Repository navigation
chore(deps): update module github.com/go-git/go-billy/v5 to v5.9.0 [security] - #3482
Conversation
ℹ️ Artifact update noticeFile name: cli/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
|
/gcbrun |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request upgrades the Go version to 1.25.0 and updates various dependencies in cli/go.mod and cli/go.sum. The review feedback notes that upgrading the Go version requires coordinating with CI/CD configurations to prevent build failures. Additionally, there is an inconsistency where golang.org/x/exp was removed from go.mod but updated in go.sum, which should be resolved by running go mod tidy.
| go 1.24.6 | ||
|
|
||
| toolchain go1.24.13 | ||
| go 1.25.0 |
There was a problem hiding this comment.
Upgrading the Go version to 1.25.0 in go.mod requires all developer environments and CI/CD workflows to support Go 1.25.0 or newer. If the CI/CD workflows are still pinned to an older Go version (such as 1.24), the builds will fail. It is recommended to coordinate this Go version bump with updates to the project's CI/CD configurations.
| go.yaml.in/yaml/v2 v2.4.2 // indirect | ||
| go.yaml.in/yaml/v3 v3.0.4 // indirect | ||
| golang.org/x/crypto v0.47.0 // indirect | ||
| golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c // indirect |
There was a problem hiding this comment.
The dependency golang.org/x/exp was removed from go.mod but its version was updated in go.sum (to v0.0.0-20260410095643-746e56fc9e2f). This creates an inconsistency between go.mod and go.sum. Running go mod tidy will synchronize these files and either restore the dependency to go.mod if it is still required, or remove it from go.sum if it is obsolete.
b9f512a to
325aa5a
Compare
|
/gcbrun |
This PR contains the following updates:
v5.6.2→v5.9.0go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion
CVE-2026-44740 / GHSA-m3xc-h892-ggx6
More information
Details
Impact
Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.
These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.
Patches
Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to
v5are likely to be affected, users are recommended to upgrade to a supportedgo-billyversion.Credits
Thanks to @faran66 for finding and reporting this issue privately to the go-git project. 🙇
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
go-billy has path traversal vulnerabilities
CVE-2026-44973 / GHSA-qw64-3x98-g7q2
More information
Details
Impact
Multiple path traversal issues exist across different components of
go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using..) to escape intended base directories.While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on
go-billyfor some level of isolation may inadvertently expose access to unintended filesystem locations.The
osfs.ChrootOSimplementation is notably affected by this vulnerability and is now deprecated inv5, removed atv6. Users are recommended to move on toosfs.BoundOSinstead:osfs.New(path, WithBoundOS()).Users requiring stronger security boundary enforcement are recommended to upgrade to
v6, where theosfsimplementation are backed by the traversal-resistant primitive os.Root.Patches
Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to
v5are likely to be affected, users are recommended to upgrade to a supportedgo-billyversion.Credits
Thanks to @faran66 and @vnykmshr for finding and separately reporting this issue privately to the go-git project. 🙇
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
go-git/go-billy (github.com/go-git/go-billy/v5)
v5.9.0Compare Source
What's Changed
Full Changelog: go-git/go-billy@v5.8.0...v5.9.0
v5.8.0Compare Source
What's Changed
Full Changelog: go-git/go-billy@v5.7.0...v5.8.0
v5.7.0Compare Source
What's Changed
Full Changelog: go-git/go-billy@v5.6.2...v5.7.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.