Skip to content

v0.3.0

Choose a tag to compare

View all tags
@thaJeztah thaJeztah released this 30 Jul 21:42
v0.3.0
This tag was signed with the committer’s verified signature.
thaJeztah Sebastiaan van Stijn
GPG key ID: 76698F39D527CE8C
Verified
Learn about vigilant mode.
1c23372
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted tar archive could use links to cause extraction operations to create or overwrite files outside the intended destination directory.

The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the ApplyLayer helpers. Users should upgrade and avoid extracting untrusted archives with earlier versions.

What's Changed

  • archive: harden tar extraction against path traversal #45
  • archive: do not follow reparse points in chtimes #90
  • archive: fix creation time updates on Windows #79
  • archive: minor cleanups and godoc touch-up #87
  • archive: RebaseArchiveEntries: fix archive path rebasing #43

Test and CI changes

  • ci: enable dependabot for actions #81
  • archive: make breakoutErr unwrap its cause #91
  • archive: use filepath for filesystem paths in tests #80
  • archive: use filepath for filesystem paths in tests #80

Full Changelog: v0.2.1...v0.3.0

Assets 2
Loading