[Autofix] Bump go-git/v5 to v5.19.0 in cli/go-git to clear critical CVEs

[vardior9]

✅ Fixed

• OSS · View in Apiiro

  • Summary:
    Bumped the direct dependency github.com/go-git/go-git/v5 in cli/go-git/go.mod from v5.12.0 to v5.19.0, and regenerated cli/go-git/go.sum via go mod tidy.

  • What Changed:
    In cli/go-git/go.mod, the required version of github.com/go-git/go-git/v5 was raised from v5.12.0 to v5.19.0, the latest released version. go mod tidy was then run inside cli/go-git/, which regenerated cli/go-git/go.sum, refreshed the indirect dependency block to match v5.19.0's transitive graph (winio, ProtonMail/go-crypto, cloudflare/circl, filepath-securejoin, go-billy, golang/groupcache, pjbgf/sha1cd, skeema/knownhosts, golang.org/x/crypto, golang.org/x/net, golang.org/x/sys, plus new transitive klauspost/cpuid/v2), and bumped the go directive to the version required by v5.19.0's module graph. go build ./... and go vet ./... both pass cleanly afterward.

  • Why This Fix:
    The overlay flagged a direct-dependency vulnerability and listed a pseudo-version fix (v5.18.1-0.20260420130857-e5bbc088b774) that is not actually published in the Go module proxy. Querying go list -m -versions github.com/go-git/go-git/v5 showed v5.19.0 as the highest available released tag; it postdates the fix commit referenced by the pseudo-version, so picking the highest available stable release is the safest no-regression strategy. A smaller bump (e.g. v5.13.x) would leave more historical CVEs unfixed; v5.19.0 is the smallest stable bump that clears them all. No replace override was needed since the dependency is declared directly.

  • Files Changed:

    • cli/go-git/go.mod
    • cli/go-git/go.sum

  • Reviewer Notes:

    • go mod tidy raised the go directive in cli/go-git/go.mod from 1.20 to 1.25.0 because v5.19.0's module graph now requires it; confirm your build/CI toolchain offers Go 1.25 (the toolchain auto-downloaded it during tidy, but a hermetic CI may need a Go version bump).
    • The indirect block changed substantially (winio, ProtonMail/go-crypto, circl, filepath-securejoin, go-billy, groupcache, sha1cd, knownhosts, golang.org/x/{crypto,net,sys} all bumped; golang.org/x/{mod,tools} dropped; new klauspost/cpuid/v2 added) — this is the normal v5.19.0 transitive graph, bu…

  • Potential Impact:
    This is a single direct dependency major-line bump from v5.12.0 to v5.19.0 in the CLI sub-module only; the parent github.com/go-git/go-git/v5 module is untouched. v5.x is the same major line, so APIs used by cli/go-git (which compiles cleanly against v5.19.0) should be source-compatible. Main blast radius is the implicit Go toolchain bump to 1.25 for the CLI build.

---

About Apiiro Autofix

This PR was automatically generated by Apiiro Autofix. Review all changes carefully before merging and run your test suite to verify no regressions.