Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY] by renovate[bot] · Pull Request #77 · vshn/waf-tool

renovate · 2026-05-13T15:33:16Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-git/go-billy/v5	`v5.0.0` → `v5.9.0`

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

CVE-2026-44740 / GHSA-m3xc-h892-ggx6

More information

Details

Impact

Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.

These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.

Credits

Thanks to @faran66 for finding and reporting this issue privately to the go-git project. 🙇

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

go-billy has path traversal vulnerabilities

CVE-2026-44973 / GHSA-qw64-3x98-g7q2

More information

Details

Impact

Multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories.

While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations.

The osfs.ChrootOS implementation is notably affected by this vulnerability and is now deprecated in v5, removed at v6. Users are recommended to move on to osfs.BoundOS instead: osfs.New(path, WithBoundOS()).

Users requiring stronger security boundary enforcement are recommended to upgrade to v6, where the osfs implementation are backed by the traversal-resistant primitive os.Root.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.

Credits

Thanks to @faran66 and @vnykmshr for finding and separately reporting this issue privately to the go-git project. 🙇

Severity

CVSS Score: 8.1 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

go-git/go-billy (github.com/go-git/go-billy/v5)

`v5.9.0`

Compare Source

What's Changed

Use path.Clean instead of filepath.Clean in iofs.Open by @puerco in #197
Deprecate ChrootOS in favour of BoundOS by @pjbgf in #201
General Improvements by @pjbgf in #203
osfs: ChrootOS eval baseDir on creation by @pjbgf in #205
Run go-git tests as part of integration tests by @pjbgf in #206

Full Changelog: go-git/go-billy@v5.8.0...v5.9.0

`v5.8.0`

Compare Source

What's Changed

build: Update module golang.org/x/net to v0.45.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #183
v5: Ensure Chmod behaviour across BoundOS and ChrootOS by @pjbgf in #187

Full Changelog: go-git/go-billy@v5.7.0...v5.8.0

`v5.7.0`

Compare Source

What's Changed

Add support for Chmod on billy.Filesystem by @bitfehler in #171
build: Update module golang.org/x/net to v0.38.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #177

Full Changelog: go-git/go-billy@v5.6.2...v5.7.0

`v5.6.2`

Compare Source

What's Changed

Enable the iofs adapter to also return other interfaces from io/fs by @JAORMX in #102
build: Bump dependencies by @pjbgf in #103

New Contributors

@JAORMX made their first contribution in #102

Full Changelog: go-git/go-billy@v5.6.1...v5.6.2

`v5.6.1`

Compare Source

What's Changed

build: bump github/codeql-action from 3.26.11 to 3.27.0 by @dependabot in #88
build: bump github/codeql-action from 3.27.0 to 3.27.1 by @dependabot in #89
build: bump github/codeql-action from 3.27.1 to 3.27.4 by @dependabot in #90
build: bump github/codeql-action from 3.27.4 to 3.27.5 by @dependabot in #91
Bump dependencies and build housekeeping by @pjbgf in #95

Full Changelog: go-git/go-billy@v5.6.0...v5.6.1

`v5.6.0`

Compare Source

What's Changed

Adding support for wasm/wasip1 by @tryggvil in #36
Memory.ReadDir() should return an error when path isn't found. by @weberc2-tempus in #38
Adding support for WriteAt by @sfc-gh-thardie in #39
Update memfs.New() to create root directory by @onee-only in #45
Fix symlink by @pjbgf in #46
Close via defer by @spennymac in #47
General improvements to memfs by @pjbgf in #50
boundos:insideBaseDirEval: return true if baseDir is "/" by @rminnich in #48
Add wrapper for io/fs by @evankanderson in #81

New Contributors

@dependabot made their first contribution in #35
@tryggvil made their first contribution in #36
@weberc2-tempus made their first contribution in #38
@sfc-gh-thardie made their first contribution in #39
@onee-only made their first contribution in #45
@spennymac made their first contribution in #47
@rminnich made their first contribution in #48
@evankanderson made their first contribution in #81

Full Changelog: go-git/go-billy@v5.5.0...v5.6.0

`v5.5.0`

Compare Source

What's Changed

*: Bump dependencies and go.mod to Go 1.18. Add codeQL workflow. by @pjbgf in #30
osfs: Add new BoundOS type by @pjbgf in #31
Re-introduce osfs.Default by @pjbgf in #33
Revert back to upstream github.com/cyphar/filepath-securejoin by @pjbgf in #34

Full Changelog: go-git/go-billy@v5.4.1...v5.5.0

`v5.4.1`

Compare Source

What's Changed

memfs: fix trunc-append by @nikandfor in #29

Full Changelog: go-git/go-billy@v5.4.0...v5.4.1

`v5.4.0`

Compare Source

What's Changed

utils: add Walk function to walk over a filesystem by @tjamet in #17
*: fix data race when running go-git tests by @pjbgf in #28

Full Changelog: go-git/go-billy@v5.3.1...v5.4.0

`v5.3.1`

Compare Source

util: fix TempDir and TempFile on non-root filesystems (3bf3fe5)

`v5.3.0`

Compare Source

util: add ReadFile function
osfs: add Default to avoid repetitive code

`v5.2.0`

Compare Source

Changelog

osfs: js/wasm implementation based on menfs

`v5.1.0`

Compare Source

Change Log

memfs: ReadDir sorted by filename #13 (MetalBlueberry)
memfs: Add support for O_EXC to memfs #10 (jawr)

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-05-13T15:33:17Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

1 additional dependency was updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.13` -> `1.25.0`
`github.com/stretchr/testify`	`v1.6.1` -> `v1.11.1`

renovate Bot changed the title ~~Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY]~~ Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY] - autoclosed May 23, 2026

renovate Bot closed this May 23, 2026

renovate Bot deleted the renovate/go-github.com-go-git-go-billy-v5-vulnerability branch May 23, 2026 14:10

Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY]

14dcdf2

renovate Bot changed the title ~~Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY] - autoclosed~~ Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY] May 23, 2026

renovate Bot reopened this May 23, 2026

renovate Bot force-pushed the renovate/go-github.com-go-git-go-billy-v5-vulnerability branch 2 times, most recently from 968e87a to 14dcdf2 Compare May 23, 2026 18:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY]#77

Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY]#77
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/go-github.com-go-git-go-billy-v5-vulnerability

renovate Bot commented May 13, 2026 •

edited

Loading

Uh oh!

renovate Bot commented May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

Details

Impact

Patches

Credits

Severity

References

go-billy has path traversal vulnerabilities

Details

Impact

Patches

Credits

Severity

References

Release Notes

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

Changelog

Change Log

Configuration

Uh oh!

renovate Bot commented May 13, 2026

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 13, 2026 •

edited

Loading