docs: add Cursor Cloud environment setup notes - #669
Draft
rrama wants to merge 4 commits into
Draft
Conversation
Co-authored-by: Ben Durrans <Benjamin.Durrans@snyk.io>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Consolidates the duplicate cloud-setup notes into a single AGENTS.md, keeping the parallel branch's more precise diagnosis of the networking test: the live GET to www.snyk.io 301-redirects to the bare snyk.io apex, which is why it fails only when that apex is missing from the allowlist. Describes that test as network-gated rather than a product defect, and points at PR #673, which replaces the live call with an httptest server and makes the caveat moot. Replaces the fixed reachable/blocked host list with guidance to probe egress directly, since the allowlist changes between runs. Co-authored-by: Cursor <cursoragent@cursor.com>
…loud-env-setup-notes-ca2c AGENTS.md: clean 3-way auto-merge, no conflict markers -- main's later additions (This repository is public, Design review guidance) and this branch's Cursor Cloud section land in non-overlapping parts of the file. Verified both survive: all eleven section headers present, branch's sole file-scope contribution (AGENTS.md only) confirms zero interaction with any other changed file.
…nv-setup-notes-ca2c (#729) ## Snyk agentic fix The Snyk Open Source scan of `cursor/cloud-env-setup-notes-ca2c` reported vulnerabilities at or above **high** severity. This branch was produced by `snyk fix --agentic` working on those. Whether that scan also failed the build depends on the Enhanced Gate, which blocks only once a vulnerability has passed its remediation SLA — so this pull request may exist for a build that is green. **3 of 5 fixed.** > These changes are generated. Review them as you would any dependency bump — check the changelogs of the upgraded packages before merging. ### Fixed | Severity | Vulnerability | Where | Breaking-change risk | | --- | --- | --- | --- | | High | [Symlink Attack](https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOGITGOGITV5-18857903) | `go.mod` | Low — This is a patch version upgrade that includes security updates and bug fixes. The changes focus on security hardening, such as rejecting path traversal in reference names and making the worktree filesystem symlink-safe. It also updates dependencies like `golang.org/x/crypto` and `golang.org/x/net`. No breaking API changes are documented, and the risk to typical application behavior is low. **Key Changes:** - **Security:** Rejects path traversal in reference names to prevent vulnerabilities. - **Security:** Hardens the worktree filesystem against symlink-related issues. - **Fix:** Corrects how index entries are stored on Windows. Source: [GitHub Release v5.19.2](https://github.com/go-git/go-git/releases/tag/v5.19.2) | | High | [Directory Traversal](https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOGITGOGITV5PLUMBING-18593988) | `go.mod` | Low — This is a patch version upgrade from `v5.19.1` to `v5.19.2`. The release contains security updates and bug fixes. **Key Changes:** - Updates to dependencies such as `golang.org/x/crypto` and `golang.org/x/net` for security purposes. [1] - A security fix to reject path traversal in reference names. [1] - A bug fix for handling backslashes in index entries on Windows. [1] There are no documented breaking API changes in this patch release. The changes are focused on improving security and fixing platform-specific bugs. Source: [GitHub Release Notes](https://github.com/go-git/go-git/releases/tag/v5.19.2) | | High | [Directory Traversal](https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOGITGOGITV5STORAGEFILESYSTEMDOTGIT-18593984) | `go.mod` | Medium — This is a patch version upgrade that includes several security fixes and hardening measures. A key change directly impacting the `storage/filesystem/dotgit` package is the introduction of stricter validation to reject path traversal in reference names. While this is a security enhancement, it is a behavioral change that could cause issues if an application was inadvertently relying on the previous, less strict validation. This change elevates the risk to medium, as it may require verification. Other changes include dependency updates and a fix for handling backslashes on Windows. **Recommendation:** Verify that any logic creating or handling git reference names does not rely on paths that could now be rejected as traversal attempts. | ### Not fixed | Severity | Vulnerability | Where | Fix available | Breaking-change risk | | --- | --- | --- | --- | --- | | High | [Allocation of Resources Without Limits or Throttling](https://security.snyk.io/vuln/SNYK-GOLANG-GOLANGORGXCRYPTOSSH-19504090) | `go.mod` | Yes | Medium — This is a security update for `golang.org/x/crypto/ssh` that addresses two Denial of Service (DoS) vulnerabilities. **Key Changes:** - **CVE-2026-56855:** Fixes a deadlock vulnerability where a malicious peer could hang an established connection. The server will now treat certain malformed messages as a protocol error and terminate the connection instead of blocking. - **CVE-2026-78662:** Fixes a deadlock vulnerability on channels that are not yet fully established. The server will now drop unexpected packets on these channels without blocking. **Risk Assessment:** This upgrade is assessed as **medium risk**. While these are critical security fixes, the change in error handling—specifically, tearing down connections upon protocol errors where they might have previously hung—is a behavioral change. Systems with non-compliant or custom SSH clients may experience unexpected connection drops that require verification. Source: [Security Announcement](https://seclists.org/oss-sec/2026/q3/200) | | High | [Allocation of Resources Without Limits or Throttling](https://security.snyk.io/vuln/SNYK-GOLANG-GOLANGORGXCRYPTOSSH-19512464) | `go.mod` | Yes | Medium — This is a security update for `golang.org/x/crypto/ssh` that addresses two Denial of Service (DoS) vulnerabilities. **Key Changes:** - **CVE-2026-56855:** Fixes a deadlock vulnerability where a malicious peer could hang an established connection. The server will now treat certain malformed messages as a protocol error and terminate the connection instead of blocking. - **CVE-2026-78662:** Fixes a deadlock vulnerability on channels that are not yet fully established. The server will now drop unexpected packets on these channels without blocking. **Risk Assessment:** This upgrade is assessed as **medium risk**. While these are critical security fixes, the change in error handling—specifically, tearing down connections upon protocol errors where they might have previously hung—is a behavioral change. Systems with non-compliant or custom SSH clients may experience unexpected connection drops that require verification. Source: [Security Announcement](https://seclists.org/oss-sec/2026/q3/200) | A row marked **Fix available: No** has no upgrade path for `snyk fix` to take. One marked **Yes** does, but needed a change the agent would not make unattended — those are the rows to look at first. **This is not necessarily a complete fix.** The build on this pull request runs the same Open Source scan and quality gate, so its result — not this description — is the verdict on what is left. ### Changes ``` go.mod | 2 +- go.sum | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) ``` <sub>Snyk ProdSec orb · build [21060](https://circleci.com/gh/snyk/go-application-framework/21060) · model `claude-opus-4-8`</sub> <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Patch-only dependency bump with security hardening in go-git; low risk unless the app relied on lax ref-name or symlink behavior. > > **Overview** > Bumps **`github.com/go-git/go-git/v5`** from **v5.19.1** to **v5.19.2** in `go.mod` and refreshes `go.sum`. This is a Snyk-driven remediation for high-severity issues in go-git (symlink/path traversal in references and worktree filesystem handling). > > No application code changes—only the dependency pin. go-git is used for local Git operations (e.g. contributor collection and file filtering). Stricter reference-name validation in v5.19.2 could reject names that were previously accepted; worth a quick smoke test if you create or parse unusual ref paths. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 6be0650. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds a
## Cursor Cloud specific instructionssection toAGENTS.md(and thereforeCLAUDE.md, which is a symlink to it), capturing the non-obvious setup gotchas anagent hits when building GAF in a Cursor Cloud Linux VM. Documentation only — no
product code, and no change to any exported API, config key, workflow identifier or
content type.
Two duplicate cloud-setup PRs had been opened against this repo by successive cloud
runs. This one now carries the consolidated content and #670 has been closed as
superseded, leaving a single PR per repo.
The notes cover:
GOTOOLCHAIN=go1.26.5must stay pinned.go.moddeclares a barego 1.26, sowith
GOTOOLCHAIN=autoGo tries to fetch a non-existentgo1.26toolchain fromgo.devand fails; the pin routes it throughproxy.golang.org.make toolscurlsgolangci-lint.run(Makefile:50), which is usually outsidethe allowlist. Install the pinned
v2.10.1from the module proxy into.bin/instead. GAF is the odd one out here — snyk-ls and code-client-go fetch the same tool
via
raw.githubusercontent.com.pkg/networking.Test_GetHTTPClientis network-gated, not broken. It does a liveGET https://www.snyk.io, which 301-redirects to the baresnyk.ioapex; it passeswhenever that apex is reachable and only fails (nil-dereferencing on the unchecked
error path) when the egress is missing.
What changed since the first revision
and kept the other branch's more precise diagnosis — the
www→ apex redirect iswhat makes it fail, which is easy to misread as
www.snyk.iobeing blocked. It nowalso points at test(networking): remove live snyk.io call from Test_GetHTTPClient #673, which replaces the live call with an
httptestserver and makesthe caveat moot once merged.
between runs, so a fixed map goes stale and gets trusted anyway. Readers are told to
probe directly, with the semantics that explain the failure above: bare entries are
apex-exact while
*.example.comcovers subdomains only, so*.snyk.iodoes notimply the
snyk.ioapex.Checklist
make test) — n/a, no code changes; markdown onlymake generate) — n/a, nothing generated is affectedmake lint) — n/a, no Go files touchedto consume and no
go.mod/go.sumchange, so no companion CLI PR is needed