Built-in Dockerfile frontend has been updated to v1.27.1 changelog.
Fix proxy CA cleanup so build steps cannot redirect it outside the build rootfs, block it with a special file, or succeed when cleanup fails. GHSA-2f5p-x9ph-g97x
Fix a daemon panic when a build requests CDI devices while CDI support is disabled. Optional devices are ignored; required devices produce an error. GHSA-r456-g3gm-cvxf
Verify container blob contents against their claimed digest before caching them. This protects shared caches from unverified blobs supplied through the low-level LLB API. GHSA-p3rc-w3hc-pqvv
Verify applied image layer DiffIDs, bind lazy stargz snapshots to their verified TOC digest, and isolate legacy layer snapshots. Image source cache keys no longer rely on unverified DiffIDs. GHSA-f2v9-hprr-32q3
Prevent malicious external frontends from crashing the daemon through gateway container lifecycle races or malformed requests and definitions. GHSA-4hgw-qrhw-fhg8
Reject special files in daemon-side snapshot reads and replace existing special files safely in LLB mkfile operations. GHSA-9728-qjrv-2xh2
Reject malformed LLB file operations with invalid symlink owner inputs instead of allowing a daemon panic. GHSA-fjj4-h6vf-m9hj
Reject malformed LLB merge operations with mismatched input counts instead of allowing a daemon panic. GHSA-cv6p-7w7g-xjwq
Limit Dockerfile, .dockerignore, gateway file, and nested LLB definition reads to prevent oversized inputs from exhausting daemon memory. GHSA-mgqf-486f-49vp
Apply source policies to Git bundle locators and reject Git full remote URLs that do not match the source identifier. GHSA-66hf-6vf5-87hc

Dependency Changes

github.com/containerd/containerd/v2 v2.3.4 -> v2.3.6
golang.org/x/crypto v0.55.0 -> v0.56.0

Previous release can be found at v0.33.0

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [buildkit](https://github.com/moby/buildkit) | patch | `0.33.0` → `0.33.1` | --- ### Release Notes <details> <summary>moby/buildkit (buildkit)</summary> ### [`v0.33.1`](https://github.com/moby/buildkit/releases/tag/v0.33.1) [Compare Source](https://github.com/moby/buildkit/compare/v0.33.0...v0.33.1) Welcome to the v0.33.1 release of buildkit! Please try out the release binaries and report any issues at <https://github.com/moby/buildkit/issues>. ##### Contributors - Tõnis Tiigi - CrazyMax - Sebastiaan van Stijn ##### Notable Changes - Built-in Dockerfile frontend has been updated to v1.27.1 [changelog](https://github.com/moby/buildkit/releases/tag/dockerfile%2F1.27.1). - Fix proxy CA cleanup so build steps cannot redirect it outside the build rootfs, block it with a special file, or succeed when cleanup fails. GHSA-2f5p-x9ph-g97x - Fix a daemon panic when a build requests CDI devices while CDI support is disabled. Optional devices are ignored; required devices produce an error. GHSA-r456-g3gm-cvxf - Verify container blob contents against their claimed digest before caching them. This protects shared caches from unverified blobs supplied through the low-level LLB API. GHSA-p3rc-w3hc-pqvv - Verify applied image layer DiffIDs, bind lazy stargz snapshots to their verified TOC digest, and isolate legacy layer snapshots. Image source cache keys no longer rely on unverified DiffIDs. GHSA-f2v9-hprr-32q3 - Prevent malicious external frontends from crashing the daemon through gateway container lifecycle races or malformed requests and definitions. GHSA-4hgw-qrhw-fhg8 - Reject special files in daemon-side snapshot reads and replace existing special files safely in LLB `mkfile` operations. GHSA-9728-qjrv-2xh2 - Reject malformed LLB file operations with invalid symlink owner inputs instead of allowing a daemon panic. GHSA-fjj4-h6vf-m9hj - Reject malformed LLB merge operations with mismatched input counts instead of allowing a daemon panic. GHSA-cv6p-7w7g-xjwq - Limit Dockerfile, `.dockerignore`, gateway file, and nested LLB definition reads to prevent oversized inputs from exhausting daemon memory. GHSA-mgqf-486f-49vp - Apply source policies to Git bundle locators and reject Git full remote URLs that do not match the source identifier. GHSA-66hf-6vf5-87hc ##### Dependency Changes - **github.com/containerd/containerd/v2** v2.3.4 -> v2.3.6 - **golang.org/x/crypto** v0.55.0 -> v0.56.0 Previous release can be found at [v0.33.0](https://github.com/moby/buildkit/releases/tag/v0.33.0) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot bot scheduled this pull request to auto merge when all checks succeed

2026-09-30 17:00:49 +02:00

renovate-bot bot force-pushed renovate/buildkit-0.x from ee2c2fe01a

/ check (pull_request) Failing after 12s

Details

to 3dd1584f23

/ check (pull_request) Successful in 17s

Details

2026-10-01 10:00:43 +02:00

Compare

renovate-bot bot merged commit 77eaf2134a into next

2026-10-01 10:01:05 +02:00