Bump github.com/moby/buildkit from 0.26.3 to 0.31.2

[dependabot]

Bumps github.com/moby/buildkit from 0.26.3 to 0.31.2.

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.31.2

Welcome to the v0.31.2 release of buildkit!

This is a security patch release with four moderate and one low severity security fixes.

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Dawei Wei

Notable Changes

• Git source checkout from a bundle file could lead to command injection. GHSA-hw3h-2gp9-cxpv
• Possible panic when incorrect parameters sent from frontend. GHSA-qx3x-mv6r-52p6
• LLB file operation can be tricked to remove /tmp directory contents. GHSA-32pv-7hq5-qhwq
• Malicious client can bypass destination directory validation on local sources upload. GHSA-g2h8-426c-7976
• WCOW cache mount source selector resolves NTFS junctions outside of cache root. GHSA-388v-wmr2-g2v2
• Fix possible buildctl failures after successful builds over slow connhelper transports. #6940
• Fix possible daemon crash during concurrent builds. #6916

Dependency Changes

• github.com/tonistiigi/fsutil 0257b3308df4 -> 30cd4fc5d911

Previous release can be found at v0.31.1

v0.31.1

buildkit 0.31.1

Welcome to the v0.31.1 release of buildkit!

This is a security patch release with two low severity security fixes.

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi

Notable Changes

• Custom frontend could bypass Seccomp/AppArmor restrictions GHSA-7236-3392-c5c6
• Possible runtime DoS via unbounded group parsing GHSA-72x6-4j93-7w86

... (truncated)

Commits

• e42e1bf Merge pull request #6960 from tonistiigi/v0.31.2-picks
• 1a32681 vendor: update github.com/tonistiigi/fsutil to 30cd4fc5d911
• 0669f4b executor/oci: avoid delete access for WCOW pin
• 44c0ed6 executor/oci: pin resolved WCOW cache source
• 473663b executor/oci: pin WCOW cache mount source across mount realization
• a9155a4 executor/oci: confine WCOW cache mount source within cache root
• 3916124 fileop: contain rm parent traversal
• 5aefc4a solver: reject negative LLB input indexes
• 1659c30 solver: add tests for op input index validation
• ed77788 solver: validate op input indices to avoid panics
• Additional commits viewable in compare view

[thepetk]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dependabot[bot], thepetk

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [thepetk]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.