Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY] (release-v0.7)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/go-git/go-billy/v5	v5.8.0 → v5.9.0

---

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

CVE-2026-44740 / GHSA-m3xc-h892-ggx6

More information

Details

Impact

Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.

These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.

Credits

Thanks to @​faran66 for finding and reporting this issue privately to the go-git project. 🙇

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6
• https://github.com/go-git/go-billy/releases/tag/v5.9.0
• https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1
• https://github.com/advisories/GHSA-m3xc-h892-ggx6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

go-billy has path traversal vulnerabilities

CVE-2026-44973 / GHSA-qw64-3x98-g7q2

More information

Details

Impact

Multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories.

While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations.

The osfs.ChrootOS implementation is notably affected by this vulnerability and is now deprecated in v5, removed at v6. Users are recommended to move on to osfs.BoundOS instead: osfs.New(path, WithBoundOS()).

Users requiring stronger security boundary enforcement are recommended to upgrade to v6, where the osfs implementation are backed by the traversal-resistant primitive os.Root.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.

Credits

Thanks to @​faran66 and @​vnykmshr for finding and separately reporting this issue privately to the go-git project. 🙇

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/go-git/go-billy/security/advisories/GHSA-qw64-3x98-g7q2
• https://github.com/go-git/go-billy/releases/tag/v5.9.0
• https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1
• https://github.com/advisories/GHSA-qw64-3x98-g7q2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

go-git/go-billy (github.com/go-git/go-billy/v5)

v5.9.0

Compare Source

What's Changed

• Use path.Clean instead of filepath.Clean in iofs.Open by @​puerco in #​197
• Deprecate ChrootOS in favour of BoundOS by @​pjbgf in #​201
• General Improvements by @​pjbgf in #​203
• osfs: ChrootOS eval baseDir on creation by @​pjbgf in #​205
• Run go-git tests as part of integration tests by @​pjbgf in #​206

Full Changelog: go-git/go-billy@v5.8.0...v5.9.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 8 additional dependencies were updated

Details:

Package	Change
golang.org/x/exp	v0.0.0-20260312153236-7ab1446f8b90 -> v0.0.0-20260410095643-746e56fc9e2f
github.com/cyphar/filepath-securejoin	v0.6.0 -> v0.6.1
golang.org/x/crypto	v0.49.0 -> v0.50.0
golang.org/x/mod	v0.34.0 -> v0.35.0
golang.org/x/net	v0.52.0 -> v0.53.0
golang.org/x/sys	v0.42.0 -> v0.43.0
golang.org/x/term	v0.41.0 -> v0.42.0
golang.org/x/text	v0.35.0 -> v0.36.0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
generative	69.55% <ø> (ø)
integration	69.55% <ø> (ø)
unit	69.55% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: acceptance/go.sum

Command failed: go mod tidy
go: downloading github.com/onsi/gomega v1.38.2
go: downloading github.com/go-openapi/testify/v2 v2.0.2
go: downloading github.com/onsi/ginkgo/v2 v2.27.2
go: downloading github.com/tektoncd/triggers v0.35.0
go: downloading github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4
go: downloading github.com/go-openapi/testify/enable/yaml/v2 v2.0.2
go: downloading github.com/tink-crypto/tink-go-hcvault/v2 v2.3.0
go: downloading google.golang.org/api v0.268.0
go: downloading filippo.io/edwards25519 v1.1.1
go: downloading github.com/aws/aws-sdk-go-v2 v1.41.2
go: downloading github.com/aws/aws-sdk-go-v2/config v1.32.10
go: downloading github.com/aws/aws-sdk-go-v2/service/kms v1.50.1
go: downloading github.com/moby/sys/atomicwriter v0.1.0
go: downloading github.com/evanphx/json-patch v5.9.0+incompatible
go: downloading knative.dev/eventing v0.30.3
go: downloading cloud.google.com/go/auth v0.18.1
go: downloading github.com/aws/smithy-go v1.24.1
go: downloading github.com/aws/aws-sdk-go-v2/credentials v1.19.10
go: downloading github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.18
go: downloading github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4
go: downloading github.com/aws/aws-sdk-go-v2/service/signin v1.0.6
go: downloading github.com/aws/aws-sdk-go-v2/service/sso v1.30.11
go: downloading github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.15
go: downloading github.com/aws/aws-sdk-go-v2/service/sts v1.41.7
go: downloading github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.18
go: downloading github.com/shoenig/test v0.6.4
go: downloading cuelabs.dev/go/oci/ociregistry v0.0.0-20250722084951-074d06050084
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.5
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.18
go: downloading github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.18
go: downloading github.com/emicklei/proto v1.14.2
go: downloading github.com/protocolbuffers/txtpbfmt v0.0.0-20251016062345-16587c79cd91
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.11
go: finding module for package knative.dev/pkg/metrics
go: downloading knative.dev/pkg v0.0.0-20260526162440-71f6ad65d251
go: finding module for package knative.dev/pkg/tracing/config
go: github.com/conforma/cli/acceptance/kubernetes/kind imports
	github.com/tektoncd/cli/pkg/formatted tested by
	github.com/tektoncd/cli/pkg/formatted.test imports
	github.com/tektoncd/cli/pkg/test imports
	github.com/tektoncd/triggers/test imports
	github.com/tektoncd/triggers/pkg/reconciler/eventlistener/resources imports
	knative.dev/eventing/pkg/reconciler/source imports
	knative.dev/pkg/metrics: module knative.dev/pkg@latest found (v0.0.0-20260526162440-71f6ad65d251), but does not contain package knative.dev/pkg/metrics
go: github.com/conforma/cli/acceptance/kubernetes/kind imports
	github.com/tektoncd/cli/pkg/formatted tested by
	github.com/tektoncd/cli/pkg/formatted.test imports
	github.com/tektoncd/cli/pkg/test imports
	github.com/tektoncd/triggers/test imports
	github.com/tektoncd/triggers/pkg/reconciler/eventlistener/resources imports
	knative.dev/eventing/pkg/reconciler/source imports
	knative.dev/pkg/tracing/config: module knative.dev/pkg@latest found (v0.0.0-20260526162440-71f6ad65d251), but does not contain package knative.dev/pkg/tracing/config