[Bug]: root module still requires vulnerable github.com/moby/go-archive v0.2.0 (GHSA-hfg8-hc9c-6c3h) #3913

Testcontainers version

v0.42.0

Using the latest Testcontainers version?

No

(Checked: the root module's go.mod on the latest release, v0.44.0, still requires github.com/moby/go-archive v0.2.0, so this affects the latest version too.)

Host OS

macOS (Darwin)

Host arch

ARM (arm64)

Go version

1.26.5

Docker version

Client:
 Version:           29.2.1
 API version:       1.53
 Go version:        go1.25.6
 Git commit:        a5c7197
 Built:             Mon Feb  2 17:16:37 2026
 OS/Arch:           darwin/arm64
 Context:           desktop-linux

Server: Docker Desktop 4.61.0 (219004)
 Engine:
  Version:          29.2.1
  API version:      1.53 (minimum version 1.44)
  Go version:       go1.25.6
  Git commit:       6bc6209
  Built:            Mon Feb  2 17:16:47 2026
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          v2.2.1
  GitCommit:        dea7da592f5d1d2b7755e3a161be07f43fad8f75
 runc:
  Version:          1.3.4
  GitCommit:        v1.3.4-0-gd6d73eb8
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Docker info

Client:
 Version:    29.2.1
 Context:    desktop-linux
 Debug Mode: false

Server:
 Server Version: 29.2.1
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Kernel Version: 6.12.68-linuxkit
 Operating System: Docker Desktop
 OSType: linux
 Architecture: aarch64
 CPUs: 10
 Total Memory: 7.653GiB

What happened?

github.com/moby/go-archive is vulnerable to a tar path-traversal issue (GHSA-hfg8-hc9c-6c3h): a crafted tar archive can write outside the intended extraction directory. Fixed as of go-archive v0.3.0, with v0.3.1–v0.3.3 fixing several extraction regressions the v0.3.0 hardening itself introduced (rejecting valid absolute symlinks/hardlinks, broken device-node permission handling) — so v0.3.3 is the version worth targeting, not just the first patched release.

The root testcontainers-go module still requires go-archive v0.2.0:

$ curl -s https://raw.githubusercontent.com/testcontainers/testcontainers-go/v0.44.0/go.mod | grep go-archive
	github.com/moby/go-archive v0.2.0

I noticed this repo's own Dependabot has already bumped go-archive to v0.3.0 in three of the per-database submodules:

• chore(deps): bump github.com/moby/go-archive from 0.2.0 to 0.3.0 in /modules/valkey #3852 (/modules/valkey)
• chore(deps): bump github.com/moby/go-archive from 0.2.0 to 0.3.0 in /modules/vearch #3854 (/modules/vearch)
• chore(deps): bump github.com/moby/go-archive from 0.2.0 to 0.3.0 in /modules/solr #3857 (/modules/solr)

but not in the root module, which is what consumers using the generic container API (testcontainers.Run, not a modules/* wrapper) actually depend on. Every dependent of the root module will keep getting flagged for this until the root module's own requirement is bumped.

I've locally verified that bumping to v0.3.3 in the root module is a drop-in change: go get github.com/moby/go-archive@v0.3.3 + go mod tidy only changes the go-archive requirement itself (no other version conflicts), and the full test suite (including tests that spin up real containers) builds and passes against it.

Would you accept a PR bumping github.com/moby/go-archive to v0.3.3 (or later) in the root module's go.mod? Happy to open one following the contributing guide (conventional-commit PR title with the security type, make tidy-all) if that's welcome — wanted to check per the "find or open an issue first" guidance before doing so.

Relevant log output

$ curl -s https://raw.githubusercontent.com/testcontainers/testcontainers-go/v0.44.0/go.mod | grep go-archive
	github.com/moby/go-archive v0.2.0

(Surfaced via GitHub Dependabot on a downstream repo depending on the root testcontainers-go module.)

Additional information

• Advisory: GHSA-hfg8-hc9c-6c3h
• go-archive v0.3.0 (original fix): https://github.com/moby/go-archive/releases/tag/v0.3.0
• go-archive v0.3.3 (rolls up fixes for v0.3.0's own extraction regressions): https://github.com/moby/go-archive/releases/tag/v0.3.3
• Related submodule bumps already merged: chore(deps): bump github.com/moby/go-archive from 0.2.0 to 0.3.0 in /modules/valkey #3852, chore(deps): bump github.com/moby/go-archive from 0.2.0 to 0.3.0 in /modules/vearch #3854, chore(deps): bump github.com/moby/go-archive from 0.2.0 to 0.3.0 in /modules/solr #3857