Bump the all-updates group across 1 directory with 12 updates

[dependabot]

Bumps the all-updates group with 10 updates in the / directory:

Package	From	To
github.com/breml/rootcerts	0.3.5	0.3.6
github.com/cyphar/filepath-securejoin	0.6.1	0.7.0
github.com/docker/cli	29.5.2+incompatible	29.6.0+incompatible
github.com/getsentry/sentry-go	0.46.2	0.47.0
github.com/moby/buildkit	0.28.1	0.31.0
golang.org/x/crypto	0.52.0	0.53.0
github.com/guptarohit/asciigraph	0.9.0	0.10.0
github.com/moby/moby/api	1.54.2	1.55.0
github.com/moby/moby/client	0.4.1	0.5.0
github.com/testcontainers/testcontainers-go	0.42.0	0.43.0

Updates github.com/breml/rootcerts from 0.3.5 to 0.3.6

Commits

• 1e7be78 Auto Update Mozilla Included CA Certificate List
• See full diff in compare view

Updates github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.7.0] - 2025-06-17

You talk of times of peace for all, and then prepare for war.

Changed

• Update to cyphar.com/go-pathrs@0.2.5, which included a build-time API breakage that we needed to work around. The API of this library is unchanged by this, but users should make sure to update to v0.7.0 of filepath-securejoin if they use the libpathrs built tag and have update to libpathrs v0.2.5.

Commits

• 8096a95 VERSION: release v0.7.0
• 1324ccb merge #101 into cyphar/filepath-securejoin:main
• dd8f0bb deps: bump to cyphar.com/go-pathrs@v0.2.5
• c9a7725 gha: bump golangci-lint to v2.12
• 2e968bd Merge pull request #91 from cyphar/dependabot/github_actions/actions/download...
• 2879148 Merge pull request #90 from cyphar/dependabot/github_actions/actions/upload-a...
• 07b805b build(deps): bump actions/download-artifact from 6 to 7
• 8507844 build(deps): bump actions/upload-artifact from 5 to 6
• daef0cf Merge pull request #89 from cyphar/dependabot/github_actions/actions/checkout-6
• 95f8ea4 build(deps): bump actions/checkout from 5 to 6
• Additional commits viewable in compare view

Updates github.com/docker/cli from 29.5.2+incompatible to 29.6.0+incompatible

Commits

• fb59821 Merge pull request #7062 from vvoland/update-docker
• ee2f737 vendor: github.com/moby/moby/client v0.5.0
• 1f80e23 vendor: github.com/moby/moby/api v1.55.0
• 1d1562e Merge pull request #7029 from agirault/login-password-dash-stdin
• 8c2e800 Merge pull request #7051 from thaJeztah/bump_moby
• 233cd4a vendor: github.com/moby/moby/api v1.55.0-rc.1, moby/client v0.5.0-rc.1
• 5b600d0 Merge pull request #7047 from thaJeztah/bump_go_events
• e6decf4 Merge pull request #7048 from thaJeztah/bump_compress
• a9284d1 Merge pull request #7049 from thaJeztah/bump_x_net
• e7319c7 Merge pull request #7050 from thaJeztah/update_authors_mailmap
• Additional commits viewable in compare view

Updates github.com/getsentry/sentry-go from 0.46.2 to 0.47.0

Release notes

Sourced from github.com/getsentry/sentry-go's releases.

0.47.0

Breaking Changes 🛠

• Fix transaction_info source getting set incorrectly across HTTP middleware integrations (http, fasthttp, fiber). Users should now expect traces to properly get grouped with their parameterized path. Transactions in affected integrations may regroup after upgrading. by @​giortzisg in #1325
• remove deprecatedotel.NewSentrySpanProcessor. Users should now use the sentryotlp.NewTraceExporter instead by @​giortzisg in #1307

  // Before
  sentry.Init(sentry.ClientOptions{Dsn: dsn, EnableTracing: true, TracesSampleRate: 1.0})
  tp := sdktrace.NewTracerProvider(
  sdktrace.WithSpanProcessor(sentryotel.NewSentrySpanProcessor()),
  )
  otel.SetTextMapPropagator(sentryotel.NewSentryPropagator())
  otel.SetTracerProvider(tp)
  // After:
  sentry.Init(sentry.ClientOptions{
  Dsn: dsn, EnableTracing: true, TracesSampleRate: 1.0,
  Integrations: func(i []sentry.Integration) []sentry.Integration {
  return append(i, sentryotel.NewOtelIntegration())
  },
  })
  exporter, _ := sentryotlp.NewTraceExporter(ctx, dsn)
  tp := sdktrace.NewTracerProvider(sdktrace.WithBatcher(exporter))
  otel.SetTracerProvider(tp)

• Enable logs by default to skip double allow behavior. Enabling logs now happens once when setting up either sentry.NewLogger or any supported integration. Also the EnableLogs flag changes to DisableLogs for a global override switch by @​giortzisg in #1306
• Remove the ContextifyFrames integration. The recommended way to add source context is SCM by @​giortzisg in #1302

New Features ✨

• Add fiber v3 integration by @​giortzisg in #1324
• Bump fasthttp from 1.51.0 to 1.71.0 by @​giortzisg in #1324
• Add sentrysql SQL tracing integration by @​giortzisg in #1305
  • Supports multiple integration paths depending on how your app opens database connections: sentrysql.Open(...), sentrysql.OpenDB(...), and wrapped drivers/connectors for custom setups.
  • Database metadata is not inferred in every setup. If the database name is not discoverable automatically, pass sentrysql.WithDatabaseName(...) so spans are populated correctly.
  • Example:

   // Simple driver-based setup
   db, err := sentrysql.Open("sqlite", ":memory:",
       sentrysql.WithDatabaseSystem(sentrysql.SystemSQLite),
       sentrysql.WithDatabaseName("main"),
   )

Internal Changes 🔧

Deps

... (truncated)

Changelog

Sourced from github.com/getsentry/sentry-go's changelog.

0.47.0

Breaking Changes 🛠

• Fix transaction_info source getting set incorrectly across HTTP middleware integrations (http, fasthttp, fiber). Users should now expect traces to properly get grouped with their parameterized path. Transactions in affected integrations may regroup after upgrading. by @​giortzisg in #1325
• remove deprecatedotel.NewSentrySpanProcessor. Users should now use the sentryotlp.NewTraceExporter instead by @​giortzisg in #1307

  // Before
  sentry.Init(sentry.ClientOptions{Dsn: dsn, EnableTracing: true, TracesSampleRate: 1.0})
  tp := sdktrace.NewTracerProvider(
  sdktrace.WithSpanProcessor(sentryotel.NewSentrySpanProcessor()),
  )
  otel.SetTextMapPropagator(sentryotel.NewSentryPropagator())
  otel.SetTracerProvider(tp)
  // After:
  sentry.Init(sentry.ClientOptions{
  Dsn: dsn, EnableTracing: true, TracesSampleRate: 1.0,
  Integrations: func(i []sentry.Integration) []sentry.Integration {
  return append(i, sentryotel.NewOtelIntegration())
  },
  })
  exporter, _ := sentryotlp.NewTraceExporter(ctx, dsn)
  tp := sdktrace.NewTracerProvider(sdktrace.WithBatcher(exporter))
  otel.SetTracerProvider(tp)

• Enable logs by default to skip double allow behavior. Enabling logs now happens once when setting up either sentry.NewLogger or any supported integration. Also the EnableLogs flag changes to DisableLogs for a global override switch by @​giortzisg in #1306
• Remove the ContextifyFrames integration. The recommended way to add source context is SCM by @​giortzisg in #1302

New Features ✨

• Add fiber v3 integration by @​giortzisg in #1324
• Bump fasthttp from 1.51.0 to 1.71.0 by @​giortzisg in #1324
• Add sentrysql SQL tracing integration by @​giortzisg in #1305
  • Supports multiple integration paths depending on how your app opens database connections: sentrysql.Open(...), sentrysql.OpenDB(...), and wrapped drivers/connectors for custom setups.
  • Database metadata is not inferred in every setup. If the database name is not discoverable automatically, pass sentrysql.WithDatabaseName(...) so spans are populated correctly.
  • Example:

   // Simple driver-based setup
   db, err := sentrysql.Open("sqlite", ":memory:",
       sentrysql.WithDatabaseSystem(sentrysql.SystemSQLite),
       sentrysql.WithDatabaseName("main"),
   )

Internal Changes 🔧

Deps

... (truncated)

Commits

• 9b7a562 release: 0.47.0
• 320597c chore: update bump-version script to also bump crosstest (#1327)
• 02a836d build(deps): sync go.work (#1326)
• dc18868 feat: add fiberv3 integration (#1324)
• f970fb5 feat: add sql transaction instrumentation (#1305)
• 1010c03 fix!: transaction source for integrations (#1325)
• 97b9ddf build(deps): bump getsentry/github-workflows from 71588ddf95134f804e82c5970a8...
• 9cce79e feat(sql): add lexer and obfuscator (#1299)
• 063a573 feat(sql): add span instrumentation (#1286)
• 34d7db0 chore(otel): remove unused semconv helpers (#1321)
• Additional commits viewable in compare view

Updates github.com/moby/buildkit from 0.28.1 to 0.31.0

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.31.0

buildkit 0.31.0

Welcome to the v0.31.0 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Sebastiaan van Stijn
• Bjorn Neergaard
• Jonathan A. Sternberg
• Akihiro Suda
• Bryce Gibson
• Ava Barron
• Brian Goff
• Jiří Moravčík
• ZRHann
• Kevin NZUGUEM
• Maya Chen
• Natnael Gebremariam
• Sai Kiran Maggidi
• okhowang(王沛文)

Notable Changes

• Built-in Dockerfile frontend has been updated to v1.25.0 changelog
• Exec steps now support a network proxy feature where all container traffic will be routed through an HTTP proxy server. This allows capturing the network traffic for inspection in build progress and provenance attestation. Source policies can define the requests that build containers are allowed to make and the ones that should be blocked. Network proxy can be enabled for the whole BuildKit daemon or enabled on a per-build basis. #6858 #6816 #6740 #6863
• The local exporter now supports a mode=delete attribute which will replace the destination directory with the contents of the build result instead of merging it. Similar to the --delete flag in rsync. #6561 #6864
• LLB APIs now support per-step resource limits for CPU and memory. #6569
• LLB APIs support a new Passthrough operation that allows defining dependency build graph branches that are required to be built but do not add any outputs to the final result. The state.Requires() client helper can be used to define such dependencies in the build graph. #6829
• All image results now default to using OCI media types. Previously this was applied based on whether annotations or attestations were needed. oci-mediatypes=false can be used for legacy Docker media types. This change raises the compatibility version of BuildKit v0.31.0 to 30. #6824
• Local cache exporter now supports the reset option to clear the unreferenced existing cache. #6612
• The local build result outputs now use a new implementation with better security guarantees in case the destination directory is mutated externally during the transfer. #6561
• New build metrics about build counts and durations have been added to the OTEL provider. #6736
• Parallel request limits for registry connections can now be set via configuration file. #6776
• In special modes where the client does not expose the session connection to transfer credentials, builds can now still fall back to anonymous registry auth instead of erroring. #6760
• Embedded binfmt emulators in the release image have been updated to QEMU v10.2.3. #6846
• Runc container runtime has been updated to v1.3.6
• Created attestations now use in-toto v1 statement format. #6823
• Due to the upgraded CLI library, the internal buildctl completion scripts flag --generate-bash-completion is no longer supported and has been replaced with --generate-shell-completion. #6848
• Fix an issue in default GC policy rules where the first rule for prioritizing releasing cache mounts and local sources did not apply. #6856
• Fix an issue where parent directories could be created with incorrect permissions due to system umask when using BuildKit embedded in Dockerd. #6828
• Fix possible segfault from race condition when HTTP server returned 401 error. #6791
• Fix source policy exact match rules losing the destination value during conversion. #6861

... (truncated)

Commits

• c411f0a Merge pull request #6876 from thaJeztah/bump_runc
• f292e5c Dockerfile: update runc binary to v1.3.6
• d31ba4a Merge pull request #6867 from okhowang/fix/platforms-data-race
• e819928 Merge pull request #6869 from crazy-max/update-policy-helpers
• e4d0dba chore: update generated files
• c13539b vendor: update policy-helpers to d5411a945cfc
• f4f035c Merge pull request #6864 from crazy-max/mode-delete-old-daemon
• e26b5d4 fix: add mutex to protect Worker.Platforms from data race
• 9176018 Merge pull request #6861 from ZRHann/fix-sourcepolicy-exact-convert
• 128c322 Merge pull request #6863 from tonistiigi/exec-proxy-cni-dial-update
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.52.0 to 0.53.0

Commits

• 45460e0 go.mod: update golang.org/x dependencies
• d37c95e pkcs12: limit PBKDF iteration count to prevent CPU exhaustion
• e2ffffe ssh: reject incomplete gssapi-with-mic configurations
• 60e158a ssh/test: isolate CLI tests from user SSH config and agent
• 1b77d23 ssh/knownhosts: reject lines with multiple or unknown markers
• 3872a2b ssh/knownhosts: verify declared key type matches decoded key
• 9f72ecc ssh/knownhosts: treat only ASCII space and tab as whitespace
• 8f405a4 ssh: validate ECDSA curve matches expected algorithm
• bb41b3d ssh: improve DH GEX group selection using PreferredBits
• e04e721 ssh/agent: validate ed25519 private key length in Add
• Additional commits viewable in compare view

Updates golang.org/x/sys from 0.45.0 to 0.46.0

Commits

• d58dcfa unix: add GPIO constants and structs
• See full diff in compare view

Updates golang.org/x/text from 0.37.0 to 0.38.0

Commits

• f4bb632 go.mod: update golang.org/x dependencies
• See full diff in compare view

Updates github.com/guptarohit/asciigraph from 0.9.0 to 0.10.0

Release notes

Sourced from github.com/guptarohit/asciigraph's releases.

v0.10.0

Added

• Spectrum / heatmap gradient coloring — color each point by its value (cool → warm) with SeriesColorGradient, the built-in HeatmapSpectrum palette, or your own stops (-g on the CLI). (#84)

{ while true; do echo $((RANDOM % 100)); sleep 0.4; done; } | asciigraph -r -g cyan,magenta -w 60 -h 15

• Threshold coloring — highlight points that breach a limit with ColorAbove / ColorBelow (or -ca / -cb on the CLI). Applies across all series and takes precedence over solid/gradient colors. (#85, closes #38)

• Flicker-free realtime mode — new ClearLines redraws only the previous graph instead of wiping the whole screen, so -r no longer flickers and preserves any output above the chart. (#79, closes #44)

Changelog

Sourced from github.com/guptarohit/asciigraph's changelog.

0.10.0 (2026-06-21)

Added

• threshold coloring: ColorAbove/ColorBelow options and -ca/-cb CLI flags (#85)
• spectrum/heatmap gradient coloring: SeriesColorGradient option, HeatmapSpectrum palette, and -g CLI flag (#84)
• flicker-free realtime mode via ClearLines, redrawing only the previous graph (#79), closes #44

Commits

• 3934c9c chore: release 0.10.0 (#83)
• 2dd6b5f chore: release 0.10.0
• 7316877 feat: add ColorAbove/ColorBelow threshold coloring option (library + CLI) (#85)
• 5e26e5c feat: add spectrum/heatmap gradient coloring (#84)
• 9d91f88 docs(cli): add example value to -g gradient flag help
• ff7fdbc docs: align gradientColor comment with min>=max guard
• 24c6b2a fix: leave legend boxes uncolored under gradient; clarify color docs
• fffe8ba docs: add rendered output image for gradient example
• f1278e6 fix(color): map bright grays to nearest of gray ramp or white
• fa2c222 fix(color): avoid Black sentinel output, guard NaN, copy gradient stops
• Additional commits viewable in compare view

Updates github.com/moby/moby/api from 1.54.2 to 1.55.0

Release notes

Sourced from github.com/moby/moby/api's releases.

api/v1.55.0

1.55.0

Changelog

• POST /containers/{id}/update now supports per-device blkio resource settingss. moby/moby#52651
• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
• docs: clarify swarm join required fields. moby/moby#52763

api/v1.55.0-rc.1

1.55.0-rc.1

Changelog

• POST /containers/{id}/update now supports per-device blkio resource settingss. moby/moby#52651
• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
• docs: clarify swarm join required fields. moby/moby#52763

Commits

• b6c53c2 Merge pull request #52773 from vvoland/c8d-amd64-variants
• 01115e8 Merge pull request #52906 from vvoland/fix-TestContainerWithConflictingNoneNe...
• b36296f Merge pull request #52913 from thaJeztah/windows_does_stats
• a81aa78 TestContainerWithConflictingNoneNetwork: Extend Windows timeout
• 908a35a Merge pull request #52914 from thaJeztah/no_stderr
• 04d33b5 Merge pull request #52912 from thaJeztah/cleanup_GenerateRandomAlphaOnlyString
• 3b2f557 Merge pull request #52722 from notandruu/integration/migrate-TestInspectAPIIm...
• 62b3aae Merge pull request #52901 from vvoland/c8d-imageusage
• 11d3342 integration-cli: un-skip stats tests on Windows
• a47b1b2 Merge pull request #52891 from smerkviladze/attestations-clearer-blob-missing...
• Additional commits viewable in compare view

Updates github.com/moby/moby/client from 0.4.1 to 0.5.0

Release notes

Sourced from github.com/moby/moby/client's releases.

client/0.5.0

0.5.0

Changelog

• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

client/v0.5.0-rc.1

0.5.0-rc.1

Changelog

• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

Changelog

Sourced from github.com/moby/moby/client's changelog.

0.5.0 (2013-07-17)

• Runtime: List all processes running inside a container with 'docker top'
• Runtime: Host directories can be mounted as volumes with 'docker run -v'
• Runtime: Containers can expose public UDP ports (eg, '-p 123/udp')
• Runtime: Optionally specify an exact public port (eg. '-p 80:4500')
• Registry: New image naming scheme inspired by Go packaging convention allows arbitrary combinations of registries
• Builder: ENTRYPOINT instruction sets a default binary entry point to a container
• Builder: VOLUME instruction marks a part of the container as persistent data

• Builder: 'docker build' displays the full output of a build by default
• Runtime: 'docker login' supports additional options

• Runtime: Dont save a container's hostname when committing an image.
• Registry: Fix issues when uploading images to a private registry

0.4.8 (2013-07-01)

• Builder: New build operation ENTRYPOINT adds an executable entry point to the container.

• Runtime: Fix a bug which caused 'docker run -d' to no longer print the container ID.
• Tests: Fix issues in the test suite

0.4.7 (2013-06-28)

• Registry: easier push/pull to a custom registry
• Remote API: the progress bar updates faster when downloading and uploading large files

• Remote API: fix a bug in the optional unix socket transport

• Runtime: improve detection of kernel version

• Runtime: host directories can be mounted as volumes with 'docker run -b'

• Runtime: fix an issue when only attaching to stdin

• Runtime: use 'tar --numeric-owner' to avoid uid mismatch across multiple hosts
• Hack: improve test suite and dev environment
• Hack: remove dependency on unit tests on 'os/user'

• Documentation: add terminology section

0.4.6 (2013-06-22)

• Runtime: fix a bug which caused creation of empty images (and volumes) to crash.

0.4.5 (2013-06-21)

• Builder: 'docker build git://URL' fetches and builds a remote git repository

• Runtime: 'docker ps -s' optionally prints container size
• Tests: Improved and simplified

• Runtime: fix a regression introduced in 0.4.3 which caused the logs command to fail.
• Builder: fix a regression when using ADD with single regular file.

0.4.4 (2013-06-19)

• Builder: fix a regression introduced in 0.4.3 which caused builds to fail on new clients.

0.4.3 (2013-06-19)

• Builder: ADD of a local file will detect tar archives and unpack them

• Runtime: Remove bsdtar dependency
• Runtime: Add unix socket and multiple -H support
• Runtime: Prevent rm of running containers
• Runtime: Use go1.1 cookiejar
• Builder: ADD improvements: use tar for copy + automatically unpack local archives

... (truncated)

Commits

• 51f6c4a Merge pull request #1227 from dotcloud/bump_0.5.0
• f4eaec3 Merge pull request #1226 from metalivedev/easydockerfile
• b083418 change -b -> -v and add udp example
• 5794857 Merge pull request #1169 from crosbymichael/buildfile-tests
• e7f3f6f Add unit tests for buildfile config instructions
• aa56714 Make dockerfile docs easier to find. Clean up formatting.
• f8dfd0a Merge pull request #1225 from dotcloud/hotfix_docker_rmi
• 3dbf9c6 Merge pull request #1219 from metalivedev/docs-repoupdate
• de563a3 Merge pull request #1194 from crosbymichael/build-verbose
• 9cf2b41 change rm usage in docs
• Additional commits viewable in compare view

Updates github.com/testcontainers/testcontainers-go from 0.42.0 to 0.43.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go's releases.

v0.43.0

What's Changed

⚠️ Breaking Changes

• chore(wait)!: change url callback in wait.ForSQL to accept network.Port (#3650) @​thaJeztah

Users of wait.ForSQL need to follow the new API contract, using Moby's network.Port instead of string when building the callback function to check the URL. Please see https://golang.testcontainers.org/features/wait/sql/

• feat!: add PullImageWithPlatform to DockerProvider (#3710) @​blueprismo

Users implementing their own testcontainers.ImageProvider need to implement the new PullImageWithPlatform method introduced by this PR.

🚀 Features

• feat(k3s): pull image opts (#3716) @​blueprismo
• feat(wait): implement AnyMultiStrategy: ForAny equivalent to ForAll. (#3719) @​jeanbza
• feat(eventhubs): add WithAzuriteContainer and functional-options config builder (#3722) @​mdelapenya
• feat!: add PullImageWithPlatform to DockerProvider (#3710) @​blueprismo
• feat(modules/dex): add Dex OIDC provider module (#3659) @​guilycst

🐛 Bug Fixes

• fix(security): remove debug code that leaks Docker credentials (#3721) @​mdelapenya
• fix(ollama): align local exec test with Ollama 0.30.6 log format (#3715) @​mdelapenya
• fix: close temp file handle before removal (#3672) @​acouvreur
• fix(compose): close docker clients to prevent goroutine leaks (#3661) @​mdelapenya
• fix: wait for log production goroutine to drain on stop (#3660) @​mdelapenya

📖 Documentation

• chore: update usage metrics (2026-06) (#3714) @github-actions[bot]

🧹 Housekeeping

• chore(wait)!: change url callback in wait.ForSQL to accept network.Port (#3650) @​thaJeztah
• chore: update usage metrics (2026-05) (#3670) @github-actions[bot]
• chore: remove cgroupnsMode setting from K3s container configuration (#3653) @​lixin9311

📦 Dependency updates

• chore(deps): update dependencies to latest versions in go.mod and go.sum (#3729) @​Steven-Harris
• chore: bump sshd-docker image to 1.4.0 (#3727) @​mdelapenya
• chore(deps): bump Ryuk to v0.14.0 (#3313) @​mdelapenya
• chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.4 to 4.26.5 (#3713) @dependabot[bot]
• chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 (#3712) @dependabot[bot]
• chore(deps): bump mkdocs-include-markdown-plugin from 7.2.2 to 7.3.0 (#3711) @dependabot[bot]
• chore(deps): bump slackapi/slack-github-action from 2.1.1 to 3.0.3 (#3677) @dependabot[bot]
• chore(deps): bump idna from 3.11 to 3.15 (#3708) @dependabot[bot]
• chore(deps): bump github.com/containerd/containerd/v2 from 2.2.2 to 2.2.4 in /modules/compose (#3709) @dependabot[bot]
• chore(deps): bump urllib3 from 2.6.3 to 2.7.0 (#3704) @dependabot[bot]

... (truncated)

Commits

• 0835739 chore: use new version (v0.43.0) in modules and examples
• 85b6d70 chore(deps): update dependencies to latest versions in go.mod and go.sum (#3729)
• 8360f71 feat(k3s): pull image opts (#3716)
• b5e7022 chore: bump sshd-docker image to 1.4.0 (#3727)
• 1c05dd5 chore(deps): bump Ryuk to v0.14.0 (#3313)
• 96ab095 feat(wait): implement AnyMultiStrategy: ForAny equivalent to ForAll. (#3719)
• 42ac7d2 chore(wait)!: change url callback in wait.ForSQL to accept network.Port (#3650)
• ab312e0 chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.4 to 4.26.5 (#3713)
• c5c95e5 chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 (#3712)
• 465d002 chore(deps): bump mkdocs-include-markdown-plugin from 7.2.2 to 7.3.0 (#3711)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 53502a0d29

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Update the Dockerfile2LLB caller for BuildKit 0.31

This upgrade pulls in BuildKit's new Dockerfile2LLB(ctx, dt, opt) (*Result, error) API, but pkg/parser/dockerfile/dockerfile.go still destructures five return values from that call. Any build that includes the Dockerfile parser now fails to compile, so either pin BuildKit below this API change or update the caller to use the returned Result.State.

Useful? React with 👍 / 👎.