Merge pull request #21489 from ashley-cui/492

Bump to v4.9.2

.cirrus.yml

@@ -6,7 +6,7 @@ env:
     #### Global variables used for all tasks
     ####
     # Name of the ultimate destination branch for this CI run, PR or post-merge.
-    DEST_BRANCH: "v4.8"
+    DEST_BRANCH: "v4.9"
     # Sane (default) value for GOPROXY and GOSUMDB.
     GOPROXY: "https://proxy.golang.org,direct"
     GOSUMDB: "sum.golang.org"

RELEASE_NOTES.md

@@ -1,5 +1,13 @@
 # Release Notes
 
+## 4.9.2
+### Security
+- This release addresses a number of Buildkit vulnerabilities including but not limited to: [CVE-2024-23651](https://github.com/advisories/GHSA-m3r6-h7wv-7xxv), [CVE-2024-23652](https://github.com/advisories/GHSA-4v98-7qmw-rqr8), and [CVE-2024-23653](https://github.com/advisories/GHSA-wr6v-9f75-vh2g).
+
+### Misc
+- Updated Buildah to v1.33.5
+- Updated the containers/common library to v0.57.4
+
 ## 4.9.1
 ### Bugfixes
 - Fixed a bug where the `--rootful` option to `podman machine set` would not set the machine to use the root connection ([#21195](https://github.com/containers/podman/issues/21195)).

version/rawversion/version.go

@@ -7,4 +7,4 @@ package rawversion
 //
 // NOTE: remember to bump the version at the top of the top-level README.md
 // file when this is bumped.
-const RawVersion = "4.9.2-dev"
+const RawVersion = "4.9.3-dev"