diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index ca064028..11083913 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,6 +1,6 @@
 {
   "name": "istio build-tools",
-  "image": "gcr.io/istio-testing/build-tools:master-5b65c620f39f8a750e68465dc49b6753926d0b0b",
+  "image": "gcr.io/istio-testing/build-tools:master-4d8a6668b6d46b3becc35f9b24467f841bbb020a",
   "privileged": true,
   "remoteEnv": {
     "USE_GKE_GCLOUD_AUTH_PLUGIN": "True",
diff --git a/common/.commonfiles.sha b/common/.commonfiles.sha
index 134e4ec2..3dd87a7b 100644
--- a/common/.commonfiles.sha
+++ b/common/.commonfiles.sha
@@ -1 +1 @@
-5fa2fe83dbbdc1314d350364be66b89773d3cf31
+6174b58ad0379ae1ecfa75187f63e8cf62d9ab61
diff --git a/common/config/license-lint.yml b/common/config/license-lint.yml
index ecd3b591..e9750b02 100644
--- a/common/config/license-lint.yml
+++ b/common/config/license-lint.yml
@@ -143,3 +143,9 @@ allowlisted_modules:
 
 # Simplified BSD License: https://github.com/gomarkdown/markdown/blob/master/LICENSE.txt
 - github.com/gomarkdown/markdown
+
+# MPL-2.0
+# https://github.com/cyphar/filepath-securejoin/blob/main/LICENSE.MPL-2.0
+# BSD
+# https://github.com/cyphar/filepath-securejoin/blob/main/LICENSE.BSD
+- github.com/cyphar/filepath-securejoin
diff --git a/common/scripts/kind_provisioner.sh b/common/scripts/kind_provisioner.sh
index 83508728..802d0d6b 100644
--- a/common/scripts/kind_provisioner.sh
+++ b/common/scripts/kind_provisioner.sh
@@ -32,7 +32,7 @@ set -x
 ####################################################################
 
 # DEFAULT_KIND_IMAGE is used to set the Kubernetes version for KinD unless overridden in params to setup_kind_cluster(s)
-DEFAULT_KIND_IMAGE="gcr.io/istio-testing/kind-node:v1.33.1"
+DEFAULT_KIND_IMAGE="gcr.io/istio-testing/kind-node:v1.34.0"
 
 # the default kind cluster should be ipv4 if not otherwise specified
 KIND_IP_FAMILY="${KIND_IP_FAMILY:-ipv4}"
diff --git a/common/scripts/setup_env.sh b/common/scripts/setup_env.sh
index 3f6f7559..e469da0d 100755
--- a/common/scripts/setup_env.sh
+++ b/common/scripts/setup_env.sh
@@ -49,6 +49,8 @@ elif [[ ${LOCAL_ARCH} == s390x ]]; then
     TARGET_ARCH=s390x
 elif [[ ${LOCAL_ARCH} == ppc64le ]]; then
     TARGET_ARCH=ppc64le
+elif [[ ${LOCAL_ARCH} == riscv64 ]]; then
+    TARGET_ARCH=riscv64
 else
     echo "This system's architecture, ${LOCAL_ARCH}, isn't supported"
     exit 1
@@ -75,7 +77,7 @@ fi
 TOOLS_REGISTRY_PROVIDER=${TOOLS_REGISTRY_PROVIDER:-gcr.io}
 PROJECT_ID=${PROJECT_ID:-istio-testing}
 if [[ "${IMAGE_VERSION:-}" == "" ]]; then
-  IMAGE_VERSION=master-5b65c620f39f8a750e68465dc49b6753926d0b0b
+  IMAGE_VERSION=master-4d8a6668b6d46b3becc35f9b24467f841bbb020a
 fi
 if [[ "${IMAGE_NAME:-}" == "" ]]; then
   IMAGE_NAME=build-tools
diff --git a/pkg/publish/docker.go b/pkg/publish/docker.go
index d122e6a3..46522beb 100644
--- a/pkg/publish/docker.go
+++ b/pkg/publish/docker.go
@@ -292,5 +292,5 @@ func getImageNameVariant(fname string) (name string, variant string, arch string
 		imageName = strings.TrimSuffix(imageName, "-debug")
 	}
 	name = imageName
-	return
+	return name, variant, arch
 }