search

srijanone / vega

Vega (वेग) is a project scaffolding tool to speed up development process.
Apache License 2.0
9 stars 7 forks source link

Update module github.com/hashicorp/go-getter to v1.7.5 [SECURITY] #283

Open renovate[bot] opened 1 week ago

renovate[bot] commented 1 week ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
github.com/hashicorp/go-getter v1.4.1 -> v1.7.5 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-6257

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution. When go-getter is performing a Git operation, go-getter will try to clone the given repository in a specified destination. Cloning initializes a git config to the provided destination and if the repository needs to get updated go-getter will pull the new changes .

An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.

Release Notes

hashicorp/go-getter (github.com/hashicorp/go-getter) ### [`v1.7.5`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.7.5) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.7.4...v1.7.5) #### What's Changed - Prevent Git Config Alteration on Git Update by [@​dduzgun-security](https://togithub.com/dduzgun-security) in [https://github.com/hashicorp/go-getter/pull/497](https://togithub.com/hashicorp/go-getter/pull/497) #### New Contributors - [@​dduzgun-security](https://togithub.com/dduzgun-security) made their first contribution in [https://github.com/hashicorp/go-getter/pull/497](https://togithub.com/hashicorp/go-getter/pull/497) **Full Changelog**: https://github.com/hashicorp/go-getter/compare/v1.7.4...v1.7.5 ### [`v1.7.4`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.7.4) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.7.3...v1.7.4) #### What's Changed - Escape user-provided strings in `git` commands [https://github.com/hashicorp/go-getter/pull/483](https://togithub.com/hashicorp/go-getter/pull/483) - Fixed a bug in `.netrc` handling if the file does not exist [https://github.com/hashicorp/go-getter/pull/433](https://togithub.com/hashicorp/go-getter/pull/433) **Full Changelog**: https://github.com/hashicorp/go-getter/compare/v1.7.3...v1.7.4 ### [`v1.7.3`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.7.3) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.7.2...v1.7.3) #### What's Changed - SEC-090: Automated trusted workflow pinning (2023-04-21) by [@​hashicorp-tsccr](https://togithub.com/hashicorp-tsccr) in [https://github.com/hashicorp/go-getter/pull/432](https://togithub.com/hashicorp/go-getter/pull/432) - SEC-090: Automated trusted workflow pinning (2023-09-11) by [@​hashicorp-tsccr](https://togithub.com/hashicorp-tsccr) in [https://github.com/hashicorp/go-getter/pull/454](https://togithub.com/hashicorp/go-getter/pull/454) - SEC-090: Automated trusted workflow pinning (2023-09-18) by [@​hashicorp-tsccr](https://togithub.com/hashicorp-tsccr) in [https://github.com/hashicorp/go-getter/pull/458](https://togithub.com/hashicorp/go-getter/pull/458) - don't change GIT_SSH_COMMAND when there is no sshKeyFile by [@​jbardin](https://togithub.com/jbardin) in [https://github.com/hashicorp/go-getter/pull/459](https://togithub.com/hashicorp/go-getter/pull/459) #### New Contributors - [@​hashicorp-tsccr](https://togithub.com/hashicorp-tsccr) made their first contribution in [https://github.com/hashicorp/go-getter/pull/432](https://togithub.com/hashicorp/go-getter/pull/432) **Full Changelog**: https://github.com/hashicorp/go-getter/compare/v1.7.2...v1.7.3 ### [`v1.7.2`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.7.2) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.7.1...v1.7.2) #### What's Changed - Don't override `GIT_SSH_COMMAND` when not needed by [@​nl-brett-stime](https://togithub.com/nl-brett-stime) [https://github.com/hashicorp/go-getter/pull/300](https://togithub.com/hashicorp/go-getter/pull/300) **Full Changelog**: https://github.com/hashicorp/go-getter/compare/v1.7.1...v1.7.2 ### [`v1.7.1`](https://togithub.com/hashicorp/go-getter/compare/v1.7.0...v1.7.1) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.7.0...v1.7.1) ### [`v1.7.0`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.7.0) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.6.2...v1.7.0) #### What's Changed - docs: provide logging recommendations by [@​mickael-hc](https://togithub.com/mickael-hc) in [https://github.com/hashicorp/go-getter/pull/371](https://togithub.com/hashicorp/go-getter/pull/371) - Update aws sdk version by [@​Jukie](https://togithub.com/Jukie) in [https://github.com/hashicorp/go-getter/pull/384](https://togithub.com/hashicorp/go-getter/pull/384) - Update S3 URL in README by [@​twelvelabs](https://togithub.com/twelvelabs) in [https://github.com/hashicorp/go-getter/pull/378](https://togithub.com/hashicorp/go-getter/pull/378) - Migrate to GHA by [@​claire-labry](https://togithub.com/claire-labry) in [https://github.com/hashicorp/go-getter/pull/379](https://togithub.com/hashicorp/go-getter/pull/379) - \[COMPLIANCE] Update MPL 2.0 LICENSE by [@​hashicorp-copywrite](https://togithub.com/hashicorp-copywrite) in [https://github.com/hashicorp/go-getter/pull/386](https://togithub.com/hashicorp/go-getter/pull/386) - remove codesign entirely from go-getter by [@​claire-labry](https://togithub.com/claire-labry) in [https://github.com/hashicorp/go-getter/pull/408](https://togithub.com/hashicorp/go-getter/pull/408) - Add decompression bomb mitigation options for v1 by [@​picatz](https://togithub.com/picatz) in [https://github.com/hashicorp/go-getter/pull/412](https://togithub.com/hashicorp/go-getter/pull/412) - v1: decompressors: add LimitedDecompressors helper by [@​shoenig](https://togithub.com/shoenig) in [https://github.com/hashicorp/go-getter/pull/413](https://togithub.com/hashicorp/go-getter/pull/413) #### New Contributors - [@​mickael-hc](https://togithub.com/mickael-hc) made their first contribution in [https://github.com/hashicorp/go-getter/pull/371](https://togithub.com/hashicorp/go-getter/pull/371) - [@​Jukie](https://togithub.com/Jukie) made their first contribution in [https://github.com/hashicorp/go-getter/pull/384](https://togithub.com/hashicorp/go-getter/pull/384) - [@​twelvelabs](https://togithub.com/twelvelabs) made their first contribution in [https://github.com/hashicorp/go-getter/pull/378](https://togithub.com/hashicorp/go-getter/pull/378) - [@​hashicorp-copywrite](https://togithub.com/hashicorp-copywrite) made their first contribution in [https://github.com/hashicorp/go-getter/pull/386](https://togithub.com/hashicorp/go-getter/pull/386) **Full Changelog**: https://github.com/hashicorp/go-getter/compare/v1.6.2...v1.7.0 ### [`v1.6.2`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.6.2) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.6.1...v1.6.2) #### What's Changed - Fix `no getter available for X-Terraform-Get source protocol` when using bare github or bitbucket hostnames: [#​370](https://togithub.com/hashicorp/go-getter/issues/370) ### [`v1.6.1`](https://togithub.com/hashicorp/go-getter/compare/v1.6.0...v1.6.1) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.6.0...v1.6.1) ### [`v1.6.0`](https://togithub.com/hashicorp/go-getter/compare/v1.5.11...v1.6.0) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.5.11...v1.6.0) ### [`v1.5.11`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.5.11) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.5.10...v1.5.11) #### What's Changed - Redact SSH key from URL query parameter by [@​macedogm](https://togithub.com/macedogm) in [https://github.com/hashicorp/go-getter/pull/348](https://togithub.com/hashicorp/go-getter/pull/348) - gcs: only run oauth test if env var is set by [@​schmichael](https://togithub.com/schmichael) in [https://github.com/hashicorp/go-getter/pull/349](https://togithub.com/hashicorp/go-getter/pull/349) #### New Contributors - [@​macedogm](https://togithub.com/macedogm) made their first contribution in [https://github.com/hashicorp/go-getter/pull/348](https://togithub.com/hashicorp/go-getter/pull/348) **Full Changelog**: https://github.com/hashicorp/go-getter/compare/v1.5.10...v1.5.11 ### [`v1.5.10`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.5.10) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.5.9...v1.5.10) - When fetching files from Google Cloud Storage, go-getter will now consider the `GOOGLE_OAUTH_ACCESS_TOKEN` environment variable as a potential source of a Google Cloud Platform access token. ([#​302](https://togithub.com/hashicorp/go-getter/pull/302)) - Fixed a regression from v1.5.9 where `git::` sources would no longer accept direct commit ids in the optional `ref` argument, and would instead only allow named refs from the remote. As a compromise, go-getter will now accept for `ref` anything that `git checkout` would accept as a valid tree selector, *unless* you also set `depth` to activate shallow clone mode in which case `ref` must be a named ref due to requirements of the Git protocol in that case. ([#​345](https://togithub.com/hashicorp/go-getter/pull/345)) ### [`v1.5.9`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.5.9) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.5.8...v1.5.9) Fix git shallow clone (`depth` parameter) for any ref. See [#​266](https://togithub.com/hashicorp/go-getter/issues/266) ### [`v1.5.8`](https://togithub.com/hashicorp/go-getter/compare/v1.5.7...v1.5.8) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.5.7...v1.5.8) ### [`v1.5.7`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.5.7) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.5.6...v1.5.7) In 1.5.7, we moved to using signore, an internal tool, for GPG signing. ### [`v1.5.6`](https://togithub.com/hashicorp/go-getter/compare/v1.5.5...v1.5.6) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.5.5...v1.5.6) ### [`v1.5.5`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.5.5) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.5.4...v1.5.5) IMPROVEMENTS: - Added and exported tar decompressor [#​328](https://togithub.com/hashicorp/go-getter/issues/328) [#​138](https://togithub.com/hashicorp/go-getter/issues/138) ### [`v1.5.4`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.5.4) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.5.3...v1.5.4) IMPROVEMENTS: - Add support to detect 5 parts s3 virtual hosted-style requests [https://github.com/hashicorp/go-getter/pull/314](https://togithub.com/hashicorp/go-getter/pull/314) - Add support for insecure HttpGetter [https://github.com/hashicorp/go-getter/pull/319](https://togithub.com/hashicorp/go-getter/pull/319) FIXES: - Allow to context cancel HTTP requests [#​321](https://togithub.com/hashicorp/go-getter/issues/321) NOTES: - This version requires Go 1.15+ and will no longer compile on older versions ### [`v1.5.3`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.5.3) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.5.2...v1.5.3) IMPROVEMENTS: - Add support for GCS object generations [https://github.com/hashicorp/go-getter/pull/310](https://togithub.com/hashicorp/go-getter/pull/310) BUGFIXES: - Avoid a race condition in HttpGetter [https://github.com/hashicorp/go-getter/pull/315](https://togithub.com/hashicorp/go-getter/pull/315) ### [`v1.5.2`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.5.2) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.5.1...v1.5.2) Bug fixes: - The goreleaser release pipeline that was created and used for the 1.5.1 release was missing the GOPRIVATE env var being set, which caused private modules to be skipped. This release contains the same code as 1.5.1, but with GOPRIVATE set to github.com/hashicorp. ### [`v1.5.1`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.5.1) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.5.0...v1.5.1) Enhancements: - Adds support for vhost-style s3 buckets ([#​283](https://togithub.com/hashicorp/go-getter/issues/283)) ### [`v1.5.0`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.5.0) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.4.2...v1.5.0) - Add support for `aws_profile` query paramter [261](https://togithub.com/hashicorp/go-getter/pull/261) - Bump dependency for CVE-2020-16845 [278](https://togithub.com/hashicorp/go-getter/pull/278) ### [`v1.4.2`](https://togithub.com/hashicorp/go-getter/releases/tag/v1.4.2) [Compare Source](https://togithub.com/hashicorp/go-getter/compare/v1.4.1...v1.4.2) Improvement: - Expose a Umask option to mask file permissions when storing local files or decompressing an archive. Helpful for clearing `setuid` or other sensitive bits. - feat(detector): provide a detector for repositories hosted on GitLab.com - Use default AWS credential chain under normal circumstances

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.