Skip to content

v0.38.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 22:09
· 34 commits to master since this release
v0.38.1
This tag was signed with the committer’s verified signature. The key has expired.
tonistiigi Tõnis Tiigi
GPG key ID: AFA9DE5F8AB7AF39
Expired
Verified
Learn about vigilant mode.
0dbe87f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

buildx 0.38.1

Welcome to the v0.38.1 release of buildx!

Please try out the release binaries and report any issues at
https://github.com/docker/buildx/issues.

Security

This release has been built with updated Go runtime 1.26.10 to address CVE-2026-111943 by rejecting certificate chains that include eight revoked eMudhra intermediate certificates.
Image pulls and pushes fail TLS certificate verification if a registry's certificate chain relies on one of the affected TLS intermediates.
Affected registries need a replacement certificate chain that does not use these intermediates.

The blocked intermediates are:

  • Domain-validated TLS: EM DV TLS CA - G3B and EM DV TLS CA - G3C
  • Organization-validated TLS: EM OV TLS CA - G3B and EM OV TLS CA - G3C
  • Extended-validation TLS: EM EV TLS CA - G3B and EM EV TLS CA - G3C
  • Code signing: EM OV CS CA - G3B and EM OV CS CA - G3C

The G3B intermediates belong to eMudhra BV, and the G3C intermediates belong to eMudhra Inc.
The keys for these intermediates were compromised.

Read more about the eMudhra Intermediate CA Compromise

There are no functional changes in Buildx itself compared to the previous release.

Previous release can be found at v0.38.0

Assets 68
Loading