fix(deps): update module github.com/hashicorp/go-getter to v1.7.5 [security]

[renovate[bot]]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/hashicorp/go-getter	v1.6.2 -> v1.7.5

GitHub Vulnerability Alerts

CVE-2023-0475

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

CVE-2024-3817

When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository’s HEAD reference of its default branch by passing arguments to the Git binary on the host it is executing on.

An attacker may format a Git URL in order to inject additional Git arguments to the Git call.

Consumers of the go-getter library should evaluate the risk associated with these issues in the context of their go-getter usage and upgrade go-getter to 1.7.4 or later.

CVE-2024-6257

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution. When go-getter is performing a Git operation, go-getter will try to clone the given repository in a specified destination. Cloning initializes a git config to the provided destination and if the repository needs to get updated go-getter will pull the new changes .

An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.

---

Release Notes

hashicorp/go-getter (github.com/hashicorp/go-getter)

v1.7.5

Compare Source

What's Changed

• Prevent Git Config Alteration on Git Update by @​dduzgun-security in https://github.com/hashicorp/go-getter/pull/497

New Contributors

• @​dduzgun-security made their first contribution in https://github.com/hashicorp/go-getter/pull/497

Full Changelog: https://github.com/hashicorp/go-getter/compare/v1.7.4...v1.7.5

v1.7.4

Compare Source

What's Changed

• Escape user-provided strings in git commands https://github.com/hashicorp/go-getter/pull/483
• Fixed a bug in .netrc handling if the file does not exist https://github.com/hashicorp/go-getter/pull/433

Full Changelog: https://github.com/hashicorp/go-getter/compare/v1.7.3...v1.7.4

v1.7.3

Compare Source

What's Changed

• SEC-090: Automated trusted workflow pinning (2023-04-21) by @​hashicorp-tsccr in https://github.com/hashicorp/go-getter/pull/432
• SEC-090: Automated trusted workflow pinning (2023-09-11) by @​hashicorp-tsccr in https://github.com/hashicorp/go-getter/pull/454
• SEC-090: Automated trusted workflow pinning (2023-09-18) by @​hashicorp-tsccr in https://github.com/hashicorp/go-getter/pull/458
• don't change GIT_SSH_COMMAND when there is no sshKeyFile by @​jbardin in https://github.com/hashicorp/go-getter/pull/459

New Contributors

• @​hashicorp-tsccr made their first contribution in https://github.com/hashicorp/go-getter/pull/432

Full Changelog: https://github.com/hashicorp/go-getter/compare/v1.7.2...v1.7.3

v1.7.2

Compare Source

What's Changed

• Don't override GIT_SSH_COMMAND when not needed by @​nl-brett-stime https://github.com/hashicorp/go-getter/pull/300

Full Changelog: https://github.com/hashicorp/go-getter/compare/v1.7.1...v1.7.2

v1.7.1

Compare Source

v1.7.0

Compare Source

What's Changed

• docs: provide logging recommendations by @​mickael-hc in https://github.com/hashicorp/go-getter/pull/371
• Update aws sdk version by @​Jukie in https://github.com/hashicorp/go-getter/pull/384
• Update S3 URL in README by @​twelvelabs in https://github.com/hashicorp/go-getter/pull/378
• Migrate to GHA by @​claire-labry in https://github.com/hashicorp/go-getter/pull/379
• [COMPLIANCE] Update MPL 2.0 LICENSE by @​hashicorp-copywrite in https://github.com/hashicorp/go-getter/pull/386
• remove codesign entirely from go-getter by @​claire-labry in https://github.com/hashicorp/go-getter/pull/408
• Add decompression bomb mitigation options for v1 by @​picatz in https://github.com/hashicorp/go-getter/pull/412
• v1: decompressors: add LimitedDecompressors helper by @​shoenig in https://github.com/hashicorp/go-getter/pull/413

New Contributors

• @​mickael-hc made their first contribution in https://github.com/hashicorp/go-getter/pull/371
• @​Jukie made their first contribution in https://github.com/hashicorp/go-getter/pull/384
• @​twelvelabs made their first contribution in https://github.com/hashicorp/go-getter/pull/378
• @​hashicorp-copywrite made their first contribution in https://github.com/hashicorp/go-getter/pull/386

Full Changelog: https://github.com/hashicorp/go-getter/compare/v1.6.2...v1.7.0

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• [ ] If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate[bot]]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
cloud.google.com/go	v0.74.0 -> v0.104.0