±stackdiff
Containers

BuildKit: what changed

In the last 90 days, 14 summarized changes: 4 security advisories, 8 releases, 2 fixes. Stackdiff reads BuildKit's own feeds (github.com) and writes two sentences per change with a link to the source; it never republishes release notes. Sources last checked .

Needs attention

Breaking changes, security advisories, end-of-life and license changes from the last 90 days, worst first.

0.31.1Securitymedium
GO-2026-6255: BuildKit: Custom frontend could bypass Seccomp/AppArmor in github.com/moby/buildkit
OSV advisory: osv.dev →
0.31.1Securitymedium
GO-2026-6256: BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit
OSV advisory: osv.dev →
0.31.1Securitymedium
GHSA-72x6-4j93-7w86: BuildKit has a possible runtime DoS via unbounded group parsing
OSV advisory: osv.dev →
0.31.1Securitymedium
GHSA-7236-3392-c5c6: BuildKit: Custom frontend could bypass Seccomp/AppArmor
OSV advisory: osv.dev →

Latest changes

Newest first, every type. Releases and fixes sit below anything that can hurt you in the weekly brief; here they are in order.

News
Anthropic Is Building a Predictive Surveillance System to Monitor Activists
Hacker News: prospect.org →
News
Building a Wall Lamp from Scratch
Hacker News: mbugert.de →
News
Watch Los Angeles get built, one building at a time (1880–2026)
Hacker News: lax-skyline.parcelscope.net →
News
Launch HN: RonanRX (YC S26) – Personalized Peptides and GLP-1s
Hacker News: news.ycombinator.com →
0.33.0Release
v0.33.0
GitHub release: github.com →
1.27.0Release
dockerfile/1.27.0
GitHub release: github.com →
1.27.0-labsRelease
dockerfile/1.27.0-labs
GitHub release: github.com →
News
Launch HN: Nori Robotics (YC S26) – A low-cost humanoid robot for development
Hacker News: norirobotics.com →
0.33.0-rc2Fix
v0.33.0-rc2
GitHub release: github.com →
News
Elevator of the Year: Modernization of the Metropolis Trust Building
Hacker News: starelevator.com →
News
Building my own network stack
Hacker News: blog.lyc8503.net →
1.27.0-rc1Release
dockerfile/1.27.0-rc1-labs
GitHub release: github.com →
1.27.0-rc1Release
dockerfile/1.27.0-rc1
GitHub release: github.com →
0.33.0-rc1Release
v0.33.0-rc1
GitHub release: github.com →
0.31.1Securitymedium
GO-2026-6255: BuildKit: Custom frontend could bypass Seccomp/AppArmor in github.com/moby/buildkit
OSV advisory: osv.dev →
0.31.1Securitymedium
GO-2026-6256: BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit
OSV advisory: osv.dev →
0.31.1Securitymedium
GHSA-72x6-4j93-7w86: BuildKit has a possible runtime DoS via unbounded group parsing
OSV advisory: osv.dev →
0.31.1Securitymedium
GHSA-7236-3392-c5c6: BuildKit: Custom frontend could bypass Seccomp/AppArmor
OSV advisory: osv.dev →
0.32.2Release
v0.32.2
GitHub release: github.com →
0.32.1Fix
v0.32.1
GitHub release: github.com →
0.32.0Release
v0.32.0
GitHub release: github.com →
0.28.1Securityhigh
GHSA-4vrq-3vrq-g6gg: BuildKit Git URL subdir component can cause access to restricted files
OSV advisory: osv.dev →
0.28.1Securityhigh
GHSA-4c29-8rgm-jvjj: BuildKit's Malicious frontend can cause file escape outside of storage root
OSV advisory: osv.dev →
0.12.5Securitymedium
GHSA-9p26-698r-w4hx: BuildKit vulnerable to possible panic when incorrect parameters sent from frontend
OSV advisory: osv.dev →
0.12.5Securityhigh
GHSA-m3r6-h7wv-7xxv: BuildKit vulnerable to possible race condition with accessing subpaths from cache mounts
OSV advisory: osv.dev →
0.12.5Securitycritical
GHSA-4v98-7qmw-rqr8: BuildKit vulnerable to possible host system access from mount stub cleaner
OSV advisory: osv.dev →
0.12.5Securitycritical
GHSA-wr6v-9f75-vh2g: Buildkit's interactive containers API does not validate entitlements check
OSV advisory: osv.dev →

Where Stackdiff reads BuildKit

Only what the vendor publishes for machines. Excerpts are capped, summaries are our own two sentences, and every line links back.

Get BuildKit changes in your Monday brief

Add BuildKit and the rest of your stack; breaking changes and CVEs go out the moment they're seen, everything else on Monday.

Get your first brief →

Other containers tools