chore(deps): update module github.com/moby/go-archive to v0.3.0 [security] (#650)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[github.com/moby/go-archive](https://redirect.github.com/moby/go-archive)
| `v0.2.0` → `v0.3.0` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fmoby%2fgo-archive/v0.3.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fmoby%2fgo-archive/v0.2.0/v0.3.0?slim=true)
|

---

### moby/go-archive: Crafted tar archive can write outside the
extraction directory
[CVE-2026-17106](https://nvd.nist.gov/vuln/detail/CVE-2026-17106) /
[GHSA-hfg8-hc9c-6c3h](https://redirect.github.com/advisories/GHSA-hfg8-hc9c-6c3h)

<details>
<summary>More information</summary>

#### Details
##### Summary
The tar extraction routines in `moby/go-archive` (`Unpack`,
`UnpackLayer`, `Untar`/`UntarUncompressed`, and the `ApplyLayer`
helpers) do not confine filesystem operations to the destination
directory. A crafted archive can create or overwrite files **outside**
the intended destination.

##### Details
The extractor decides where each archive entry lands using lexical
string checks and then performs the filesystem operation on a path that
is resolved by the OS, so a links introduced by the archive can be
followed out of the destination directory.

##### Impact
An attacker who controls the contents of archive can create or overwrite
files at arbitrary paths writable by the extracting process.

##### Workarounds
Only extract trusted archives.

#### Severity
- CVSS Score: 7.1 / 10 (High)
- Vector String:
`CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

#### References
-
[https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h](https://redirect.github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h)
-
[https://github.com/moby/moby/issues/52948](https://redirect.github.com/moby/moby/issues/52948)
-
[https://docs.docker.com/desktop/release-notes/#&#8203;4860](https://docs.docker.com/desktop/release-notes/#&#8203;4860)
-
[https://github.com/bikini/exploitarium/tree/main/docker-cp-copyout-destination-escape](https://redirect.github.com/bikini/exploitarium/tree/main/docker-cp-copyout-destination-escape)
-
[https://github.com/docker/cli/releases/tag/v29.7.0](https://redirect.github.com/docker/cli/releases/tag/v29.7.0)
-
[https://github.com/moby/moby/releases/tag/docker-v29.7.0](https://redirect.github.com/moby/moby/releases/tag/docker-v29.7.0)
-
[https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp](https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp)
-
[https://github.com/advisories/GHSA-hfg8-hc9c-6c3h](https://redirect.github.com/advisories/GHSA-hfg8-hc9c-6c3h)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-hfg8-hc9c-6c3h)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>moby/go-archive (github.com/moby/go-archive)</summary>

###
[`v0.3.0`](https://redirect.github.com/moby/go-archive/releases/tag/v0.3.0)

[Compare
Source](https://redirect.github.com/moby/go-archive/compare/v0.2.1...v0.3.0)

#### Security

This release fixes **CVE-2026-17106** /
**[GHSA-hfg8-hc9c-6c3h](https://redirect.github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h)**,
where a crafted tar archive could use links to cause extraction
operations to create or overwrite files outside the intended destination
directory.

The issue affected `Unpack`, `UnpackLayer`, `Untar`,
`UntarUncompressed`, and the `ApplyLayer` helpers. Users should upgrade
and avoid extracting untrusted archives with earlier versions.

#### What's Changed

- archive: harden tar extraction against path traversal
[#&#8203;45](https://redirect.github.com/moby/go-archive/pull/45)
- archive: do not follow reparse points in chtimes
[#&#8203;90](https://redirect.github.com/moby/go-archive/pull/90)
- archive: fix creation time updates on Windows
[#&#8203;79](https://redirect.github.com/moby/go-archive/pull/79)
- archive: minor cleanups and godoc touch-up
[#&#8203;87](https://redirect.github.com/moby/go-archive/pull/87)
- archive: RebaseArchiveEntries: fix archive path rebasing
[#&#8203;43](https://redirect.github.com/moby/go-archive/pull/43)

#### Test and CI changes

- ci: enable dependabot for actions
[#&#8203;81](https://redirect.github.com/moby/go-archive/pull/81)
- archive: make breakoutErr unwrap its cause
[#&#8203;91](https://redirect.github.com/moby/go-archive/pull/91)
- archive: use filepath for filesystem paths in tests
[#&#8203;80](https://redirect.github.com/moby/go-archive/pull/80)
- archive: use filepath for filesystem paths in tests
[#&#8203;80](https://redirect.github.com/moby/go-archive/pull/80)

**Full Changelog**:
<moby/go-archive@v0.2.1...v0.3.0>

###
[`v0.2.1`](https://redirect.github.com/moby/go-archive/releases/tag/v0.2.1)

[Compare
Source](https://redirect.github.com/moby/go-archive/compare/v0.2.0...v0.2.1)

#### What's Changed

- reject out-of-range device numbers in layer
[#&#8203;36](https://redirect.github.com/moby/go-archive/pull/36)
- createImpliedDirectories: fix directory detection and path handling
[#&#8203;44](https://redirect.github.com/moby/go-archive/pull/44)
- createImpliedDirectories: honor NoLchown for implied directories
[#&#8203;70](https://redirect.github.com/moby/go-archive/pull/70)
- createTarFile: use switch for timestamp updates
[#&#8203;67](https://redirect.github.com/moby/go-archive/pull/67)
- drop redundant ExcludePatterns initialization
[#&#8203;62](https://redirect.github.com/moby/go-archive/pull/62)
- ExportChanges: use POSIX / Unix conventions for Tar operations
[#&#8203;41](https://redirect.github.com/moby/go-archive/pull/41)
- getInodeFromStat: return error on failure
[#&#8203;50](https://redirect.github.com/moby/go-archive/pull/50)
- overlayWhiteoutConverter.ConvertRead: avoid redundant chown
[#&#8203;55](https://redirect.github.com/moby/go-archive/pull/55)
- overlayWhiteoutConverter.ConvertWrite: explicitly use POSIX / Unix
[#&#8203;38](https://redirect.github.com/moby/go-archive/pull/38)
- overlayWhiteoutConverter.ConvertWrite: simplify directory check
[#&#8203;34](https://redirect.github.com/moby/go-archive/pull/34)
- overlayWhiteoutConverter: fixes and cleanups
[#&#8203;52](https://redirect.github.com/moby/go-archive/pull/52)
- RebaseArchiveEntries: use POSIX / Unix paths
[#&#8203;42](https://redirect.github.com/moby/go-archive/pull/42)
- tarAppender.addTarFile: normalize archivePath to POSIX
[#&#8203;40](https://redirect.github.com/moby/go-archive/pull/40)
- tarAppender.addTarFile: return error before writing header
[#&#8203;51](https://redirect.github.com/moby/go-archive/pull/51)
- TarOptions: document IncludeFiles, ExcludePatterns
[#&#8203;61](https://redirect.github.com/moby/go-archive/pull/61)
- Unpack: prevent nil-pointer if nil-options are passed
[#&#8203;66](https://redirect.github.com/moby/go-archive/pull/66)
- remove some intermediate vars
[#&#8203;53](https://redirect.github.com/moby/go-archive/pull/53)
- rename some vars to prevent shadowing "path" import
[#&#8203;35](https://redirect.github.com/moby/go-archive/pull/35)
- rename vars to prevent shadowing and for clarity
[#&#8203;39](https://redirect.github.com/moby/go-archive/pull/39)
- fix typos in comments
[#&#8203;59](https://redirect.github.com/moby/go-archive/pull/59)
- modernize code
[#&#8203;30](https://redirect.github.com/moby/go-archive/pull/30)

##### Test and CI changes

- ci: don't fail fast
[#&#8203;74](https://redirect.github.com/moby/go-archive/pull/74)
- ci: update golangci-lint to v2.12 for compatibility with go1.26
[#&#8203;46](https://redirect.github.com/moby/go-archive/pull/46)
- ci: pin actions by sha
[#&#8203;22](https://redirect.github.com/moby/go-archive/pull/22)
- ci: use go.mod for "minimum" Go version, and use custom name
[#&#8203;29](https://redirect.github.com/moby/go-archive/pull/29)
- golangci-lint: enable gosec linter
[#&#8203;47](https://redirect.github.com/moby/go-archive/pull/47)
- fix some linting issues and use t.TempDir() in more places
[#&#8203;31](https://redirect.github.com/moby/go-archive/pull/31)
- add test to verify symlinks targets are preserved (skipped)
[#&#8203;48](https://redirect.github.com/moby/go-archive/pull/48)
- archive: add regression tests for tar path-traversal containment
[#&#8203;68](https://redirect.github.com/moby/go-archive/pull/68)
- archive: Add test for implied directories through symlinks
[#&#8203;76](https://redirect.github.com/moby/go-archive/pull/76)
- archive: fix breakout error type assertions in tests
[#&#8203;69](https://redirect.github.com/moby/go-archive/pull/69)
- archive: Test extracted file modes with process umask
[#&#8203;65](https://redirect.github.com/moby/go-archive/pull/65)
- chrootarchive: fix "non-root" skips on Windows
[#&#8203;71](https://redirect.github.com/moby/go-archive/pull/71)
- Reduce shelling out in tests
[#&#8203;64](https://redirect.github.com/moby/go-archive/pull/64)
- test: use current user for archive ownership in breakout tests
[#&#8203;72](https://redirect.github.com/moby/go-archive/pull/72)
- make toUnixPath more generic, and long-path aware
[#&#8203;58](https://redirect.github.com/moby/go-archive/pull/58)
- testBreakout: pre-create implied victim directory in breakout test
[#&#8203;73](https://redirect.github.com/moby/go-archive/pull/73)
- TestImpliedDirectoryPermissions: test with umask
[#&#8203;57](https://redirect.github.com/moby/go-archive/pull/57)

##### Dependency updates

- build: bump minimum Go version to 1.24
[#&#8203;27](https://redirect.github.com/moby/go-archive/pull/27)
- build: bump minimum Go version to 1.25
[#&#8203;28](https://redirect.github.com/moby/go-archive/pull/28)
- update github.com/moby/sys/sequential v0.7.0
[#&#8203;75](https://redirect.github.com/moby/go-archive/pull/75)
- update github.com/klauspost/compress v1.18.7
[#&#8203;78](https://redirect.github.com/moby/go-archive/pull/78)
- update moby/patternmatcher v0.6.1, klauspost/compress v1.18.3,
sirupsen/logrus v1.9.4
[#&#8203;23](https://redirect.github.com/moby/go-archive/pull/23)
- update moby/sys dependencies
[#&#8203;77](https://redirect.github.com/moby/go-archive/pull/77)

**Full Changelog**:
<moby/go-archive@v0.2.0...v0.2.1>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/netresearch/ldap-manager).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zMy4yIiwidXBkYXRlZEluVmVyIjoiNDQuMzMuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsic2VjdXJpdHkiXX0=-->

Author: renovate[bot]

go.mod

@@ -153,7 +153,7 @@ require (
 	github.com/karamaru-alpha/copyloopvar v1.2.2 // indirect
 	github.com/kisielk/errcheck v1.10.0 // indirect
 	github.com/kkHAIKE/contextcheck v1.1.6 // indirect
-	github.com/klauspost/compress v1.18.6 // indirect
+	github.com/klauspost/compress v1.18.7 // indirect
 	github.com/kulti/thelper v0.7.1 // indirect
 	github.com/kunwardeep/paralleltest v1.0.15 // indirect
 	github.com/lasiar/canonicalheader v1.1.2 // indirect
@@ -179,12 +179,12 @@ require (
 	github.com/mgechev/revive v1.15.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/go-archive v0.2.0 // indirect
+	github.com/moby/go-archive v0.3.0 // indirect
 	github.com/moby/moby/api v1.55.0 // indirect
 	github.com/moby/moby/client v0.5.0 // indirect
 	github.com/moby/patternmatcher v0.6.1 // indirect
 	github.com/moby/sys/sequential v0.7.0 // indirect
-	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/user v0.4.1 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/moricho/tparallel v0.3.2 // indirect

go.sum

@@ -340,6 +340,8 @@ github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBF
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
 github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
+github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -398,6 +400,8 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=
 github.com/moby/go-archive v0.2.0/go.mod h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU=
+github.com/moby/go-archive v0.3.0 h1:nos4BtzzUIqB406BgQnWGMI4qib9BZ8XUHU+ucv/n1c=
+github.com/moby/go-archive v0.3.0/go.mod h1:Npdv43fFqlhZW7Xo8fbm3ZMYFvAGNviUPqX21VERbcE=
 github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
 github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
 github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc=
@@ -414,6 +418,8 @@ github.com/moby/sys/sequential v0.7.0 h1:ASQNGNROJSuOO6LL6bPHbKvuZu6NU8P4ldPWk31
 github.com/moby/sys/sequential v0.7.0/go.mod h1:NfSTAp6V3fw4tmkD62PEcOKeZKquXT8VKCkf7aVR79o=
 github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
 github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0=
+github.com/moby/sys/user v0.4.1/go.mod h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=