[Autofix] Bump go-git/v5 to v5.17.2 in cli/go-git to fix critical CVEs

[vardior9]

✅ Fixed

• OSS · View in Apiiro

  • Summary:
    Bumped the direct dependency github.com/go-git/go-git/v5 in cli/go-git/go.mod from v5.12.0 to v5.17.2 (the nearest fix version per the overlay) and regenerated cli/go-git/go.sum via go mod tidy.

  • What Changed:
    Edited cli/go-git/go.mod to upgrade github.com/go-git/go-git/v5 from v5.12.0 to v5.17.2. Ran go mod tidy from the cli/go-git directory, which refreshed cli/go-git/go.sum and propagated the resulting transitive bumps (e.g. golang.org/x/crypto 0.31.0→0.45.0, golang.org/x/net 0.23.0→0.47.0, ProtonMail/go-crypto 1.0.0→1.1.6, cyphar/filepath-securejoin 0.2.4→0.4.1, cloudflare/circl 1.3.7→1.6.3). The Go toolchain directive was also updated to go 1.24.0 / toolchain go1.24.13 because the new go-git release requires a newer minimum Go version. Verified with go build ./... from the cli/go-git module — the build completes with no errors.

  • Why This Fix:
    The overlay's only listed remediation strategy is the direct upgrade to v5.17.2 (the nearest fix version), so I applied exactly that — the smallest patch-level bump within the v5 line that clears the critical CVE chain. Alternatives (replace directives or pinning to an even newer release) were not necessary because v5.17.2 already publishes a clean dependency tree and go mod tidy resolved everything cleanly. This repo is the upstream go-git project itself, but the CLI lives in its own module that consumes the published v5 module, so a manifest-level bump is the correct lever.

  • Files Changed:

    • cli/go-git/go.mod
    • cli/go-git/go.sum

  • Reviewer Notes:

    • go mod tidy raised the module's minimum Go directive from go 1.20 to go 1.24.0 (with toolchain go1.24.13) because go-git v5.17.x requires a newer Go. Confirm any CI that builds cli/go-git uses Go 1.24+.
    • Several transitive deps were also bumped as a side effect of go mod tidy (golang.org/x/crypto, x/net, ProtonMail/go-crypto, cloudflare/circl, etc.); these are the versions go-git v5.17.2 pins.

  • Potential Impact:
    Low-to-medium blast radius: only the standalone cli/go-git module is affected — the top-level github.com/go-git/go-git/v5 module is untouched. The CLI's source files (main.go, receive_pack.go, upload_pack.go, update_server_info.go, version.go) compile cleanly against v5.17.2 with no API changes required. The bumped Go toolchain requirement (1.20 → 1.24) is the most likely friction point for downstream builders of this CLI.

---

About Apiiro Autofix

This PR was automatically generated by Apiiro Autofix. Review all changes carefully before merging and run your test suite to verify no regressions.