fix: upgrade go-git to patched releases for GHSA-hc8v-wwc9-vgxm

Closed
CH
2mo ago
+9-3

Summary

Upgraded the direct and indirect go-git dependencies to patched releases that address the symlink-following worktree flaw covered by GHSA-hc8v-wwc9-vgxm. The update also refreshes the matching go-billy/v6 indirect dependency required by the patched v6 line.

Vulnerability Fixed

GHSA-hc8v-wwc9-vgxm (HIGH): go-git worktree operations may follow symlinks and read or write outside the intended worktree boundary.

Changes Made

  • Bumped github.com/go-git/go-git/v6 in go.mod from v6.0.0-alpha.4 to v6.0.0-alpha.5, the lowest available patched v6 release.
  • Refreshed the indirect github.com/go-git/go-git/v5 dependency in go.mod from v5.19.1 to v5.19.2, the lowest available patched v5 release.
  • Updated go.sum to record the patched go-git artifacts and the corresponding github.com/go-git/go-billy/v6 v6.0.0-alpha.2 transitive dependency selected by go get.

Verification

Ran syft dir:. -o cyclonedx-json=sbom.json followed by env GRYPE_DB_AUTO_UPDATE=false grype sbom:sbom.json --only-fixed against the patched repository checkout. Outcome: resolved — grype no longer reports GHSA-hc8v-wwc9-vgxm for the generated SBOM.

Risk Assessment

View the risk assessment in Chainloop