Version 0.48.1-RC1 (#3781)

* Update version.txt

* Replace mholt/archiver with mholt/archives.

* Pass blob readers to unarchivers rather than having a dedicated blob unarchiver.

* Fixed unarchiving of links.

* Try to fix hardlink failures.

Revert "Try to fix hardlink failures."

This reverts commit feb27a3.

Update unarchiver.go

* Use correct []byte reader interface.

* ProxyReader needs to implement io.Seeker for unpacking zip archives.

* Address CVEs.

* Placate check-format

* Update macOS runner.

macos-15 is ARM, so we need macos-15-intel.

* Updated golangci-lint dev dependency and migrated config.

* Allow performance tests to run for up to a minute.

* Updated changelog for 0.48.1.

* Updated GitHub Actions to Go 1.24.

* Updated Go to 1.24.11 to remediate CVEs.

* Avoid concurrent map read/write.

* Updated changelog.

Author: mitchell-as

changelog.md

@@ -10,7 +10,11 @@ and this project adheres to
 
 ### Security
 
-Addressed all known, fixable CVEs.
+- Addressed all known, fixable CVEs.
+
+### Fixed
+
+- Fixed occasional panic due to a concurrent map read/write during runtime setup.
 
 ## 0.48.0
 

pkg/runtime/depot.go

@@ -160,6 +160,9 @@ func (d *depot) SetCacheSize(mb int) {
 // Artifact metadata comes from the depot's cache, and may not exist for installed artifacts that
 // predate the cache.
 func (d *depot) Exists(id strfmt.UUID) (bool, *artifactInfo) {
+	d.mapMutex.Lock()
+	defer d.mapMutex.Unlock()
+
 	if _, ok := d.artifacts[id]; ok {
 		if artifact, exists := d.config.Cache[id]; exists {
 			return true, artifact