chore(deps): update go deps

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/go-containerregistry	v0.21.9 → v0.22.1
github.com/moby/buildkit	v0.32.2 → v0.33.0
golang.org/x/sync	v0.22.0 → v0.23.0

---

Release Notes

google/go-containerregistry (github.com/google/go-containerregistry)

v0.22.1

Compare Source

What's Changed

• Reject non-canonical IP literals in all SSRF guards by @​shaggyinsomniac in #​2426
• daemon: fix stale docker/docker reference in WithClient docs by @​BobDu in #​2428
• build(deps): bump the go-deps group across 2 directories with 4 updates by @​dependabot[bot] in #​2422
• authn: do not overwrite AuthConfig.Auth when username and password are empty by @​nileshpatil6 in #​2420
• build(deps): bump the actions group across 1 directory with 8 updates by @​dependabot[bot] in #​2423
• Support pulling images by sha512 digest by @​BobDu in #​2427
• Allow empty label and annotation values in crane mutate by @​theadsingh in #​2418
• fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml by @​tprussak in #​2434
• validate: support index attestation manifests and empty configs by @​Subserial in #​2414
• name: improve error when parsing a reference with a URL scheme by @​locker95 in #​2431
• fix(build): install binaries to /ko-app and add to PATH (#​2424) by @​tprussak in #​2436
• fix(release): honor declared Go toolchain by @​rksharma-owg in #​2435
• remote: apply checkRedirectSSRF to writer-side HTTP clients by @​locker95 in #​2432
• flatten: preserve config and layer media types when flattening by @​Subserial in #​2438
• fix(mutate): make Time layer updates lazy by @​amarkdotdev in #​2429
• build(deps): bump the go-deps group across 2 directories with 3 updates by @​dependabot[bot] in #​2439
• remote: copy manifest annotations to referrers fallback tag descriptors by @​codysoyland in #​2441

New Contributors

• @​shaggyinsomniac made their first contribution in #​2426
• @​BobDu made their first contribution in #​2428
• @​nileshpatil6 made their first contribution in #​2420
• @​theadsingh made their first contribution in #​2418
• @​locker95 made their first contribution in #​2431
• @​rksharma-owg made their first contribution in #​2435
• @​codysoyland made their first contribution in #​2441

Full Changelog: google/go-containerregistry@v0.22.0...v0.22.1

v0.22.0

Compare Source

What's Changed

• mutate: let Time and Canonical take tarball.LayerOption by @​mzihlmann in #​2403
• build: add multi-architecture Cloud Build configurations for crane, gcrane, and krane by @​tprussak in #​2412
• remote: resolve push-check credentials against the repository by @​mzihlmann in #​2411
• Allow single-character repository paths by @​semx in #​2407
• fix: add missing substitutions and workspace cleanup to new build files by @​tprussak in #​2413
• remote: retry failed Puller and Pusher initialization by @​iahsanGill in #​2406
• build(deps): bump the actions group across 1 directory with 8 updates by @​dependabot[bot] in #​2405
• build(deps): bump the go-deps group across 1 directory with 3 updates by @​dependabot[bot] in #​2415
• go.mod: bump Go version + add toolchain directive to replace .go-version file by @​Subserial in #​2416
• fix: Fix new build options and provenance by @​tprussak in #​2417
• fix(build): unify new build flow into cloudbuild_v2.yaml by @​tprussak in #​2419

New Contributors

• @​mzihlmann made their first contribution in #​2403
• @​tprussak made their first contribution in #​2412
• @​semx made their first contribution in #​2407

Full Changelog: google/go-containerregistry@v0.21.9...v0.21.10

moby/buildkit (github.com/moby/buildkit)

v0.33.0

Compare Source

Welcome to the v0.33.0 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• CrazyMax
• Tõnis Tiigi
• Sebastiaan van Stijn
• Matthieu MOREL
• eliuriegas
• Daniel Nephin
• Dawei Wei
• Guthrie McAfee Armstrong
• Jiří Moravčík
• Leo Li
• Ravi Arnan
• Shurong Cao
• Spencer G. Jones
• Vedant Madane

Notable Changes

• Built-in Dockerfile frontend has been updated to v1.27.0 changelog
• Builds using proxy-based network tracking/monitoring for exec steps now support fallback to the daemon's proxy settings when the BuildKit daemon is running behind a proxy. #​7074
• The maximum attestation size for exporters has been raised to 80 MiB. #​7104
• Content produced by Rootless versions of BuildKit has been updated to be compatible with Rootful versions of BuildKit for result reproducibility. #​7039
• Buildctl now supports passing valueless build-args read from the environment. #​7030
• Sanitize platform IDs returned by frontend to ensure tar exports can't end up with invalid paths for Windows. #​7022
• Suppress bogus git advice messages on progress output from the way BuildKit checks out git repositories. #​6998
• Build history can now be disabled from daemon configuration #​7040
• Redact more possible inline credentials in progress output or HTTP source and Git bundle steps. This didn't include builds that used build secrets to pass credentials. #​7068
• MaxRegistryConcurrency now also applies to remote cache requests. #​7049
• Windows containers now support RUN --mount=type=secret build secrets. #​6944
• Fix possible "no active session for" error when running concurrent builds with remote cache #​7047
• Fix possible "failed to apply diffs: snapshot does not exist" error #​7035
• Fix possible context upload errors when context directory contains foreign characters. #​6989
• Fix possible silently dropped cache link in remote cache exporter. #​7053
• Fix xz archive unpacking silently skipping when xz binary was missing in environment. #​7071
• Fix possible incorrect platform validation warnings caused by mismatched Windows OS versions #​7072
• Fix QEMU emulator arguments being persisted on an exec operation when a canceled operation is executed again. #​7092

Dependency Changes

• cyphar.com/go-pathrs v0.2.1 -> v0.2.5
• github.com/Microsoft/hcsshim v0.15.0-rc.1 -> v0.15.0-rc.4
• github.com/aws/aws-sdk-go-v2 v1.43.0 -> v1.43.8
• github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14 -> v1.7.18
• github.com/aws/aws-sdk-go-v2/config v1.32.31 -> v1.32.39
• github.com/aws/aws-sdk-go-v2/credentials v1.19.30 -> v1.19.38
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.31 -> v1.18.39
• github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.3.5 -> v0.3.10
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.31 -> v1.4.39
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.31 -> v2.7.39
• github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.32 -> v1.4.40
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 -> v1.13.18
• github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.24 -> v1.9.28
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.31 -> v1.13.39
• github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.32 -> v1.19.36
• github.com/aws/aws-sdk-go-v2/service/s3 v1.106.0 -> v1.106.5
• github.com/aws/aws-sdk-go-v2/service/signin v1.5.0 -> v1.5.8
• github.com/aws/aws-sdk-go-v2/service/sso v1.33.0 -> v1.33.8
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.0 -> v1.38.8
• github.com/aws/aws-sdk-go-v2/service/sts v1.45.0 -> v1.45.8
• github.com/aws/smithy-go v1.27.4 -> v1.27.10
• github.com/containerd/containerd/v2 v2.3.3 -> v2.3.4
• github.com/containerd/go-runc v1.1.0 -> v1.2.1
• github.com/containerd/platforms v1.0.0-rc.4 -> v1.0.0-rc.5
• github.com/cyphar/filepath-securejoin v0.6.0 -> v0.6.1
• github.com/docker/cli v29.6.2 -> v29.7.2
• github.com/felixge/httpsnoop v1.0.4 -> v1.1.0
• github.com/go-logr/logr v1.4.3 -> v1.4.4
• github.com/klauspost/compress v1.19.1 -> v1.19.2
• github.com/moby/policy-helpers 856be88 -> dd6c549
• github.com/moby/sys/userns v0.1.0 -> v0.2.0
• github.com/pelletier/go-toml/v2 v2.3.1 -> v2.4.3
• github.com/prometheus/client_golang v1.23.2 -> v1.24.1
• github.com/prometheus/common v0.67.5 -> v0.70.1
• github.com/prometheus/procfs v0.20.1 -> v0.21.1
• github.com/sirupsen/logrus v1.9.4 -> v1.10.1
• github.com/stretchr/testify v1.11.1 -> v1.12.1
• github.com/tonistiigi/fsutil 6d9dc2e -> 83cac42
• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0 -> v0.70.0
• go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.69.0 -> v0.70.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 -> v0.70.0
• go.opentelemetry.io/otel v1.44.0 -> v1.45.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0 -> v1.45.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0 -> v1.45.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 -> v1.45.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 -> v1.45.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 -> v1.45.0
• go.opentelemetry.io/otel/exporters/prometheus v0.66.0 -> v0.67.0
• go.opentelemetry.io/otel/metric v1.44.0 -> v1.45.0
• go.opentelemetry.io/otel/sdk v1.44.0 -> v1.45.0
• go.opentelemetry.io/otel/sdk/metric v1.44.0 -> v1.45.0
• go.opentelemetry.io/otel/trace v1.44.0 -> v1.45.0
• go.opentelemetry.io/proto/otlp v1.10.0 -> v1.11.0
• go.yaml.in/yaml/v3 v3.0.4 -> v3.0.5
• golang.org/x/crypto v0.54.0 -> v0.55.0
• golang.org/x/mod v0.38.0 -> v0.40.0
• golang.org/x/net v0.57.0 -> v0.58.0
• golang.org/x/text v0.40.0 -> v0.41.0
• google.golang.org/genproto/googleapis/api 3dc84a4 -> 6ac0973
• google.golang.org/genproto/googleapis/rpc 3dc84a4 -> 6ac0973
• google.golang.org/grpc v1.82.1 -> v1.83.2
• google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 -> v1.6.2
• google.golang.org/protobuf f2248ac -> v1.36.12

Previous release can be found at v0.32.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
github.com/docker/cli	v29.6.2+incompatible -> v29.7.2+incompatible
github.com/klauspost/compress	v1.19.1 -> v1.19.2
github.com/sirupsen/logrus	v1.9.4 -> v1.10.1