fix(security/medium/mimir-build-image): update module github.com/moby/buildkit to v0.31.1 [security] (main) - #16427
Open
renovate-sh-app[bot] wants to merge 2 commits into
Conversation
…/buildkit to v0.31.1 [security] | datasource | package | from | to | | ---------- | ------------------------ | ------- | ------- | | go | github.com/moby/buildkit | v0.29.0 | v0.31.1 | Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
renovate-sh-app
Bot
added
automerge-security-update
severity:MEDIUM
update-minor
labels
Contributor
Author
ℹ️ Artifact update noticeFile name: mimir-build-image/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
Contributor
|
Building new version of mimir-build-image. After image is built and pushed to the registry, a new commit will automatically be added to this PR with new image version |
mimir-github-bot
Bot
requested review from
bubu11e,
vaxvms and
wilfriedroset
as code owners
August 20, 2026 02:18
Contributor
|
Not building new version of mimir-build-image. This PR modifies the build image or the build image build workflow, but the image |
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.29.0→v0.31.1Warning
Some dependencies could not be looked up. Check the warning logs for more information.
BuildKit: Custom frontend could bypass Seccomp/AppArmor
CVE-2026-61711 / GHSA-7236-3392-c5c6
More information
Details
Impact
A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the
security.insecureentitlement. Other security measures, like Linux capabilities were still applied to these containers.Patches
Problem has been fixed in versions v0.31.1+
Workarounds
Only use BuildKit frontends from trusted providers.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
BuildKit has a possible runtime DoS via unbounded group parsing
CVE-2026-61712 / GHSA-72x6-4j93-7w86
More information
Details
Impact
Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the buildkitd process.
Patches
Issue is fixed in BuildKit v0.31.1+
Workarounds
Use trusted build sources.
References
This is BuildKit variant of containerd advisory GHSA-jpcc-p29g-p8mq
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
moby/buildkit (github.com/moby/buildkit)
v0.31.1Compare Source
buildkit 0.31.1
Welcome to the v0.31.1 release of buildkit!
This is a security patch release with two low severity security fixes.
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
Dependency Changes
This release has no dependency changes
Previous release can be found at v0.31.0
v0.31.0Compare Source
buildkit 0.31.0
Welcome to the v0.31.0 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
mode=deleteattribute which will replace the destination directory with the contents of the build result instead of merging it. Similar to the--deleteflag in rsync. #6561 #6864state.Requires()client helper can be used to define such dependencies in the build graph. #6829oci-mediatypes=falsecan be used for legacy Docker media types. This change raises the compatibility version of BuildKit v0.31.0 to 30. #6824resetoption to clear the unreferenced existing cache. #6612buildctlcompletion scripts flag--generate-bash-completionis no longer supported and has been replaced with--generate-shell-completion. #6848Dependency Changes
f64d9cf->545e8a4a39d601->d5411a9fc52b725d098a2a2aa163->0257b33404c0d5-> v0.1.1a2c0da2newdf92998->055de636f92a3b->3dc84a46f92a3b->3dc84a4Previous release can be found at v0.30.0
v0.30.0Compare Source
Welcome to the v0.30.0 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Contributors
Notable Changes
fetch-by-commitoption where commit is fetched by the SHA and then associated with the reference. This is useful when checking out mutable referencesrefs/NR/mergewhere the commit SHA may change during invocation and cause checksum mismatch error #6708retry_modeandretry_max_attemptsto configure retry behavior of S3 client #6657disable_accept_encodingoption for GCS interoperability #6642Dependency Changes
b7c0b99->a39d6018636f87->6f92a3b8636f87->6f92a3bPrevious release can be found at v0.29.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
Need help?
You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.