fix(snyk): remediate high-and-above vulnerabilities on chore/spike_sarif_ufm

[prodsec-github-automation]

Snyk agentic fix

The Snyk Open Source scan of chore/spike_sarif_ufm reported vulnerabilities at or above high severity. This branch was produced by snyk fix --agentic working on those.

Whether that scan also failed the build depends on the Enhanced Gate, which blocks only once a vulnerability has passed its remediation SLA — so this pull request may exist for a build that is green.

3 of 5 fixed.

These changes are generated. Review them as you would any dependency bump — check the changelogs of the upgraded packages before merging.

Fixed

Severity	Vulnerability	Where	Breaking-change risk
High	Symlink Attack	go.mod	Low — This is a patch version upgrade that includes security updates and bug fixes. The changes focus on security hardening, such as rejecting path traversal in reference names and making the worktree filesystem symlink-safe. It also updates dependencies like golang.org/x/crypto and golang.org/x/net. No breaking API changes are documented, and the risk to typical application behavior is low. Key Changes: - Security: Rejects path traversal in reference names to prevent vulnerabilities. - Security: Hardens the worktree filesystem against symlink-related issues. - Fix: Corrects how index entries are stored on Windows. Source: GitHub Release v5.19.2
High	Directory Traversal	go.mod	Low — This is a patch version upgrade from v5.19.1 to v5.19.2. The release contains security updates and bug fixes. Key Changes: - Updates to dependencies such as golang.org/x/crypto and golang.org/x/net for security purposes. [1] - A security fix to reject path traversal in reference names. [1] - A bug fix for handling backslashes in index entries on Windows. [1] There are no documented breaking API changes in this patch release. The changes are focused on improving security and fixing platform-specific bugs. Source: GitHub Release Notes
High	Directory Traversal	go.mod	Medium — This is a patch version upgrade that includes several security fixes and hardening measures. A key change directly impacting the storage/filesystem/dotgit package is the introduction of stricter validation to reject path traversal in reference names. While this is a security enhancement, it is a behavioral change that could cause issues if an application was inadvertently relying on the previous, less strict validation. This change elevates the risk to medium, as it may require verification. Other changes include dependency updates and a fix for handling backslashes on Windows. Recommendation: Verify that any logic creating or handling git reference names does not rely on paths that could now be rejected as traversal attempts.

Not fixed

Severity	Vulnerability	Where	Fix available	Breaking-change risk
High	Allocation of Resources Without Limits or Throttling	go.mod	Yes	Medium — This is a security update for golang.org/x/crypto/ssh that addresses two Denial of Service (DoS) vulnerabilities. Key Changes: - CVE-2026-56855: Fixes a deadlock vulnerability where a malicious peer could hang an established connection. The server will now treat certain malformed messages as a protocol error and terminate the connection instead of blocking. - CVE-2026-78662: Fixes a deadlock vulnerability on channels that are not yet fully established. The server will now drop unexpected packets on these channels without blocking. Risk Assessment: This upgrade is assessed as medium risk. While these are critical security fixes, the change in error handling—specifically, tearing down connections upon protocol errors where they might have previously hung—is a behavioral change. Systems with non-compliant or custom SSH clients may experience unexpected connection drops that require verification. Source: Security Announcement
High	Allocation of Resources Without Limits or Throttling	go.mod	Yes	Medium — This is a security update for golang.org/x/crypto/ssh that addresses two Denial of Service (DoS) vulnerabilities. Key Changes: - CVE-2026-56855: Fixes a deadlock vulnerability where a malicious peer could hang an established connection. The server will now treat certain malformed messages as a protocol error and terminate the connection instead of blocking. - CVE-2026-78662: Fixes a deadlock vulnerability on channels that are not yet fully established. The server will now drop unexpected packets on these channels without blocking. Risk Assessment: This upgrade is assessed as medium risk. While these are critical security fixes, the change in error handling—specifically, tearing down connections upon protocol errors where they might have previously hung—is a behavioral change. Systems with non-compliant or custom SSH clients may experience unexpected connection drops that require verification. Source: Security Announcement

A row marked Fix available: No has no upgrade path for snyk fix to take. One marked Yes does, but needed a change the agent would not make unattended — those are the rows to look at first.

This is not necessarily a complete fix. The build on this pull request runs the same Open Source scan and quality gate, so its result — not this description — is the verdict on what is left.

Changes

 go.mod | 2 +-
 go.sum | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

_{Snyk ProdSec orb · build 21485 · model claude-opus-4-8}

---

Note

Medium Risk
Patch upgrade to a security-sensitive git library used for local repo access; stricter rejection of path traversal in reference names could surface errors if unusual refs were previously accepted. Remaining high findings in golang.org/x/crypto/ssh are not addressed in this PR.

Overview
Bumps github.com/go-git/go-git/v5 from v5.19.1 to v5.19.2 in go.mod and refreshes go.sum, as part of a Snyk remediation for high-severity issues (symlink / directory traversal in git plumbing and dotgit storage).

There is no application code change in this diff; behavior for git operations (e.g. contributor collection under internal/contributors) comes from the library’s stricter path/reference validation and worktree hardening in the patch release.

^{Reviewed by Cursor Bugbot for commit 29a9db6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 4 relevant code sections from 4 files (average relevance: 0.73) internal/ufm_helpers/remediation.go (lines 1-275) CLAUDE.md (lines 1-146) pkg/utils/sarif/sarif.go (lines 248-516) README.md (lines 1-48)

🤖 Repository instructions applied (from AGENTS.md)

[CatalinSnyk]

issue: missing a go mod tidy