fix(snyk): remediate high-and-above vulnerabilities on feat/CLI-1838

[prodsec-github-automation]

Snyk agentic fix

The Snyk Open Source scan of feat/CLI-1838 reported vulnerabilities at or above high severity. This branch was produced by snyk fix --agentic working on those.

Whether that scan also failed the build depends on the Enhanced Gate, which blocks only once a vulnerability has passed its remediation SLA — so this pull request may exist for a build that is green.

5 of 5 fixed.

These changes are generated. Review them as you would any dependency bump — check the changelogs of the upgraded packages before merging.

Fixed

Severity	Vulnerability	Where	Breaking-change risk
High	Symlink Attack	go.mod	Low — This is a patch version upgrade that includes security updates and bug fixes. The changes focus on security hardening, such as rejecting path traversal in reference names and making the worktree filesystem symlink-safe. It also updates dependencies like golang.org/x/crypto and golang.org/x/net. No breaking API changes are documented, and the risk to typical application behavior is low. Key Changes: - Security: Rejects path traversal in reference names to prevent vulnerabilities. - Security: Hardens the worktree filesystem against symlink-related issues. - Fix: Corrects how index entries are stored on Windows. Source: GitHub Release v5.19.2
High	Directory Traversal	go.mod	Low — This is a patch version upgrade from v5.19.1 to v5.19.2. The release contains security updates and bug fixes. Key Changes: - Updates to dependencies such as golang.org/x/crypto and golang.org/x/net for security purposes. [1] - A security fix to reject path traversal in reference names. [1] - A bug fix for handling backslashes in index entries on Windows. [1] There are no documented breaking API changes in this patch release. The changes are focused on improving security and fixing platform-specific bugs. Source: GitHub Release Notes
High	Directory Traversal	go.mod	Medium — This is a patch version upgrade that includes several security fixes and hardening measures. A key change directly impacting the storage/filesystem/dotgit package is the introduction of stricter validation to reject path traversal in reference names. While this is a security enhancement, it is a behavioral change that could cause issues if an application was inadvertently relying on the previous, less strict validation. This change elevates the risk to medium, as it may require verification. Other changes include dependency updates and a fix for handling backslashes on Windows. Recommendation: Verify that any logic creating or handling git reference names does not rely on paths that could now be rejected as traversal attempts.
High	Allocation of Resources Without Limits or Throttling	go.mod	Medium — This is a security update for golang.org/x/crypto/ssh that addresses two Denial of Service (DoS) vulnerabilities. Key Changes: - CVE-2026-56855: Fixes a deadlock vulnerability where a malicious peer could hang an established connection. The server will now treat certain malformed messages as a protocol error and terminate the connection instead of blocking. - CVE-2026-78662: Fixes a deadlock vulnerability on channels that are not yet fully established. The server will now drop unexpected packets on these channels without blocking. Risk Assessment: This upgrade is assessed as medium risk. While these are critical security fixes, the change in error handling—specifically, tearing down connections upon protocol errors where they might have previously hung—is a behavioral change. Systems with non-compliant or custom SSH clients may experience unexpected connection drops that require verification. Source: Security Announcement
High	Allocation of Resources Without Limits or Throttling	go.mod	Medium — This is a security update for golang.org/x/crypto/ssh that addresses two Denial of Service (DoS) vulnerabilities. Key Changes: - CVE-2026-56855: Fixes a deadlock vulnerability where a malicious peer could hang an established connection. The server will now treat certain malformed messages as a protocol error and terminate the connection instead of blocking. - CVE-2026-78662: Fixes a deadlock vulnerability on channels that are not yet fully established. The server will now drop unexpected packets on these channels without blocking. Risk Assessment: This upgrade is assessed as medium risk. While these are critical security fixes, the change in error handling—specifically, tearing down connections upon protocol errors where they might have previously hung—is a behavioral change. Systems with non-compliant or custom SSH clients may experience unexpected connection drops that require verification. Source: Security Announcement

This is not necessarily a complete fix. The build on this pull request runs the same Open Source scan and quality gate, so its result — not this description — is the verdict on what is left.

Changes

 go.mod | 10 +++++-----
 go.sum | 10 ++++++++++
 2 files changed, 15 insertions(+), 5 deletions(-)

_{Snyk ProdSec orb · build 21353 · model claude-opus-4-8}

---

Note

Medium Risk
Security patch upgrades to go-git and golang.org/x/crypto can change runtime behavior (stricter git reference validation, SSH disconnect-on-error) even though no first-party code changed.

Overview
This PR only updates go.mod / go.sum—no application source changes. It remediates high-severity Open Source findings by bumping github.com/go-git/go-git/v5 from v5.19.1 to v5.19.2 (symlink / reference path-traversal hardening and related fixes) and pulling in newer golang.org/x modules, notably golang.org/x/crypto v0.54.0 → v0.56.0 (SSH DoS deadlock fixes), plus minor bumps to golang.org/x/mod, golang.org/x/text, and golang.org/x/tools.

Reviewers should treat this like any generated dependency bump: confirm CI and any git/SSH-heavy flows still behave as expected, since go-git may reject reference names it previously allowed and x/crypto/ssh may drop connections on protocol errors where older versions could hang.

^{Reviewed by Cursor Bugbot for commit 80b73d1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 2 relevant code sections from 2 files (average relevance: 0.71) internal/ufm_helpers/remediation.go (lines 1-275) CLAUDE.md (lines 1-146)

🤖 Repository instructions applied (from AGENTS.md)