```release-note:security
audit/file: Restrict `mode` parameter. Refuse setting an [irregular](https://pkg.go.dev/io/fs#FileMode.IsRegular) file mode and silently strip any executable bits. HCSEC-2025-14.
```
