build(deps): Bump github.com/creachadair/atomicfile from 0.4.1 to 0.4.2

[dependabot]

Bumps github.com/creachadair/atomicfile from 0.4.1 to 0.4.2.

Commits

• 8c0516b Propagate WriteAll errors (#1)
• 7250cf2 .github: update actions/checkout to v7
• dde1bf6 go.mod: update module dependencies
• 1d13b06 go.mod: update module dependencies
• f084b64 go.mod: update module dependencies
• 714b2d7 go.mod: update module dependencies
• 0293e4a go.mod: update module dependencies
• a06c451 go.mod: update module dependencies
• ab90417 go.mod: update module dependencies
• See full diff in compare view

[lklimek]

Dependency Security Review — github.com/creachadair/atomicfile 0.4.1 → 0.4.2

Verdict: Safe — recommend merge.

Change summary

9 upstream commits, but only 4 lines of non-test production code changed (rest is go.mod refreshes + an actions/checkout bump). The whole library is ~120 lines; all of it was audited, not just the diff.

The sole functional change fixes a swallowed-error bug in WriteAll:

// v0.4.1 — errors discarded, WriteAll ALWAYS returned nil
Tx(target, mode, func(w io.Writer) error {
    nw, err = w.(*File).tmp.ReadFrom(r)
    return nil          // <- read error dropped; Tx result also dropped
})

// v0.4.2
err = Tx(target, mode, func(w io.Writer) error {
    nw, err = w.(*File).tmp.ReadFrom(r)
    return err
})

Bug fix (correctness/integrity). No API change, no breaking change. Two regression tests added upstream covering the read-failure and rename-failure paths. Tag v0.4.2 is on origin/main and GitHub-signed.

Known vulnerabilities

Source	atomicfile	mds
OSV.dev	None	None
GitHub Advisory DB (ecosystem=go)	None	None

go.sum entries for both new versions verified against sum.golang.org — hashes match exactly, no tampering.

Library audit findings

Severity	Finding	CWE
LOW (fixed by this bump)	WriteAll discarded both the read error and the Tx/rename error, always returning nil — a truncated or failed atomic write was reported as success (silent data loss).	CWE-390, CWE-252
INFO	New() uses os.Lstat to reject non-regular targets — TOCTOU-advisory only (documented upstream). Not exploitable here: both call sites write to locally-controlled paths.	CWE-367
INFO	Temp file created in target dir via os.CreateTemp, Chmod(mode) before write, unlink on failure. No symlink-follow or predictable-name issues.	—

No new attack surface introduced by v0.4.2.

Transitive mds 0.26.0 → 0.29.2 — not in our build graph

github.com/creachadair/mds is a test-only dependency of atomicfile (mtest in atomicfile_test.go). Confirmed via go mod why -m (path terminates at atomicfile.test) and go list -deps ./... | grep creachadair/mds → 0 hits. The 3-minor-version jump — the bulk of the version delta — compiles into nothing we ship.

Codebase impact

Call site	API	Affected?	Status
internal/libs/confix/confix.go:60	WriteData(outputPath, buf.Bytes(), 0600)	No — WriteData unchanged, already propagated errors	OK, no action
scripts/linkpatch/linkpatch.go:153	WriteAll(path, &output, 0644)	Yes — err was previously always nil; real I/O/rename failures now surface	OK, improvement — call site already does _, err = ...; return err, works with zero code change

Neither site takes an untrusted-network path or attacker-controlled filename. The only behavioral change is in a dev/docs script, whose failure mode moves from "silently corrupt output" to "fail loudly" — the desired direction.

Note on the red govulncheck job

The govulncheck failure on this PR is not caused by this bump: it is GO-2026-5856, a Go stdlib crypto/tls issue, resolved by the Go toolchain bump to 1.26.5 (#1395, now merged to v1.6-dev). Requesting a @dependabot rebase so this PR picks up the new go.mod.

Minor upstream-posture caveat: creachadair/* has no SECURITY.md and this integrity fix shipped without a CVE/GHSA, so these modules are effectively invisible to vulnerability tooling — rely on diff review rather than scanner alerts for them.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

[lklimek]

@dependabot rebase

[lklimek]

Post-rebase CI status

Rebase completed (25a0f238 → 3c27c2e3); go.mod now carries go 1.26.5, and the original blocker GO-2026-5856 (stdlib crypto/tls) is resolved.

However govulncheck is still red, on a different and equally unrelated finding:

Vulnerability #1: GO-2026-6061
  Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2
  transport server implementation in google.golang.org/grpc
  Found in: google.golang.org/grpc@v1.82.0
  Fixed in: google.golang.org/grpc@v1.82.1

This is inherited from v1.6-dev (which also pins grpc v1.82.0) and has nothing to do with the atomicfile bump. The fix is already queued as #1392 (grpc 1.82.0 → 1.82.1).

Not merging yet. Suggested order: merge #1392 first, then @dependabot rebase this PR once more to pick up grpc v1.82.1. All other 15 checks on the rebased head are green, and the dependency audit above stands unchanged — this PR itself is clean.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

[lklimek]

@dependabot rebase

[lklimek]

@dependabot rebase