chore(deps): update module github.com/go-git/go-billy/v5 to v5.9.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/go-git/go-billy/v5	v5.6.2 → v5.9.0

---

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

CVE-2026-44740 / GHSA-m3xc-h892-ggx6

More information

Details

Impact

Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.

These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.

Credits

Thanks to @​faran66 for finding and reporting this issue privately to the go-git project. 🙇

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6
• https://github.com/go-git/go-billy/releases/tag/v5.9.0
• https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-44740
• https://github.com/advisories/GHSA-m3xc-h892-ggx6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

go-billy has path traversal vulnerabilities

CVE-2026-44973 / GHSA-qw64-3x98-g7q2

More information

Details

Impact

Multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories.

While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations.

The osfs.ChrootOS implementation is notably affected by this vulnerability and is now deprecated in v5, removed at v6. Users are recommended to move on to osfs.BoundOS instead: osfs.New(path, WithBoundOS()).

Users requiring stronger security boundary enforcement are recommended to upgrade to v6, where the osfs implementation are backed by the traversal-resistant primitive os.Root.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.

Credits

Thanks to @​faran66 and @​vnykmshr for finding and separately reporting this issue privately to the go-git project. 🙇

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/go-git/go-billy/security/advisories/GHSA-qw64-3x98-g7q2
• https://github.com/go-git/go-billy/releases/tag/v5.9.0
• https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-44973
• https://github.com/advisories/GHSA-qw64-3x98-g7q2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

go-git/go-billy (github.com/go-git/go-billy/v5)

v5.9.0

Compare Source

What's Changed

• Use path.Clean instead of filepath.Clean in iofs.Open by @​puerco in #​197
• Deprecate ChrootOS in favour of BoundOS by @​pjbgf in #​201
• General Improvements by @​pjbgf in #​203
• osfs: ChrootOS eval baseDir on creation by @​pjbgf in #​205
• Run go-git tests as part of integration tests by @​pjbgf in #​206

Full Changelog: go-git/go-billy@v5.8.0...v5.9.0

v5.8.0

Compare Source

What's Changed

• build: Update module golang.org/x/net to v0.45.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​183
• v5: Ensure Chmod behaviour across BoundOS and ChrootOS by @​pjbgf in #​187

Full Changelog: go-git/go-billy@v5.7.0...v5.8.0

v5.7.0

Compare Source

What's Changed

• Add support for Chmod on billy.Filesystem by @​bitfehler in #​171
• build: Update module golang.org/x/net to v0.38.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​177

Full Changelog: go-git/go-billy@v5.6.2...v5.7.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: provider/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 10 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.23.5 -> 1.25.0
github.com/cyphar/filepath-securejoin	v0.4.1 -> v0.6.1
golang.org/x/crypto	v0.39.0 -> v0.50.0
golang.org/x/exp	v0.0.0-20250207012021-f9890c6ad9f3 -> v0.0.0-20260410095643-746e56fc9e2f
golang.org/x/mod	v0.25.0 -> v0.35.0
golang.org/x/net	v0.40.0 -> v0.53.0
golang.org/x/sync	v0.15.0 -> v0.20.0
golang.org/x/sys	v0.33.0 -> v0.43.0
golang.org/x/term	v0.32.0 -> v0.42.0
golang.org/x/text	v0.26.0 -> v0.36.0
golang.org/x/tools	v0.33.0 -> v0.44.0