build: bump github.com/cyphar/filepath-securejoin from 0.4.1 to 0.5.0

[dependabot]

Bumps github.com/cyphar/filepath-securejoin from 0.4.1 to 0.5.0.

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.5.0] - 2025-09-26

Let the past die. Kill it if you have to.

NOTE: With this release, some parts of github.com/cyphar/filepath-securejoin are now licensed under the Mozilla Public License (version 2). Please see COPYING.md as well as the the license header in each file for more details.

Breaking

• The new API introduced in the [0.3.0][] release has been moved to a new subpackage called pathrs-lite. This was primarily done to better indicate the split between the new and old APIs, as well as indicate to users the purpose of this subpackage (it is a less complete version of [libpathrs][]).

  We have added some wrappers to the top-level package to ease the transition, but those are deprecated and will be removed in the next minor release of filepath-securejoin. Users should update their import paths.

  This new subpackage has also been relicensed under the Mozilla Public License (version 2), please see COPYING.md for more details.

Added

• Most of the key bits the safe procfs API have now been exported and are available in github.com/cyphar/filepath-securejoin/pathrs-lite/procfs. At the moment this primarily consists of a new procfs.Handle API:

  • OpenProcRoot returns a new handle to /proc, endeavouring to make it safe if possible (subset=pid to protect against mistaken write attacks and leaks, as well as using fsopen(2) to avoid racing mount attacks).

    OpenUnsafeProcRoot returns a handle without attempting to create one with subset=pid, which makes it more dangerous to leak. Most users should use OpenProcRoot (even if you need to use ProcRoot as the base of an operation, as filepath-securejoin will internally open a handle when necessary).

  • The (*procfs.Handle).Open* family of methods lets you get a safe O_PATH handle to subpaths within /proc for certain subpaths.

    For OpenThreadSelf, the returned ProcThreadSelfCloser needs to be called after you completely finish using the handle (this is necessary because Go is multi-threaded and ProcThreadSelf references /proc/thread-self which may disappear if we do not runtime.LockOSThread -- ProcThreadSelfCloser is currently equivalent to runtime.UnlockOSThread).

    Note that you cannot open any procfs symlinks (most notably magic-links)

... (truncated)

Commits

• bb9e81f VERSION: release 0.5.0
• 17e58e1 CHANGELOG: minor updates
• cc071b2 hack: properly test ./...
• a1c1895 CHANGELOG: fix kernel version for open_tree(2)
• 432c95e doc: minor godoc improvements
• 90002f2 CHANGELOG: mention MPLv2 in pathrs-lite entry
• 59fcb8b COPYING: fix reference to pathrs-lite internal pkgs
• 43797e7 pathrs-lite: add Close to procfs wrapper
• 2a0e2b6 pathrs-lite: move Reopen impl to internal/procfs
• 3c5e239 *: update and improve godocs
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)