[floatpanebot]

What?

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/landlock-lsm/go-landlock	v0.8.1 → v0.11.0

---

Release Notes

landlock-lsm/go-landlock (github.com/landlock-lsm/go-landlock)

v0.11.0: ABI V11 Support

Compare Source

Transparent changes for Go-Landlock users:

• LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS: By using this new flag, Go-Landlock can avoid unnecessary thread locking and an extra syscall during Landlock enforcement. This feature is safe for all users and automatically used.

Documentation updates for better AI-assisted development:

• Added UPGRADE.md to point to upgrade procedure. This conventional file name is picked up by tools like Github's dependabot.
• Documented how to use Landlock in Go with raw syscalls. I hope that some vibe coded apps will avoid common pitfalls that way.

v0.10.1

Compare Source

Make handled access rights in Config struct public

v0.10.0: ABI V10 Support

Compare Source

Features:

• UDP bind/connect/send restrictions
• Quieting audit logging

v0.9.0: ABI V9 support

Compare Source

Adds support for LANDLOCK_ACCESS_FS_RESOLVE_UNIX (see https://docs.kernel.org/userspace-api/landlock.html#filesystem-flags), as introduced by Linux 7.1 today.

Users are advised to use landlock.V9 to restrict outgoing connections to named UNIX sockets. Individual sockets or directories can be allow-listed using the FSRule.WithResolveUnix() modifier for file system rules. As usual, the things to look out for are documented in config.go next to the landlock.V9 identifier.

For a step-by-step instruction for upgrading (or when using an AI agent!), see https://github.com/landlock-lsm/go-landlock/blob/main/docs/upgrade.md

Full Changelog: landlock-lsm/go-landlock@v0.8.1...v0.9.0

Why?

Automated dependency update via Renovate.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[floatpanebot]

❌ Security failed

Commit: fc1da26 · run logs

Failed jobs:

• govulncheck — Run govulncheck ./... and update vulnerable deps.

Failure details

Build errors:

• 2026-10-24T20:39:06.1147544Z ##[error] #1: termimage.go:134: termimage.Clear calls bufio.Writer.Flush, which eventually calls x509.Certificate.Verify
• 2026-10-24T20:39:06.1158731Z ##[error] #1: internal/source/source.go:83: source.fetch calls http.Client.Do
• 2026-10-24T20:39:06.1159987Z ##[error] #2: internal/source/source.go:83: source.fetch calls http.Client.Do
• 2026-10-24T20:39:06.1161743Z ##[error] #3: internal/source/source.go:79: source.fetch calls http.NewRequestWithContext
• 2026-10-24T20:39:06.1163043Z ##[error] #4: internal/source/source.go:79: source.fetch calls http.NewRequestWithContext
• 2026-10-24T20:39:06.1147529Z ##[error] #1: termimage.go:134: termimage.Clear calls bufio.Writer.Flush, which eventually calls x509.Certificate.Verify
• 2026-10-24T20:39:06.1158722Z ##[error] #1: internal/source/source.go:83: source.fetch calls http.Client.Do
• 2026-10-24T20:39:06.1159983Z ##[error] #2: internal/source/source.go:83: source.fetch calls http.Client.Do

[floatpanebot]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.26 -> 1.26.0
golang.org/x/sys	v0.40.0 -> v0.48.0