From 9597704597a7b6938499f9e4144aafa9d98789c6 Mon Sep 17 00:00:00 2001 From: JMR-dev Date: Tue, 18 Aug 2026 22:00:40 -0500 Subject: [PATCH] Fix Dependabot alerts: upgrade go-git, pin a patched Go toolchain Two open Dependabot alerts, both against github.com/go-git/go-git/v6, a transitive dependency of github.com/pulumi/pulumi/sdk/v3 by way of common/workspace: CVE-2026-71556 (high, 7.1) worktree operations may follow symlinks, allowing writes outside the worktree CVE-2026-71557 (medium, 6.3) malicious reference names may resolve outside the reference storage Both are fixed in v6.0.0-alpha.5. The Pulumi SDK is already at its latest release (v3.258.0) and still requires alpha.4, so bumping the direct dependency does not help; an explicit minimum-version entry is the remedy. go-billy comes along as a consequence. Also pins toolchain go1.26.6. govulncheck reported six reachable standard-library vulnerabilities from building on go1.26.4 -- ASN.1, TLS, net/url, net/http and os -- all fixed in 1.26.5/1.26.6. Dependabot does not track the Go standard library, so nothing alerted on these, but they were reachable from pulumi.Run and dns.LookupManagedZone. Pinning the floor in go.mod means every build gets a patched stdlib rather than whatever the build host happens to have. govulncheck now reports no vulnerabilities. Not addressed, deliberately: GO-2026-5932 flags golang.org/x/crypto/openpgp as unmaintained and unsafe by design. It has no fixed version, and our code does not call it. Upgrading x/crypto to v0.55.0 was tried and does not clear it, so that change was dropped to keep this diff minimal. Co-Authored-By: Claude Opus 5 (1M context) --- infra/go.mod | 6 ++++-- infra/go.sum | 8 ++++---- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/infra/go.mod b/infra/go.mod index 40deb37..1fb4473 100644 --- a/infra/go.mod +++ b/infra/go.mod @@ -2,6 +2,8 @@ module gitea-infra go 1.25.11 +toolchain go1.26.6 + require ( github.com/pulumi/pulumi-gcp/sdk/v9 v9.34.1 github.com/pulumi/pulumi/sdk/v3 v3.258.0 @@ -36,8 +38,8 @@ require ( github.com/emirpasic/gods v1.18.1 // indirect github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect github.com/go-git/gcfg/v2 v2.0.2 // indirect - github.com/go-git/go-billy/v6 v6.0.0-alpha.1 // indirect - github.com/go-git/go-git/v6 v6.0.0-alpha.4 // indirect + github.com/go-git/go-billy/v6 v6.0.0-alpha.2 // indirect + github.com/go-git/go-git/v6 v6.0.0-alpha.5 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/godbus/dbus/v5 v5.2.2 // indirect diff --git a/infra/go.sum b/infra/go.sum index 474541c..61f1ee6 100644 --- a/infra/go.sum +++ b/infra/go.sum @@ -69,12 +69,12 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= github.com/go-git/gcfg/v2 v2.0.2 h1:MY5SIIfTGGEMhdA7d7JePuVVxtKL7Hp+ApGDJAJ7dpo= github.com/go-git/gcfg/v2 v2.0.2/go.mod h1:/lv2NsxvhepuMrldsFilrgct6pxzpGdSRC13ydTLSLs= -github.com/go-git/go-billy/v6 v6.0.0-alpha.1 h1:xVjAR4oUvrKy7/Xuw/lLlV3gkxR3KO2H8W+MamuVVsQ= -github.com/go-git/go-billy/v6 v6.0.0-alpha.1/go.mod h1:eaCUpHbedW7//EwcYmUDfJe2N6sJC9O12AT0OTqJR1E= +github.com/go-git/go-billy/v6 v6.0.0-alpha.2 h1:1Sv5WemXL8CxKrAx1gioJ+uHNb2bZJhiQLfwSZ4Et8c= +github.com/go-git/go-billy/v6 v6.0.0-alpha.2/go.mod h1:r/bsv9i/iDyyEU8/Z6mjC+YraOVwie1ddfUqBCElKXQ= github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1 h1:gmqi2jvsreu0s8JMLylYDFq4sbjHwwlhktMw0DUg3mA= github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1/go.mod h1:ECf1MqJlBdYpKggBrOXjo/0EnvRZx6D++I86UYjPgAQ= -github.com/go-git/go-git/v6 v6.0.0-alpha.4 h1:aDTc2UGanmaE7FkGLSlBEB9nohMnQ+RKXcfq/D+esDQ= -github.com/go-git/go-git/v6 v6.0.0-alpha.4/go.mod h1:4ODa/G7hPWrh4Y+7lmt59Ij3zW38IEfvRoAZxLYYBhc= +github.com/go-git/go-git/v6 v6.0.0-alpha.5 h1:sE+OlkHgYWNMVmN1s9sR7uyFgsWLtxcNWse/vBYKxRE= +github.com/go-git/go-git/v6 v6.0.0-alpha.5/go.mod h1:3IjhiZnM+uBmUrOGSeqrJpsmi4Vd0H2NZO/uK2a7d0s= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=