GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix: bump hashicorp/go-getter to v1.8.10 (backport 2.29) by coder[bot] · Pull Request #31511 · coder/coder

Conversation

@coder

@coder coder Bot commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

Stacked on #31510 (Go 1.26.10 for 2.29). Merge that first, then retarget this PR to release/2.29.

Bumps github.com/hashicorp/go-getter (indirect) from v1.8.3 to v1.8.10 on release/2.29. This clears CVE-2026-88922 (archive permission bits, fixed in 1.8.9) and CVE-2026-19585 (S3/GCS path traversal, fixed in 1.8.10), which the IronBank VAT scan of 2.38.4 flags in /opt/coder. Same change as the 2.34–2.38 backports (#31506–#31509).

Coder is not vulnerable: go-getter only comes in through coder/preview → coder/trivy's Terraform parser, and preview always disables downloads, so go-getter is never called. This is scan hygiene.

Heads-up for review: go-getter 1.8.10 needs newer versions of several modules, so Go's minimum version selection also bumps them (aws-sdk-go-v2, grpc, protobuf, otel, google.golang.org/api, golang.org/x/*, klauspost/compress and others). 2.29 is further behind than the other lines, so this diff is the largest (~220 lines of go.mod/go.sum). The go directive stays at 1.26.10 from the parent PR.

Verified: go build ./... succeeds, and go test ./codersdk/... ./coderd/httpmw/... ./coderd/httpapi/... ./coderd/rbac/... ./tailnet/... ./agent/agentssh/... ./coderd/database/awsiamrds/... ./site/... passes. Local git hooks were skipped; CI is the gate.

Part of ENT-240 (parent ENT-230).

Opened by Superblink on behalf of @droopy4096.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@coder coder Bot assigned droopy4096 Oct 29, 2026
@linear-code

linear-code Bot commented Oct 29, 2026

Copy link
Copy Markdown

ENT-240
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@github-actions github-actions Bot added the community Pull Requests and issues created by the community. label Oct 29, 2026
@droopy4096
droopy4096 added this pull request to stack #31512 October 29, 2026 16:47
@coder
coder Bot requested review from Emyrk, denisra and jdomeracki-coder October 29, 2026 17:20
@coder
coder Bot force-pushed the superblink/ent-240-go-getter-1810-release-229 branch from aa8db7e to 9a4afc8 Compare November 2, 2026 19:17
denisra
denisra approved these changes Nov 2, 2026
View reviewed changes
Base automatically changed from superblink/ent-240-go-1-26-10-release-229 to release/2.29 November 2, 2026 20:21
@coder
fix: bump hashicorp/go-getter to v1.8.10 (backport 2.29)
191882d
@denisra
denisra force-pushed the superblink/ent-240-go-getter-1810-release-229 branch from 9a4afc8 to 191882d Compare November 2, 2026 20:21
@denisra
denisra merged commit 404b04f into release/2.29 Nov 2, 2026
6 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@denisra
denisra deleted the superblink/ent-240-go-getter-1810-release-229 branch November 2, 2026 20:21
@github-actions github-actions Bot locked and limited conversation to collaborators Nov 2, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@denisra denisra denisra approved these changes
@Emyrk Emyrk Awaiting requested review from Emyrk
@jdomeracki-coder jdomeracki-coder Awaiting requested review from jdomeracki-coder

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@droopy4096 droopy4096

Labels

community Pull Requests and issues created by the community.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@denisra @droopy4096
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.