GeezerVison

Bumps github.com/hashicorp/go-getter (indirect) from v1.8.6 to v1.8.10 on release/2.38, matching main and release/2.39 (bumped there as a side effect of #31288). This clears two findings the IronBank VAT scan of coder-service-2:2.38.4 flags (Medium) in /opt/coder:

• CVE-2026-88922: extracted archives can keep elevated permission bits (fixed in 1.8.9).
• CVE-2026-19585: path traversal in S3/GCS directory downloads (fixed in 1.8.10).

Coder is not vulnerable: go-getter only comes in through coder/preview → the coder/trivy Terraform parser, and preview always disables downloads (parser.OptionWithDownloads(false)), so go-getter is never called. This is scan hygiene.

Heads-up for review: this was a standalone go get github.com/hashicorp/[email protected] && go mod tidy, but go-getter 1.8.10 needs newer versions of several modules, so Go's minimum version selection also bumps them (e.g. aws-sdk-go-v2, klauspost/compress). These are the minimums go-getter needs; main is already at or above them. The go directive is unchanged. See the go.mod diff for the full list.

Verified: go build ./... succeeds, and go test ./aibridge/... ./coderd/database/awsiamrds/... ./coderd/cachecompress/... ./codersdk/... passes (covers the main consumers of the bumped modules; one toolsdk goleak failure under heavy machine load passed on rerun). Local git hooks were skipped; CI is the gate.

Not backported to release/2.29: go-getter 1.8.9+ requires Go 1.26 and that branch is on Go 1.25.

Part of ENT-240 (parent ENT-230). The same CVEs in /opt/terraform/terraform are tracked in ENT-241 (blocked upstream).

Opened by Superblink on behalf of @droopy4096.