Sebastiaan van Stijn f6d6bede46 vendor: github.com/moby/go-archive v0.3.0 ...

full diff: https://github.com/moby/go-archive/compare/v0.2.1...v0.3.0

v0.3.0

This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted
tar archive could use links to cause extraction operations to create or
overwrite files outside the intended destination directory.

The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the
ApplyLayer helpers. Users should upgrade and avoid extracting untrusted
archives with earlier versions.

What's Changed

* archive: harden tar extraction against path traversal
* archive: do not follow reparse points in chtimes
* archive: fix creation time updates on Windows
* archive: minor cleanups and godoc touch-up
* archive: RebaseArchiveEntries: fix archive path rebasing

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

2026-07-30 19:17:27 +02:00

..

dario.cat/mergo

vendor: dario.cat/mergo v1.0.2

2025-08-06 01:16:17 +02:00

github.com

vendor: github.com/moby/go-archive v0.3.0

2026-07-30 19:17:27 +02:00

go.etcd.io/raft/v3

vendor: github.com/moby/swarmkit/v2 v2.1.2

2026-04-23 21:39:53 +02:00

go.opentelemetry.io

vendor: go.opentelemetry.io/otel v1.44.0, go.opentelemetry.io/contrib v0.69.0

2026-06-09 16:35:02 +02:00

go.yaml.in/yaml/v3

vendor: go.yaml.in/yaml/v3 v3.0.5

2026-07-27 14:43:56 +02:00

golang.org/x

vendor: golang.org/x/net v0.57.0

2026-07-27 21:28:05 +02:00

google.golang.org

vendor: google.golang.org/grpc v1.82.1

2026-07-25 03:59:22 +02:00

gotest.tools/v3

vendor: gotest.tools/v3 v3.5.2

2025-02-09 13:39:45 +01:00

tags.cncf.io/container-device-interface

Update container-device-interface to v0.6.2

2023-11-04 01:18:41 +01:00

modules.txt

vendor: github.com/moby/go-archive v0.3.0

2026-07-30 19:17:27 +02:00