Update module github.com/moby/go-archive to v0.3.0 [SECURITY] (release-v0.7) - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/moby/go-archive	v0.1.0 → v0.3.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

moby/go-archive: Crafted tar archive can write outside the extraction directory

CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h

More information

Details

Summary

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination.

Details

The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so a links introduced by the archive can be followed out of the destination directory.

Impact

An attacker who controls the contents of archive can create or overwrite files at arbitrary paths writable by the extracting process.

Workarounds

Only extract trusted archives.

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h
• https://github.com/moby/moby/issues/52948
• https://docs.docker.com/desktop/release-notes/#​4860
• https://github.com/bikini/exploitarium/tree/main/docker-cp-copyout-destination-escape
• https://github.com/docker/cli/releases/tag/v29.7.0
• https://github.com/moby/moby/releases/tag/docker-v29.7.0
• https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp
• https://github.com/advisories/GHSA-hfg8-hc9c-6c3h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

moby/go-archive (github.com/moby/go-archive)

v0.3.0

Compare Source

Security

This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted tar archive could use links to cause extraction operations to create or overwrite files outside the intended destination directory.

The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the ApplyLayer helpers. Users should upgrade and avoid extracting untrusted archives with earlier versions.

What's Changed

• archive: harden tar extraction against path traversal #​45
• archive: do not follow reparse points in chtimes #​90
• archive: fix creation time updates on Windows #​79
• archive: minor cleanups and godoc touch-up #​87
• archive: RebaseArchiveEntries: fix archive path rebasing #​43

Test and CI changes

• ci: enable dependabot for actions #​81
• archive: make breakoutErr unwrap its cause #​91
• archive: use filepath for filesystem paths in tests #​80
• archive: use filepath for filesystem paths in tests #​80

Full Changelog: moby/go-archive@v0.2.1...v0.3.0

v0.2.1

Compare Source

What's Changed

• reject out-of-range device numbers in layer #​36
• createImpliedDirectories: fix directory detection and path handling #​44
• createImpliedDirectories: honor NoLchown for implied directories #​70
• createTarFile: use switch for timestamp updates #​67
• drop redundant ExcludePatterns initialization #​62
• ExportChanges: use POSIX / Unix conventions for Tar operations #​41
• getInodeFromStat: return error on failure #​50
• overlayWhiteoutConverter.ConvertRead: avoid redundant chown #​55
• overlayWhiteoutConverter.ConvertWrite: explicitly use POSIX / Unix #​38
• overlayWhiteoutConverter.ConvertWrite: simplify directory check #​34
• overlayWhiteoutConverter: fixes and cleanups #​52
• RebaseArchiveEntries: use POSIX / Unix paths #​42
• tarAppender.addTarFile: normalize archivePath to POSIX #​40
• tarAppender.addTarFile: return error before writing header #​51
• TarOptions: document IncludeFiles, ExcludePatterns #​61
• Unpack: prevent nil-pointer if nil-options are passed #​66
• remove some intermediate vars #​53
• rename some vars to prevent shadowing "path" import #​35
• rename vars to prevent shadowing and for clarity #​39
• fix typos in comments #​59
• modernize code #​30

Test and CI changes

• ci: don't fail fast #​74
• ci: update golangci-lint to v2.12 for compatibility with go1.26 #​46
• ci: pin actions by sha #​22
• ci: use go.mod for "minimum" Go version, and use custom name #​29
• golangci-lint: enable gosec linter #​47
• fix some linting issues and use t.TempDir() in more places #​31
• add test to verify symlinks targets are preserved (skipped) #​48
• archive: add regression tests for tar path-traversal containment #​68
• archive: Add test for implied directories through symlinks #​76
• archive: fix breakout error type assertions in tests #​69
• archive: Test extracted file modes with process umask #​65
• chrootarchive: fix "non-root" skips on Windows #​71
• Reduce shelling out in tests #​64
• test: use current user for archive ownership in breakout tests #​72
• make toUnixPath more generic, and long-path aware #​58
• testBreakout: pre-create implied victim directory in breakout test #​73
• TestImpliedDirectoryPermissions: test with umask #​57

Dependency updates

• build: bump minimum Go version to 1.24 #​27
• build: bump minimum Go version to 1.25 #​28
• update github.com/moby/sys/sequential v0.7.0 #​75
• update github.com/klauspost/compress v1.18.7 #​78
• update moby/patternmatcher v0.6.1, klauspost/compress v1.18.3, sirupsen/logrus v1.9.4 #​23
• update moby/sys dependencies #​77

Full Changelog: moby/go-archive@v0.2.0...v0.2.1

v0.2.0

Compare Source

What's Changed

• remove aliases for deprecated types and functions #​10
• chrootarchive: remove redundant "init" mitigation for CVE-2019-14271 #​11
• xattr: Fix OS matching #​20
• TestOverlayTarUntar: remove redundant cmpopts.EquateEmpty #​9
• go.mod: bump github.com/klauspost/compress v1.18.2 #​19
• gha: update actions #​18

Full Changelog: moby/go-archive@v0.1.0...v0.2.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
github.com/klauspost/compress	v1.18.5 -> v1.18.7
github.com/moby/sys/sequential	v0.6.0 -> v0.7.0
github.com/moby/sys/user	v0.4.0 -> v0.4.1

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:11 AM UTC · Completed 4:27 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review

Findings

Medium

• [stale-reference] go.mod:65 — The comment above the replace directive still reads "Force moby/go-archive to v0.1.0 for compatibility with docker/docker v28.5.2" and "v0.2.0 removed archive.Compression type which docker still uses," but the replacement target has been changed to v0.3.0. The comment is now factually incorrect.
  Remediation: Update the comment to reflect the new version (v0.3.0) and the actual reason for the pin (CVE-2026-17106 security fix), or remove the comment and replace directive entirely if v0.3.0 restores API compatibility.

• [incomplete-update] acceptance/go.mod:277 — The acceptance/go.mod still contains replace github.com/moby/go-archive v0.2.0 => github.com/moby/go-archive v0.1.0, pinning to v0.1.0 which is affected by CVE-2026-17106. This PR's security fix does not extend to the acceptance module.
  Remediation: Update the acceptance/go.mod replace directive to also use v0.3.0, or remove the pin if no longer needed.

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[medium] stale-reference

The comment above the replace directive still reads 'Force moby/go-archive to v0.1.0 for compatibility with docker/docker v28.5.2' and 'v0.2.0 removed archive.Compression type which docker still uses,' but the replacement target has been changed to v0.3.0. The comment is now factually incorrect.

Suggested fix: Update the comment to reflect the new version (v0.3.0) and the actual reason for the pin (CVE-2026-17106 security fix), or remove the comment and replace directive entirely if v0.3.0 restores API compatibility.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 7:58 AM UTC · Completed 8:16 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

Retro: PR #3507 — moby/go-archive security update (release-v0.7)

Workflow: Renovate opened PR #3507 at 04:10 UTC to bump moby/go-archive v0.1.0→v0.3.0, fixing CVE-2026-17106 (CVSS 7.1 High, tar path traversal). The review agent (run 32214772690) completed in ~17 minutes at $3.40, producing a non-blocking comment verdict with two valid medium findings. The PR was autoclosed by Renovate at 07:57 UTC — approximately 3.5 hours after creation — before any human reviewed it.

Review quality

The review agent performed well on this PR:

• Valid findings: Both findings were correct and actionable — the stale comment in go.mod (still referencing v0.1.0 after bump to v0.3.0) and the incomplete multi-module update (acceptance/go.mod still pinning to the CVE-affected v0.1.0).
• False positive caught internally: The correctness sub-agent produced a false positive (reading from the base branch file instead of the PR head), and the orchestrator correctly identified and removed it before posting.
• Appropriate verdict: The comment (non-blocking) verdict with requires-manual-review was the right call — the replace directive exists due to an API compatibility concern that requires human investigation to determine whether v0.3.0 resolves it.

Evidence for existing issues

All improvement opportunities identified in this workflow are already tracked by open issues:

• Renovate grouping rule causes security update PRs to be autoclosed without merging #3483, Exclude Renovate vulnerability PRs from grouped patch updates to prevent security fixes stalling behind failing CI bundles #3482 — This PR is another instance of the Renovate autoclosure pattern: a standalone security fix PR was created, reviewed, then autoclosed before merging because Renovate absorbed it into a grouped PR. This is the same pattern documented for go-git v5.19.1 and v5.19.2 on main, now confirmed to also affect release branches (release-v0.7) and different packages (moby/go-archive). The CVE-2026-17106 fix may remain unapplied on release-v0.7.
• Review agent should verify multi-module Go dependency update completeness fullsend-ai/fullsend#4594 — The review agent correctly flagged that acceptance/go.mod was not updated, providing further evidence that multi-module Go dependency completeness checking is a real and recurring gap. Renovate updated only the root go.mod replace directive.
• Add pre-review early exit for bot-authored dependency-update PRs fullsend-ai/agents#257, Add an ec inspect policy-data command #513 — The full review pipeline ($3.40, 3 sub-agents on Opus, challenger round) ran on a 2-file, 24-line mechanical Renovate bump. The entire review was wasted when the PR was autoclosed. These existing proposals for early-exit or lightweight review on bot dependency PRs would have prevented this waste.
• Extend pre-retro early-exit to skip retro on trivially-handled mechanical PRs fullsend-ai/agents#649, Skip retro agent for automated bot dependency PRs fullsend-ai/fullsend#3833, #4006 — This retro itself runs on an autoclosed Renovate PR, adding further cost for minimal value.

No new proposals

The review agent's behavior was correct within the current system constraints. All identified improvement opportunities — token cost on bot dependency PRs, Renovate autoclosure of security PRs, multi-module update completeness, and retro skipping for mechanical PRs — are covered by existing open issues with clear proposals and validation criteria.