chore(deps) Bump github.com/go-git/go-billy/v5 to v5.9.0 to avoid CVE…

go.mod

@@ -52,7 +52,7 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chai2010/gettext-go v1.0.3 // indirect
 	github.com/cloudflare/circl v1.6.1 // indirect
-	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
+	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/davidmz/go-pageant v1.0.2 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
@@ -68,7 +68,7 @@ require (
 	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-fed/httpsig v1.1.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.6.2 // indirect
+	github.com/go-git/go-billy/v5 v5.9.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-openapi/jsonpointer v0.21.1 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
@@ -180,3 +180,11 @@ require (
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect
 )
+
+// go-git/go-billy v5.9.0 (bumped to fix CVE-2026-44740) only uses
+// filepath-securejoin's stable SecureJoin API, but its go.mod hard-pins
+// filepath-securejoin v0.6.1, which removed the MkdirAll wrapper that
+// argo-cd/v3 v3.1.10's vendored util/io/files package still relies on.
+// Pin back to the last version compatible with both to avoid a much larger,
+// unrelated upgrade of argo-cd/v3 (and the k8s.io v1.34 cascade that follows).
+replace github.com/cyphar/filepath-securejoin => github.com/cyphar/filepath-securejoin v0.4.1

go.sum

@@ -185,8 +185,8 @@ github.com/go-fed/httpsig v1.1.0 h1:9M+hb0jkEICD8/cAiNqEB66R87tTINszBRTjwjQzWcI=
 github.com/go-fed/httpsig v1.1.0/go.mod h1:RCMrTZvN1bJYtofsG4rd5NaO5obxQ5xBkdiS7xsT7bM=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
-github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
+github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
+github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
 github.com/go-git/go-git/v5 v5.16.2 h1:fT6ZIOjE5iEnkzKyxTHK1W4HGAsPhqEqiSAssSO77hM=

pkg/cmd/tls_test.go

@@ -13,33 +13,35 @@ func TestTLSVersionName(t *testing.T) {
 	tests := []struct {
 		name     string
 		version  uint16
-		expected string
+		expected []string // Accept either variant due to map iteration randomness
 	}{
 		{
 			name:     "TLS1.1",
 			version:  tls.VersionTLS11,
-			expected: "1.1",
+			expected: []string{"1.1", "tls1.1"},
 		},
 		{
 			name:     "TLS1.2",
 			version:  tls.VersionTLS12,
-			expected: "1.2",
+			expected: []string{"1.2", "tls1.2"},
 		},
 		{
 			name:     "TLS1.3",
 			version:  tls.VersionTLS13,
-			expected: "1.3",
+			expected: []string{"1.3", "tls1.3"},
 		},
 		{
 			name:     "unknown",
 			version:  999,
-			expected: "unknown (999)",
+			expected: []string{"unknown (999)"},
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.expected, TLSVersionName(tt.version))
+			result := TLSVersionName(tt.version)
+			assert.Contains(t, tt.expected, result,
+				"TLSVersionName returned %q, expected one of %v", result, tt.expected)
 		})
 	}
 }