chore: merge upstream moby/buildkit v0.13.2 by janishorsts · Pull Request #38 · EarthBuild/buildkit

janishorsts · 2026-10-02T10:36:37Z

EarthBuild/earthbuild#1000

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

coderabbitai · 2026-10-02T10:36:45Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Commit to this branch
Create a new PR

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-10-02T10:36:52Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/github.com/docker/docker@v25.0.3+incompatible
	golang/golang.org/x/crypto@v0.21.0
	golang/google.golang.org/grpc@v1.59.0
	golang/github.com/google/shlex@v0.0.0-20191202100458-e7afc7fbc510
	golang/github.com/hashicorp/go-cleanhttp@v0.5.2
	golang/github.com/hashicorp/go-immutable-radix@v1.3.1
	golang/github.com/hashicorp/go-multierror@v1.1.1
	golang/github.com/hashicorp/golang-lru@v0.5.4
	golang/github.com/opencontainers/go-digest@v1.0.0
	golang/github.com/spdx/tools-golang@v0.5.3
	golang/kernel.org/pub/linux/libs/security/libcap/cap@v1.2.67
	golang/github.com/containerd/stargz-snapshotter@v0.15.1
	golang/github.com/aws/aws-sdk-go-v2@v1.24.1
	golang/github.com/containernetworking/plugins@v1.4.0
	golang/github.com/docker/distribution@v2.8.2+incompatible
	golang/github.com/containerd/containerd@v1.7.13
	golang/github.com/containerd/nydus-snapshotter@v0.13.7
	golang/go.opentelemetry.io/otel@v1.21.0
	golang/github.com/docker/cli@v25.0.3+incompatible
	golang/github.com/Microsoft/hcsshim@v0.11.4
	golang/golang.org/x/net@v0.23.0
	golang/google.golang.org/protobuf@v1.31.0
	golang/github.com/agext/levenshtein@v1.2.3
	golang/github.com/armon/circbuf@v0.0.0-20190214190532-5111143e8da2
	golang/github.com/gogo/googleapis@v1.4.1
	golang/github.com/gogo/protobuf@v1.3.2
	golang/github.com/mitchellh/hashstructure/v2@v2.0.2
	golang/github.com/moby/locker@v1.0.1
	golang/github.com/pkg/errors@v0.9.1
	golang/github.com/serialx/hashring@v0.0.0-20200727003509-22c0c7ab6b1b
	golang/github.com/tonistiigi/units@v0.0.0-20180711220420-6950e57a87ea
	golang/github.com/vishvananda/netlink@v1.2.1-beta.2
See 67 more rows in the dashboard

View full report

socket-security · 2026-10-02T10:36:54Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	Critical CVE: Authz zero length regression in golang `github.com/docker/docker` CVE: GHSA-v23v-6jw2-98fq Authz zero length regression (CRITICAL) Affected versions: >= 19.03.0 < 23.0.15; >= 26.0.0 < 26.1.5; >= 27.0.0 < 27.1.1; >= 24.0.0 < 25.0.6 Patched version: 25.0.6 From: go.mod → `golang/github.com/docker/docker@v25.0.3+incompatible` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/docker/docker@v25.0.3+incompatible`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang `golang.org/x/crypto` CVE: GHSA-v778-237x-gjrc Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (CRITICAL) Affected versions: < 0.31.0 Patched version: 0.31.0 From: go.mod → `golang/golang.org/x/crypto@v0.21.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: golang `golang.org/x/crypto`: FIDO/U2F security key physical presence check can be bypassed CVE: GHSA-89gr-r52h-f8rx golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go.mod → `golang/golang.org/x/crypto@v0.21.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: golang `golang.org/x/crypto` vulnerable to auth bypass via unenforced @Revoked status CVE: GHSA-5cgq-3rg8-m6cv golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go.mod → `golang/golang.org/x/crypto@v0.21.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: golang `golang.org/x/crypto` vulnerable to infinite loop on large channel writes CVE: GHSA-rm3j-f69w-wqmq golang.org/x/crypto vulnerable to infinite loop on large channel writes (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go.mod → `golang/golang.org/x/crypto@v0.21.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: golang `golang.org/x/crypto`: Invoking VerifiedPublicKeyCallback permissions skip enforcement CVE: GHSA-x527-x647-q7gg golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go.mod → `golang/golang.org/x/crypto@v0.21.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: golang `golang.org/x/crypto`: Invoking client can cause server deadlock on unexpected responses CVE: GHSA-vgwf-h737-ff37 golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go.mod → `golang/golang.org/x/crypto@v0.21.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: golang `golang.org/x/crypto` doesn't enforce invoking key constraints CVE: GHSA-jppx-rxg9-jmrx golang.org/x/crypto doesn't enforce invoking key constraints (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go.mod → `golang/golang.org/x/crypto@v0.21.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: golang `golang.org/x/crypto` doesn't drop invoking agent constraints when forwarding keys CVE: GHSA-f5wc-c3c7-36mc golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go.mod → `golang/golang.org/x/crypto@v0.21.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/golang.org/x/crypto@v0.21.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: gRPC-Go has an authorization bypass via missing leading slash in :path in golang `google.golang.org/grpc` CVE: GHSA-p77j-4mvh-x3m3 gRPC-Go has an authorization bypass via missing leading slash in :path (CRITICAL) Affected versions: < 1.79.3 Patched version: 1.79.3 From: go.mod → `golang/google.golang.org/grpc@v1.59.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/google.golang.org/grpc@v1.59.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

github-actions · 2026-10-02T10:38:59Z

🎉 Are we earthbuild yet?

Great progress! You've reduced "earthly" occurrences by 10 (4.61%)

📈 Overall Progress

Branch	Total Count
main	217
This PR	207
Difference	-10 (4.61%)

📁 Changes by file type:

File Type	Change
Go files (.go)	✅ -9
Documentation (.md)	➖ No change
Earthfiles	➖ No change

Keep up the great work migrating from Earthly to Earthbuild! 🚀

💡 Tips for finding more occurrences

Run locally to see detailed breakdown:

./.github/scripts/count-earthly.sh

Note that the goal is not to reach 0.
There is anticipated to be at least some occurences of earthly in the source code due to backwards compatibility with config files and language constructs.

chore: merge v0.13.2

981a83e

janishorsts added this pull request to stack #39 October 2, 2026 10:43

janishorsts marked this pull request as draft October 2, 2026 10:44

janishorsts added 4 commits October 2, 2026 11:46

fix: make vendor

3668771

fix: make archutil

065c631

chore: align github action versions with upstream

d2b4917

fix: inline cache

5c127fb

janishorsts changed the title ~~chore: merge v0.13.2~~ chore: merge upstream moby/buildkit v0.13.2 Oct 2, 2026

janishorsts added 2 commits October 2, 2026 13:34

fix: action actions/github-script@v7 is not allowed

574139e

fix: test-windows

defe94d

This was referenced Oct 2, 2026

chore(buildkit): merge v0.13.2 EarthBuild/earthbuild#1000

Draft

proposal: deprecate and remove experimental ticktock BuildKit (earthly-next) EarthBuild/earthbuild#1003

Open

Navigation Menu

chore: merge upstream moby/buildkit v0.13.2 - #38

chore: merge upstream moby/buildkit v0.13.2 #38
janishorsts wants to merge 7 commits into
chore-merge-v0.13.2-unresolvedfrom
chore-merge-v0.13.2

janishorsts commented Oct 2, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 2, 2026 •

edited

Loading

Draft PR not reviewed

Uh oh!

socket-security Bot commented Oct 2, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

janishorsts commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Draft PR not reviewed

Uh oh!

socket-security Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026

🎉 Are we earthbuild yet?

📈 Overall Progress

📁 Changes by file type:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

janishorsts commented Oct 2, 2026 •

edited

Loading

coderabbitai Bot commented Oct 2, 2026 •

edited

Loading

socket-security Bot commented Oct 2, 2026 •

edited

Loading

socket-security Bot commented Oct 2, 2026 •

edited

Loading