chore(deps): update go deps

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-git/go-billy/v5	v5.9.1 → v5.9.2
github.com/moby/buildkit	v0.33.0 → v0.33.1
github.com/olekukonko/tablewriter	v1.1.4 → v1.1.5

---

Release Notes

go-git/go-billy (github.com/go-git/go-billy/v5)

v5.9.2

Compare Source

What's Changed

• build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​216
• build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​230
• build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​229

Full Changelog: go-git/go-billy@v5.9.0...v5.9.2

moby/buildkit (github.com/moby/buildkit)

v0.33.1

Compare Source

Welcome to the v0.33.1 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Sebastiaan van Stijn

Notable Changes

• Built-in Dockerfile frontend has been updated to v1.27.1 changelog.
• Fix proxy CA cleanup so build steps cannot redirect it outside the build rootfs, block it with a special file, or succeed when cleanup fails. GHSA-2f5p-x9ph-g97x
• Fix a daemon panic when a build requests CDI devices while CDI support is disabled. Optional devices are ignored; required devices produce an error. GHSA-r456-g3gm-cvxf
• Verify container blob contents against their claimed digest before caching them. This protects shared caches from unverified blobs supplied through the low-level LLB API. GHSA-p3rc-w3hc-pqvv
• Verify applied image layer DiffIDs, bind lazy stargz snapshots to their verified TOC digest, and isolate legacy layer snapshots. Image source cache keys no longer rely on unverified DiffIDs. GHSA-f2v9-hprr-32q3
• Prevent malicious external frontends from crashing the daemon through gateway container lifecycle races or malformed requests and definitions. GHSA-4hgw-qrhw-fhg8
• Reject special files in daemon-side snapshot reads and replace existing special files safely in LLB mkfile operations. GHSA-9728-qjrv-2xh2
• Reject malformed LLB file operations with invalid symlink owner inputs instead of allowing a daemon panic. GHSA-fjj4-h6vf-m9hj
• Reject malformed LLB merge operations with mismatched input counts instead of allowing a daemon panic. GHSA-cv6p-7w7g-xjwq
• Limit Dockerfile, .dockerignore, gateway file, and nested LLB definition reads to prevent oversized inputs from exhausting daemon memory. GHSA-mgqf-486f-49vp
• Apply source policies to Git bundle locators and reject Git full remote URLs that do not match the source identifier. GHSA-66hf-6vf5-87hc

Dependency Changes

• github.com/containerd/containerd/v2 v2.3.4 -> v2.3.6
• golang.org/x/crypto v0.55.0 -> v0.56.0

Previous release can be found at v0.33.0

olekukonko/tablewriter (github.com/olekukonko/tablewriter)

v1.1.5

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.26.3 -> 1.26.8