Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY] (main) - autoclosed by renovate[bot] · Pull Request #3299 · conforma/cli

renovate · 2026-05-13T17:56:27Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/go-git/go-billy/v5	`v5.8.0` → `v5.9.0`

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

CVE-2026-44740 / GHSA-m3xc-h892-ggx6

More information

Details

Impact

Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.

These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.

Credits

Thanks to @faran66 for finding and reporting this issue privately to the go-git project. 🙇

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

go-billy has path traversal vulnerabilities

CVE-2026-44973 / GHSA-qw64-3x98-g7q2

More information

Details

Impact

Multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories.

While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations.

The osfs.ChrootOS implementation is notably affected by this vulnerability and is now deprecated in v5, removed at v6. Users are recommended to move on to osfs.BoundOS instead: osfs.New(path, WithBoundOS()).

Users requiring stronger security boundary enforcement are recommended to upgrade to v6, where the osfs implementation are backed by the traversal-resistant primitive os.Root.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.

Credits

Thanks to @faran66 and @vnykmshr for finding and separately reporting this issue privately to the go-git project. 🙇

Severity

CVSS Score: 8.1 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

go-git/go-billy (github.com/go-git/go-billy/v5)

`v5.9.0`

Compare Source

What's Changed

Use path.Clean instead of filepath.Clean in iofs.Open by @puerco in #197
Deprecate ChrootOS in favour of BoundOS by @pjbgf in #201
General Improvements by @pjbgf in #203
osfs: ChrootOS eval baseDir on creation by @pjbgf in #205
Run go-git tests as part of integration tests by @pjbgf in #206

Full Changelog: go-git/go-billy@v5.8.0...v5.9.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-05-13T17:56:30Z

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

8 additional dependencies were updated

Details:

Package	Change
`golang.org/x/exp`	`v0.0.0-20250911091902-df9299821621` -> `v0.0.0-20260410095643-746e56fc9e2f`
`github.com/cyphar/filepath-securejoin`	`v0.6.0` -> `v0.6.1`
`golang.org/x/crypto`	`v0.49.0` -> `v0.50.0`
`golang.org/x/mod`	`v0.33.0` -> `v0.35.0`
`golang.org/x/net`	`v0.52.0` -> `v0.53.0`
`golang.org/x/sys`	`v0.42.0` -> `v0.43.0`
`golang.org/x/term`	`v0.41.0` -> `v0.42.0`
`golang.org/x/text`	`v0.35.0` -> `v0.36.0`

codecov · 2026-05-13T18:10:43Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	`55.59% <ø> (ø)`
generative	`17.82% <ø> (ø)`
integration	`26.56% <ø> (ø)`
unit	`69.03% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

renovate · 2026-05-28T08:34:15Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: acceptance/go.sum

Command failed: go mod tidy
go: downloading github.com/onsi/ginkgo v1.16.5
go: downloading github.com/onsi/gomega v1.38.2
go: downloading github.com/yudai/pp v2.0.1+incompatible
go: downloading gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
go: downloading github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399
go: downloading go.uber.org/goleak v1.3.0
go: downloading gotest.tools/v3 v3.5.2
go: downloading gotest.tools v2.2.0+incompatible
go: downloading github.com/go-openapi/testify/v2 v2.4.1
go: downloading github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d
go: downloading github.com/otiai10/mint v1.5.1
go: downloading github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb
go: downloading github.com/elazarl/goproxy v1.7.2
go: downloading github.com/creack/pty v1.1.24
go: downloading github.com/stretchr/objx v0.5.2
go: downloading github.com/hashicorp/go-hclog v1.6.3
go: downloading github.com/onsi/ginkgo/v2 v2.27.2
go: downloading k8s.io/apiserver v0.35.4
go: downloading k8s.io/component-base v0.35.4
go: downloading github.com/tektoncd/triggers v0.35.0
go: downloading github.com/sassoftware/relic/v7 v7.6.2
go: downloading github.com/go-quicktest/qt v1.101.0
go: downloading golang.org/x/tools v0.44.0
go: downloading github.com/nxadm/tail v1.4.11
go: downloading github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.5
go: downloading github.com/go-openapi/testify/enable/yaml/v2 v2.4.1
go: downloading github.com/google/trillian v1.7.2
go: downloading github.com/go-sql-driver/mysql v1.9.3
go: downloading github.com/jackc/pgx/v5 v5.7.5
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.5
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.5
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.5
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.5
go: downloading github.com/tink-crypto/tink-go-awskms/v2 v2.1.0
go: downloading github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0
go: downloading github.com/tink-crypto/tink-go-hcvault/v2 v2.4.0
go: downloading github.com/tink-crypto/tink-go/v2 v2.6.0
go: downloading go.step.sm/crypto v0.75.0
go: downloading github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
go: downloading github.com/gliderlabs/ssh v0.3.8
go: downloading github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6
go: downloading github.com/go-rod/rod v0.116.2
go: downloading k8s.io/cli-runtime v0.34.2
go: downloading knative.dev/serving v0.39.4
go: downloading github.com/blendle/zapdriver v1.3.1
go: downloading software.sslmate.com/src/go-pkcs12 v0.4.0
go: downloading github.com/cloudevents/sdk-go/v2 v2.16.2
go: downloading github.com/google/gofuzz v1.2.0
go: downloading github.com/lib/pq v1.10.9
go: downloading github.com/hashicorp/go-uuid v1.0.3
go: downloading gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7
go: downloading github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
go: downloading google.golang.org/api v0.271.0
go: downloading github.com/kylelemons/godebug v1.1.0
go: downloading filippo.io/edwards25519 v1.1.1
go: downloading github.com/jackc/pgpassfile v1.0.0
go: downloading github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761
go: downloading github.com/jmhodges/clock v1.2.0
go: downloading github.com/aws/aws-sdk-go-v2 v1.41.4
go: downloading github.com/aws/aws-sdk-go-v2/config v1.32.12
go: downloading github.com/aws/aws-sdk-go-v2/service/kms v1.50.1
go: downloading github.com/jellydator/ttlcache/v3 v3.4.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0
go: downloading github.com/Azure/azure-sdk-for-go v68.0.0+incompatible
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
go: downloading github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0
go: downloading cloud.google.com/go/kms v1.26.0
go: downloading cloud.google.com/go v0.123.0
go: downloading github.com/hashicorp/vault/api v1.22.0
go: downloading github.com/aws/aws-sdk-go v1.55.8
go: downloading github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
go: downloading github.com/moby/sys/atomicwriter v0.1.0
go: downloading github.com/ysmood/goob v0.4.0
go: downloading github.com/ysmood/got v0.40.0
go: downloading github.com/ysmood/gson v0.7.3
go: downloading github.com/ysmood/fetchup v0.2.3
go: downloading github.com/ysmood/leakless v0.9.0
go: downloading github.com/Masterminds/semver/v3 v3.4.0
go: downloading github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
go: downloading go.etcd.io/etcd/client/pkg/v3 v3.6.5
go: downloading go.etcd.io/etcd/client/v3 v3.6.5
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0
go: downloading github.com/google/btree v1.1.3
go: downloading github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de
go: downloading knative.dev/eventing v0.30.3
go: downloading knative.dev/networking v0.0.0-20231017124814-2a7676e912b7
go: downloading github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef
go: downloading github.com/zalando/go-keyring v0.2.3
go: downloading github.com/allegro/bigcache/v3 v3.1.0
go: downloading github.com/kelseyhightower/envconfig v1.4.0
go: downloading github.com/fsnotify/fsnotify v1.9.0
go: downloading cloud.google.com/go/auth v0.18.2
go: downloading github.com/golang/protobuf v1.5.4
go: downloading github.com/hashicorp/golang-lru/v2 v2.0.7
go: downloading github.com/aws/smithy-go v1.24.2
go: downloading github.com/aws/aws-sdk-go-v2/credentials v1.19.12
go: downloading github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20
go: downloading github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6
go: downloading github.com/aws/aws-sdk-go-v2/service/signin v1.0.8
go: downloading github.com/aws/aws-sdk-go-v2/service/sso v1.30.13
go: downloading github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17
go: downloading github.com/aws/aws-sdk-go-v2/service/sts v1.41.9
go: downloading github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20
go: downloading github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2
go: downloading github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0
go: downloading cloud.google.com/go/iam v1.5.3
go: downloading cloud.google.com/go/longrunning v0.8.0
go: downloading github.com/googleapis/gax-go/v2 v2.17.0
go: downloading google.golang.org/genproto v0.0.0-20260128011058-8636f8732409
go: downloading github.com/hashicorp/errwrap v1.1.0
go: downloading github.com/hashicorp/go-multierror v1.1.1
go: downloading github.com/hashicorp/go-rootcerts v1.0.2
go: downloading github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0
go: downloading github.com/hashicorp/go-secure-stdlib/strutil v0.1.2
go: downloading github.com/hashicorp/hcl v1.0.1-vault-7
go: downloading github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c
go: downloading github.com/shoenig/test v0.6.4
go: downloading github.com/go-task/slim-sprig/v3 v3.0.0
go: downloading github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0
go: downloading sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2
go: downloading go.etcd.io/etcd/api/v3 v3.6.5
go: downloading github.com/coreos/go-systemd/v22 v22.7.0
go: downloading github.com/coreos/go-semver v0.3.1
go: downloading github.com/danieljoos/wincred v1.2.3
go: downloading github.com/godbus/dbus/v5 v5.1.0
go: downloading cuelabs.dev/go/oci/ociregistry v0.0.0-20251212221603-3adeb8663819
go: downloading github.com/pelletier/go-toml/v2 v2.2.4
go: downloading cloud.google.com/go/compute/metadata v0.9.0
go: downloading cloud.google.com/go/auth/oauth2adapt v0.2.8
go: downloading github.com/google/s2a-go v0.1.9
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20
go: downloading github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20
go: downloading github.com/hashicorp/go-sockaddr v1.0.7
go: downloading github.com/ryanuber/go-glob v1.0.0
go: downloading github.com/natefinch/atomic v1.0.1
go: downloading github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24
go: downloading github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6
go: downloading github.com/gogo/protobuf v1.3.2
go: downloading github.com/emicklei/proto v1.14.3
go: downloading github.com/protocolbuffers/txtpbfmt v0.0.0-20260217160748-a481f6a22f94
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.14
go: downloading gonum.org/v1/gonum v0.17.0
go: downloading github.com/jackc/puddle/v2 v2.2.2
go: downloading github.com/golang-jwt/jwt/v5 v5.3.0
go: downloading github.com/mitchellh/go-wordwrap v1.0.1
go: finding module for package knative.dev/pkg/metrics
go: downloading knative.dev/pkg v0.0.0-20260526162440-71f6ad65d251
go: finding module for package knative.dev/pkg/tracing/config
go: github.com/conforma/cli/acceptance/kubernetes/kind imports
	github.com/tektoncd/cli/pkg/formatted tested by
	github.com/tektoncd/cli/pkg/formatted.test imports
	github.com/tektoncd/cli/pkg/test imports
	github.com/tektoncd/triggers/test imports
	github.com/tektoncd/triggers/pkg/reconciler/eventlistener/resources imports
	knative.dev/eventing/pkg/reconciler/source imports
	knative.dev/pkg/metrics: module knative.dev/pkg@latest found (v0.0.0-20260526162440-71f6ad65d251), but does not contain package knative.dev/pkg/metrics
go: github.com/conforma/cli/acceptance/kubernetes/kind imports
	github.com/tektoncd/cli/pkg/formatted tested by
	github.com/tektoncd/cli/pkg/formatted.test imports
	github.com/tektoncd/cli/pkg/test imports
	github.com/tektoncd/triggers/test imports
	github.com/tektoncd/triggers/pkg/reconciler/eventlistener/resources imports
	knative.dev/eventing/pkg/reconciler/source imports
	knative.dev/pkg/tracing/config: module knative.dev/pkg@latest found (v0.0.0-20260526162440-71f6ad65d251), but does not contain package knative.dev/pkg/tracing/config

fullsend-ai-retro · 2026-06-12T21:14:18Z

🤖 Finished Retro · ✅ Success · Started 9:14 PM UTC · Completed 9:18 PM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-retro · 2026-06-12T21:18:50Z

Retro: PR #3299 — Renovate auto-closed dependency update

What happened: PR #3299 was a Renovate bot PR to bump go-billy/v5 from v5.8.0 to v5.9.0 (two CVEs). Renovate failed to run go mod tidy cleanly due to upstream knative.dev/pkg incompatibilities. The PR sat open for ~30 days until a human (simonbaird) manually handled the go-git module update in PR #3335, merged 2026-06-12 at 20:57 UTC. Renovate auto-closed PR #3299 fifteen minutes later. The retro agent was then dispatched on the closed event.

No fullsend agents reviewed or interacted with this PR prior to closure. The only agent activity was this retro dispatch itself.

Assessment: This retro run is a token-cost waste — there is no agent workflow to analyze. The retro was triggered on a bot-authored, never-merged PR with zero agent involvement. However, all relevant improvements are already tracked upstream:

#1411 — Skip retro dispatch for unmerged PRs with no agent interaction (directly covers this case)
#1630 — Skip retro dispatch for bot-authored PRs with review-only agent interaction
#2176 — Skip retro dispatch for closed-without-merge PRs with immediate successor
#1371 — Skip review dispatch for bot-authored PRs

No new proposals needed — existing issues adequately cover the improvements.

renovate Bot added main renovate labels May 13, 2026

github-actions Bot added the size: S label May 13, 2026

renovate Bot force-pushed the renovate/main-go-github.com-go-git-go-billy-v5-vulnerability branch from 9a916c8 to de5d7ee Compare May 18, 2026 10:39

renovate Bot force-pushed the renovate/main-go-github.com-go-git-go-billy-v5-vulnerability branch from de5d7ee to 25cf609 Compare May 28, 2026 08:34

github-actions Bot added size: XS and removed size: S labels May 28, 2026

Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY]

9f40903

renovate Bot force-pushed the renovate/main-go-github.com-go-git-go-billy-v5-vulnerability branch from 25cf609 to 9f40903 Compare May 28, 2026 17:44

renovate Bot changed the title ~~Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY] (main)~~ Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY] (main) - autoclosed Jun 12, 2026

renovate Bot closed this Jun 12, 2026

renovate Bot deleted the renovate/main-go-github.com-go-git-go-billy-v5-vulnerability branch June 12, 2026 21:12

fullsend-ai-retro Bot mentioned this pull request Jun 12, 2026

Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY] (release-v0.8) - autoclosed #3302

Closed

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY] (main) - autoclosed#3299

Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY] (main) - autoclosed#3299
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/main-go-github.com-go-git-go-billy-v5-vulnerability

renovate Bot commented May 13, 2026 •

edited

Loading

Uh oh!

renovate Bot commented May 13, 2026

Uh oh!

codecov Bot commented May 13, 2026 •

edited

Loading

Uh oh!

renovate Bot commented May 28, 2026

Uh oh!

fullsend-ai-retro Bot commented Jun 12, 2026 •

edited

Loading

Uh oh!

fullsend-ai-retro Bot commented Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

Details

Impact

Patches

Credits

Severity

References

go-billy has path traversal vulnerabilities

Details

Impact

Patches

Credits

Severity

References

Release Notes

v5.9.0

What's Changed

Configuration

Uh oh!

renovate Bot commented May 13, 2026

ℹ️ Artifact update notice

File name: acceptance/go.mod

Uh oh!

codecov Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

renovate Bot commented May 28, 2026

⚠️ Artifact update problem

File name: acceptance/go.sum

Uh oh!

fullsend-ai-retro Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Jun 12, 2026

Retro: PR #3299 — Renovate auto-closed dependency update

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 13, 2026 •

edited

Loading

`v5.9.0`

codecov Bot commented May 13, 2026 •

edited

Loading

fullsend-ai-retro Bot commented Jun 12, 2026 •

edited

Loading