[Autofix] Bump go-git/v5 to v5.18.0 in cli/go-git to fix critical CVE#12
Open
vardior9 wants to merge 1 commit into
Open
[Autofix] Bump go-git/v5 to v5.18.0 in cli/go-git to fix critical CVE#12vardior9 wants to merge 1 commit into
vardior9 wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
✅ Fixed
OSS · View in Apiiro
Summary:
Upgraded the direct dependency github.com/go-git/go-git/v5 in cli/go-git/go.mod from v5.12.0 to v5.18.0, which clears the critical SCA finding, and regenerated go.sum with
go mod tidy.What Changed:
Edited
cli/go-git/go.modto changegithub.com/go-git/go-git/v5 v5.12.0togithub.com/go-git/go-git/v5 v5.18.0. Then rango mod tidyfromcli/go-git/, which regeneratedcli/go-git/go.sumand refreshed transitive indirect requires (e.g.golang.org/x/crypto,golang.org/x/net,Microsoft/go-winio,cloudflare/circl,pjbgf/sha1cd,cyphar/filepath-securejoin,ProtonMail/go-crypto,golang.org/x/sys,skeema/knownhosts,golang.org/x/text,go-git/go-billy,golang.org/x/tools,golang.org/x/mod) to versions compatible with v5.18.0. The Go toolchain directive was auto-updated fromgo 1.20togo 1.24.0withtoolchain go1.24.13because v5.18.0 requires a newer Go module syntax. Verified the package compiles withgo build ./....Why This Fix:
The overlay listed two remediation strategies (v5.18.0 and a pseudo-version v5.18.1-0.20260420130857-e5bbc088b774). I picked v5.18.0 because it is the smallest, properly tagged release that clears the vulnerability and is closest to the current 5.12.0 — the overlay explicitly instructs choosing the smallest non-breaking bump, and a tagged release is preferred over a pseudo-version for reproducibility. The dependency is declared directly in this manifest (Declaration Type: Direct), so a manifest version bump plus
go mod tidyis the canonical fix; no replace directive is required because the parent repo at/tmp/repois a separate module path that the published v5.18.0 satisfies.Files Changed:
cli/go-git/go.modcli/go-git/go.sumReviewer Notes:
go mod tidyraised the module'sgodirective from 1.20 to 1.24 and added atoolchain go1.24.13line — go-git v5.18.0 requires this; CI forcli/go-gitwill need a Go 1.24+ toolchain.go mod tidy.Potential Impact:
The bump from v5.12.0 to v5.18.0 is six minor releases inside the same v5 major line; go-git maintains backward compatibility within v5, so the public API used by the cli should still compile (verified locally with
go build ./...). The main externally visible change is thego 1.24requirement in cli/go-git/go.mod, which means any build environment pinned to Go <1.24 for this submodule will need its toolchain updated.About Apiiro Autofix
This PR was automatically generated by Apiiro Autofix. Review all changes carefully before merging and run your test suite to verify no regressions.