Security
This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted tar archive could use links to cause extraction operations to create or overwrite files outside the intended destination directory.
The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the ApplyLayer helpers. Users should upgrade and avoid extracting untrusted archives with earlier versions.
What's Changed
- archive: harden tar extraction against path traversal https://github.com/moby/go-archive/pull/45
- archive: do not follow reparse points in chtimes https://github.com/moby/go-archive/pull/90
- archive: fix creation time updates on Windows https://github.com/moby/go-archive/pull/79
- archive: minor cleanups and godoc touch-up https://github.com/moby/go-archive/pull/87
- archive: RebaseArchiveEntries: fix archive path rebasing https://github.com/moby/go-archive/pull/43
Test and CI changes
- ci: enable dependabot for actions https://github.com/moby/go-archive/pull/81
- archive: make breakoutErr unwrap its cause https://github.com/moby/go-archive/pull/91
- archive: use filepath for filesystem paths in tests https://github.com/moby/go-archive/pull/80
- archive: use filepath for filesystem paths in tests https://github.com/moby/go-archive/pull/80
Full Changelog: https://github.com/moby/go-archive/compare/v0.2.1...v0.3.0