dev tools updates

Dockerfile

@@ -16,10 +16,10 @@ ARG MINIO_VERSION=RELEASE.2025-09-07T16-13-09Z
 ARG MINIO_MC_VERSION=RELEASE.2025-08-13T08-35-41Z
 ARG AZURITE_VERSION=3.35.0
 ARG GOTESTSUM_VERSION=v1.13.0
-ARG DELVE_VERSION=v1.26.0
+ARG DELVE_VERSION=v1.26.3
 ARG DOCKER_VERSION=29.4
 ARG DOCKER_CLI_VERSION=${DOCKER_VERSION}
-ARG BUILDX_VERSION=0.31.1
+ARG BUILDX_VERSION=0.34.0
 
 ARG EXPORT_BASE=alpine
 ARG ALPINE_VERSION=3.23

cache/blobs.go

@@ -109,7 +109,7 @@ func computeBlobChain(ctx context.Context, sr *immutableRef, createIfNeeded bool
 				}
 				defer func() {
 					if err != nil {
-						l.Discard()
+						l.Discard(ctx)
 					}
 				}()
 
@@ -461,7 +461,7 @@ func ensureCompression(ctx context.Context, ref *immutableRef, comp compression.
 		}
 		defer func() {
 			if err != nil {
-				l.Discard()
+				l.Discard(ctx)
 			}
 		}()
 

cache/manager.go

@@ -235,7 +235,7 @@ func (cm *cacheManager) GetByBlob(ctx context.Context, desc ocispecs.Descriptor,
 	snapshotID := chainID.String()
 	if link != nil {
 		snapshotID = link.getSnapshotID()
-		go link.Release(context.TODO())
+		go link.Release(context.WithoutCancel(ctx))
 	}
 
 	l, err := cm.LeaseManager.Create(ctx, func(l *leases.Lease) error {

cache/refs.go

@@ -1519,8 +1519,9 @@ func (cr *cacheRecord) finalize(ctx context.Context) error {
 	go func() {
 		cr.cm.mu.Lock()
 		defer cr.cm.mu.Unlock()
-		if err := mutable.remove(context.TODO(), true); err != nil {
-			bklog.G(ctx).Error(err)
+		cleanupCtx := context.WithoutCancel(ctx)
+		if err := mutable.remove(cleanupCtx, true); err != nil {
+			bklog.G(cleanupCtx).Error(err)
 		}
 	}()
 

client/build_test.go

@@ -2349,7 +2349,7 @@ func testClientGatewayCanceledCredentialsCallbackReturns(t *testing.T, sb integr
 	t.Cleanup(proxyServer.Close)
 
 	ref := strings.TrimPrefix(proxyServer.URL, "http://") + "/" + repo + ":latest"
-	host := strings.SplitN(ref, "/", 2)[0]
+	host, _, _ := strings.Cut(ref, "/")
 
 	started := make(chan struct{})
 	release := make(chan struct{})

client/client_test.go

@@ -13726,8 +13726,12 @@ func testGitBundleRoundTrip(t *testing.T, sb integration.Sandbox) {
 	localBare := t.TempDir()
 	err = runInDir(localBare, "git init --bare")
 	require.NoError(t, err)
-	bundlePath := filepath.Join(t.TempDir(), "bundle.pack")
-	require.NoError(t, os.WriteFile(bundlePath, bundleBytes, 0644))
+	bundleRoot := t.TempDir()
+	root, err := os.OpenRoot(bundleRoot)
+	require.NoError(t, err)
+	require.NoError(t, root.WriteFile("bundle.pack", bundleBytes, 0644))
+	require.NoError(t, root.Close())
+	bundlePath := filepath.Join(bundleRoot, "bundle.pack")
 	err = runInDir(localBare, fmt.Sprintf("git fetch %s +refs/*:refs/*", bundlePath))
 	require.NoError(t, err)
 	//nolint:gosec // Test-controlled temp dir and commit SHA are not attacker input.

control/control.go

@@ -81,8 +81,7 @@ type Opt struct {
 }
 
 type Controller struct { // TODO: ControlService
-	// buildCount needs to be 64bit aligned
-	buildCount                   int64
+	buildCount                   atomic.Int64
 	opt                          Opt
 	solver                       *llbsolver.Solver
 	history                      *history.Queue
@@ -213,7 +212,7 @@ func (c *Controller) releaseUnreferencedCache(ctx context.Context) error {
 }
 
 func (c *Controller) Prune(req *controlapi.PruneRequest, stream controlapi.Control_PruneServer) error {
-	if atomic.LoadInt64(&c.buildCount) == 0 {
+	if c.buildCount.Load() == 0 {
 		imageutil.CancelCacheLeases()
 	}
 
@@ -383,8 +382,8 @@ func translateLegacySolveRequest(req *controlapi.SolveRequest) {
 func (c *Controller) Solve(ctx context.Context, req *controlapi.SolveRequest) (*controlapi.SolveResponse, error) {
 	defer trace.StartRegion(ctx, "Solve").End()
 	trace.Logf(ctx, "Request", "solve request: %v", req.Ref)
-	atomic.AddInt64(&c.buildCount, 1)
-	defer atomic.AddInt64(&c.buildCount, -1)
+	c.buildCount.Add(1)
+	defer c.buildCount.Add(-1)
 
 	if req.Cache == nil {
 		req.Cache = &controlapi.CacheOptions{} // make sure cache options are initialized

docs/generate.go

@@ -15,18 +15,24 @@ import (
 func main() {
 	re := regexp.MustCompile("(?s)<!---GENERATE_START (.*?)-->(.*?)<!---GENERATE_END-->\n")
 
-	err := filepath.Walk("./docs", func(path string, stat fs.FileInfo, err error) error {
+	root, err := os.OpenRoot("./docs")
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+
+	err = fs.WalkDir(root.FS(), ".", func(path string, d fs.DirEntry, err error) error {
 		if err != nil {
 			return err
 		}
-		if stat.IsDir() {
+		if d.IsDir() {
 			return nil
 		}
 		if filepath.Ext(path) != ".md" {
 			return nil
 		}
 
-		data, err := os.ReadFile(path)
+		data, err := root.ReadFile(path)
 		if err != nil {
 			return err
 		}
@@ -61,14 +67,21 @@ func main() {
 		}
 
 		if !bytes.Equal(data, dataNew) {
-			fmt.Println(path)
-			if err := os.WriteFile(path, dataNew, stat.Mode()); err != nil {
+			info, err := d.Info()
+			if err != nil {
+				return err
+			}
+			fmt.Println(filepath.Join("docs", path))
+			if err := root.WriteFile(path, dataNew, info.Mode()); err != nil {
 				return err
 			}
 		}
 
 		return nil
 	})
+	if closeErr := root.Close(); closeErr != nil && err == nil {
+		err = closeErr
+	}
 	if err != nil {
 		fmt.Println(err)
 		os.Exit(1)

executor/containerdexecutor/executor_unix.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"slices"
 
 	ctd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/containerd/v2/core/mount"
@@ -46,8 +47,8 @@ func getUserSpec(user, rootfsPath string) (specs.User, error) {
 func (w *containerdExecutor) prepareExecutionEnv(ctx context.Context, rootMount executor.Mount, mounts []executor.Mount, meta executor.Meta, details *containerState, netMode pb.NetMode) (string, string, func(), error) {
 	var releasers []func()
 	releaseAll := func() {
-		for i := len(releasers) - 1; i >= 0; i-- {
-			releasers[i]()
+		for _, release := range slices.Backward(releasers) {
+			release()
 		}
 	}
 
@@ -133,8 +134,8 @@ func (w *containerdExecutor) ensureCWD(details *containerState, meta executor.Me
 func (w *containerdExecutor) createOCISpec(ctx context.Context, id, resolvConf, hostsFile string, namespace network.Namespace, mounts []executor.Mount, meta executor.Meta, details *containerState) (*specs.Spec, func(), error) {
 	var releasers []func()
 	releaseAll := func() {
-		for i := len(releasers) - 1; i >= 0; i-- {
-			releasers[i]()
+		for _, release := range slices.Backward(releasers) {
+			release()
 		}
 	}
 

executor/runcexecutor/executor.go

@@ -646,7 +646,7 @@ func runcProcessHandle(ctx context.Context, killer procKiller) (*procHandle, con
 		for {
 			select {
 			case <-ctx.Done():
-				killCtx, timeout := context.WithCancelCause(context.Background())                                         //nolint:govet
+				killCtx, timeout := context.WithCancelCause(context.WithoutCancel(ctx))                                   //nolint:govet
 				killCtx, _ = context.WithTimeoutCause(killCtx, 7*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 				if err := p.killer.Kill(killCtx); err != nil {
 					select {

exporter/tar/export.go

@@ -3,6 +3,7 @@ package local
 import (
 	"context"
 	"os"
+	"slices"
 	"strings"
 	"time"
 
@@ -81,8 +82,8 @@ func (e *localExporterInstance) Export(ctx context.Context, inp *exporter.Source
 	var defers []func() error
 
 	defer func() {
-		for i := len(defers) - 1; i >= 0; i-- {
-			defers[i]()
+		for _, f := range slices.Backward(defers) {
+			f()
 		}
 	}()
 

frontend/dockerfile/parser/dumper/main.go

@@ -8,16 +8,13 @@ import (
 )
 
 func main() {
-	var f *os.File
-	var err error
-
 	if len(os.Args) < 2 {
 		fmt.Println("please supply filename(s)")
 		os.Exit(1)
 	}
 
 	for _, fn := range os.Args[1:] {
-		f, err = os.Open(fn)
+		f, err := os.Open(fn) //nolint:gosec // not using os.Root to support symlinks
 		if err != nil {
 			panic(err)
 		}

frontend/gateway/container/container.go

@@ -97,8 +97,8 @@ func NewContainer(ctx context.Context, cm cache.Manager, exec executor.Executor,
 		return cm.New(ctx, ref, g)
 	}, platform.OS)
 	if err != nil {
-		for i := len(p.Actives) - 1; i >= 0; i-- { // call in LIFO order
-			p.Actives[i].Ref.Release(context.TODO())
+		for _, active := range slices.Backward(p.Actives) { // call in LIFO order
+			active.Ref.Release(context.TODO())
 		}
 		for _, o := range p.OutputRefs {
 			o.Ref.Release(context.TODO())
@@ -435,8 +435,8 @@ func (gwCtr *gatewayContainer) Release(ctx context.Context) error {
 	err1 := gwCtr.errGroup.Wait()
 
 	var err2 error
-	for i := len(gwCtr.cleanup) - 1; i >= 0; i-- { // call in LIFO order
-		err := gwCtr.cleanup[i]()
+	for _, cleanup := range slices.Backward(gwCtr.cleanup) { // call in LIFO order
+		err := cleanup()
 		if err2 == nil {
 			err2 = err
 		}

hack/dockerfiles/doctoc.Dockerfile

@@ -10,7 +10,7 @@ FROM base AS doctoc
 
 # DOCTOC_VERSION is the version of doctoc to install
 # see https://github.com/thlorenz/doctoc/tags for available releases.
-ARG DOCTOC_VERSION=v2.3.0
+ARG DOCTOC_VERSION=v2.4.1
 RUN npm install -g doctoc@${DOCTOC_VERSION#v}
 RUN --mount=type=bind,source=README.md,target=README.md,rw <<EOT
   set -e

hack/dockerfiles/govulncheck.Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 
 ARG GO_VERSION=1.26
-ARG GOVULNCHECK_VERSION=v1.1.4
+ARG GOVULNCHECK_VERSION=v1.3.0
 ARG FORMAT="text"
 
 FROM golang:${GO_VERSION}-alpine AS base

hack/dockerfiles/lint.Dockerfile

@@ -3,8 +3,8 @@
 ARG GO_VERSION=1.26
 ARG ALPINE_VERSION=3.23
 ARG XX_VERSION=1.9.0
-ARG PROTOLINT_VERSION=0.50.5
-ARG GOLANGCI_LINT_VERSION=v2.8.0
+ARG PROTOLINT_VERSION=0.56.4
+ARG GOLANGCI_LINT_VERSION=v2.12.2
 ARG GOLANGCI_FROM_SOURCE=false
 ARG GOPLS_VERSION=v0.38.0
 # GOPLS_ANALYZERS defines gopls analyzers to be run. disabled by default: deprecated simplifyrange unusedfunc unusedvariable
@@ -34,7 +34,7 @@ RUN apk add --no-cache gcc musl-dev yamllint
 ARG GOLANGCI_LINT_VERSION
 ARG GOLANGCI_FROM_SOURCE
 COPY --link --from=golangci-binary / /usr/bin/
-RUN [ "${GOLANGCI_FROM_SOURCE}" = "true" ] && exit 0; wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s ${GOLANGCI_LINT_VERSION}
+RUN [ "${GOLANGCI_FROM_SOURCE}" = "true" ] && exit 0; wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/${GOLANGCI_LINT_VERSION}/install.sh | sh -s ${GOLANGCI_LINT_VERSION}
 COPY --link --from=protolint-base /usr/local/bin/protolint /usr/local/bin/protolint
 COPY --link --from=xx / /
 WORKDIR /go/src/github.com/moby/buildkit

session/grpc.go

@@ -67,9 +67,9 @@ func serve(ctx context.Context, grpcServer *grpc.Server, conn net.Conn) {
 }
 
 func grpcClientConn(ctx context.Context, conn net.Conn, opts map[string][]string) (context.Context, *grpc.ClientConn, error) {
-	var dialCount int64
+	var dialCount atomic.Int64
 	dialer := grpc.WithContextDialer(func(ctx context.Context, addr string) (net.Conn, error) {
-		if c := atomic.AddInt64(&dialCount, 1); c > 1 {
+		if c := dialCount.Add(1); c > 1 {
 			return nil, errors.Errorf("only one connection allowed")
 		}
 		return conn, nil

session/sshforward/sshprovider/agentprovider.go

@@ -130,7 +130,7 @@ func toDialer(paths []string, raw bool) (func(context.Context) (net.Conn, error)
 			continue
 		}
 
-		fi, err := os.Stat(p)
+		fi, err := os.Stat(p) //nolint:gosec // SSH agent paths are explicit user inputs and may intentionally be symlinks.
 		if err != nil {
 			return nil, errors.WithStack(err)
 		}
@@ -142,7 +142,7 @@ func toDialer(paths []string, raw bool) (func(context.Context) (net.Conn, error)
 			return nil, errors.Errorf("raw mode only supported with socket paths")
 		}
 
-		f, err := os.Open(p)
+		f, err := os.Open(p) //nolint:gosec // SSH key paths are explicit user inputs and may intentionally be symlinks.
 		if err != nil {
 			return nil, errors.Wrapf(err, "failed to open %s", p)
 		}

session/testutil/testutil.go

@@ -20,7 +20,7 @@ func TestStream(handler Handler) Dialer {
 	s1, s2 := sockPair()
 	return func(ctx context.Context, proto string, meta map[string][]string) (net.Conn, error) {
 		go func() {
-			err := handler(context.TODO(), s1, meta)
+			err := handler(context.WithoutCancel(ctx), s1, meta)
 			if err != nil {
 				bklog.G(ctx).Error(err)
 			}

solver/edge.go

@@ -972,7 +972,7 @@ func (e *edge) execOp(ctx context.Context) (any, error) {
 
 	for i := range results {
 		if i != int(index) {
-			go results[i].Release(context.TODO())
+			go results[i].Release(context.WithoutCancel(ctx))
 		}
 	}
 

solver/llbsolver/history/buildhistory.go

@@ -290,7 +290,7 @@ func (h *Queue) addResource(ctx context.Context, l leases.Lease, desc *controlap
 			if err != nil {
 				return err
 			}
-			defer lr.Discard()
+			defer lr.Discard(ctx)
 			ok, err := h.migrateBlobV2(ctx, desc.Digest, detectSkipLayers)
 			if err != nil {
 				return err

solver/llbsolver/ops/exec.go

@@ -412,8 +412,8 @@ func (e *ExecOp) Exec(ctx context.Context, jobCtx solver.JobContext, inputs []so
 			err = errdefs.WithExecError(err, execInputs, execMounts)
 		} else {
 			// Only release actives if err is nil.
-			for i := len(p.Actives) - 1; i >= 0; i-- { // call in LIFO order
-				p.Actives[i].Ref.Release(context.TODO())
+			for _, active := range slices.Backward(p.Actives) { // call in LIFO order
+				active.Ref.Release(context.TODO())
 			}
 		}
 		for _, o := range p.OutputRefs {