starred/cli
1
0
Fork 0
mirror of https://github.com/docker/cli.git synced 2026-08-28 10:05:17 -05:00
Code Issues Packages Projects Releases Wiki Activity
12,980 Commits 13 Branches 320 Tags
29.x
Commit Graph
6 Commits
Author SHA1 Message Date
Sebastiaan van Stijn a6014a702b vendor: github.com/moby/go-archive v0.3.2 
full diff: https://github.com/moby/go-archive/compare/v0.3.1...v0.3.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-31 18:53:47 +02:00
Sebastiaan van Stijn f6d6bede46 vendor: github.com/moby/go-archive v0.3.0 
full diff: https://github.com/moby/go-archive/compare/v0.2.1...v0.3.0

v0.3.0

This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted
tar archive could use links to cause extraction operations to create or
overwrite files outside the intended destination directory.

The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the
ApplyLayer helpers. Users should upgrade and avoid extracting untrusted
archives with earlier versions.

What's Changed

* archive: harden tar extraction against path traversal
* archive: do not follow reparse points in chtimes
* archive: fix creation time updates on Windows
* archive: minor cleanups and godoc touch-up
* archive: RebaseArchiveEntries: fix archive path rebasing

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-30 19:17:27 +02:00
Sebastiaan van Stijn f6dfb40875 vendor: github.com/moby/go-archive main / v0.3.0-dev 
full diff: https://github.com/moby/go-archive/compare/v0.2.0...2ff9bfb8b2ee

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-27 21:24:52 +02:00
Sebastiaan van Stijn 349fad1635 vendor: github.com/moby/go-archive v0.2.1 
full diff: https://github.com/moby/go-archive/compare/v0.2.0...v0.2.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-23 23:05:30 +02:00
Sebastiaan van Stijn e7a091eceb vendor: github.com/moby/go-archive v0.1.0 
full diff: https://github.com/moby/go-archive/compare/21f3f3385ab7...v0.1.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2025-04-16 13:08:08 +02:00
Sebastiaan van Stijn 342a01a9ff migrate to use github.com/moby/go-archive 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2025-04-09 13:18:58 +02:00