What's Changed

• user: prevent possible DoS via unbounded parsing of user and group database files in CVE-2026-61801 / GHSA-mjcv-p78q-w5fw. This fixes a similar issue as CVE-2026-47262 in containerd.
• user: prevent falling back to looking up numeric usernames and improve handling of numeric user/group to prevent looking up numeric values as usernames. This fixes a similar issue as CVE-2026-46680 in containerd. https://github.com/moby/sys/pull/221
• user: bump Go to 1.18, modernize https://github.com/moby/sys/pull/198
• user: make code a bit more DRY https://github.com/moby/sys/pull/225
• user: test cleanups https://github.com/moby/sys/pull/226

Full Changelog: https://github.com/moby/sys/compare/user/v0.4.0...user/v0.4.1