Bump the go-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the go-dependencies group with 5 updates in the / directory:

Package	From	To
github.com/containerd/containerd	1.7.33	1.7.34
github.com/moby/buildkit	0.30.0	0.31.1
github.com/moby/moby/api	1.54.2	1.55.0
github.com/moby/moby/client	0.4.1	0.5.0
github.com/osscontainertools/kaniko	1.27.5	1.28.0

Updates github.com/containerd/containerd from 1.7.33 to 1.7.34

Release notes

Sourced from github.com/containerd/containerd's releases.

containerd 1.7.34

Welcome to the v1.7.34 release of containerd!

The thirty-fourth patch release for containerd 1.7 contains various fixes and updates.

Highlights

Container Runtime Interface (CRI)

• Fix lost container exit events when events arrive before container info is cached (#11634)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Chris Henzie
• Samuel Karp
• Akihiro Suda
• Maksym Pavlenko
• Phil Estes
• Sopho Merkviladze
• ningmingxiao

Changes

• Prepare release notes for v1.7.34 (#13753)
  • 7db112471 Prepare release notes for v1.7.34
• Update go to 1.26.5/1.25.12 (#13731)
  • c06144c85 Update go to 1.26.5/1.25.12
• ci: pin fog-json to resolve gem conflict (#13712)
  • b84460e50 ci: pin fog-json to resolve gem conflict
• cri:fix lost container exit events if they arrive before info is cached (#11634)
  • 2fe076ea7 cri:fix lost container exit events if they arrive before info is cached
• build(deps): bump golang.org/x/* dependencies (#13502)
  • 862057716 bump golang.org/x/* dependencies

Dependency Changes

• golang.org/x/crypto v0.45.0 -> v0.52.0
• golang.org/x/mod v0.29.0 -> v0.35.0
• golang.org/x/net v0.47.0 -> v0.55.0
• golang.org/x/sync v0.18.0 -> v0.20.0
• golang.org/x/sys v0.38.0 -> v0.45.0
• golang.org/x/term v0.37.0 -> v0.43.0
• golang.org/x/text v0.31.0 -> v0.37.0

... (truncated)

Commits

• fb9028b Merge pull request #13753 from chrishenzie/prepare-v1.7.34
• 7db1124 Prepare release notes for v1.7.34
• 9f2643b Merge pull request #13731 from chrishenzie/1.7-go1.25.12
• c06144c Update go to 1.26.5/1.25.12
• 321152f Merge pull request #13712 from k8s-infra-cherrypick-robot/cherry-pick-13707-t...
• b84460e ci: pin fog-json to resolve gem conflict
• 7df7d64 Merge pull request #11634 from ningmingxiao/v1.7_fix_event
• 2fe076e cri:fix lost container exit events if they arrive before info is cached
• 71bbb8c Merge pull request #13502 from smerkviladze/backport-1.7/bump_x_deps
• 8620577 bump golang.org/x/* dependencies
• See full diff in compare view

Updates github.com/moby/buildkit from 0.30.0 to 0.31.1

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.31.1

buildkit 0.31.1

Welcome to the v0.31.1 release of buildkit!

This is a security patch release with two low severity security fixes.

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi

Notable Changes

• Custom frontend could bypass Seccomp/AppArmor restrictions GHSA-7236-3392-c5c6
• Possible runtime DoS via unbounded group parsing GHSA-72x6-4j93-7w86

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.31.0

v0.31.0

buildkit 0.31.0

Welcome to the v0.31.0 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Sebastiaan van Stijn
• Bjorn Neergaard
• Jonathan A. Sternberg
• Akihiro Suda
• Bryce Gibson
• Ava Barron
• Brian Goff
• Jiří Moravčík
• ZRHann
• Kevin NZUGUEM

... (truncated)

Commits

• 673b7e0 Merge pull request #6896 from tonistiigi/v0.31.1-picks
• 81ce1c6 ci: tolerate empty test matrix includes
• 69a3924 user: limit size of parsed passwd/group files
• 3ea6dd0 security: validate exec security modes
• c411f0a Merge pull request #6876 from thaJeztah/bump_runc
• f292e5c Dockerfile: update runc binary to v1.3.6
• d31ba4a Merge pull request #6867 from okhowang/fix/platforms-data-race
• e819928 Merge pull request #6869 from crazy-max/update-policy-helpers
• e4d0dba chore: update generated files
• c13539b vendor: update policy-helpers to d5411a945cfc
• Additional commits viewable in compare view

Updates github.com/moby/moby/api from 1.54.2 to 1.55.0

Release notes

Sourced from github.com/moby/moby/api's releases.

api/v1.55.0

1.55.0

Changelog

• POST /containers/{id}/update now supports per-device blkio resource settingss. moby/moby#52651
• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
• docs: clarify swarm join required fields. moby/moby#52763

api/v1.55.0-rc.1

1.55.0-rc.1

Changelog

• POST /containers/{id}/update now supports per-device blkio resource settingss. moby/moby#52651
• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
• docs: clarify swarm join required fields. moby/moby#52763

Commits

• b6c53c2 Merge pull request #52773 from vvoland/c8d-amd64-variants
• 01115e8 Merge pull request #52906 from vvoland/fix-TestContainerWithConflictingNoneNe...
• b36296f Merge pull request #52913 from thaJeztah/windows_does_stats
• a81aa78 TestContainerWithConflictingNoneNetwork: Extend Windows timeout
• 908a35a Merge pull request #52914 from thaJeztah/no_stderr
• 04d33b5 Merge pull request #52912 from thaJeztah/cleanup_GenerateRandomAlphaOnlyString
• 3b2f557 Merge pull request #52722 from notandruu/integration/migrate-TestInspectAPIIm...
• 62b3aae Merge pull request #52901 from vvoland/c8d-imageusage
• 11d3342 integration-cli: un-skip stats tests on Windows
• a47b1b2 Merge pull request #52891 from smerkviladze/attestations-clearer-blob-missing...
• Additional commits viewable in compare view

Updates github.com/moby/moby/client from 0.4.1 to 0.5.0

Release notes

Sourced from github.com/moby/moby/client's releases.

client/0.5.0

0.5.0

Changelog

• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

client/v0.5.0-rc.1

0.5.0-rc.1

Changelog

• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

Changelog

Sourced from github.com/moby/moby/client's changelog.

0.5.0 (2013-07-17)

• Runtime: List all processes running inside a container with 'docker top'
• Runtime: Host directories can be mounted as volumes with 'docker run -v'
• Runtime: Containers can expose public UDP ports (eg, '-p 123/udp')
• Runtime: Optionally specify an exact public port (eg. '-p 80:4500')
• Registry: New image naming scheme inspired by Go packaging convention allows arbitrary combinations of registries
• Builder: ENTRYPOINT instruction sets a default binary entry point to a container
• Builder: VOLUME instruction marks a part of the container as persistent data

• Builder: 'docker build' displays the full output of a build by default
• Runtime: 'docker login' supports additional options

• Runtime: Dont save a container's hostname when committing an image.
• Registry: Fix issues when uploading images to a private registry

0.4.8 (2013-07-01)

• Builder: New build operation ENTRYPOINT adds an executable entry point to the container.

• Runtime: Fix a bug which caused 'docker run -d' to no longer print the container ID.
• Tests: Fix issues in the test suite

0.4.7 (2013-06-28)

• Registry: easier push/pull to a custom registry
• Remote API: the progress bar updates faster when downloading and uploading large files

• Remote API: fix a bug in the optional unix socket transport

• Runtime: improve detection of kernel version

• Runtime: host directories can be mounted as volumes with 'docker run -b'

• Runtime: fix an issue when only attaching to stdin

• Runtime: use 'tar --numeric-owner' to avoid uid mismatch across multiple hosts
• Hack: improve test suite and dev environment
• Hack: remove dependency on unit tests on 'os/user'

• Documentation: add terminology section

0.4.6 (2013-06-22)

• Runtime: fix a bug which caused creation of empty images (and volumes) to crash.

0.4.5 (2013-06-21)

• Builder: 'docker build git://URL' fetches and builds a remote git repository

• Runtime: 'docker ps -s' optionally prints container size
• Tests: Improved and simplified

• Runtime: fix a regression introduced in 0.4.3 which caused the logs command to fail.
• Builder: fix a regression when using ADD with single regular file.

0.4.4 (2013-06-19)

• Builder: fix a regression introduced in 0.4.3 which caused builds to fail on new clients.

0.4.3 (2013-06-19)

• Builder: ADD of a local file will detect tar archives and unpack them

• Runtime: Remove bsdtar dependency
• Runtime: Add unix socket and multiple -H support
• Runtime: Prevent rm of running containers
• Runtime: Use go1.1 cookiejar
• Builder: ADD improvements: use tar for copy + automatically unpack local archives

... (truncated)

Commits

• 51f6c4a Merge pull request #1227 from dotcloud/bump_0.5.0
• f4eaec3 Merge pull request #1226 from metalivedev/easydockerfile
• b083418 change -b -> -v and add udp example
• 5794857 Merge pull request #1169 from crosbymichael/buildfile-tests
• e7f3f6f Add unit tests for buildfile config instructions
• aa56714 Make dockerfile docs easier to find. Clean up formatting.
• f8dfd0a Merge pull request #1225 from dotcloud/hotfix_docker_rmi
• 3dbf9c6 Merge pull request #1219 from metalivedev/docs-repoupdate
• de563a3 Merge pull request #1194 from crosbymichael/build-verbose
• 9cf2b41 change rm usage in docs
• Additional commits viewable in compare view

Updates github.com/osscontainertools/kaniko from 1.27.5 to 1.28.0

Release notes

Sourced from github.com/osscontainertools/kaniko's releases.

v1.28.0

Update Notice

Kaniko now officially features an Alpine variant, making it effortless customize your builder:

FROM ghcr.io/osscontainertools/kaniko:v1.28.0-alpine
RUN apk add --no-cache curl jq

In this Release we activated these feature-flags:

• FF_KANIKO_RUN_MOUNT_BIND
• FF_KANIKO_VOLUME_SKIP_MKDIR
• FF_KANIKO_BUILDKIT_ARG_ENV_PRECEDENCE
• FF_KANIKO_PRESERVE_HARDLINKS
• FF_KANIKO_DEPRECATE_INTER_STAGE_RESTORE
• FF_KANIKO_NO_PROPAGATE_ANNOTATIONS
• FF_KANIKO_PRESERVE_MOUNTED_PATHS
• FF_KANIKO_OCI_WARMER
• FF_KANIKO_WARMER_CACHE_LOCK

⚠️ Some of these flags change how cache keys are computed. In particular FF_KANIKO_NO_PROPAGATE_ANNOTATIONS shifts every base-image-derived key, and FF_KANIKO_BUILDKIT_ARG_ENV_PRECEDENCE changes keys for builds with ARG/ENV. Existing cache entries are invalidated, so the first build after upgrading is a full rebuild that repopulates the cache.

⚠️ FF_KANIKO_OCI_WARMER switches the warmer to an OCI layout, so an existing warmer cache can no longer be used and can be deleted.

FF_KANIKO_RUN_MOUNT_BIND lets you mount a file from the build context into a RUN step instead of COPY-ing it in, so it never lands in a layer:

RUN --mount=type=bind,source=requirements.txt,target=requirements.txt \
  uv pip install -r requirements.txt

ℹ️ Cross-stage bind mounts from=<stage> are not yet supported.

FF_KANIKO_VOLUME_SKIP_MKDIR stops kaniko from creating the directory declared by VOLUME, matching docker. Creating it gave the directory a fresh mtime on every run, which broke cache hits in downstream stages, so until now a VOLUME was silently invalidating your cache. If a later step relies on the directory existing, create it yourself with RUN, or WORKDIR if your base image has no shell:

VOLUME /data
WORKDIR /data

FF_KANIKO_BUILDKIT_ARG_ENV_PRECEDENCE resolves an ARG and ENV of the same name by declaration order, matching BuildKit. An ARG declared after an ENV (including one inherited from a base image) now wins, where kaniko previously let the ENV win unconditionally:

FROM alpine AS base
ENV HELLO=upstream
FROM base AS child
ARG HELLO
RUN echo $HELLO   # now prints the --build-arg value, not "upstream"

If you relied on the old behaviour, move the ENV after the ARG so it keeps overriding.

FF_KANIKO_PRESERVE_HARDLINKS keeps hardlinks intact when you COPY --from=<image> a remote image instead of expanding each into an independent file, which can significantly shrink images that rely on hardlinks (e.g. git installs where many binaries share one inode). No migration needed, the output is smaller for the same input.

... (truncated)

Changelog

Sourced from github.com/osscontainertools/kaniko's changelog.

v1.28.0 Release 2026-06-28

Update Notice

In this Release we activated these feature-flags:

• FF_KANIKO_RUN_MOUNT_BIND
• FF_KANIKO_VOLUME_SKIP_MKDIR
• FF_KANIKO_BUILDKIT_ARG_ENV_PRECEDENCE
• FF_KANIKO_PRESERVE_HARDLINKS
• FF_KANIKO_DEPRECATE_INTER_STAGE_RESTORE
• FF_KANIKO_NO_PROPAGATE_ANNOTATIONS
• FF_KANIKO_PRESERVE_MOUNTED_PATHS
• FF_KANIKO_OCI_WARMER
• FF_KANIKO_WARMER_CACHE_LOCK

⚠️ Some of these flags change how cache keys are computed. In particular FF_KANIKO_NO_PROPAGATE_ANNOTATIONS shifts every base-image-derived key, and FF_KANIKO_BUILDKIT_ARG_ENV_PRECEDENCE changes keys for builds with ARG/ENV. Existing cache entries are invalidated, so the first build after upgrading is a full rebuild that repopulates the cache.

⚠️ FF_KANIKO_OCI_WARMER switches the warmer to an OCI layout, so an existing warmer cache can no longer be used and can be deleted.

FF_KANIKO_RUN_MOUNT_BIND lets you mount a file from the build context into a RUN step instead of COPY-ing it in, so it never lands in a layer:

RUN --mount=type=bind,source=requirements.txt,target=requirements.txt \
  uv pip install -r requirements.txt

ℹ️ Cross-stage bind mounts from=<stage> are not yet supported.

FF_KANIKO_VOLUME_SKIP_MKDIR stops kaniko from creating the directory declared by VOLUME, matching docker. Creating it gave the directory a fresh mtime on every run, which broke cache hits in downstream stages, so until now a VOLUME was silently invalidating your cache. If a later step relies on the directory existing, create it yourself with RUN, or WORKDIR if your base image has no shell:

VOLUME /data
WORKDIR /data

FF_KANIKO_BUILDKIT_ARG_ENV_PRECEDENCE resolves an ARG and ENV of the same name by declaration order, matching BuildKit. An ARG declared after an ENV (including one inherited from a base image) now wins, where kaniko previously let the ENV win unconditionally:

FROM alpine AS base
ENV HELLO=upstream
FROM base AS child
ARG HELLO
RUN echo $HELLO   # now prints the --build-arg value, not "upstream"

If you relied on the old behaviour, move the ENV after the ARG so it keeps overriding.

FF_KANIKO_PRESERVE_HARDLINKS keeps hardlinks intact when you COPY --from=<image> a remote image instead of expanding each into an independent file, which can significantly shrink images that rely on hardlinks (e.g. git installs where many binaries share one inode). No migration needed, the output is smaller for the same input.

ℹ️ Hardlinks from other build stages are not yet preserved, only from remote images.

FF_KANIKO_DEPRECATE_INTER_STAGE_RESTORE disables the inter-stage restore that --preserve-context performed between stages. Its original purpose, smuggling secrets across stages, is now served by RUN --mount=type=secret:

RUN --mount=type=secret,id=netrc,target=/root/.netrc \
  uv pip install -r requirements.txt
</tr></table> 

... (truncated)

Commits

• 3f96357 Merge pull request #846 from osscontainertools/release-v1.28.0
• c64b151 release
• c3e76b8 Merge pull request #845 from osscontainertools/dependabot/github_actions/acti...
• 425d57a build(deps): bump imjasonh/setup-crane in the actions group
• 9dd2035 graduate feature flags for v1.28.0 (#802)
• b368330 Merge pull request #837 from osscontainertools/mz-readme-fold-args-toc
• 59ce49b bump docker to 29.5.2 and k3s to v1.36.2 in integration tests (#827)
• a86660f mz841: ADD applies the tar root entry to the destination dir (#842)
• 6a76c3a Merge pull request #838 from osscontainertools/dependabot/go_modules/gomod-a2...
• 4115533 build(deps): bump github.com/docker/cli in the gomod group
• Additional commits viewable in compare view

Updates golang.org/x/sync from 0.20.0 to 0.21.0

Commits

• 5071ed6 all: fix some comments to improve readability
• See full diff in compare view

Updates golang.org/x/sys from 0.45.0 to 0.46.0

Commits

• d58dcfa unix: add GPIO constants and structs
• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
github.com/moby/buildkit	[>= 0.20.a, < 0.21]