v0.3.3

What's Changed

• Fix a regression introduced in v0.3.0 that caused archive extraction to reject hardlinks with absolute targets, as produced by
  some image builders. Absolute hardlink targets are now resolved relative to the extraction root, while paths that escape the root
  remain rejected. moby/go-archive#100
• Fix a regression introduced in v0.3.0 that caused archive extraction to fail when applying permissions to device nodes, including
  nodes on nodev filesystems and dev/ptmx. Device nodes are now referenced without opening the underlying device before applying
  their mode. moby/go-archive#103
• Set close-on-exec on file descriptors used by the Linux permission fallback to prevent them from leaking into child processes.
  moby/go-archive#104

Full Changelog: v0.3.2...v0.3.3

v0.3.2

What's Changed

Fix a regression introduced in v0.3.0 that caused archive extraction to fail when paths traversed absolute symlinks inside the destination root, such as var/run -> /run. Absolute symlink targets are now resolved relative to the extraction root while relative symlink escapes remain rejected. #93

Full Changelog: v0.3.1...v0.3.2

v0.3.1

Fixes

This patch release fixes a regression introduced in v0.2.1 where archive extraction could fail when an archive omitted explicit entries for parent directories. For example, extracting etc/dnf/ without a preceding etc/ entry could return mkdirat etc/dnf: no such file or directory.

This prevented affected images from being extracted. Archive extraction now creates implied parent directories for both file and directory entries.

What's Changed

• archive: create implied parents for directory entries #92
• archive: Tarballer.Go: suppress io.ErrClosedPipe logs on close #94

Full Changelog: v0.3.0...v0.3.1

v0.3.0

Security

This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted tar archive could use links to cause extraction operations to create or overwrite files outside the intended destination directory.

The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the ApplyLayer helpers. Users should upgrade and avoid extracting untrusted archives with earlier versions.

What's Changed

• archive: harden tar extraction against path traversal #45
• archive: do not follow reparse points in chtimes #90
• archive: fix creation time updates on Windows #79
• archive: minor cleanups and godoc touch-up #87
• archive: RebaseArchiveEntries: fix archive path rebasing #43

Test and CI changes

• ci: enable dependabot for actions #81
• archive: make breakoutErr unwrap its cause #91
• archive: use filepath for filesystem paths in tests #80
• archive: use filepath for filesystem paths in tests #80

Full Changelog: v0.2.1...v0.3.0

v0.2.1

What's Changed

• reject out-of-range device numbers in layer #36
• createImpliedDirectories: fix directory detection and path handling #44
• createImpliedDirectories: honor NoLchown for implied directories #70
• createTarFile: use switch for timestamp updates #67
• drop redundant ExcludePatterns initialization #62
• ExportChanges: use POSIX / Unix conventions for Tar operations #41
• getInodeFromStat: return error on failure #50
• overlayWhiteoutConverter.ConvertRead: avoid redundant chown #55
• overlayWhiteoutConverter.ConvertWrite: explicitly use POSIX / Unix #38
• overlayWhiteoutConverter.ConvertWrite: simplify directory check #34
• overlayWhiteoutConverter: fixes and cleanups #52
• RebaseArchiveEntries: use POSIX / Unix paths #42
• tarAppender.addTarFile: normalize archivePath to POSIX #40
• tarAppender.addTarFile: return error before writing header #51
• TarOptions: document IncludeFiles, ExcludePatterns #61
• Unpack: prevent nil-pointer if nil-options are passed #66
• remove some intermediate vars #53
• rename some vars to prevent shadowing "path" import #35
• rename vars to prevent shadowing and for clarity #39
• fix typos in comments #59
• modernize code #30

Test and CI changes

• ci: don't fail fast #74
• ci: update golangci-lint to v2.12 for compatibility with go1.26 #46
• ci: pin actions by sha #22
• ci: use go.mod for "minimum" Go version, and use custom name #29
• golangci-lint: enable gosec linter #47
• fix some linting issues and use t.TempDir() in more places #31
• add test to verify symlinks targets are preserved (skipped) #48
• archive: add regression tests for tar path-traversal containment #68
• archive: Add test for implied directories through symlinks #76
• archive: fix breakout error type assertions in tests #69
• archive: Test extracted file modes with process umask #65
• chrootarchive: fix "non-root" skips on Windows #71
• Reduce shelling out in tests #64
• test: use current user for archive ownership in breakout tests #72
• make toUnixPath more generic, and long-path aware #58
• testBreakout: pre-create implied victim directory in breakout test #73
• TestImpliedDirectoryPermissions: test with umask #57

Dependency updates

• build: bump minimum Go version to 1.24 #27
• build: bump minimum Go version to 1.25 #28
• update github.com/moby/sys/sequential v0.7.0 #75
• update github.com/klauspost/compress v1.18.7 #78
• update moby/patternmatcher v0.6.1, klauspost/compress v1.18.3, sirupsen/logrus v1.9.4 #23
• update moby/sys dependencies #77

Full Changelog: v0.2.0...v0.2.1

v0.2.0

What's Changed

• remove aliases for deprecated types and functions #10
• chrootarchive: remove redundant "init" mitigation for CVE-2019-14271 #11
• xattr: Fix OS matching #20
• TestOverlayTarUntar: remove redundant cmpopts.EquateEmpty #9
• go.mod: bump github.com/klauspost/compress v1.18.2 #19
• gha: update actions #18

Full Changelog: v0.1.0...v0.2.0

v0.1.0

This is the initial release of this module, which was extracted from github.com/docker/docker/pkg/archive, with some additional refactors to align with the equivalent package in containerd. This release should be considered "transitional", and contains various functions and methods that are marked deprecated, which will be removed in a future release once consumers have migrated.

What's Changed

• Small fixes for compilation in #1
• gha: add codeQL, test and codecov in #5
• use wrapper function instead of variable for freebsd in #3
• fix linting issues in #2
• ci: add golangci-lint in #4
• assert interface for nosysFileInfo in #6
• move compression to a separate package in #7
• move FileInfoHeaderNoLookups to separate tarheader package in #8

Full Changelog: https://github.com/moby/go-archive/commits/v0.1.0