You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Binary Distribution Update: To streamline our release process and align with other HashiCorp tools, all release binaries will now be published exclusively to the official HashiCorp release site. We will no longer attach release assets to GitHub Releases.
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
Although Codacy analysis indicates the PR is up to standards, it should not be merged in its current state due to security vulnerabilities identified in the requested Go toolchain (1.25.8). Specifically, this version is susceptible to XSS (CVE-2026-32289) and DoS (CVE-2026-32281, CVE-2026-32288) attacks. Furthermore, there is a significant gap between the PR title and the actual changes, which include substantial updates to the Go toolchain and various cloud SDKs.
About this PR
The update involves a high number of indirect dependencies across critical SDKs. This increases the risk surface beyond a standard maintenance bump; verify that no breaking changes are introduced by these secondary updates.
The scope of this PR is much broader than the title suggests. It includes a Go toolchain update and updates to several major library suites (AWS, Google Cloud SDK, and OpenTelemetry). Please update the PR metadata to reflect the full scope of these changes to ensure they are properly audited.
Test suggestions
Verify successful compilation and basic functionality of resource fetching using the upgraded go-getter library.
Verify that the project build environment supports the non-standard Go version 1.25.8 specified in go.mod.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify successful compilation and basic functionality of resource fetching using the upgraded `go-getter` library.
2. Verify that the project build environment supports the non-standard Go version 1.25.8 specified in `go.mod`.
The reason will be displayed to describe this comment to others. Learn more.
🔴 HIGH RISK
The requested Go toolchain version 1.25.8 has multiple known vulnerabilities: XSS via improper context tracking in JS template literals (CVE-2026-32289), and Denial of Service (DoS) risks via certificate chain validation (CVE-2026-32281) and crafted archives (CVE-2026-32288). Additionally, version 1.25.8 appears to be a non-standard release for the current Go ecosystem. Upgrading to 1.25.9 is required to mitigate these security risks.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filegoPull requests that update Go code
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
bot
added
dependencies
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Bumps github.com/hashicorp/go-getter from 1.8.3 to 1.8.6.
Release notes
Sourced from github.com/hashicorp/go-getter's releases.
... (truncated)
Commits
d23bff4Merge pull request #608 from hashicorp/dependabot/go_modules/go-security-9c51...2c4aba8Merge pull request #613 from hashicorp/pull/v1.8.6fe61ed9Merge pull request #611 from hashicorp/SECVULN-41053d533656Merge pull request #606 from hashicorp/pull/CRT388f23dAdditional test for local branch and headb7ceaa5harden checkout ref handling and added regression tests769cc14Release version bump up6086a6aReview Comments Addressede02063cRevert "SECVULN Fix for git checkout argument injection enables arbitrary fil...c93084d[chore] : Bump google.golang.org/grpc