fix(snyk): remediate high-and-above vulnerabilities on feat/IANDT-27-contributors-post-invoke-hook

[prodsec-github-automation]

Snyk agentic fix

The Snyk Open Source scan of feat/IANDT-27-contributors-post-invoke-hook reported vulnerabilities at or above high severity. This branch was produced by snyk fix --agentic working on those.

Whether that scan also failed the build depends on the Enhanced Gate, which blocks only once a vulnerability has passed its remediation SLA — so this pull request may exist for a build that is green.

5 of 5 fixed.

These changes are generated. Review them as you would any dependency bump — check the changelogs of the upgraded packages before merging.

Fixed

Severity	Vulnerability	Where	Breaking-change risk
High	Symlink Attack	go.mod	Low — This is a patch version upgrade that includes security updates and bug fixes. The changes focus on security hardening, such as rejecting path traversal in reference names and making the worktree filesystem symlink-safe. It also updates dependencies like golang.org/x/crypto and golang.org/x/net. No breaking API changes are documented, and the risk to typical application behavior is low. Key Changes: - Security: Rejects path traversal in reference names to prevent vulnerabilities. - Security: Hardens the worktree filesystem against symlink-related issues. - Fix: Corrects how index entries are stored on Windows. Source: GitHub Release v5.19.2
High	Directory Traversal	go.mod	Low — This is a patch version upgrade from v5.19.1 to v5.19.2. The release contains security updates and bug fixes. Key Changes: - Updates to dependencies such as golang.org/x/crypto and golang.org/x/net for security purposes. [1] - A security fix to reject path traversal in reference names. [1] - A bug fix for handling backslashes in index entries on Windows. [1] There are no documented breaking API changes in this patch release. The changes are focused on improving security and fixing platform-specific bugs. Source: GitHub Release Notes
High	Directory Traversal	go.mod	Medium — This is a patch version upgrade that includes several security fixes and hardening measures. A key change directly impacting the storage/filesystem/dotgit package is the introduction of stricter validation to reject path traversal in reference names. While this is a security enhancement, it is a behavioral change that could cause issues if an application was inadvertently relying on the previous, less strict validation. This change elevates the risk to medium, as it may require verification. Other changes include dependency updates and a fix for handling backslashes on Windows. Recommendation: Verify that any logic creating or handling git reference names does not rely on paths that could now be rejected as traversal attempts.
High	Allocation of Resources Without Limits or Throttling	go.mod	Medium — This is a security update for golang.org/x/crypto/ssh that addresses two Denial of Service (DoS) vulnerabilities. Key Changes: - CVE-2026-56855: Fixes a deadlock vulnerability where a malicious peer could hang an established connection. The server will now treat certain malformed messages as a protocol error and terminate the connection instead of blocking. - CVE-2026-78662: Fixes a deadlock vulnerability on channels that are not yet fully established. The server will now drop unexpected packets on these channels without blocking. Risk Assessment: This upgrade is assessed as medium risk. While these are critical security fixes, the change in error handling—specifically, tearing down connections upon protocol errors where they might have previously hung—is a behavioral change. Systems with non-compliant or custom SSH clients may experience unexpected connection drops that require verification. Source: Security Announcement
High	Allocation of Resources Without Limits or Throttling	go.mod	Medium — This is a security update for golang.org/x/crypto/ssh that addresses two Denial of Service (DoS) vulnerabilities. Key Changes: - CVE-2026-56855: Fixes a deadlock vulnerability where a malicious peer could hang an established connection. The server will now treat certain malformed messages as a protocol error and terminate the connection instead of blocking. - CVE-2026-78662: Fixes a deadlock vulnerability on channels that are not yet fully established. The server will now drop unexpected packets on these channels without blocking. Risk Assessment: This upgrade is assessed as medium risk. While these are critical security fixes, the change in error handling—specifically, tearing down connections upon protocol errors where they might have previously hung—is a behavioral change. Systems with non-compliant or custom SSH clients may experience unexpected connection drops that require verification. Source: Security Announcement

This is not necessarily a complete fix. The build on this pull request runs the same Open Source scan and quality gate, so its result — not this description — is the verdict on what is left.

Changes

 go.mod | 10 +++++-----
 go.sum | 10 ++++++++++
 2 files changed, 15 insertions(+), 5 deletions(-)

_{Snyk ProdSec orb · build 21136 · model claude-opus-4-8}

---

Note

Medium Risk
Security patches touch go-git path validation and x/crypto SSH connection handling, which can change behavior for malformed refs or non-compliant SSH peers even though application code is unchanged.

Overview
This PR updates only go.mod and go.sum to remediate high-severity Open Source findings reported by Snyk (agentic fix).

github.com/go-git/go-git/v5 is bumped v5.19.1 → v5.19.2, addressing symlink and directory-traversal issues in git plumbing and filesystem storage. That dependency is used in contributor/git workflows (e.g. internal/contributors/collect.go), so the patch mainly tightens reference-name validation and worktree symlink handling rather than changing application code here.

Transitive golang.org/x modules are also raised: golang.org/x/crypto v0.54.0 → v0.56.0 (SSH DoS/deadlock fixes), plus minor bumps to golang.org/x/mod, golang.org/x/text, and golang.org/x/tools to align with the upgraded tree.

No first-party Go source changes; reviewers should treat this like a security-focused dependency bump and sanity-check git/SSH-related paths if anything relied on previously lax reference handling.

^{Reviewed by Cursor Bugbot for commit de785ec. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 2 relevant code sections from 2 files (average relevance: 0.71) CLAUDE.md (lines 1-146) internal/ufm_helpers/remediation.go (lines 1-275)

🤖 Repository instructions applied (from AGENTS.md)