chore(deps): update module github.com/moby/go-archive to v0.3.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/moby/go-archive	v0.2.0 → v0.3.0

---

moby/go-archive: Crafted tar archive can write outside the extraction directory

CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h

More information

Details

Summary

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination.

Details

The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so a links introduced by the archive can be followed out of the destination directory.

Impact

An attacker who controls the contents of archive can create or overwrite files at arbitrary paths writable by the extracting process.

Workarounds

Only extract trusted archives.

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h
• https://github.com/moby/moby/issues/52948
• https://docs.docker.com/desktop/release-notes/#​4860
• https://github.com/bikini/exploitarium/tree/main/docker-cp-copyout-destination-escape
• https://github.com/docker/cli/releases/tag/v29.7.0
• https://github.com/moby/moby/releases/tag/docker-v29.7.0
• https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp
• https://github.com/advisories/GHSA-hfg8-hc9c-6c3h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

moby/go-archive (github.com/moby/go-archive)

v0.3.0

Compare Source

Security

This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted tar archive could use links to cause extraction operations to create or overwrite files outside the intended destination directory.

The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the ApplyLayer helpers. Users should upgrade and avoid extracting untrusted archives with earlier versions.

What's Changed

• archive: harden tar extraction against path traversal #​45
• archive: do not follow reparse points in chtimes #​90
• archive: fix creation time updates on Windows #​79
• archive: minor cleanups and godoc touch-up #​87
• archive: RebaseArchiveEntries: fix archive path rebasing #​43

Test and CI changes

• ci: enable dependabot for actions #​81
• archive: make breakoutErr unwrap its cause #​91
• archive: use filepath for filesystem paths in tests #​80
• archive: use filepath for filesystem paths in tests #​80

Full Changelog: moby/go-archive@v0.2.1...v0.3.0

v0.2.1

Compare Source

What's Changed

• reject out-of-range device numbers in layer #​36
• createImpliedDirectories: fix directory detection and path handling #​44
• createImpliedDirectories: honor NoLchown for implied directories #​70
• createTarFile: use switch for timestamp updates #​67
• drop redundant ExcludePatterns initialization #​62
• ExportChanges: use POSIX / Unix conventions for Tar operations #​41
• getInodeFromStat: return error on failure #​50
• overlayWhiteoutConverter.ConvertRead: avoid redundant chown #​55
• overlayWhiteoutConverter.ConvertWrite: explicitly use POSIX / Unix #​38
• overlayWhiteoutConverter.ConvertWrite: simplify directory check #​34
• overlayWhiteoutConverter: fixes and cleanups #​52
• RebaseArchiveEntries: use POSIX / Unix paths #​42
• tarAppender.addTarFile: normalize archivePath to POSIX #​40
• tarAppender.addTarFile: return error before writing header #​51
• TarOptions: document IncludeFiles, ExcludePatterns #​61
• Unpack: prevent nil-pointer if nil-options are passed #​66
• remove some intermediate vars #​53
• rename some vars to prevent shadowing "path" import #​35
• rename vars to prevent shadowing and for clarity #​39
• fix typos in comments #​59
• modernize code #​30

Test and CI changes

• ci: don't fail fast #​74
• ci: update golangci-lint to v2.12 for compatibility with go1.26 #​46
• ci: pin actions by sha #​22
• ci: use go.mod for "minimum" Go version, and use custom name #​29
• golangci-lint: enable gosec linter #​47
• fix some linting issues and use t.TempDir() in more places #​31
• add test to verify symlinks targets are preserved (skipped) #​48
• archive: add regression tests for tar path-traversal containment #​68
• archive: Add test for implied directories through symlinks #​76
• archive: fix breakout error type assertions in tests #​69
• archive: Test extracted file modes with process umask #​65
• chrootarchive: fix "non-root" skips on Windows #​71
• Reduce shelling out in tests #​64
• test: use current user for archive ownership in breakout tests #​72
• make toUnixPath more generic, and long-path aware #​58
• testBreakout: pre-create implied victim directory in breakout test #​73
• TestImpliedDirectoryPermissions: test with umask #​57

Dependency updates

• build: bump minimum Go version to 1.24 #​27
• build: bump minimum Go version to 1.25 #​28
• update github.com/moby/sys/sequential v0.7.0 #​75
• update github.com/klauspost/compress v1.18.7 #​78
• update moby/patternmatcher v0.6.1, klauspost/compress v1.18.3, sirupsen/logrus v1.9.4 #​23
• update moby/sys dependencies #​77

Full Changelog: moby/go-archive@v0.2.0...v0.2.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
github.com/klauspost/compress	v1.18.6 -> v1.18.7
github.com/moby/sys/user	v0.4.0 -> v0.4.1

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
gomod/github.com/klauspost/compress	1.18.7	🟢 7.3	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 6 Found 17/27 approved changesets -- score normalized to 6 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Vulnerabilities 🟢 8 2 existing vulnerabilities detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits License 🟢 9 license file detected Fuzzing 🟢 10 project is fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md CI-Tests 🟢 10 27 out of 27 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 13 contributing companies or organizations
gomod/github.com/moby/go-archive	0.3.0	Unknown	Unknown
gomod/github.com/moby/sys/user	0.4.1	🟢 6.5	Details Check Score Reason Code-Review 🟢 8 Found 12/15 approved changesets -- score normalized to 8 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing ⚠️ 0 project is not fuzzed Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• go.mod

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.70%. Comparing base (3b06231) to head (e4b1f8f).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #268   +/-   ##
=======================================
  Coverage   74.70%   74.70%           
=======================================
  Files          10       10           
  Lines         427      427           
=======================================
  Hits          319      319           
  Misses         88       88           
  Partials       20       20           

Flag	Coverage Δ
e2e	74.70% <ø> (ø)
integration	74.70% <ø> (ø)
unittests	74.70% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.