[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/moby/sys/capability	v0.4.0 → v0.5.0

---

Release Notes

moby/sys (github.com/moby/sys/capability)

v0.5.0

Breaking changes

IdentityMapping.ToHost no longer special-cases the remapped root

ToHost used to skip the ID-map lookup when the ID passed in was equal to the
host remapped-root ID (as returned by RootPair). This was wrong: the arguments
are container IDs, and comparing them against a host value made no sense.

With a subuid/subgid base below 65536 (for example rootless:1000:65536, used
to align dind-rootless container UIDs), a non-root container UID equal to the
base (1000 in this example) was returned unmapped, so it appeared as root
inside the container.

ToHost now always translates both UID and GID through the mappings.
Container root (0) still maps to the host remapped-root base, same as
RootPair returns. An empty (nil) mapping is treated as identity.

What this means for callers:

• Pass container IDs only. Code that passes the host remapped-root pair (for
  example, the result of RootPair) to ToHost and expects it back unchanged
  gets a different result or an error now. Pass 0, 0 instead, or use
  RootPair directly.
• If ToHost returns an error, both returned IDs are now -1. Previously
  they could hold a partially translated value.

The only known caller that was relying on old behavior was moby/moby;
it was fixed by moby/moby#53859.

See #​242 and #​241.

Windows: MkdirAndChown no longer creates parent directories

On Windows, MkdirAndChown used to call os.MkdirAll, so it also created any
missing parent directories, unlike on Unix. It now uses os.Mkdir, as
documented. Use MkdirAllAndChown if you need parent directories created. See
#​236.

Changes

• user: GetExecUser: use strings.Cut to split user:group (#​228)
• user: GetExecUser: always clone default Sgids (#​229)
• user: GetExecUser: rewrite with parseUserArg, parseGroupArg (#​231, #​232)
• user: parseNumeric: require non-empty values (#​235)
• user: MkdirAllAndChown, MkdirAndChown: DRY (#​244)
• user: GoDoc fixes (#​233, #​237)
• user: test fixes and cleanups (#​227, #​234)
• user: require Go 1.24 (#​272)

New Contributors

• @​sueun-dev made their first contribution in #​233
• @​okhowang made their first contribution in #​242

Full Changelog: moby/sys@user/v0.4.1...user/v0.5.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[forking-renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: vendor.sum

go: cannot find main module, but -modfile was set.
	-modfile cannot be used to set the module root directory.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[thaJeztah]

Looks like it got confused because of the multi-module repository;