, but you might also have been relying on undocumented or buggy behavior. Please file an issue describing what you're doing, how it worked before this release and why it doesn't work anymore, and pin your projects to v1.0.10 (the latest release before this one) while we decide how to address your concerns.

What's Changed

New Contributors

... (truncated)

Commits
  • f8a9906 Merge pull request #533 from gdpu11/fix/count-preserve-value-on-error
  • f3a68a1 Merge pull request #534 from gdpu11/fix/native-integer-ranges
  • 70f7745 fix: reject native integer flag overflow on 32-bit systems
  • 2084408 test: cover native integer flag bounds on 32-bit systems
  • 7d0f377 fix: preserve count flag values when parsing fails
  • d26a4dc Merge pull request #526 from dewanshshekhar/fix/text-flag-type-check
  • 2d401c7 Fix type identification for text flags
  • fa584ba Merge pull request #520 from adenzhou1350/codex/fix-copy-go-string-value
  • cc9e689 Merge upstream master and retain its linter version
  • 70f284b Merge pull request #521 from Harshil-1603/fix/string-map-records
  • Additional commits viewable in compare view

@dependabot
dependabot Bot requested a review from a team as a code owner November 8, 2026 04:53
@dependabot dependabot Bot added the dependabot 🤖 Created by the dependabot label Nov 8, 2026
@kichristensen

Copy link
Copy Markdown
Contributor

@dependabot rebase

… updates

Bumps the go-dependencies group with 4 updates in the / directory: [github.com/docker/buildx](https://github.com/docker/buildx), [github.com/docker/cli](https://github.com/docker/cli), [github.com/moby/buildkit](https://github.com/moby/buildkit) and [github.com/spf13/pflag](https://github.com/spf13/pflag).


Updates `github.com/docker/buildx` from 0.38.1 to 0.38.2
- [Release notes](https://github.com/docker/buildx/releases)
- [Commits](docker/buildx@v0.38.1...v0.38.2)

Updates `github.com/docker/cli` from 29.9.2+incompatible to 29.9.3+incompatible
- [Commits](docker/cli@v29.9.2...v29.9.3)

Updates `github.com/moby/buildkit` from 0.34.1 to 0.34.2
- [Release notes](https://github.com/moby/buildkit/releases)
- [Commits](moby/buildkit@v0.34.1...v0.34.2)

Updates `github.com/spf13/pflag` from 1.0.10 to 1.1.0
- [Release notes](https://github.com/spf13/pflag/releases)
- [Commits](spf13/pflag@v1.0.10...v1.1.0)

---
updated-dependencies:
- dependency-name: github.com/docker/buildx
  dependency-version: 0.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/docker/cli
  dependency-version: 29.9.3+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/moby/buildkit
  dependency-version: 0.34.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/spf13/pflag
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Chore(deps): Bump the go-dependencies group with 4 updates Chore(deps): Bump the go-dependencies group across 1 directory with 4 updates Nov 8, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-dependencies-bff08dcb29 branch from baa885f to 8952580 Compare November 8, 2026 22:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependabot 🤖 Created by the dependabot

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant