fix(deps): update module github.com/moby/buildkit to v0.25.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/moby/buildkit	v0.24.0 -> v0.25.1

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

moby/buildkit (github.com/moby/buildkit)

v0.25.1

Compare Source

buildkit 0.25.1

Welcome to the v0.25.1 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax

Notable Changes

• Fix possible cache export failure when previously exported cache blob has been deleted #​6261
• Fix possible cache corruption or error when using inline cache with multiple exporters #​6263
• Fix intermediate wrapper for custom provenance attestation fields #​6275

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.25.0

v0.25.0

Compare Source

buildkit 0.25.0

Welcome to the v0.25.0 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Jonathan A. Sternberg
• Akihiro Suda
• Brian Goff
• greggu
• Sebastiaan van Stijn
• Søren Hansen
• Vigilans
• Sam Oluwalana
• Shivam
• Tianon Gravi
• nikelborm

Notable Changes

• Git sources now support working with SHA-256 based code repositories. #​6194
• New Checksum has been added to llb.Image to specify verification digest of the image. Unlike the existing digest in the image reference, where digest overrides the tag if both are set, in this mode, the image is resolved by the tag and only verified by checksum. #​6234
• The remote cache exporter (also used in provenance creation) has been completely rewritten to solve various concurrency and loop issues. There should be no user-visible changes in the cache format itself. #​6129
• BuildKit daemon now supports a way to add custom fields to the provenance attestation to specify the environment BuildKit is running in. Additional field are picked up from config files in /etc/buildkitd/provenance.d directory. #​6210
• Containerd executor on Windows now supports HyperVIsolation option. #​6224
• Included runc container runtime has been updated to v1.3.1 #​6236
• CNI plugins have been updated to v1.8.0 #​6185
• Qemu emulation binaries have been updated to v10.0.4. #​6215
• Fix possible infinite loop when exporting cache #​6186
• Fix issue where some errors could lose their source or stack information when wrapped with errors.Join. #​6226
• Multiple fixes to how the builds from Git context are recorded in provenance. #​6213
• Fix issue where build arguments could be missing in the history record's provenance attestation. #​6221
• Fix issue where materials=false could be incorrectly set in provenance attestation for a build that used frontend inputs. #​6203
• Fix not setting the platform in the subject descriptor of the OCI artifact-style attestation manifest. This confused some registries. #​6191
• Fix some improper formatting in error messages. #​6192
• Fix issue with checking out annotated tags by full reference. #​6244

Dependency Changes

• github.com/docker/cli v28.3.3 -> v28.4.0
• google.golang.org/protobuf v1.36.6 -> v1.36.9

Previous release can be found at v0.24.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: module github.com/moby/buildkit@v0.25.1 requires go >= 1.24.0; switching to go1.24.9
go: downloading go1.24.9 (linux/amd64)
go: download go1.24.9: golang.org/toolchain@v0.0.1-go1.24.9.linux-amd64: verifying module: checksum database disabled by GOSUMDB=off

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.