[dependabot]

Bumps github.com/moby/sys/user from 0.3.0 to 0.4.1.

Release notes

Sourced from github.com/moby/sys/user's releases.

mountinfo v0.4.1

Fixes and improvements:

• Fix PrefixFilter() being too greedy (#61)
• TestMountedBy*: add missing pre-checks (ce8f425e79a74602c4055fb1776f38043d56827b)
• Documentation improvements (#52)

user/v0.4.1

What's Changed

• user: prevent possible DoS via unbounded parsing of user and group database files in CVE-2026-61801 / GHSA-mjcv-p78q-w5fw. This fixes a similar issue as CVE-2026-47262 in containerd.
• user: prevent falling back to looking up numeric usernames and improve handling of numeric user/group to prevent looking up numeric values as usernames. This fixes a similar issue as CVE-2026-46680 in containerd. moby/sys#221
• user: bump Go to 1.18, modernize moby/sys#198
• user: make code a bit more DRY moby/sys#225
• user: test cleanups moby/sys#226

Full Changelog: moby/sys@user/v0.4.0...user/v0.4.1

mountinfo v0.4.0

Breaking changes:

• PidMountInfo is now deprecated and will be removed before v1.0; users should switch to GetMountsFromReader (#47)

Fixes and improvements:

• run filter after all fields are parsed (#50)
• correct handling errors from bufio.Scan
• documentation formatting fixes (#48)

Thanks to:

• Aleksa Sarai

capability v0.4.0

Added

• New separate API for ambient ([GetAmbient], [SetAmbient], [ResetAmbient]) and bound ([GetBound], [DropBound]) capabilities, modelled after libcap. (#176)

Fixed

• [Apply] now returns an error if called for non-zero pid. Before this change, it could silently change some capabilities of the current process, instead of the one identified by the pid. (#168, #174)
• Fixed tests that change capabilities to be run in a separate process. (#173)
• Other improvements in tests. (#169, #170)

Changed

• Use raw syscalls (which are slightly faster). (#176)
• Most tests are now limited to testing the public API of the package. (#162)
• Simplify parsing /proc/pid/status, add a test case. (#162)
• Optimize the number of syscall to set ambient capabilities in Apply by clearing them first; add a test case. (#163, #164)
• Better documentation for [Apply], [NewFile], [NewFile2], [NewPid], [NewPid2]. (#175)

... (truncated)

Commits

• 85a71bb Merge commit from fork
• 2c56c3d user: limit line length in ParseGroupFilter
• bba2f13 user: limit reads from user database files
• ee79b0e Merge pull request #221 from thaJeztah/limit_uidgid
• 6eb9f15 user: GetAdditionalGroups: treat numeric group arguments as GIDs only
• c66bd2d user: prevent falling back to looking up numeric usernames
• c873359 Merge pull request #226 from thaJeztah/user_test_cleanups
• f41a5ef Merge pull request #225 from thaJeztah/user_dry
• 5c2e8a0 user: add test-cases for maxID (math.MaxInt32)
• e001aea user: use sub-tests
• Additional commits viewable in compare view

[stefanberger]

@dependabot rebase

[stefanberger]

@dependabot rebase

[stefanberger]

@dependabot rebase