chore(deps): update module github.com/hashicorp/go-getter to v1.8.6 [security] by renovate[bot] · Pull Request #38 · pulumiverse/pulumi-redpanda

renovate · 2025-08-18T18:48:42Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/hashicorp/go-getter	`v1.7.5` → `v1.8.6`

HashiCorp go-getter Vulnerable to Symlink Attacks

CVE-2025-8959 / GHSA-wjrx-6529-hcj3

More information

Details

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

HashiCorp's go-getter library may allow arbitrary file reads

CVE-2026-4660 / GHSA-92mm-2pjq-r785

More information

Details

HashiCorp's go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

hashicorp/go-getter (github.com/hashicorp/go-getter)

`v1.8.6`

Compare Source

`v1.8.5`

Compare Source

What's Changed

[chore] : Bump the go group with 2 updates by @dependabot[bot] in #576
use %w to wrap error by @Ericwww in #475
fix: #538 http file download skipped if headResp.ContentLength is 0 by @martijnvdp in #539
chore: fix error message capitalization in checksum function by @ssagarverma in #578
[chore] : Bump the go group with 8 updates by @dependabot[bot] in #577
Fix git url with ambiguous ref by @nimasamii in #382
fix: resolve compilation errors in get_git_test.go by @CreatorHead in #579
[chore] : Bump the actions group with 2 updates by @dependabot[bot] in #582
[chore] : Bump the go group with 3 updates by @dependabot[bot] in #583
test that arbitrary files cannot be checksummed by @schmichael in #250
[chore] : Bump google.golang.org/api from 0.260.0 to 0.262.0 in the go group by @dependabot[bot] in #585
[chore] : Bump actions/checkout from 6.0.1 to 6.0.2 in the actions group by @dependabot[bot] in #586
[chore] : Bump the go group with 3 updates by @dependabot[bot] in #588
[chore] : Bump actions/cache from 5.0.2 to 5.0.3 in the actions group by @dependabot[bot] in #589
[chore] : Bump aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0 in the actions group by @dependabot[bot] in #592
[chore] : Bump google.golang.org/api from 0.264.0 to 0.265.0 in the go group by @dependabot[bot] in #591
[chore] : Bump the go group with 5 updates by @dependabot[bot] in #593
IND-6310 - CRT Onboarding by @nasareeny in #584
Fix crt build path by @ssagarverma in #594
[chore] : Bump the go group with 3 updates by @dependabot[bot] in #596
fix: remove checkout action from set-product-version job by @ssagarverma in #598
[chore] : Bump the actions group with 4 updates by @dependabot[bot] in #595
fix(deps): upgrade go.opentelemetry.io/otel/sdk to v1.40.0 (GO-2026-4394) by @ssagarverma in #599
Prepare go-getter for v1.8.5 release by @nasareeny in #597
[chore] : Bump the actions group with 2 updates by @dependabot[bot] in #600
sec: bump go and xrepos + redact aws tokens in url by @dduzgun-security in #604

NOTES:

Binary Distribution Update: To streamline our release process and align with other HashiCorp tools, all release binaries will now be published exclusively to the official HashiCorp release site. We will no longer attach release assets to GitHub Releases.

New Contributors

@Ericwww made their first contribution in #475
@martijnvdp made their first contribution in #539
@nimasamii made their first contribution in #382
@nasareeny made their first contribution in #584

Full Changelog: hashicorp/go-getter@v1.8.4...v1.8.5

`v1.8.4`

Compare Source

What's Changed

[IND-4227][COMPLIANCE] chore: Fix lint issues-build tags by @ssagarverma in #568
[IND-4227] [COMPLIANCE] Update Copyright Headers by @oss-core-libraries-dashboard[bot] in #566
[COMPLIANCE] Update Copyright Headers by @oss-core-libraries-dashboard[bot] in #571
[chore] : Bump the actions group across 1 directory with 3 updates by @dependabot[bot] in #567
fix: allow downloading S3 files from MinIO over http by @vsarunas in #570
[chore] : Bump the actions group across 1 directory with 6 updates by @dependabot[bot] in #574
[chore] : Bump the go group across 1 directory with 12 updates by @dependabot[bot] in #575

New Contributors

@ssagarverma made their first contribution in #568
@oss-core-libraries-dashboard[bot] made their first contribution in #566

Full Changelog: hashicorp/go-getter@v1.8.3...v1.8.4

`v1.8.3`

Compare Source

What's Changed

[chore] : Bump actions/cache from 4.2.4 to 4.3.0 in the actions group by @dependabot[bot] in #562
[chore] : Bump aws-actions/configure-aws-credentials from 5.0.0 to 5.1.0 in the actions group by @dependabot[bot] in #563
Remove failed decompressed files by @allisonlarson in #564

New Contributors

@allisonlarson made their first contribution in #564

Full Changelog: hashicorp/go-getter@v1.8.2...v1.8.3

`v1.8.2`

Compare Source

What's Changed

Ensure temporary directory symlinks do not cause errors by @cam-stitt in #560

New Contributors

@cam-stitt made their first contribution in #560

Full Changelog: hashicorp/go-getter@v1.8.1...v1.8.2

`v1.8.1`

Compare Source

What's Changed

chore(deps): bump ulikunitz/xz to v0.5.15 by @thevilledev in #550
Improve CI/CD, fix tests by @YakDriver in #554
[fix] Windows junction handling by @YakDriver in #557

New Contributors

@thevilledev made their first contribution in #550

Full Changelog: hashicorp/go-getter@v1.8.0...v1.8.1

`v1.8.0`

What's Changed

[chore] : Bump the actions group with 2 updates by @dependabot[bot] in #543
[chore] : Bump google-github-actions/auth from 2.1.12 to 3.0.0 in the actions group by @dependabot[bot] in #546
go: bump ulikunitz/xz to v.0.5.14 to resolve GHSA-jc7w-c686-c4v9 by @ryancragun in #547
Upgrade to aws-sdk-go-v2, v1 is unsupported by @YakDriver in #548
Modernize codebase: Fix linting issues, update CI/CD workflow, and improve test categorization by @YakDriver in #549

New Contributors

@ryancragun made their first contribution in #547
@YakDriver made their first contribution in #548

Full Changelog: hashicorp/go-getter@v1.7.9...v1.8.0

`v1.7.9`

Compare Source

What's Changed

Speed up XZ decompression by 5x with bufio wrapper by @vsarunas in #520
Fix CI Workflow by @mohanmanikanta2299 in #522
test: Remove use of "mitchellh/go-testing-interface" for stdlib by @jrasell in #523
fix: url redact of multiple sshkey by @dduzgun-security in #528
Publish arm binaries by @sethvargo in #525
fix errcheck lint errors and run it as part of pr checks by @abhijeetviswa in #530
fix additional lint errors and increase linter scope by @abhijeetviswa in #531
IND-3728 enabling dependabot by @KaushikiAnand in #529
fix: go-getter subdir paths by @dduzgun-security in #540

New Contributors

@vsarunas made their first contribution in #520
@jrasell made their first contribution in #523
@sethvargo made their first contribution in #525
@abhijeetviswa made their first contribution in #530
@KaushikiAnand made their first contribution in #529

Full Changelog: hashicorp/go-getter@v1.7.8...v1.7.9

`v1.7.8`

Compare Source

What's Changed

sec: fix s3 and gcs host checks by @dduzgun-security in #512

Full Changelog: hashicorp/go-getter@v1.7.7...v1.7.8

`v1.7.7`

Compare Source

What's Changed

Clean up git repo on disk when the ref checkout fails by @james-warren0 in #504
[COMPLIANCE] Add Copyright and License Headers by @hashicorp-copywrite in #409
Add CODEOWNERS file in .github/CODEOWNERS by @mukeshjc in #505
IND-1804 Bump up dependencies to remediate vulnerabiities by @mohanmanikanta2299 in #513
Updating arguments in github release CI by @mohanmanikanta2299 in #514
Updating .goreleaser.yml file with valid version by @mohanmanikanta2299 in #515

New Contributors

@james-warren0 made their first contribution in #504
@mukeshjc made their first contribution in #505
@mohanmanikanta2299 made their first contribution in #513

Full Changelog: hashicorp/go-getter@v1.7.6...v1.7.7

`v1.7.6`

Compare Source

What's Changed

fix: Avoid panic when s3 URL is invalid by @liamg in #501

New Contributors

@liamg made their first contribution in #501

Full Changelog: hashicorp/go-getter@v1.7.5...v1.7.6

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

…security]

renovate · 2026-04-10T16:34:24Z

ℹ️ Artifact update notice

File name: provider/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

49 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.23.5` -> `1.25.8`
`cel.dev/expr`	`v0.20.0` -> `v0.25.1`
`cloud.google.com/go`	`v0.118.3` -> `v0.123.0`
`cloud.google.com/go/auth`	`v0.14.1` -> `v0.18.2`
`cloud.google.com/go/auth/oauth2adapt`	`v0.2.7` -> `v0.2.8`
`cloud.google.com/go/compute/metadata`	`v0.6.0` -> `v0.9.0`
`cloud.google.com/go/iam`	`v1.4.0` -> `v1.5.3`
`cloud.google.com/go/monitoring`	`v1.24.0` -> `v1.24.3`
`cloud.google.com/go/storage`	`v1.50.0` -> `v1.61.3`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.26.0` -> `v1.30.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric`	`v0.49.0` -> `v0.55.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping`	`v0.49.0` -> `v0.55.0`
`github.com/cncf/xds/go`	`v0.0.0-20250121191232-2f005788dc42` -> `v0.0.0-20251210132809-ee656c7534f5`
`github.com/envoyproxy/go-control-plane/envoy`	`v1.32.4` -> `v1.36.0`
`github.com/envoyproxy/protoc-gen-validate`	`v1.2.1` -> `v1.3.0`
`github.com/go-jose/go-jose/v4`	`v4.0.5` -> `v4.1.3`
`github.com/go-logr/logr`	`v1.4.2` -> `v1.4.3`
`github.com/golang/glog`	`v1.2.4` -> `v1.2.5`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.4` -> `v0.3.14`
`github.com/googleapis/gax-go/v2`	`v2.14.1` -> `v2.17.0`
`github.com/hashicorp/go-version`	`v1.7.0` -> `v1.8.0`
`github.com/hashicorp/terraform-plugin-log`	`v0.9.0` -> `v0.10.0`
`github.com/klauspost/compress`	`v1.17.11` -> `v1.18.5`
`github.com/spiffe/go-spiffe/v2`	`v2.5.0` -> `v2.6.0`
`github.com/ulikunitz/xz`	`v0.5.10` -> `v0.5.15`
`go.opentelemetry.io/auto/sdk`	`v1.1.0` -> `v1.2.1`
`go.opentelemetry.io/contrib/detectors/gcp`	`v1.34.0` -> `v1.39.0`
`go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc`	`v0.58.0` -> `v0.63.0`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.59.0` -> `v0.61.0`
`go.opentelemetry.io/otel`	`v1.36.0` -> `v1.42.0`
`go.opentelemetry.io/otel/metric`	`v1.36.0` -> `v1.42.0`
`go.opentelemetry.io/otel/sdk`	`v1.36.0` -> `v1.42.0`
`go.opentelemetry.io/otel/sdk/metric`	`v1.34.0` -> `v1.42.0`
`go.opentelemetry.io/otel/trace`	`v1.36.0` -> `v1.42.0`
`golang.org/x/crypto`	`v0.39.0` -> `v0.49.0`
`golang.org/x/mod`	`v0.25.0` -> `v0.33.0`
`golang.org/x/net`	`v0.40.0` -> `v0.52.0`
`golang.org/x/oauth2`	`v0.30.0` -> `v0.36.0`
`golang.org/x/sync`	`v0.15.0` -> `v0.20.0`
`golang.org/x/sys`	`v0.33.0` -> `v0.42.0`
`golang.org/x/term`	`v0.32.0` -> `v0.41.0`
`golang.org/x/text`	`v0.26.0` -> `v0.35.0`
`golang.org/x/time`	`v0.11.0` -> `v0.15.0`
`golang.org/x/tools`	`v0.33.0` -> `v0.42.0`
`google.golang.org/api`	`v0.222.0` -> `v0.271.0`
`google.golang.org/genproto`	`v0.0.0-20250313205543-e70fdf4c4cb4` -> `v0.0.0-20260128011058-8636f8732409`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20250519155744-55703ea1f237` -> `v0.0.0-20260203192932-546029d2fa20`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20250519155744-55703ea1f237` -> `v0.0.0-20260226221140-a57be14db171`
`google.golang.org/grpc`	`v1.72.1` -> `v1.79.3`
`google.golang.org/protobuf`	`v1.36.6` -> `v1.36.11`

renovate Bot force-pushed the renovate/go-github.com-hashicorp-go-getter-vulnerability branch from 1610e88 to 92d9999 Compare February 2, 2026 18:58

renovate Bot changed the title ~~chore(deps): update module github.com/hashicorp/go-getter to v1.7.9 [security]~~ chore(deps): update module github.com/hashicorp/go-getter to v1.7.9 [security] - autoclosed Mar 27, 2026

renovate Bot closed this Mar 27, 2026

renovate Bot deleted the renovate/go-github.com-hashicorp-go-getter-vulnerability branch March 27, 2026 01:47

renovate Bot changed the title ~~chore(deps): update module github.com/hashicorp/go-getter to v1.7.9 [security] - autoclosed~~ chore(deps): update module github.com/hashicorp/go-getter to v1.7.9 [security] Mar 30, 2026

renovate Bot reopened this Mar 30, 2026

renovate Bot force-pushed the renovate/go-github.com-hashicorp-go-getter-vulnerability branch 2 times, most recently from 92d9999 to 9c1a112 Compare March 30, 2026 18:31

chore(deps): update module github.com/hashicorp/go-getter to v1.8.6 […

ddcde7e

…security]

renovate Bot force-pushed the renovate/go-github.com-hashicorp-go-getter-vulnerability branch from 9c1a112 to ddcde7e Compare April 10, 2026 16:34

renovate Bot changed the title ~~chore(deps): update module github.com/hashicorp/go-getter to v1.7.9 [security]~~ chore(deps): update module github.com/hashicorp/go-getter to v1.8.6 [security] Apr 10, 2026

Navigation Menu

Uh oh!

chore(deps): update module github.com/hashicorp/go-getter to v1.8.6 [security] - #38

chore(deps): update module github.com/hashicorp/go-getter to v1.8.6 [security]#38
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-hashicorp-go-getter-vulnerability

renovate Bot commented Aug 18, 2025 •

edited

Loading

Uh oh!

renovate Bot commented Apr 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

HashiCorp go-getter Vulnerable to Symlink Attacks

Details

Severity

References

HashiCorp's go-getter library may allow arbitrary file reads

Details

Severity

References

Release Notes

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

Configuration

Uh oh!

renovate Bot commented Apr 10, 2026

ℹ️ Artifact update notice

File name: provider/go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 18, 2025 •

edited

Loading