github.com/cyphar/filepath-securejoin v0.5.0 added MPL-2.0 code which is not allowed in the CNCF license rules by default and requires an exception, see cncf/foundation#1154

We are holding the update in podman, buildah and in our storage library to avoid the bump for now, containers/container-libs#359.

Looks like it was bumped in cadcf47 here, you may need to revert it until it gets an exception.