chore(deps): bump github.com/cyphar/filepath-securejoin from 0.4.1 to 0.5.0

[dependabot]

Bumps github.com/cyphar/filepath-securejoin from 0.4.1 to 0.5.0.

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.5.0] - 2025-09-26

Let the past die. Kill it if you have to.

NOTE: With this release, some parts of github.com/cyphar/filepath-securejoin are now licensed under the Mozilla Public License (version 2). Please see COPYING.md as well as the the license header in each file for more details.

Breaking

• The new API introduced in the [0.3.0][] release has been moved to a new subpackage called pathrs-lite. This was primarily done to better indicate the split between the new and old APIs, as well as indicate to users the purpose of this subpackage (it is a less complete version of [libpathrs][]).

  We have added some wrappers to the top-level package to ease the transition, but those are deprecated and will be removed in the next minor release of filepath-securejoin. Users should update their import paths.

  This new subpackage has also been relicensed under the Mozilla Public License (version 2), please see COPYING.md for more details.

Added

• Most of the key bits the safe procfs API have now been exported and are available in github.com/cyphar/filepath-securejoin/pathrs-lite/procfs. At the moment this primarily consists of a new procfs.Handle API:

  • OpenProcRoot returns a new handle to /proc, endeavouring to make it safe if possible (subset=pid to protect against mistaken write attacks and leaks, as well as using fsopen(2) to avoid racing mount attacks).

    OpenUnsafeProcRoot returns a handle without attempting to create one with subset=pid, which makes it more dangerous to leak. Most users should use OpenProcRoot (even if you need to use ProcRoot as the base of an operation, as filepath-securejoin will internally open a handle when necessary).

  • The (*procfs.Handle).Open* family of methods lets you get a safe O_PATH handle to subpaths within /proc for certain subpaths.

    For OpenThreadSelf, the returned ProcThreadSelfCloser needs to be called after you completely finish using the handle (this is necessary because Go is multi-threaded and ProcThreadSelf references /proc/thread-self which may disappear if we do not runtime.LockOSThread -- ProcThreadSelfCloser is currently equivalent to runtime.UnlockOSThread).

    Note that you cannot open any procfs symlinks (most notably magic-links)

... (truncated)

Commits

• bb9e81f VERSION: release 0.5.0
• 17e58e1 CHANGELOG: minor updates
• cc071b2 hack: properly test ./...
• a1c1895 CHANGELOG: fix kernel version for open_tree(2)
• 432c95e doc: minor godoc improvements
• 90002f2 CHANGELOG: mention MPLv2 in pathrs-lite entry
• 59fcb8b COPYING: fix reference to pathrs-lite internal pkgs
• 43797e7 pathrs-lite: add Close to procfs wrapper
• 2a0e2b6 pathrs-lite: move Reopen impl to internal/procfs
• 3c5e239 *: update and improve godocs
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (master@74a3275). Learn more about missing BASE report.
⚠️ Report is 136 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff            @@
##             master   #24745   +/-   ##
=========================================
  Coverage          ?   60.71%           
=========================================
  Files             ?      404           
  Lines             ?    66091           
  Branches          ?        0           
=========================================
  Hits              ?    40126           
  Misses            ?    22718           
  Partials          ?     3247           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[dependabot]

Superseded by #25143.