chore(deps): bump github.com/cyphar/filepath-securejoin from 0.4.1 to 0.5.1

[dependabot]

Bumps github.com/cyphar/filepath-securejoin from 0.4.1 to 0.5.1.

Release notes

Sourced from github.com/cyphar/filepath-securejoin's releases.

v0.5.1 -- "Spooky scary skeletons send shivers down your spine!"

Changed

• openat2 can return -EAGAIN if it detects a possible attack in certain scenarios (namely if there was a rename or mount while walking a path with a .. component). While this is necessary to avoid a denial-of-service in the kernel, it does require retry loops in userspace.

  In previous versions, pathrs-lite would retry openat2 32 times before returning an error, but we've received user reports that this limit can be hit on systems with very heavy load. In some synthetic benchmarks (testing the worst-case of an attacker doing renames in a tight loop on every core of a 16-core machine) we managed to get a ~3% failure rate in runc. We have improved this situation in two ways:

  • We have now increased this limit to 128, which should be good enough for most use-cases without becoming a denial-of-service vector (the number of syscalls called by the O_PATH resolver in a typical case is within the same ballpark). The same benchmarks show a failure rate of ~0.12% which (while not zero) is probably sufficient for most users.

  • In addition, we now return a unix.EAGAIN error that is bubbled up and can be detected by callers. This means that callers with stricter requirements to avoid spurious errors can choose to do their own infinite EAGAIN retry loop (though we would strongly recommend users use time-based deadlines in such retry loops to avoid potentially unbounded denials-of-service).

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.5.1] - 2025-10-31

Spooky scary skeletons send shivers down your spine!

Changed

• openat2 can return -EAGAIN if it detects a possible attack in certain scenarios (namely if there was a rename or mount while walking a path with a .. component). While this is necessary to avoid a denial-of-service in the kernel, it does require retry loops in userspace.

  In previous versions, pathrs-lite would retry openat2 32 times before returning an error, but we've received user reports that this limit can be hit on systems with very heavy load. In some synthetic benchmarks (testing the worst-case of an attacker doing renames in a tight loop on every core of a 16-core machine) we managed to get a ~3% failure rate in runc. We have improved this situation in two ways:

  • We have now increased this limit to 128, which should be good enough for most use-cases without becoming a denial-of-service vector (the number of syscalls called by the O_PATH resolver in a typical case is within the same ballpark). The same benchmarks show a failure rate of ~0.12% which (while not zero) is probably sufficient for most users.

  • In addition, we now return a unix.EAGAIN error that is bubbled up and can be detected by callers. This means that callers with stricter requirements to avoid spurious errors can choose to do their own infinite EAGAIN retry loop (though we would strongly recommend users use time-based deadlines in such retry loops to avoid potentially unbounded denials-of-service).

[0.5.0] - 2025-09-26

Let the past die. Kill it if you have to.

NOTE: With this release, some parts of github.com/cyphar/filepath-securejoin are now licensed under the Mozilla Public License (version 2). Please see COPYING.md as well as the the license header in each file for more details.

Breaking

• The new API introduced in the [0.3.0][] release has been moved to a new subpackage called pathrs-lite. This was primarily done to better indicate the split between the new and old APIs, as well as indicate to users the purpose of this subpackage (it is a less complete version of [libpathrs][]).

  We have added some wrappers to the top-level package to ease the transition, but those are deprecated and will be removed in the next minor release of filepath-securejoin. Users should update their import paths.

... (truncated)

Commits

• ee2f5be VERSION: release v0.5.1
• 0bbec36 CHANGELOG: mention openat2 retry loop changes
• 13b93d7 merge #77 into cyphar/filepath-securejoin:release-0.5
• b12321d openat2: increase retry count to 128
• a9e1a52 gopathrs: return raw errors from openat2 retry loop
• 0b6f2b5 pathrs: support errors.Is(unix.EXDEV) checks for ErrPossible*
• 0064e4b VERSION: back to development
• bb9e81f VERSION: release 0.5.0
• 17e58e1 CHANGELOG: minor updates
• cc071b2 hack: properly test ./...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.29%. Comparing base (fe4ab01) to head (6cc0fc8).
⚠️ Report is 7 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #25143      +/-   ##
==========================================
+ Coverage   62.24%   62.29%   +0.04%     
==========================================
  Files         351      351              
  Lines       49213    49213              
==========================================
+ Hits        30634    30658      +24     
+ Misses      15645    15630      -15     
+ Partials     2934     2925       -9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[dependabot]

Superseded by #25154.