Skip to content

chore(deps): bump the go-dependencies group across 1 directory with 2 updates#9

Merged
aledbf merged 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-b73e14cb69
Jul 22, 2026
Merged

chore(deps): bump the go-dependencies group across 1 directory with 2 updates#9
aledbf merged 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-b73e14cb69

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 18, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 2 updates in the / directory: github.com/moby/buildkit and golang.org/x/net.

Updates github.com/moby/buildkit from 0.31.1 to 0.31.2

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.31.2

Welcome to the v0.31.2 release of buildkit!

This is a security patch release with four moderate and one low severity security fixes.

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

  • Tõnis Tiigi
  • CrazyMax
  • Dawei Wei

Notable Changes

  • Git source checkout from a bundle file could lead to command injection. GHSA-hw3h-2gp9-cxpv
  • Possible panic when incorrect parameters sent from frontend. GHSA-qx3x-mv6r-52p6
  • LLB file operation can be tricked to remove /tmp directory contents. GHSA-32pv-7hq5-qhwq
  • Malicious client can bypass destination directory validation on local sources upload. GHSA-g2h8-426c-7976
  • WCOW cache mount source selector resolves NTFS junctions outside of cache root. GHSA-388v-wmr2-g2v2
  • Fix possible buildctl failures after successful builds over slow connhelper transports. #6940
  • Fix possible daemon crash during concurrent builds. #6916

Dependency Changes

  • github.com/tonistiigi/fsutil 0257b3308df4 -> 30cd4fc5d911

Previous release can be found at v0.31.1

Commits
  • e42e1bf Merge pull request #6960 from tonistiigi/v0.31.2-picks
  • 1a32681 vendor: update github.com/tonistiigi/fsutil to 30cd4fc5d911
  • 0669f4b executor/oci: avoid delete access for WCOW pin
  • 44c0ed6 executor/oci: pin resolved WCOW cache source
  • 473663b executor/oci: pin WCOW cache mount source across mount realization
  • a9155a4 executor/oci: confine WCOW cache mount source within cache root
  • 3916124 fileop: contain rm parent traversal
  • 5aefc4a solver: reject negative LLB input indexes
  • 1659c30 solver: add tests for op input index validation
  • ed77788 solver: validate op input indices to avoid panics
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.56.0 to 0.57.0

Commits
  • b8f09f6 go.mod: update golang.org/x dependencies
  • f05f21b idna: reject all-ASCII xn-- labels on all Go versions
  • 0f748cf internal/http3: clean up stream I/O methods usages in tests
  • 0bb961e internal/http3: add net/http.ResponseController support
  • 0ca694d webdav: document Dir's lack of defense against filesystem modification
  • bd5f1dc http2: initialize Transport on NewClientConn
  • 488ff63 bpf: add security considerations to package docs
  • 93d1f25 xsrftoken: avoid token collisions
  • 5a3baee internal/http3: prevent panic in QPACK decoder due to overflow
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 18, 2026
@github-code-quality

github-code-quality Bot commented Jul 18, 2026

Copy link
Copy Markdown

Code Coverage Overview

Languages: Go

Go / code-coverage/go

The overall coverage in commit 00052f0 in the dependabot/go_module... branch remains at 53%, unchanged from commit e9e7e10 in the main branch.


Updated July 22, 2026 04:07 UTC

aledbf added a commit that referenced this pull request Jul 22, 2026
* test(parity): retry parity sides on transient docker build flakes

The runtime parity lane's docker builds flake on contended CI runners
(BuildKit "failed to solve", a registry hiccup, or a container-setup
failure surfaced as `Command failed: docker build`). A flake on one
side while the other succeeds shows up as a false TS-vs-Go divergence
and fails the job under PARITY_STRICT=true, where an inconclusive skip
is red too. This turned unrelated dependabot PRs (#9, #10) and a main
daily run red on up.dotfiles-local* cases.

Wrap each side's CLI invocation in a bounded retry (2 attempts) gated
on isRetryableFailure, a predicate deliberately broader than
isInfraError. Retrying is safe: a deterministic product failure
reproduces on the next attempt and still goes red. The narrow
isInfraError/classifyParitySide oracle-usability path is unchanged, so
no real divergence is masked as a skip.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Manuel Alejandro de Brito Fontes <aledbf@gmail.com>

---------

Signed-off-by: Manuel Alejandro de Brito Fontes <aledbf@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
@aledbf

aledbf commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

… updates

Bumps the go-dependencies group with 2 updates in the / directory: [github.com/moby/buildkit](https://github.com/moby/buildkit) and [golang.org/x/net](https://github.com/golang/net).


Updates `github.com/moby/buildkit` from 0.31.1 to 0.31.2
- [Release notes](https://github.com/moby/buildkit/releases)
- [Commits](moby/buildkit@v0.31.1...v0.31.2)

Updates `golang.org/x/net` from 0.56.0 to 0.57.0
- [Commits](golang/net@v0.56.0...v0.57.0)

---
updated-dependencies:
- dependency-name: github.com/moby/buildkit
  dependency-version: 0.31.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump the go-dependencies group with 2 updates chore(deps): bump the go-dependencies group across 1 directory with 2 updates Jul 22, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-dependencies-b73e14cb69 branch from e709871 to 00052f0 Compare July 22, 2026 04:06
@aledbf
aledbf merged commit d9a9ef1 into main Jul 22, 2026
11 checks passed
@aledbf
aledbf deleted the dependabot/go_modules/go-dependencies-b73e14cb69 branch July 22, 2026 11:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant