Skip to content

fix(deps): vuln minor upgrades — 8 packages (minor: 6 · patch: 2) [test/go.mod] - #2886

Open
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/go/test/0-1788170587
Open

fix(deps): vuln minor upgrades — 8 packages (minor: 6 · patch: 2) [test/go.mod]#2886
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/go/test/0-1788170587

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Aug 31, 2026

Copy link
Copy Markdown

Summary: High-severity security update — 8 packages upgraded (MINOR changes included)

Manifests changed:

  • test/go.mod (go)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
github.com/go-git/go-git/v5 v5.16.5 v5.19.2 minor Transitive 6 HIGH, 14 MEDIUM, 6 LOW
github.com/go-git/go-billy/v5 v5.6.2 v5.9.1 minor Transitive 3 HIGH, 3 MEDIUM
google.golang.org/grpc v1.81.1 v1.83.2 minor Transitive 2 HIGH
golang.org/x/crypto v0.53.0 v0.55.0 minor Transitive 2 UNKNOWN
golang.org/x/mod v0.37.0 v0.40.0 minor Transitive 2 UNKNOWN
golang.org/x/text v0.38.0 v0.41.0 minor Transitive 1 UNKNOWN
filippo.io/edwards25519 v1.1.0 v1.1.1 patch Transitive 3 LOW
github.com/klauspost/compress v1.18.6 v1.18.7 patch Transitive 1 UNKNOWN

Security Details

🚨 Critical & High Severity (11 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
github.com/go-git/go-billy/v5 CVE-2026-44973 HIGH Billy: Path traversal vulnerabilities v5.6.2 - -
github.com/go-git/go-billy/v5 GO-2026-5597 HIGH Go-billy has path traversal vulnerabilities in github.com/go-git/go-billy v5.6.2 5.9.0 -
github.com/go-git/go-billy/v5 GHSA-qw64-3x98-g7q2 HIGH go-billy has path traversal vulnerabilities v5.6.2 5.9.0 -
github.com/go-git/go-git/v5 GO-2026-5074 high Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git v5.16.5 5.19.0 -
github.com/go-git/go-git/v5 CVE-2026-45022 high go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git v5.16.5 - -
github.com/go-git/go-git/v5 GHSA-389r-gv7p-r3rp HIGH go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git v5.16.5 5.19.0 -
github.com/go-git/go-git/v5 GO-2026-6213 high Worktree operations may follow symlinks in github.com/go-git/go-git v5.16.5 5.19.2 -
github.com/go-git/go-git/v5 CVE-2026-71556 high go-git: Worktree operations may follow symlinks v5.16.5 - -
github.com/go-git/go-git/v5 GHSA-hc8v-wwc9-vgxm HIGH go-git: Worktree operations may follow symlinks v5.16.5 5.19.2 -
google.golang.org/grpc GO-2026-6061 HIGH Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc v1.81.1 1.82.1 -
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities v1.81.1 1.82.1 -
ℹ️ Other Vulnerabilities (32)
Package CVE Severity Summary Unsafe Version Fixed In Case
github.com/go-git/go-billy/v5 CVE-2026-44740 medium go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion v5.6.2 - -
github.com/go-git/go-billy/v5 GO-2026-5490 medium Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy v5.6.2 5.9.0 -
github.com/go-git/go-git/v5 GO-2026-5105 medium Go-git: Credential leak via cross-host redirect in smart HTTP transport in github.com/go-git/go-git v5.16.5 5.18.0 -
github.com/go-git/go-git/v5 CVE-2026-41506 medium go-git Credential leak via cross-host redirect in smart HTTP transport v5.16.5 - -
github.com/go-git/go-billy/v5 GHSA-m3xc-h892-ggx6 MODERATE go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion v5.6.2 5.9.0 -
github.com/go-git/go-git/v5 CVE-2026-34165 MODERATE go-git: Maliciously crafted idx file can cause asymmetric memory consumption v5.16.5 - -
github.com/go-git/go-git/v5 GHSA-jhf3-xxhw-2wpp MODERATE go-git: Maliciously crafted idx file can cause asymmetric memory consumption v5.16.5 5.17.1 -
github.com/go-git/go-git/v5 GHSA-w5pp-99ch-qj29 MODERATE go-git: Malformed Git object data may cause panics or resource exhaustion v5.16.5 5.19.1 -
github.com/go-git/go-git/v5 GHSA-3xc5-wrhm-f963 MODERATE go-git: Credential leak via cross-host redirect in smart HTTP transport v5.16.5 5.18.0 -
github.com/go-git/go-git/v5 GHSA-qgq7-7hm3-q39j MODERATE go-git: Malicious reference names may modify files outside the reference storage v5.16.5 5.19.2 -
github.com/go-git/go-git/v5 CVE-2026-71557 MODERATE go-git: Malicious reference names may modify files outside the reference storage v5.16.5 - -
github.com/go-git/go-git/v5 GO-2026-4910 MODERATE Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git v5.16.5 5.17.1 -
github.com/go-git/go-git/v5 GHSA-crhj-59gh-8x96 MODERATE go-git: Crafted repositories may modify main and submodule .git directories v5.16.5 5.19.1 -
github.com/go-git/go-git/v5 CVE-2026-45571 MODERATE go-git: Crafted repositories may modify main and submodule .git directories v5.16.5 - -
github.com/go-git/go-git/v5 GO-2026-5336 MODERATE Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git v5.16.5 5.19.1 -
github.com/go-git/go-git/v5 GO-2026-6214 MODERATE Path traversal via crafted reference names in github.com/go-git/go-git v5.16.5 5.19.2 -
github.com/go-git/go-git/v5 GO-2026-5693 MODERATE Go-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git v5.16.5 5.19.1 -
filippo.io/edwards25519 GO-2026-4503 low Invalid result or undefined behavior in filippo.io/edwards25519 v1.1.0 1.1.1 -
filippo.io/edwards25519 GHSA-fw7p-63qq-7hpr LOW filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity v1.1.0 1.1.1 -
filippo.io/edwards25519 CVE-2026-26958 low filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity v1.1.0 - -
github.com/go-git/go-git/v5 CVE-2026-33762 LOW go-git: Missing validation decoding Index v4 files leads to panic v5.16.5 - -
github.com/go-git/go-git/v5 GO-2026-5496 LOW Improper single-quote escaping in go-git SSH transport in github.com/go-git/go-git v5.16.5 5.19.1 -
github.com/go-git/go-git/v5 GHSA-gm2x-2g9h-ccm8 LOW go-git missing validation decoding Index v4 files leads to panic v5.16.5 5.17.1 -
github.com/go-git/go-git/v5 GO-2026-4909 LOW Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git v5.16.5 5.17.1 -
github.com/go-git/go-git/v5 GHSA-m7cr-m3pv-hgrp LOW go-git: Improper single-quote escaping in go-git SSH transport v5.16.5 5.19.1 -
github.com/go-git/go-git/v5 CVE-2026-45570 LOW go-git: Improper single-quote escaping in go-git SSH transport v5.16.5 - -
github.com/klauspost/compress GO-2026-5841 unknown OOB read in github.com/klauspost/compress/s2 v1.18.6 1.18.7 -
golang.org/x/crypto GO-2026-5932 unknown The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues v0.53.0 - -
golang.org/x/crypto GO-2026-6303 unknown Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh v0.53.0 0.55.0 -
golang.org/x/mod GO-2026-6180 unknown Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb v0.37.0 0.40.0 -
golang.org/x/mod GO-2026-6179 unknown Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog v0.37.0 0.40.0 -
golang.org/x/text GO-2026-5970 unknown Infinite loop on invalid input in golang.org/x/text v0.38.0 0.39.0 -

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

@dd-octo-sts
dd-octo-sts Bot marked this pull request as ready for review August 31, 2026 20:52
@dd-octo-sts
dd-octo-sts Bot requested review from a team as code owners August 31, 2026 20:52
@dd-octo-sts
dd-octo-sts Bot requested review from tedkahwaji and removed request for a team August 31, 2026 20:52
@dd-prapprover-prod-77c48c

dd-prapprover-prod-77c48c Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

  • ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-08-31T20:53:08Z
  • ⬜ CI tests passed
  • ⬜ Approved
  • ⬜ Merge Started
  • ⬜ Merged

➡️ Current phase: waiting for CI tests to complete...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tedkahwaji tedkahwaji Awaiting requested review from tedkahwaji tedkahwaji is a code owner automatically assigned from DataDog/telemetry-onboarding

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

adms-dependency-update adms-go adms-high-severity adms-low-severity adms-medium-severity adms-minor-update adms-mode-all-vulns campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants