diff --git a/bake/bake.go b/bake/bake.go
index 23ac031f..54c19a15 100644
--- a/bake/bake.go
+++ b/bake/bake.go
@@ -2,7 +2,6 @@ package bake
 
 import (
 	"context"
-	"encoding/csv"
 	"io"
 	"os"
 	"path"
@@ -27,6 +26,7 @@ import (
 	"github.com/moby/buildkit/client/llb"
 	"github.com/moby/buildkit/session/auth/authprovider"
 	"github.com/pkg/errors"
+	"github.com/tonistiigi/go-csvvalue"
 	"github.com/zclconf/go-cty/cty"
 	"github.com/zclconf/go-cty/cty/convert"
 )
@@ -1393,8 +1393,7 @@ func removeAttestDupes(s []string) []string {
 }
 
 func parseOutput(str string) map[string]string {
-	csvReader := csv.NewReader(strings.NewReader(str))
-	fields, err := csvReader.Read()
+	fields, err := csvvalue.Fields(str, nil)
 	if err != nil {
 		return nil
 	}
diff --git a/builder/builder.go b/builder/builder.go
index dbd7d4cf..b603120f 100644
--- a/builder/builder.go
+++ b/builder/builder.go
@@ -2,7 +2,6 @@ package builder
 
 import (
 	"context"
-	"encoding/csv"
 	"encoding/json"
 	"net/url"
 	"os"
@@ -27,6 +26,7 @@ import (
 	"github.com/moby/buildkit/util/progress/progressui"
 	"github.com/pkg/errors"
 	"github.com/spf13/pflag"
+	"github.com/tonistiigi/go-csvvalue"
 	"golang.org/x/sync/errgroup"
 )
 
@@ -601,8 +601,7 @@ func csvToMap(in []string) (map[string]string, error) {
 	}
 	m := make(map[string]string, len(in))
 	for _, s := range in {
-		csvReader := csv.NewReader(strings.NewReader(s))
-		fields, err := csvReader.Read()
+		fields, err := csvvalue.Fields(s, nil)
 		if err != nil {
 			return nil, err
 		}
diff --git a/commands/build.go b/commands/build.go
index c3b40bd7..7861b10b 100644
--- a/commands/build.go
+++ b/commands/build.go
@@ -5,7 +5,6 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/base64"
-	"encoding/csv"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
@@ -59,6 +58,7 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
+	"github.com/tonistiigi/go-csvvalue"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/metric"
 	"google.golang.org/grpc/codes"
@@ -982,9 +982,9 @@ func (cfg *invokeConfig) parseInvokeConfig(invoke, on string) error {
 		return nil
 	}
 
-	csvReader := csv.NewReader(strings.NewReader(invoke))
-	csvReader.LazyQuotes = true
-	fields, err := csvReader.Read()
+	csvParser := csvvalue.NewParser()
+	csvParser.LazyQuotes = true
+	fields, err := csvParser.Fields(invoke, nil)
 	if err != nil {
 		return err
 	}
diff --git a/go.mod b/go.mod
index 2a591efb..bd6a7dc4 100644
--- a/go.mod
+++ b/go.mod
@@ -28,7 +28,7 @@ require (
 	github.com/hashicorp/hcl/v2 v2.20.1
 	github.com/in-toto/in-toto-golang v0.5.0
 	github.com/mitchellh/hashstructure/v2 v2.0.2
-	github.com/moby/buildkit v0.14.1-0.20240625190127-aaaf86e5470b // master (v0.15-dev)
+	github.com/moby/buildkit v0.14.1-0.20240627230018-8397d0b9f756
 	github.com/moby/sys/mountinfo v0.7.1
 	github.com/moby/sys/signal v0.7.0
 	github.com/morikuni/aec v1.0.0
@@ -42,6 +42,7 @@ require (
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.9.0
 	github.com/tonistiigi/fsutil v0.0.0-20240424095704-91a3fc46842c
+	github.com/tonistiigi/go-csvvalue v0.0.0-20240619222358-bb8dd5cba3c2
 	github.com/zclconf/go-cty v1.14.4
 	go.opentelemetry.io/otel v1.21.0
 	go.opentelemetry.io/otel/metric v1.21.0
@@ -140,7 +141,6 @@ require (
 	github.com/secure-systems-lab/go-securesystemslib v0.4.0 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/theupdateframework/notary v0.7.0 // indirect
-	github.com/tonistiigi/go-csvvalue v0.0.0-20240619222358-bb8dd5cba3c2 // indirect
 	github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea // indirect
 	github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
diff --git a/go.sum b/go.sum
index 212b62b3..f48a8a79 100644
--- a/go.sum
+++ b/go.sum
@@ -300,8 +300,8 @@ github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/z
 github.com/mitchellh/mapstructure v0.0.0-20150613213606-2caf8efc9366/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/moby/buildkit v0.14.1-0.20240625190127-aaaf86e5470b h1:x1TdL3kMOFi3qdlAYBPVf4YzPD8fIZAjIjGfRycru8Q=
-github.com/moby/buildkit v0.14.1-0.20240625190127-aaaf86e5470b/go.mod h1:ui4ZkNR6Z3kVMVqLY5JcoWcmlibi7TJL3bdzikvs5Yw=
+github.com/moby/buildkit v0.14.1-0.20240627230018-8397d0b9f756 h1:mA5DQAEH2HFsn0hxzK5kDLF/JZe87tbMmMD3KTsCY7c=
+github.com/moby/buildkit v0.14.1-0.20240627230018-8397d0b9f756/go.mod h1:ui4ZkNR6Z3kVMVqLY5JcoWcmlibi7TJL3bdzikvs5Yw=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
diff --git a/util/buildflags/attests.go b/util/buildflags/attests.go
index 71150d27..600b755e 100644
--- a/util/buildflags/attests.go
+++ b/util/buildflags/attests.go
@@ -1,13 +1,13 @@
 package buildflags
 
 import (
-	"encoding/csv"
 	"fmt"
 	"strconv"
 	"strings"
 
 	controllerapi "github.com/docker/buildx/controller/pb"
 	"github.com/pkg/errors"
+	"github.com/tonistiigi/go-csvvalue"
 )
 
 func CanonicalizeAttest(attestType string, in string) string {
@@ -45,8 +45,7 @@ func ParseAttest(in string) (*controllerapi.Attest, error) {
 		return nil, nil
 	}
 
-	csvReader := csv.NewReader(strings.NewReader(in))
-	fields, err := csvReader.Read()
+	fields, err := csvvalue.Fields(in, nil)
 	if err != nil {
 		return nil, err
 	}
diff --git a/util/buildflags/cache.go b/util/buildflags/cache.go
index 866ed0ff..7e0971b2 100644
--- a/util/buildflags/cache.go
+++ b/util/buildflags/cache.go
@@ -2,20 +2,19 @@ package buildflags
 
 import (
 	"context"
-	"encoding/csv"
 	"os"
 	"strings"
 
 	awsconfig "github.com/aws/aws-sdk-go-v2/config"
 	controllerapi "github.com/docker/buildx/controller/pb"
 	"github.com/pkg/errors"
+	"github.com/tonistiigi/go-csvvalue"
 )
 
 func ParseCacheEntry(in []string) ([]*controllerapi.CacheOptionsEntry, error) {
 	outs := make([]*controllerapi.CacheOptionsEntry, 0, len(in))
 	for _, in := range in {
-		csvReader := csv.NewReader(strings.NewReader(in))
-		fields, err := csvReader.Read()
+		fields, err := csvvalue.Fields(in, nil)
 		if err != nil {
 			return nil, err
 		}
diff --git a/util/buildflags/export.go b/util/buildflags/export.go
index 8f484c01..2a2832bd 100644
--- a/util/buildflags/export.go
+++ b/util/buildflags/export.go
@@ -1,7 +1,6 @@
 package buildflags
 
 import (
-	"encoding/csv"
 	"regexp"
 	"strings"
 
@@ -11,6 +10,7 @@ import (
 	"github.com/moby/buildkit/exporter/containerimage/exptypes"
 	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/pkg/errors"
+	"github.com/tonistiigi/go-csvvalue"
 )
 
 func ParseExports(inp []string) ([]*controllerapi.ExportEntry, error) {
@@ -19,8 +19,7 @@ func ParseExports(inp []string) ([]*controllerapi.ExportEntry, error) {
 		return nil, nil
 	}
 	for _, s := range inp {
-		csvReader := csv.NewReader(strings.NewReader(s))
-		fields, err := csvReader.Read()
+		fields, err := csvvalue.Fields(s, nil)
 		if err != nil {
 			return nil, err
 		}
diff --git a/util/buildflags/printfunc.go b/util/buildflags/printfunc.go
index 1019702f..c6281069 100644
--- a/util/buildflags/printfunc.go
+++ b/util/buildflags/printfunc.go
@@ -1,12 +1,12 @@
 package buildflags
 
 import (
-	"encoding/csv"
 	"strconv"
 	"strings"
 
 	controllerapi "github.com/docker/buildx/controller/pb"
 	"github.com/pkg/errors"
+	"github.com/tonistiigi/go-csvvalue"
 )
 
 const defaultPrintFunc = "build"
@@ -16,8 +16,7 @@ func ParsePrintFunc(str string) (*controllerapi.PrintFunc, error) {
 		return nil, nil
 	}
 
-	csvReader := csv.NewReader(strings.NewReader(str))
-	fields, err := csvReader.Read()
+	fields, err := csvvalue.Fields(str, nil)
 	if err != nil {
 		return nil, err
 	}
diff --git a/util/buildflags/secrets.go b/util/buildflags/secrets.go
index 25112085..2e442297 100644
--- a/util/buildflags/secrets.go
+++ b/util/buildflags/secrets.go
@@ -1,11 +1,11 @@
 package buildflags
 
 import (
-	"encoding/csv"
 	"strings"
 
 	controllerapi "github.com/docker/buildx/controller/pb"
 	"github.com/pkg/errors"
+	"github.com/tonistiigi/go-csvvalue"
 )
 
 func ParseSecretSpecs(sl []string) ([]*controllerapi.Secret, error) {
@@ -21,8 +21,7 @@ func ParseSecretSpecs(sl []string) ([]*controllerapi.Secret, error) {
 }
 
 func parseSecret(value string) (*controllerapi.Secret, error) {
-	csvReader := csv.NewReader(strings.NewReader(value))
-	fields, err := csvReader.Read()
+	fields, err := csvvalue.Fields(value, nil)
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to parse csv secret")
 	}
diff --git a/vendor/github.com/moby/buildkit/frontend/dockerfile/linter/linter.go b/vendor/github.com/moby/buildkit/frontend/dockerfile/linter/linter.go
index 1fed40ef..da94cbc9 100644
--- a/vendor/github.com/moby/buildkit/frontend/dockerfile/linter/linter.go
+++ b/vendor/github.com/moby/buildkit/frontend/dockerfile/linter/linter.go
@@ -39,7 +39,7 @@ func New(config *Config) *Linter {
 }
 
 func (lc *Linter) Run(rule LinterRuleI, location []parser.Range, txt ...string) {
-	if lc == nil || lc.Warn == nil || lc.SkipAll {
+	if lc == nil || lc.Warn == nil || lc.SkipAll || rule.IsDeprecated() {
 		return
 	}
 	rulename := rule.RuleName()
@@ -71,11 +71,13 @@ func (lc *Linter) Error() error {
 type LinterRuleI interface {
 	RuleName() string
 	Run(warn LintWarnFunc, location []parser.Range, txt ...string)
+	IsDeprecated() bool
 }
 
 type LinterRule[F any] struct {
 	Name        string
 	Description string
+	Deprecated  bool
 	URL         string
 	Format      F
 }
@@ -92,6 +94,10 @@ func (rule *LinterRule[F]) Run(warn LintWarnFunc, location []parser.Range, txt .
 	warn(rule.Name, rule.Description, rule.URL, short, location)
 }
 
+func (rule *LinterRule[F]) IsDeprecated() bool {
+	return rule.Deprecated
+}
+
 func LintFormatShort(rulename, msg string, line int) string {
 	msg = fmt.Sprintf("%s: %s", rulename, msg)
 	if line > 0 {
diff --git a/vendor/github.com/moby/buildkit/session/filesync/diffcopy.go b/vendor/github.com/moby/buildkit/session/filesync/diffcopy.go
index 56bffe53..5cc5fdc0 100644
--- a/vendor/github.com/moby/buildkit/session/filesync/diffcopy.go
+++ b/vendor/github.com/moby/buildkit/session/filesync/diffcopy.go
@@ -21,10 +21,6 @@ type Stream interface {
 	RecvMsg(m interface{}) error
 }
 
-func sendDiffCopy(stream Stream, fs fsutil.FS, progress progressCb) error {
-	return errors.WithStack(fsutil.Send(stream.Context(), stream, fs, progress))
-}
-
 func newStreamWriter(stream grpc.ClientStream) io.WriteCloser {
 	wc := &streamWriterCloser{ClientStream: stream}
 	return &bufferedWriteCloser{Writer: bufio.NewWriter(wc), Closer: wc}
diff --git a/vendor/github.com/moby/buildkit/session/filesync/diffcopy_unix.go b/vendor/github.com/moby/buildkit/session/filesync/diffcopy_unix.go
new file mode 100644
index 00000000..d80489d0
--- /dev/null
+++ b/vendor/github.com/moby/buildkit/session/filesync/diffcopy_unix.go
@@ -0,0 +1,13 @@
+//go:build !windows
+// +build !windows
+
+package filesync
+
+import (
+	"github.com/pkg/errors"
+	"github.com/tonistiigi/fsutil"
+)
+
+func sendDiffCopy(stream Stream, fs fsutil.FS, progress progressCb) error {
+	return errors.WithStack(fsutil.Send(stream.Context(), stream, fs, progress))
+}
diff --git a/vendor/github.com/moby/buildkit/session/filesync/diffcopy_windows.go b/vendor/github.com/moby/buildkit/session/filesync/diffcopy_windows.go
new file mode 100644
index 00000000..0054e75d
--- /dev/null
+++ b/vendor/github.com/moby/buildkit/session/filesync/diffcopy_windows.go
@@ -0,0 +1,21 @@
+//go:build windows
+// +build windows
+
+package filesync
+
+import (
+	"github.com/Microsoft/go-winio"
+	"github.com/pkg/errors"
+	"github.com/tonistiigi/fsutil"
+)
+
+func sendDiffCopy(stream Stream, fs fsutil.FS, progress progressCb) error {
+	// adding one SeBackupPrivilege to the process so as to be able
+	// to run the subsequent goroutines in fsutil.Send that need
+	// to copy over special Windows metadata files.
+	// TODO(profnandaa): need to cross-check that this cannot be
+	// exploited in any way.
+	winio.EnableProcessPrivileges([]string{winio.SeBackupPrivilege})
+	defer winio.DisableProcessPrivileges([]string{winio.SeBackupPrivilege})
+	return errors.WithStack(fsutil.Send(stream.Context(), stream, fs, progress))
+}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 1e1e89c9..8a080d77 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -515,7 +515,7 @@ github.com/mitchellh/go-wordwrap
 github.com/mitchellh/hashstructure/v2
 # github.com/mitchellh/mapstructure v1.5.0
 ## explicit; go 1.14
-# github.com/moby/buildkit v0.14.1-0.20240625190127-aaaf86e5470b
+# github.com/moby/buildkit v0.14.1-0.20240627230018-8397d0b9f756
 ## explicit; go 1.21
 github.com/moby/buildkit/api/services/control
 github.com/moby/buildkit/api/types