fix: upgrade go-git to patched releases for GHSA-hc8v-wwc9-vgxm

Closed
CH
2mo ago
+6-2

Summary

Updated the pinned go-git dependencies to the first patched releases that address the symlink-following worktree advisory. This keeps the change limited to the Go module manifest and lockfile.

Vulnerability Fixed

GHSA-hc8v-wwc9-vgxm (HIGH): go-git worktree operations may follow symlinks outside the intended worktree boundary.

Changes Made

  • Bumped github.com/go-git/go-git/v6 from v6.0.0-alpha.4 to v6.0.0-alpha.5 in go.mod, matching the first patched v6 release.
  • Refreshed the indirect github.com/go-git/go-git/v5 entry from v5.19.1 to v5.19.2 in go.mod, matching the patched v5 line referenced by the assessment.
  • Updated go.sum with checksums for the patched module versions.

Verification

Ran syft dir:. -o cyclonedx-json=sbom.json && grype sbom:sbom.json --only-fixed -o json against the patched repository SBOM. Outcome: resolved — grype no longer reports GHSA-hc8v-wwc9-vgxm for the scanned source tree.

Risk Assessment

View the risk assessment in Chainloop