build(deps): bump github.com/moby/buildkit from 0.23.2 to 0.28.1 in the go_modules group across 1 directory

[dependabot]

Bumps the go_modules group with 1 update in the / directory: github.com/moby/buildkit.

Updates github.com/moby/buildkit from 0.23.2 to 0.28.1

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.28.1

Welcome to the v0.28.1 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Sebastiaan van Stijn

Notable Changes

• Fix insufficient validation of Git URL #ref:subdir fragments that could allow access to restricted files outside the checked-out repository root. GHSA-4vrq-3vrq-g6gg
• Fix a vulnerability where an untrusted custom frontend could cause files to be written outside the BuildKit state directory. GHSA-4c29-8rgm-jvjj
• Fix a panic when processing invalid .dockerignore patterns during COPY. #6610 moby/patternmatcher#9

Dependency Changes

• github.com/moby/patternmatcher v0.6.0 -> v0.6.1

Previous release can be found at v0.28.0

v0.28.0

buildkit 0.28.0

Welcome to the v0.28.0 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Sebastiaan van Stijn
• Jonathan A. Sternberg
• Akihiro Suda
• Amr Mahdi
• Dan Duvall
• David Karlsson
• Jonas Geiler
• Kevin L.
• rsteube

... (truncated)

Commits

• 45b038c git: normalize and validate subdir paths
• f5462c2 git: harden ref arg handling
• 71577a5 source: extract SafeFileName into shared pathutil package
• df43783 source/http: use os.Root for saved file operations
• 9ce6f62 source/http: sanitize downloaded filenames
• 099cf80 executor: validate container IDs centrally
• 2642113 Merge pull request #6610 from thaJeztah/0.28_backport_bump_patternmatcher
• 802da78 vendor: github.com/moby/patternmatcher v0.6.1
• 5245d86 Merge pull request #6551 from tonistiigi/v0.28-cherry-picks
• 90ee5de vendor: update x/net to v0.51.0
• Additional commits viewable in compare view

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.16%. Comparing base (99470e9) to head (a3069e2).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2705      +/-   ##
==========================================
- Coverage   79.31%   79.16%   -0.15%     
==========================================
  Files         117      117              
  Lines        8016     8016              
==========================================
- Hits         6358     6346      -12     
- Misses       1275     1298      +23     
+ Partials      383      372      -11     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cuixq]

This PR bumped github.com/moby/buildkit from v0.23.2 to v0.28.1. This new version of buildkit requires github.com/opencontainers/runtime-spec v1.3.0. However, osv-scanner depends on osv-scalibr, which currently uses github.com/containerd/containerd v1.7.x.

The containerd v1.7.x code is incompatible with runtime-spec v1.3.0 due to API changes.

# github.com/containerd/containerd/oci
../go/pkg/mod/github.com/containerd/containerd@v1.7.30/oci/spec_opts.go:1506:34: cannot use limit (variable of type int64) as *int64 value in assignment

Forcing opencontainers/runtime-spec to v1.2.1 seems fixes the failure: this version allows both moby/buildkit v0.28.1 and containerd v1.7.x to compile successfully.

replace github.com/opencontainers/runtime-spec => github.com/opencontainers/runtime-spec v1.2.1

[cuixq]

@dependabot rebase