Skip to content

build(deps): bump github.com/cyphar/filepath-securejoin from 0.4.1 to 0.5.0#4527

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/github.com/cyphar/filepath-securejoin-0.5.0
Closed

build(deps): bump github.com/cyphar/filepath-securejoin from 0.4.1 to 0.5.0#4527
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/github.com/cyphar/filepath-securejoin-0.5.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Sep 25, 2025

Bumps github.com/cyphar/filepath-securejoin from 0.4.1 to 0.5.0.

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.5.0] - 2025-09-26

Let the past die. Kill it if you have to.

NOTE: With this release, some parts of github.com/cyphar/filepath-securejoin are now licensed under the Mozilla Public License (version 2). Please see COPYING.md as well as the the license header in each file for more details.

Breaking

  • The new API introduced in the [0.3.0][] release has been moved to a new subpackage called pathrs-lite. This was primarily done to better indicate the split between the new and old APIs, as well as indicate to users the purpose of this subpackage (it is a less complete version of [libpathrs][]).

    We have added some wrappers to the top-level package to ease the transition, but those are deprecated and will be removed in the next minor release of filepath-securejoin. Users should update their import paths.

    This new subpackage has also been relicensed under the Mozilla Public License (version 2), please see COPYING.md for more details.

Added

  • Most of the key bits the safe procfs API have now been exported and are available in github.com/cyphar/filepath-securejoin/pathrs-lite/procfs. At the moment this primarily consists of a new procfs.Handle API:

    • OpenProcRoot returns a new handle to /proc, endeavouring to make it safe if possible (subset=pid to protect against mistaken write attacks and leaks, as well as using fsopen(2) to avoid racing mount attacks).

      OpenUnsafeProcRoot returns a handle without attempting to create one with subset=pid, which makes it more dangerous to leak. Most users should use OpenProcRoot (even if you need to use ProcRoot as the base of an operation, as filepath-securejoin will internally open a handle when necessary).

    • The (*procfs.Handle).Open* family of methods lets you get a safe O_PATH handle to subpaths within /proc for certain subpaths.

      For OpenThreadSelf, the returned ProcThreadSelfCloser needs to be called after you completely finish using the handle (this is necessary because Go is multi-threaded and ProcThreadSelf references /proc/thread-self which may disappear if we do not runtime.LockOSThread -- ProcThreadSelfCloser is currently equivalent to runtime.UnlockOSThread).

      Note that you cannot open any procfs symlinks (most notably magic-links)

... (truncated)

Commits
  • bb9e81f VERSION: release 0.5.0
  • 17e58e1 CHANGELOG: minor updates
  • cc071b2 hack: properly test ./...
  • a1c1895 CHANGELOG: fix kernel version for open_tree(2)
  • 432c95e doc: minor godoc improvements
  • 90002f2 CHANGELOG: mention MPLv2 in pathrs-lite entry
  • 59fcb8b COPYING: fix reference to pathrs-lite internal pkgs
  • 43797e7 pathrs-lite: add Close to procfs wrapper
  • 2a0e2b6 pathrs-lite: move Reopen impl to internal/procfs
  • 3c5e239 *: update and improve godocs
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump github.com/cyphar/filepath-securejoin
80d3386 
Bumps [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) from 0.4.1 to 0.5.0.
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases)
- [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md)
- [Commits](cyphar/filepath-securejoin@v0.4.1...v0.5.0)

---
updated-dependencies:
- dependency-name: github.com/cyphar/filepath-securejoin
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Sep 25, 2025
@AkihiroSuda
Copy link
Copy Markdown
Member

AkihiroSuda commented Sep 25, 2025 •
edited
Loading

https://github.com/containerd/nerdctl/actions/runs/18021858860/job/51286598244?pr=4527

Not allowed license MPL-2.0 found for library github.com/cyphar/filepath-securejoin
Not allowed license MPL-2.0 found for library github.com/cyphar/filepath-securejoin/pathrs-lite

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Sep 26, 2025

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot bot deleted the dependabot/go_modules/github.com/cyphar/filepath-securejoin-0.5.0 branch September 26, 2025 06:34
@cyphar cyphar mentioned this pull request Oct 20, 2025
Closed
12 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@AkihiroSuda