Update module github.com/go-git/go-billy/v5 to v5.9.0 [SECURITY] (release-v0.8) - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/go-git/go-billy/v5	v5.8.0 → v5.9.0

---

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

CVE-2026-44740 / GHSA-m3xc-h892-ggx6

More information

Details

Impact

Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.

These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.

Credits

Thanks to @​faran66 for finding and reporting this issue privately to the go-git project. 🙇

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6
• https://github.com/go-git/go-billy/releases/tag/v5.9.0
• https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-44740
• https://github.com/advisories/GHSA-m3xc-h892-ggx6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

go-billy has path traversal vulnerabilities

CVE-2026-44973 / GHSA-qw64-3x98-g7q2

More information

Details

Impact

Multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories.

While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations.

The osfs.ChrootOS implementation is notably affected by this vulnerability and is now deprecated in v5, removed at v6. Users are recommended to move on to osfs.BoundOS instead: osfs.New(path, WithBoundOS()).

Users requiring stronger security boundary enforcement are recommended to upgrade to v6, where the osfs implementation are backed by the traversal-resistant primitive os.Root.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.

Credits

Thanks to @​faran66 and @​vnykmshr for finding and separately reporting this issue privately to the go-git project. 🙇

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/go-git/go-billy/security/advisories/GHSA-qw64-3x98-g7q2
• https://github.com/go-git/go-billy/releases/tag/v5.9.0
• https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-44973
• https://github.com/advisories/GHSA-qw64-3x98-g7q2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

go-git/go-billy (github.com/go-git/go-billy/v5)

v5.9.0

Compare Source

What's Changed

• Use path.Clean instead of filepath.Clean in iofs.Open by @​puerco in #​197
• Deprecate ChrootOS in favour of BoundOS by @​pjbgf in #​201
• General Improvements by @​pjbgf in #​203
• osfs: ChrootOS eval baseDir on creation by @​pjbgf in #​205
• Run go-git tests as part of integration tests by @​pjbgf in #​206

Full Changelog: go-git/go-billy@v5.8.0...v5.9.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: acceptance/go.sum

Command failed: go mod tidy
go: finding module for package knative.dev/pkg/metrics
go: finding module for package knative.dev/pkg/tracing/config
go: github.com/conforma/cli/acceptance/kubernetes/kind imports
	github.com/tektoncd/cli/pkg/formatted tested by
	github.com/tektoncd/cli/pkg/formatted.test imports
	github.com/tektoncd/cli/pkg/test imports
	github.com/tektoncd/triggers/test imports
	github.com/tektoncd/triggers/pkg/reconciler/eventlistener/resources imports
	knative.dev/eventing/pkg/reconciler/source imports
	knative.dev/pkg/metrics: module knative.dev/pkg@latest found (v0.0.0-20260526162440-71f6ad65d251), but does not contain package knative.dev/pkg/metrics
go: github.com/conforma/cli/acceptance/kubernetes/kind imports
	github.com/tektoncd/cli/pkg/formatted tested by
	github.com/tektoncd/cli/pkg/formatted.test imports
	github.com/tektoncd/cli/pkg/test imports
	github.com/tektoncd/triggers/test imports
	github.com/tektoncd/triggers/pkg/reconciler/eventlistener/resources imports
	knative.dev/eventing/pkg/reconciler/source imports
	knative.dev/pkg/tracing/config: module knative.dev/pkg@latest found (v0.0.0-20260526162440-71f6ad65d251), but does not contain package knative.dev/pkg/tracing/config

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 9:14 PM UTC · Completed 9:18 PM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-retro]

Retro: PR #3302 — Autoclosed Renovate dependency bump

This retro was triggered on PR #3302, an automated Renovate bot PR to bump go-billy v5.8.0 → v5.9.0 on the release-v0.8 branch. The PR was never reviewed or touched by any fullsend agent. It sat open for ~4 weeks with a go mod tidy failure, was rebased twice by Renovate, and was autoclosed on 2026-06-12 when a human (PR #3335) manually addressed the same dependency update on main.

No agent work occurred on this PR — no triage, no code agent, no review agent, no fix agent. The retro agent itself is the only fullsend agent that ran, making this a pure waste of compute.

This pattern is recurring: 6 autoclosed Renovate PRs in conforma/cli have triggered retro agents recently (#3302, #3301, #3299, #3253, #3252, #3250), all with zero agent involvement.

Existing issues already cover this

The root cause — retro dispatch not filtering out PRs with no agent interaction — is already tracked by multiple open issues in fullsend-ai/fullsend:

• #939 — Skip retro dispatch on PRs with no agent involvement (canonical)
• #1411 — Skip retro dispatch for unmerged PRs with no agent interaction
• #1630 — Skip retro dispatch for bot-authored PRs with review-only agent interaction
• #2176 — Skip retro dispatch for closed-without-merge PRs with immediate successor

Since these issues already comprehensively cover the improvement needed, no new proposals are warranted.