chore(deps): bump github.com/moby/go-archive from 0.2.0 to 0.3.0
Merged
DE
2mo ago+6-6
Bumps github.com/moby/go-archive from 0.2.0 to 0.3.0.
Release notes
Sourced from github.com/moby/go-archive's releases.
v0.3.0
Security
This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted tar archive could use links to cause extraction operations to create or overwrite files outside the intended destination directory.
The issue affected
Unpack,UnpackLayer,Untar,UntarUncompressed, and theApplyLayerhelpers. Users should upgrade and avoid extracting untrusted archives with earlier versions.What's Changed
- archive: harden tar extraction against path traversal moby/go-archive#45
- archive: do not follow reparse points in chtimes moby/go-archive#90
- archive: fix creation time updates on Windows moby/go-archive#79
- archive: minor cleanups and godoc touch-up moby/go-archive#87
- archive: RebaseArchiveEntries: fix archive path rebasing moby/go-archive#43
Test and CI changes
- ci: enable dependabot for actions moby/go-archive#81
- archive: make breakoutErr unwrap its cause moby/go-archive#91
- archive: use filepath for filesystem paths in tests moby/go-archive#80
- archive: use filepath for filesystem paths in tests moby/go-archive#80
Full Changelog: https://github.com/moby/go-archive/compare/v0.2.1...v0.3.0
v0.2.1
What's Changed
- reject out-of-range device numbers in layer moby/go-archive#36
- createImpliedDirectories: fix directory detection and path handling moby/go-archive#44
- createImpliedDirectories: honor NoLchown for implied directories moby/go-archive#70
- createTarFile: use switch for timestamp updates moby/go-archive#67
- drop redundant ExcludePatterns initialization moby/go-archive#62
- ExportChanges: use POSIX / Unix conventions for Tar operations moby/go-archive#41
- getInodeFromStat: return error on failure moby/go-archive#50
- overlayWhiteoutConverter.ConvertRead: avoid redundant chown moby/go-archive#55
- overlayWhiteoutConverter.ConvertWrite: explicitly use POSIX / Unix moby/go-archive#38
- overlayWhiteoutConverter.ConvertWrite: simplify directory check moby/go-archive#34
- overlayWhiteoutConverter: fixes and cleanups moby/go-archive#52
- RebaseArchiveEntries: use POSIX / Unix paths moby/go-archive#42
- tarAppender.addTarFile: normalize archivePath to POSIX moby/go-archive#40
- tarAppender.addTarFile: return error before writing header moby/go-archive#51
- TarOptions: document IncludeFiles, ExcludePatterns moby/go-archive#61
- Unpack: prevent nil-pointer if nil-options are passed moby/go-archive#66
- remove some intermediate vars moby/go-archive#53
- rename some vars to prevent shadowing "path" import moby/go-archive#35
- rename vars to prevent shadowing and for clarity moby/go-archive#39
- fix typos in comments moby/go-archive#59
- modernize code moby/go-archive#30
... (truncated)
Commits
1c23372Merge pull request #43 from thaJeztah/fix_rebase_from_root8829a25RebaseArchiveEntries: fix archive path rebasingc583b20Merge pull request #90 from thaJeztah/chtimes_nofollowa0576cbarchive: do not follow reparse points in chtimesb0d5bafarchive: add test for unexpected reparse points in chtimesc23e4e5Merge pull request #79 from thaJeztah/test_chtimesaa1541aarchive: fix creation time updates on Windowsc68e60darchive: add Windows creation time testa11565dMerge pull request #91 from thaJeztah/breakout_unwrapb680a61Merge pull request #89 from moby/dependabot/github_actions/codeql-actions-ba9...- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.