Skip to content

Bump github.com/moby/go-archive from 0.3.0 to 0.3.3 in /integration-tests - #535

Merged
friedemannf merged 2 commits into
developfrom
dependabot/go_modules/integration-tests/github.com/moby/go-archive-0.3.3
Sep 2, 2026
Merged

friedemannf merged 2 commits into
developfrom
dependabot/go_modules/integration-tests/github.com/moby/go-archive-0.3.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/moby/go-archive from 0.3.0 to 0.3.3.

Release notes

Sourced from github.com/moby/go-archive's releases.

v0.3.3

What's Changed

  • Fix a regression introduced in v0.3.0 that caused archive extraction to reject hardlinks with absolute targets, as produced by some image builders. Absolute hardlink targets are now resolved relative to the extraction root, while paths that escape the root remain rejected. moby/go-archive#100
  • Fix a regression introduced in v0.3.0 that caused archive extraction to fail when applying permissions to device nodes, including nodes on nodev filesystems and dev/ptmx. Device nodes are now referenced without opening the underlying device before applying their mode. moby/go-archive#103
  • Set close-on-exec on file descriptors used by the Linux permission fallback to prevent them from leaking into child processes. moby/go-archive#104

Full Changelog: moby/go-archive@v0.3.2...v0.3.3

v0.3.2

What's Changed

Fix a regression introduced in v0.3.0 that caused archive extraction to fail when paths traversed absolute symlinks inside the destination root, such as var/run -> /run. Absolute symlink targets are now resolved relative to the extraction root while relative symlink escapes remain rejected. moby/go-archive#93

Full Changelog: moby/go-archive@v0.3.1...v0.3.2

v0.3.1

Fixes

This patch release fixes a regression introduced in v0.2.1 where archive extraction could fail when an archive omitted explicit entries for parent directories. For example, extracting etc/dnf/ without a preceding etc/ entry could return mkdirat etc/dnf: no such file or directory.

This prevented affected images from being extracted. Archive extraction now creates implied parent directories for both file and directory entries.

What's Changed

Full Changelog: moby/go-archive@v0.3.0...v0.3.1

Commits
  • ae9e219 Merge pull request #104 from thaJeztah/use_O_CLOEXEC
  • 98ff1da archive: set close-on-exec for chmod fallback descriptors
  • 1e8dfbc Merge pull request #103 from thaJeztah/fix_chmod_fallback
  • e738eed archive: keep procfs file alive during fchmodat
  • 2d863f5 archive: preserve procfs access during chroot extraction
  • 89653ed archive: fix chmod fallback for device nodes on nodev mounts
  • f37d413 Merge pull request #106 from thaJeztah/fallback_no_read
  • 4ffc915 archive: test chmod fallback without read permission
  • 9af1c40 Merge pull request #105 from thaJeztah/test_chrooted_chmod_fallback
  • 3daca2a archive: test chmod fallback without procfs in chroot
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the dependencies-go Go Dependency Updates label Sep 1, 2026
@dependabot
dependabot Bot requested review from a team as code owners September 1, 2026 03:26
Bumps [github.com/moby/go-archive](https://github.com/moby/go-archive) from 0.3.0 to 0.3.3.
- [Release notes](https://github.com/moby/go-archive/releases)
- [Changelog](https://github.com/moby/go-archive/blob/main/changes_test.go)
- [Commits](moby/go-archive@v0.3.0...v0.3.3)

---
updated-dependencies:
- dependency-name: github.com/moby/go-archive
  dependency-version: 0.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/integration-tests/github.com/moby/go-archive-0.3.3 branch from 7a59232 to 158f23d Compare September 2, 2026 12:59
@friedemannf
friedemannf merged commit 2cb9bad into develop Sep 2, 2026
26 of 28 checks passed
@friedemannf
friedemannf deleted the dependabot/go_modules/integration-tests/github.com/moby/go-archive-0.3.3 branch September 2, 2026 17:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies-go Go Dependency Updates

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant