security: fix HIGH SCA vulns in go-git/go-billy deps

[sawez-deepsource]

What this does

Clears both HIGH SCA advisories flagged for globstar in the July scan by bumping the go-git dependency family. Lock/manifest change only (go.mod + go.sum).

Module	Before	After	Dep type	HIGH cleared
github.com/go-git/go-git/v5	v5.14.0	v5.19.1	direct	CVE-2026-45022 (GO-2026-5074)
github.com/go-git/go-billy/v5	v5.6.2	v5.9.0	indirect (via go-git)	CVE-2026-44973 (GO-2026-5597)

A single direct bump of go-git/v5 does it — go-billy is its transitive filesystem dep, so go-git v5.19.1 (which pins go-billy v5.9.0) pulls the fixed go-billy automatically via MVS.

Why v5.19.1 (not the scan's 5.19.0)

5.19.0 fixes the flagged HIGH (GO-2026-5074) but leaves 3 other known go-git advisories in the tree. v5.19.1 is the minimal version clearing every known go-git 5.x advisory (verified against OSV) — same minor, still in-major v5, no added risk. It also incidentally sweeps the MODERATE/LOW go-git, go-billy, and cloudflare/circl advisories that govulncheck found present in the binary.

Transitive changes (all consequences of the go-git bump)

All // indirect, pulled by go-git v5.19.1's own requirements:
ProtonMail/go-crypto 1.1.5→1.1.6, cloudflare/circl 1.6.0→1.6.3, cyphar/filepath-securejoin 0.4.1→0.6.1, pjbgf/sha1cd 0.3.2→0.6.0, +klauspost/cpuid/v2 2.3.0. Plus testify 1.10.0→1.11.1 (test-only; go-git's test-dep floor via MVS). go directive unchanged (1.25.0).

Why this is safe

go-git is used in exactly one file — pkg/cli/git.go (GetChangedFiles) — via stable core APIs (PlainOpen, Worktree, Status, plumbing.NewHash, CommitObject, Tree.Diff, merkletrie). v5.14→v5.19 is entirely within major v5, so no breaking API changes; confirmed by byte-identical analysis output before vs after.

Verification

• ✅ Build/tests: make build clean; make test all pass, coverage 27.6% identical baseline vs after (pkg/cli 40.4% identical); make test-builtin-rules → all builtin rule tests pass.
• ✅ govulncheck (binary mode, the shipped artifact): 11 affected vulnerabilities → 0. The only residual is GO-2026-5932 (golang.org/x/crypto/openpgp is unmaintained) — no fix version exists, it's module-level and not called, and it was present pre-change (no regression).
• ✅ e2e parity on real repos (baseline binary vs fixed binary):
  • go-git git-diff path (check --new-since-rev=<full-hash>) resolves commits, computes the tree diff, and finds issues byte-identically — 35-file changeset → 3 issues, 7-file → 0 issues.
  • Full self-scan (Go + Python + JS) byte-identical — 6 issues.
  • On a repo that trips a pre-existing checker crash, both binaries fail identically (same signal, site, and stack; only ASLR pointers differ) — confirming the analysis engine is unaffected.

Blast radius

go.mod / go.sum only. 0 code changes. One direct bump (go-git); everything else is its transitive closure.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
globstar	Ignored	Preview	Aug 5, 2026 6:19pm