chore(deps): bump the misc-deps group across 1 directory with 3 updates

[dependabot]

Bumps the misc-deps group with 3 updates in the / directory: github.com/hashicorp/vault/api, kcl-lang.io/kpm and github.com/cyphar/filepath-securejoin.

Updates github.com/hashicorp/vault/api from 1.21.0 to 1.22.0

Changelog

Sourced from github.com/hashicorp/vault/api's changelog.

Previous versions

• v1.10.0 - v1.15.16
• v1.0.0 - v1.9.10
• v0.11.6 and earlier

Commits

• 526ac82 Merge remote-tracking branch 'remotes/from/ce/main'
• 8041281 Backport Update vault-plugin-secrets-terraform to v0.13.0 into ce/main (#9814)
• dce7d8a Backport Update vault-plugin-secrets-kubernetes to v0.12.0 into ce/main (#9811)
• 9cae193 Merge remote-tracking branch 'remotes/from/ce/main'
• abde734 UI: Fix MFA validation timing issue (#9774) (#9799)
• da04c45 Merge remote-tracking branch 'remotes/from/ce/main'
• bf32d52 [UI] Ember Data Migration - KV Cleanup (#9623) (#9794)
• 0c3dcbc Backport Update vault-plugin-auth-azure to v0.22.0 into ce/main (#9782)
• 69b8abb Merge remote-tracking branch 'remotes/from/ce/main'
• 8cf2228 Fix auth method config submit following ember data migration (#9755) (#9793)
• Additional commits viewable in compare view

Updates kcl-lang.io/kpm from 0.11.3 to 0.11.4

Release notes

Sourced from kcl-lang.io/kpm's releases.

v0.11.4

What's Changed

• Chore: (deps): bump github.com/containers/image/v5 from 5.34.3 to 5.36.1 by @​dependabot[bot] in kcl-lang/kpm#651
• chore: (deps): bump actions/checkout from 4 to 5 by @​dependabot[bot] in kcl-lang/kpm#650
• Chore: (deps): bump golang.org/x/mod from 0.26.0 to 0.27.0 by @​dependabot[bot] in kcl-lang/kpm#652
• Chore: (deps): bump kcl-lang.io/kcl-go from 0.11.2 to 0.11.3 by @​dependabot[bot] in kcl-lang/kpm#649
• Chore: (deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0 by @​dependabot[bot] in kcl-lang/kpm#656
• Chore: (deps): bump github.com/onsi/gomega from 1.36.2 to 1.38.1 by @​dependabot[bot] in kcl-lang/kpm#657
• fix(#659): allow client to request credentials in each call via envvar by @​cjuega in kcl-lang/kpm#660
• Fix handling of include patterns in kpm pkg by @​adborden in kcl-lang/kpm#661
• fix: prevent skipping dependency download when cache folder is empty by @​wolfchkov in kcl-lang/kpm#665

New Contributors

• @​cjuega made their first contribution in kcl-lang/kpm#660
• @​adborden made their first contribution in kcl-lang/kpm#661
• @​wolfchkov made their first contribution in kcl-lang/kpm#665

Full Changelog: kcl-lang/kpm@v0.11.3...v0.11.4

Commits

• b6d1809 Merge pull request #665 from wolfchkov/fix-skip-dep-download
• 62411b7 fix: prevent skipping dependency download when cache folder is empty
• d2b887d Merge pull request #661 from adborden/bugfix/mod-include
• 3f95c1f Merge pull request #660 from cjuega/main
• 31c243e fix: handle includes correctly
• f97b4ff test: update TarDir unit test
• 2af4858 test: add e2e test suite for 'kpm pkg'
• ed9aca6 feat(client): allow client to request credentials in each call via envvar
• cca5480 Merge pull request #657 from kcl-lang/dependabot/go_modules/github.com/onsi/g...
• 5e88ee7 Chore: (deps): bump github.com/onsi/gomega from 1.36.2 to 1.38.1
• Additional commits viewable in compare view

Updates github.com/cyphar/filepath-securejoin from 0.5.0 to 0.6.0

Release notes

Sourced from github.com/cyphar/filepath-securejoin's releases.

v0.6.0 -- "By the Power of Greyskull!"

While quite small code-wise, this release marks a very key point in the development of filepath-securejoin.

filepath-securejoin was originally intended (back in 2017) to simply be a single-purpose library that would take some common code used in container runtimes (specifically, Docker's FollowSymlinksInScope) and make it more general-purpose (with the eventual goals of it ending up in the Go stdlib).

Of course, I quickly discovered that this problem was actually far more complicated to solve when dealing with racing attackers, which lead to me developing openat2(2) and libpathrs. I had originally planned for libpathrs to completely replace filepath-securejoin "once it was ready" but in the interim we needed to fix several race attacks in runc as part of security advisories. Obviously we couldn't require the usage of a pre-0.1 Rust library in runc so it was necessary to port bits of libpathrs into filepath-securejoin. (Ironically the first prototypes of libpathrs were originally written in Go and then rewritten to Rust, so the code in filepath-securejoin is actually Go code that was rewritten to Rust then re-rewritten to Go.)

It then became clear that pure-Go libraries will likely not be willing to require CGo for all of their builds, so it was necessary to accept that filepath-securejoin will need to stay. As such, in v0.5.0 we provided more pure-Go implementations of features from libpathrs but moved them into pathrs-lite subpackage to clarify what purpose these helpers serve.

This release finally closes the loop and makes it so that pathrs-lite can transparently use libpathrs (via a libpathrs build-tag). This means that upstream libraries can use the pure Go version if they prefer, but downstreams (either downstream library users or even downstream distributions) are able to migrate to libpathrs for all usages of pathrs-lite in an entire Go binary.

I should make it clear that I do not plan to port the rest of libpathrs to Go, as I do not wish to maintain two copies of the same codebase. pathrs-lite already provides the core essentials necessary to operate on paths safely for most modern systems. Users who want additional hardening or more ergonomic APIs are free to use cyphar.com/go-pathrs (libpathrs's Go bindings).

Breaking

• The deprecated MkdirAll, MkdirAllHandle, OpenInRoot, OpenatInRoot and Reopen wrappers have been removed. Please switch to using pathrs-lite directly.

Added

• pathrs-lite now has support for using libpathrs as a backend. This is opt-in and can be enabled at build time with the libpathrs build tag. The intention is to allow for downstream libraries and other projects to

... (truncated)

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.6.0] - 2025-11-03

By the Power of Greyskull!

Breaking

• The deprecated MkdirAll, MkdirAllHandle, OpenInRoot, OpenatInRoot and Reopen wrappers have been removed. Please switch to using pathrs-lite directly.

Added

• pathrs-lite now has support for using libpathrs as a backend. This is opt-in and can be enabled at build time with the libpathrs build tag. The intention is to allow for downstream libraries and other projects to make use of the pure-Go github.com/cyphar/filepath-securejoin/pathrs-lite package and distributors can then opt-in to using libpathrs for the entire binary if they wish.

[0.5.1] - 2025-10-31

Spooky scary skeletons send shivers down your spine!

Changed

• openat2 can return -EAGAIN if it detects a possible attack in certain scenarios (namely if there was a rename or mount while walking a path with a .. component). While this is necessary to avoid a denial-of-service in the kernel, it does require retry loops in userspace.

  In previous versions, pathrs-lite would retry openat2 32 times before returning an error, but we've received user reports that this limit can be hit on systems with very heavy load. In some synthetic benchmarks (testing the worst-case of an attacker doing renames in a tight loop on every core of a 16-core machine) we managed to get a ~3% failure rate in runc. We have improved this situation in two ways:

  • We have now increased this limit to 128, which should be good enough for most use-cases without becoming a denial-of-service vector (the number of syscalls called by the O_PATH resolver in a typical case is within the same ballpark). The same benchmarks show a failure rate of ~0.12% which (while not zero) is probably sufficient for most users.

  • In addition, we now return a unix.EAGAIN error that is bubbled up and can be detected by callers. This means that callers with stricter requirements to avoid spurious errors can choose to do their own infinite EAGAIN retry loop (though we would strongly recommend users use time-based deadlines in such retry loops to avoid potentially unbounded denials-of-service).

Commits

• 60da611 VERSION: release v0.6.0
• f9f2d4c go: bump to cyphar.com/go-pathrs@v0.2.1
• 9543130 merge v0.5.x branch into main
• aa2152d merge #78 into cyphar/filepath-securejoin:release-0.5
• d85ff0a VERSION: back to development
• ee2f5be VERSION: release v0.5.1
• 0bbec36 CHANGELOG: mention openat2 retry loop changes
• 8e20ab4 CHANGELOG: mention openat2 retry loop changes
• 13b93d7 merge #77 into cyphar/filepath-securejoin:release-0.5
• b12321d openat2: increase retry count to 128
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions