Bump dependencies

[renovate]

This PR contains the following updates:

Package	Manager	Type	Update	Change
docker	regex	run	patch	28.5.1 -> 28.5.2
docker-buildx	regex	run	minor	0.29.1 -> 0.30.0
docker-compose	regex	run	patch	2.40.0 -> 2.40.3
docker/setup-qemu-action	github-actions	action	minor	v3.6.0 -> v3.7.0
dotnet-sdk	regex	script	patch	9.0.305 -> 9.0.307
dotnet-sdk	regex	task	patch	9.0.305 -> 9.0.307
dotnet-sdk	regex	action	patch	9.0.305 -> 9.0.307
mcr.microsoft.com/dotnet/sdk	dockerfile	final	patch	9.0.305-noble -> 9.0.307-noble

---

Release Notes

moby/moby (docker)

v28.5.2

Compare Source

28.5.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

• docker/cli, 28.5.2 milestone
• moby/moby, 28.5.2 milestone

[!CAUTION]
This release contains fixes for three high-severity security vulnerabilities in runc:

• CVE-2025-31133
• CVE-2025-52565
• CVE-2025-52881

All three vulnerabilities ultimately allow (through different methods) for full container breakouts by bypassing runc's restrictions for writing to arbitrary /proc files.

Packaging updates

• Update runc to v1.3.3. moby/moby#51394

Bug fixes and enhancements

• dockerd-rootless.sh: if slirp4netns is not installed, try using pasta (passt). moby/moby#51162
• Update Go runtime to 1.24.9. moby/moby#51387, docker/cli#6613

Deprecations

• Go-SDK: cli/command/image/build: deprecate DefaultDockerfileName, DetectArchiveReader, WriteTempDockerfile, ResolveAndValidateContextPath. These utilities were only used internally and will be removed in the next release. docker/cli#6610
• Go-SDK: cli/command/image/build: deprecate IsArchive utility. docker/cli#6560
• Go-SDK: opts: deprecate ValidateMACAddress. docker/cli#6560
• Go-SDK: opts: deprecate ListOpts.Delete(). docker/cli#6560

docker/buildx (docker-buildx)

v0.30.0

Compare Source

buildx 0.30.0

Welcome to the v0.30.0 release of buildx!

Please try out the release binaries and report any issues at
https://github.com/docker/buildx/issues.

Contributors

• CrazyMax
• Tõnis Tiigi
• Jonathan A. Sternberg
• Remy Suen
• Sebastiaan van Stijn
• aevesdocker
• Akihiro Suda
• Guillaume Lours
• Ricardo Branco
• Roberto Castellotti
• Roberto Villarreal

Notable Changes

• Tar exporter output will now automatically create parent directories. #​3478
• Deprecate docker buildx install and docker buildx uninstall in favor of using docker buildx directly without relying on the docker builder aliases. #​3472
• Clarify CLI help for the --tag option to give more guidance on a valid argument. #​3454
• Bake: Ensure typed variables with no value still carry type to prevent a panic. #​3463
• imagetools create now persists attestation manifest and any manifest cosign-based signatures when creating new images. #​3433
• Add option to docker-container driver to write github actions payload for provenance with --driver-opt=provenance-add-gha=true. #​3453
• Avoid concurrent map write panic with imagetools create. #​3510
• Avoid panic when linking a nil target to another build in Bake. #​3511
• DAP: Next, step in, and step out requests now respect breakpoints. #​3488
• DAP: Verify breakpoints when stopOnEntry is used. #​3488
• DAP: Support runInTerminal reverse request when buildx dap is run in standalone mode. #​3471
• DAP: Stop sending null in setBreakpoints response when the breakpoints are cleared to conform to the specification. #​3481
• DAP: exec command now works when suspended on a COPY line. #​3469
• DAP: Debugger now ensures that all inputs are properly executed when suspended on a line. #​3469
• DAP: Debugger now pauses on COPY lines when there is a non-existent file. #​3437
• Compose support has been updated to v2.9.1. #​3494

Dependency Changes

• github.com/aws/aws-sdk-go-v2 v1.30.3 -> v1.38.1
• github.com/aws/aws-sdk-go-v2/config v1.27.27 -> v1.31.3
• github.com/aws/aws-sdk-go-v2/credentials v1.17.27 -> v1.18.7
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 -> v1.18.4
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15 -> v1.4.4
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15 -> v2.7.4
• github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 -> v1.8.3
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 -> v1.13.0
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 -> v1.13.4
• github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 -> v1.28.2
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 -> v1.34.0
• github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 -> v1.38.0
• github.com/aws/smithy-go v1.20.3 -> v1.22.5
• github.com/cenkalti/backoff/v5 v5.0.3 new
• github.com/compose-spec/compose-go/v2 v2.9.0 -> v2.9.1
• github.com/containerd/containerd/api v1.9.0 -> v1.10.0
• github.com/containerd/containerd/v2 v2.1.4 -> v2.2.0
• github.com/containerd/platforms v1.0.0-rc.1 -> v1.0.0-rc.2
• github.com/docker/cli v28.4.0 -> v28.5.1
• github.com/docker/docker v28.4.0 -> v28.5.1
• github.com/emicklei/go-restful/v3 v3.11.0 -> v3.13.0
• github.com/fxamacker/cbor/v2 v2.7.0 -> v2.9.0
• github.com/go-logr/logr v1.4.2 -> v1.4.3
• github.com/gofrs/flock v0.12.1 -> v0.13.0
• github.com/google/gnostic-models v0.6.8 -> v0.7.0
• github.com/gorilla/websocket v1.5.0 -> e064f32
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1 -> v2.27.2
• github.com/klauspost/compress v1.18.0 -> v1.18.1
• github.com/moby/buildkit v0.25.0 -> v0.26.0
• github.com/modern-go/reflect2 v1.0.2 -> 35a7c28
• github.com/secure-systems-lab/go-securesystemslib v0.6.0 -> v0.9.1
• github.com/stretchr/testify v1.11.0 -> v1.11.1
• go.opentelemetry.io/auto/sdk v1.1.0 -> v1.2.1
• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 -> v0.61.0
• go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.60.0 -> v0.61.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 -> v0.61.0
• go.opentelemetry.io/otel v1.35.0 -> v1.38.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0 -> v1.38.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.35.0 -> v1.38.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 -> v1.38.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 -> v1.38.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 -> v1.38.0
• go.opentelemetry.io/otel/metric v1.35.0 -> v1.38.0
• go.opentelemetry.io/otel/sdk v1.35.0 -> v1.38.0
• go.opentelemetry.io/otel/sdk/metric v1.35.0 -> v1.38.0
• go.opentelemetry.io/otel/trace v1.35.0 -> v1.38.0
• go.opentelemetry.io/proto/otlp v1.5.0 -> v1.7.1
• go.yaml.in/yaml/v2 v2.4.2 new
• golang.org/x/crypto v0.38.0 -> v0.42.0
• golang.org/x/mod v0.24.0 -> v0.29.0
• golang.org/x/net v0.39.0 -> v0.44.0
• golang.org/x/oauth2 v0.29.0 -> v0.30.0
• golang.org/x/sync v0.16.0 -> v0.17.0
• golang.org/x/sys v0.33.0 -> v0.37.0
• golang.org/x/term v0.32.0 -> v0.35.0
• golang.org/x/text v0.25.0 -> v0.29.0
• golang.org/x/time v0.11.0 -> v0.14.0
• golang.org/x/tools v0.32.0 -> v0.37.0
• google.golang.org/genproto/googleapis/api 56aae31 -> c5933d9
• google.golang.org/genproto/googleapis/rpc 56aae31 -> c5933d9
• google.golang.org/grpc v1.72.2 -> v1.76.0
• google.golang.org/protobuf v1.36.9 -> v1.36.10
• k8s.io/api v0.32.3 -> v0.34.1
• k8s.io/apimachinery v0.32.3 -> v0.34.1
• k8s.io/client-go v0.32.3 -> v0.34.1
• k8s.io/kube-openapi 32ad38e -> f3f2b99
• k8s.io/utils 3ea5e8c -> 4c0f3b2
• sigs.k8s.io/json 9aa6b5e -> cfa47c3
• sigs.k8s.io/randfill v1.0.0 new
• sigs.k8s.io/structured-merge-diff/v6 v6.3.0 new
• sigs.k8s.io/yaml v1.4.0 -> v1.6.0

Previous release can be found at v0.29.1

docker/compose (docker-compose)

v2.40.3

Compare Source

What's Changed

🐛 Fixes

• Fix OCI compose override support by @​ndeloof #​13311
• Fix help output for "exec --no-tty" option by @​tonyo #​13314
• Prompt default implementation to prevent a panic by @​ndeloof #​13317
• Run hooks on restart by @​ndeloof #​13321
• Fix(run): Ensure images exist only for the target service in run command by @​idsulik #​13325
• Fix(git): Fix path traversal vulnerability in git remote loader by @​idsulik #​13331

🔧 Internal

• Test to check writeComposeFile detects invalid OCI artifact by @​ndeloof #​13309
• Code Cleanup by @​ndeloof #​13315

⚙️ Dependencies

• Bump compose-go to version v2.9.1 by @​glours #​13332

Full Changelog: docker/compose@v2.40.2...v2.40.3

v2.40.2

Compare Source

What's Changed

🐛 Fixes

• Compose can't create a tar with adequate uid:gid ownership by @​ndeloof in #​13299
• Test digest or canonical reference, not only tag, when checking if an image is already present by @​glours in #​13302

🔧 Internal

• Fail build if minimal required version of buildx isn't installed by @​ndeloof in #​13295
• remove unused code to only rely on api.Service by @​ndeloof in #​13300
• Introduce WithPrompt to configure compose backend to use a plugable UI component for user interaction by @​ndeloof in #​13308

Full Changelog: docker/compose@v2.40.1...v2.40.2

v2.40.1

Compare Source

What's Changed

🐛 Fixes

• Write error to watcher error channel if Start() fails by @​Trolldemorted in #​13263
• Fix: set PWD only if not set by @​kianelbo in #​13268
• bake only interpolates ${*} by @​ndeloof in #​13270
• Fix: make "publish" push all compose files addressed in "extends" statements when using "profiles". by @​ogoulpeau-ledger in #​13277
• Support Ctrl+Z to run compose in background by @​ndeloof in #​13289
• Fix race-condition bug in publish command by @​paul-kinexon in #​13291
• Set secret/config uid:gid to match container's USER by @​ndeloof in #​13288
• Fix failure to delegate build with bake by @​ndeloof in #​13275
• Make CTRL+Z a no-op operation on Windows by @​glours in #​13293

🔧 Internal

• pkg/compose: align classic builder implementation with docker/cli by @​thaJeztah in #​13278
• pkg/compose: build with bake: drop support for buildx v0.16 and lower by @​thaJeztah in #​13280
• Use fixed version of compose bridge transformer images by @​glours in #​13284

⚙️ Dependencies

• Build(deps): bump github.com/docker/docker from 28.5.0+incompatible to 28.5.1+incompatible by @​dependabot[bot] in #​13274
• Build(deps): bump github.com/docker/cli from 28.5.0+incompatible to 28.5.1+incompatible by @​dependabot[bot] in #​13273
• Build(deps): bump golang.org/x/sys from 0.36.0 to 0.37.0 by @​dependabot[bot] in #​13272
• Build(deps): bump docker/buildx v0.29.1, moby/buildkit v0.25.1 by @​thaJeztah in #​13279
• Bump golang to version 1.24.9 by @​glours in #​13285

New Contributors

• @​Trolldemorted made their first contribution in #​13263
• @​ogoulpeau-ledger made their first contribution in #​13277
• @​paul-kinexon made their first contribution in #​13291

Full Changelog: docker/compose@v2.40.0...v2.40.1

docker/setup-qemu-action (docker/setup-qemu-action)

v3.7.0

Compare Source

• Bump @​docker/actions-toolkit from 0.56.0 to 0.67.0 in #​217 #​230
• Bump brace-expansion from 1.1.11 to 1.1.12 in #​220
• Bump form-data from 2.5.1 to 2.5.5 in #​218
• Bump tmp from 0.2.3 to 0.2.4 in #​221
• Bump undici from 5.28.4 to 5.29.0 in #​219

Full Changelog: docker/setup-qemu-action@v3.6.0...v3.7.0

dotnet/sdk (dotnet-sdk)

v9.0.307

Compare Source

v9.0.306: .NET 9.0.10

Compare Source

Release

What's Changed

• [release/8.0.4xx] Update dependencies from dotnet/msbuild by @​dotnet-maestro[bot] in #​50229
• [automated] Merge branch 'release/8.0.4xx' => 'release/9.0.1xx' by @​github-actions[bot] in #​50268
• [release/8.0.3xx] Update dependencies from dotnet/source-build-reference-packages by @​dotnet-maestro[bot] in #​50270
• [release/9.0.1xx] Update dependencies from dotnet/templating by @​dotnet-maestro[bot] in #​50281
• [release/8.0.4xx] Update dependencies from dotnet/source-build-reference-packages by @​dotnet-maestro[bot] in #​50272
• [automated] Merge branch 'release/8.0.3xx' => 'release/8.0.4xx' by @​github-actions[bot] in #​50277
• [release/8.0.4xx] Update dependencies from dotnet/templating by @​dotnet-maestro[bot] in #​50298
• [release/8.0.4xx] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​50301
• [release/9.0.1xx] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​50304
• [release/9.0.1xx] Update dependencies from dotnet/templating by @​dotnet-maestro[bot] in #​50320
• [release/9.0.1xx] Update dependencies from dotnet/templating by @​dotnet-maestro[bot] in #​50326
• Update branding to 9.0.111 by @​vseanreesermsft in #​50586
• Update our container images to ones that are in support by @​marcpopMSFT in #​49942
• Update branding to 8.0.415 by @​vseanreesermsft in #​50585
• [automated] Merge branch 'release/8.0.4xx' => 'release/9.0.1xx' by @​github-actions[bot] in #​50692
• [automated] Merge branch 'release/9.0.1xx' => 'release/9.0.3xx' by @​github-actions[bot] in #​50683
• [release/9.0.1xx] Update dependencies from dotnet/templating by @​dotnet-maestro[bot] in #​50591
• [release/9.0.1xx] Update dependencies from dotnet/roslyn by @​dotnet-maestro[bot] in #​50466
• [release/9.0.1xx] Update dependencies from dotnet/source-build-reference-packages by @​dotnet-maestro[bot] in #​50590
• [release/9.0.1xx] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​50543
• [release/9.0.1xx] Update dependencies from dotnet/msbuild by @​dotnet-maestro[bot] in #​50382
• [release/9.0.1xx] Update dependencies from dotnet/razor by @​dotnet-maestro[bot] in #​50459
• [release/9.0.1xx] Update dependencies from dotnet/msbuild by @​dotnet-maestro[bot] in #​50720
• [release/9.0.3xx] Update dependencies from dotnet/msbuild by @​dotnet-maestro[bot] in #​50383
• [release/9.0.3xx] Update dependencies from dotnet/roslyn by @​dotnet-maestro[bot] in #​50467
• [release/9.0.3xx] Update dependencies from microsoft/vstest by @​dotnet-maestro[bot] in #​50542
• [release/9.0.3xx] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​50544
• Update branding to 9.0.306 by @​vseanreesermsft in #​50724
• [release/9.0.3xx] Update dependencies from dotnet/templating by @​dotnet-maestro[bot] in #​50592
• Merging internal commits for release/9.0.1xx by @​vseanreesermsft in #​50712
• [release/8.0.4xx] Update dependencies from dotnet/source-build-reference-packages by @​dotnet-maestro[bot] in #​50539
• .NET Source-Build 9.0.110 September 2025 Updates by @​dotnet-sb-bot in #​50714
• [release/9.0.3xx] Update dependencies from dotnet/roslyn-analyzers by @​dotnet-maestro[bot] in #​50457
• [release/9.0.3xx] Update dependencies from dotnet/razor by @​dotnet-maestro[bot] in #​50465
• [automated] Merge branch 'release/8.0.4xx' => 'release/9.0.1xx' by @​github-actions[bot] in #​50745
• [automated] Merge branch 'release/9.0.1xx' => 'release/9.0.3xx' by @​github-actions[bot] in #​50699
• [release/8.0.4xx] Update dependencies from dotnet/templating by @​dotnet-maestro[bot] in #​50357
• [release/9.0.1xx] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​50764
• [release/9.0.3xx] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​50765
• Upgrade scancode to 32.4.1 by @​Winniexu01 in #​50777
• Add static to fix IDE0062 by @​marcpopMSFT in #​50771
• [automated] Merge branch 'release/9.0.1xx' => 'release/9.0.3xx' by @​github-actions[bot] in #​50772
• [release/8.0.4xx] Update dependencies from dotnet/msbuild by @​dotnet-maestro[bot] in #​50381
• [release/9.0.3xx] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​50804
• [release/9.0.1xx] Update dependencies from dotnet/source-build-reference-packages by @​dotnet-maestro[bot] in #​50802
• [release/9.0.1xx] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​50803
• [automated] Merge branch 'release/8.0.4xx' => 'release/9.0.1xx' by @​github-actions[bot] in #​50788
• [automated] Merge branch 'release/9.0.1xx' => 'release/9.0.3xx' by @​github-actions[bot] in #​50827
• [9.0.3xx] detect .NET 10 RID-specific tools and provide a more actionable error by @​baronfel in #​50416
• Merging internal commits for release/9.0.3xx by @​vseanreesermsft in #​50711
• [9.0.1xx] detect .NET 10 RID-specific tools and provide a more actionable error by @​baronfel in #​50415
• [automated] Merge branch 'release/9.0.1xx' => 'release/9.0.3xx' by @​github-actions[bot] in #​50845
• [release/9.0.3xx] Update dependencies from dotnet/roslyn by @​dotnet-maestro[bot] in #​50848
• [release/9.0.3xx] Update dependencies from dotnet/templating by @​dotnet-maestro[bot] in #​50853
• [release/9.0.3xx] Make duplicate deb/rpm packages so we can sign them with the new PMC key by @​github-actions[bot] in #​50910

Full Changelog: dotnet/sdk@v9.0.305...v9.0.306

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.