[crazy-max]

No description provided.

[thaJeztah]

Did you want to bump the other deps through Buildkit, or have the separate PRs (at least for visibility)?

• vendor: golang.org/x/net v0.60.0 (security) #4178
• vendor: github.com/containerd/containerd/v2 v2.4.2 (security) #4180
• vendor: go.yaml.in/yaml/v3 v3.0.6 (security) #4182

(looks like BuildKit didn't include the golang.org/x/net bump?)

[crazy-max]

Did you want to bump the other deps through Buildkit, or have the separate PRs (at least for visibility)?

• vendor: golang.org/x/net v0.60.0 (security) #4178
• vendor: github.com/containerd/containerd/v2 v2.4.2 (security) #4180
• vendor: go.yaml.in/yaml/v3 v3.0.6 (security) #4182

(looks like BuildKit didn't include the golang.org/x/net bump?)

Yeah, I'd prefer to bring in the shared dependency bumps through BuildKit, as we've done with previous vendoring updates, e.g. #4036 and #4122. This already picks up containerd, compress, and fsutil. It will be mentioned in the release notes.

We're also doing an RC tomorrow. This security release is primarily focused on fixes affecting our own tooling. It doesn't pick up the x/net so I'd keep #4178 separate but fine to bring YAML bump as this is a patch release.