fix(snyk): remediate high-and-above vulnerabilities on feat/CLI-1813_optimize_feature_flags

[prodsec-github-automation]

Snyk agentic fix

The Snyk Open Source scan of feat/CLI-1813_optimize_feature_flags reported vulnerabilities at or above high severity. This branch was produced by snyk fix --agentic working on those.

Whether that scan also failed the build depends on the Enhanced Gate, which blocks only once a vulnerability has passed its remediation SLA — so this pull request may exist for a build that is green.

5 of 5 fixed.

These changes are generated. Review them as you would any dependency bump — check the changelogs of the upgraded packages before merging.

Fixed

Severity	Vulnerability	Where	Breaking-change risk
High	Symlink Attack	go.mod	Low — This is a patch version upgrade that includes security updates and bug fixes. The changes focus on security hardening, such as rejecting path traversal in reference names and making the worktree filesystem symlink-safe. It also updates dependencies like golang.org/x/crypto and golang.org/x/net. No breaking API changes are documented, and the risk to typical application behavior is low. Key Changes: - Security: Rejects path traversal in reference names to prevent vulnerabilities. - Security: Hardens the worktree filesystem against symlink-related issues. - Fix: Corrects how index entries are stored on Windows. Source: GitHub Release v5.19.2
High	Directory Traversal	go.mod	Low — This is a patch version upgrade from v5.19.1 to v5.19.2. The release contains security updates and bug fixes. Key Changes: - Updates to dependencies such as golang.org/x/crypto and golang.org/x/net for security purposes. [1] - A security fix to reject path traversal in reference names. [1] - A bug fix for handling backslashes in index entries on Windows. [1] There are no documented breaking API changes in this patch release. The changes are focused on improving security and fixing platform-specific bugs. Source: GitHub Release Notes
High	Directory Traversal	go.mod	Medium — This is a patch version upgrade that includes several security fixes and hardening measures. A key change directly impacting the storage/filesystem/dotgit package is the introduction of stricter validation to reject path traversal in reference names. While this is a security enhancement, it is a behavioral change that could cause issues if an application was inadvertently relying on the previous, less strict validation. This change elevates the risk to medium, as it may require verification. Other changes include dependency updates and a fix for handling backslashes on Windows. Recommendation: Verify that any logic creating or handling git reference names does not rely on paths that could now be rejected as traversal attempts.
High	Allocation of Resources Without Limits or Throttling	go.mod	Medium — This is a security update for golang.org/x/crypto/ssh that addresses two Denial of Service (DoS) vulnerabilities. Key Changes: - CVE-2026-56855: Fixes a deadlock vulnerability where a malicious peer could hang an established connection. The server will now treat certain malformed messages as a protocol error and terminate the connection instead of blocking. - CVE-2026-78662: Fixes a deadlock vulnerability on channels that are not yet fully established. The server will now drop unexpected packets on these channels without blocking. Risk Assessment: This upgrade is assessed as medium risk. While these are critical security fixes, the change in error handling—specifically, tearing down connections upon protocol errors where they might have previously hung—is a behavioral change. Systems with non-compliant or custom SSH clients may experience unexpected connection drops that require verification. Source: Security Announcement
High	Allocation of Resources Without Limits or Throttling	go.mod	Medium — This is a security update for golang.org/x/crypto/ssh that addresses two Denial of Service (DoS) vulnerabilities. Key Changes: - CVE-2026-56855: Fixes a deadlock vulnerability where a malicious peer could hang an established connection. The server will now treat certain malformed messages as a protocol error and terminate the connection instead of blocking. - CVE-2026-78662: Fixes a deadlock vulnerability on channels that are not yet fully established. The server will now drop unexpected packets on these channels without blocking. Risk Assessment: This upgrade is assessed as medium risk. While these are critical security fixes, the change in error handling—specifically, tearing down connections upon protocol errors where they might have previously hung—is a behavioral change. Systems with non-compliant or custom SSH clients may experience unexpected connection drops that require verification. Source: Security Announcement

This is not necessarily a complete fix. The build on this pull request runs the same Open Source scan and quality gate, so its result — not this description — is the verdict on what is left.

Changes

 go.mod | 10 +++++-----
 go.sum | 10 ++++++++++
 2 files changed, 15 insertions(+), 5 deletions(-)

_{Snyk ProdSec orb · build 21227 · model claude-opus-4-8}

---

Note

Medium Risk
Patch upgrades fix critical Git traversal/symlink and SSH DoS issues but change validation and SSH error handling; verify Git/SSH paths if the framework or its deps exercise them in production.

Overview
Dependency-only update to go.mod / go.sum from Snyk agentic remediation (5 high-severity issues). No application source changes.

Direct bumps: github.com/go-git/go-git/v5 v5.19.1 → v5.19.2, plus golang.org/x/mod, golang.org/x/text, and indirect golang.org/x/crypto and golang.org/x/tools.

go-git v5.19.2 hardens Git operations: rejects path traversal in reference names, symlink-safe worktree filesystem behavior, and related fixes in plumbing/storage paths that addressed the reported traversal and symlink issues.

golang.org/x/crypto (SSH) picks up DoS/deadlock fixes that may terminate connections on malformed protocol traffic instead of hanging—relevant only where SSH from this dependency tree is used at runtime.

Reviewers should treat this like any security patch bump: confirm changelogs and that Git reference naming or custom SSH clients are not relying on pre-fix behavior.

^{Reviewed by Cursor Bugbot for commit 8b7530d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

⚠️ Snyk checks are incomplete.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
⚠️	Open Source Security	0	0	0	0	See details
⚠️	Licenses	0	0	0	0	See details
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 2 relevant code sections from 2 files (average relevance: 0.71) internal/ufm_helpers/remediation.go (lines 1-275) CLAUDE.md (lines 1-146)

🤖 Repository instructions applied (from AGENTS.md)