Everyone involved
Contractural Liability
Every transaction is part of a chain of transactions and the normal course of action is to sue along the chain.
For the website situation, the website owner sues you you sue the 3rd party software provider. For the building situation, the homeowner sues the builder and they sue the lumber yard and so in up the chain.
Now liability can be limited by the contract (subject to any legal restrictions on such limitation). So, you may be liable to the website owner but the 3rd party supplier may have limited their liability to you: if so, the buck stops with you.
Another way the chain may be broken is if one of the parties no longer exists - is bankrupt, dead, liquidated or simply cannot be found (more of a practical issue than a legal one).
Negligence
Notwithstanding the contract chain, anyone can sue anyone for negligence. That is the plaintiff alleges the defendant owed them a duty of care, failed in that duty and damage resulted.
The foundational case is Donoghue v Stevenson where Donoghue drank ginger beer with a snail in it that had been manufactured by Stevenson. She by-passed the contractural chain because as she had received the ginger beer as a gift, she had no contract with anyone.
Now a contract cannot limit your liability to anyone who is not a party to the contract. However, a contract can make someone else responsible for any damages you have to pay and any legal costs. This is called an indemnity and it is basically how insurance works. Notwithstanding, it's still you being sued and if your indemnifies doesn't pay (because they went broke or you didn't fulfil the terms of your contract with them) you will have to.