From 1b575c33e619cfed6c08345c2359f80866b803a8 Mon Sep 17 00:00:00 2001
From: "devsy-app[bot]" <277138668+devsy-app[bot]@users.noreply.github.com>
Date: Fri, 14 Aug 2026 11:04:42 +0000
Subject: [PATCH 1/2] fix(dockerfile): guard nil deref in parseUser/parseArg

guard against nil Next in parseUser/parseArg
---
 pkg/dockerfile/parse.go      |  6 ++++++
 pkg/dockerfile/parse_test.go | 16 ++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/pkg/dockerfile/parse.go b/pkg/dockerfile/parse.go
index 11d946d5a..31b68f9ba 100644
--- a/pkg/dockerfile/parse.go
+++ b/pkg/dockerfile/parse.go
@@ -453,6 +453,9 @@ func (d *Dockerfile) indexStagesByTarget() {
 }
 
 func parseUser(instruction *parser.Node) instructions.KeyValuePair {
+	if instruction.Next == nil {
+		return instructions.KeyValuePair{}
+	}
 	value := instruction.Next.Value
 	if strings.Contains(value, ":") && !strings.HasPrefix(value, "${") {
 		value = strings.Split(value, ":")[0]
@@ -462,6 +465,9 @@ func parseUser(instruction *parser.Node) instructions.KeyValuePair {
 
 func parseArg(instruction *parser.Node) instructions.KeyValuePairOptional {
 	node := instruction.Next
+	if node == nil {
+		return instructions.KeyValuePairOptional{}
+	}
 	if node.Next != nil {
 		value := node.Next.Value
 		return instructions.KeyValuePairOptional{Key: node.Value, Value: &value}
diff --git a/pkg/dockerfile/parse_test.go b/pkg/dockerfile/parse_test.go
index 6441321ff..72ae4c434 100644
--- a/pkg/dockerfile/parse_test.go
+++ b/pkg/dockerfile/parse_test.go
@@ -358,3 +358,19 @@ FROM ${REGISTRY}/${IMAGE}:${TAG}`
 	)
 	s.Equal("gcr.io/my/image:latest", baseImage)
 }
+
+// A bare directive with no value must not panic the parser; the buildkit parser
+// still emits the node, so parseUser/parseArg must tolerate a nil Next.
+func (s *ParseTestSuite) TestValuelessUserDoesNotPanic() {
+	d, err := Parse("FROM ubuntu\nUSER")
+	s.NoError(err)
+	s.Require().NotEmpty(d.Stages)
+	s.Empty(d.Stages[0].Users[0].Key)
+}
+
+func (s *ParseTestSuite) TestValuelessArgDoesNotPanic() {
+	d, err := Parse("FROM ubuntu\nARG")
+	s.NoError(err)
+	s.Require().NotEmpty(d.Stages)
+	s.Empty(d.Stages[0].Args[0].Key)
+}

From 34fbc75d7256fe579bafb68b8a1a93fbd47857e3 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Mon, 17 Aug 2026 05:56:51 +0000
Subject: [PATCH 2/2] style: update comment

Signed-off-by: Samuel K <skevetter@pm.me>
---
 pkg/dockerfile/parse_test.go | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkg/dockerfile/parse_test.go b/pkg/dockerfile/parse_test.go
index 72ae4c434..931f861f5 100644
--- a/pkg/dockerfile/parse_test.go
+++ b/pkg/dockerfile/parse_test.go
@@ -359,8 +359,6 @@ FROM ${REGISTRY}/${IMAGE}:${TAG}`
 	s.Equal("gcr.io/my/image:latest", baseImage)
 }
 
-// A bare directive with no value must not panic the parser; the buildkit parser
-// still emits the node, so parseUser/parseArg must tolerate a nil Next.
 func (s *ParseTestSuite) TestValuelessUserDoesNotPanic() {
 	d, err := Parse("FROM ubuntu\nUSER")
 	s.NoError(err)