Update module github.com/hashicorp/go-getter to v1.7.4 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/hashicorp/go-getter	v1.7.0 -> v1.7.4

GitHub Vulnerability Alerts

CVE-2024-3817

When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository’s HEAD reference of its default branch by passing arguments to the Git binary on the host it is executing on.

An attacker may format a Git URL in order to inject additional Git arguments to the Git call.

Consumers of the go-getter library should evaluate the risk associated with these issues in the context of their go-getter usage and upgrade go-getter to 1.7.4 or later.

---

Release Notes

hashicorp/go-getter (github.com/hashicorp/go-getter)

v1.7.4

Compare Source

What's Changed

• Escape user-provided strings in git commands https://github.com/hashicorp/go-getter/pull/483
• Fixed a bug in .netrc handling if the file does not exist https://github.com/hashicorp/go-getter/pull/433

Full Changelog: hashicorp/go-getter@v1.7.3...v1.7.4

v1.7.3

Compare Source

What's Changed

• SEC-090: Automated trusted workflow pinning (2023-04-21) by @​hashicorp-tsccr in https://github.com/hashicorp/go-getter/pull/432
• SEC-090: Automated trusted workflow pinning (2023-09-11) by @​hashicorp-tsccr in https://github.com/hashicorp/go-getter/pull/454
• SEC-090: Automated trusted workflow pinning (2023-09-18) by @​hashicorp-tsccr in https://github.com/hashicorp/go-getter/pull/458
• don't change GIT_SSH_COMMAND when there is no sshKeyFile by @​jbardin in https://github.com/hashicorp/go-getter/pull/459

New Contributors

• @​hashicorp-tsccr made their first contribution in https://github.com/hashicorp/go-getter/pull/432

Full Changelog: hashicorp/go-getter@v1.7.2...v1.7.3

v1.7.2

Compare Source

What's Changed

• Don't override GIT_SSH_COMMAND when not needed by @​nl-brett-stime https://github.com/hashicorp/go-getter/pull/300

Full Changelog: hashicorp/go-getter@v1.7.1...v1.7.2

v1.7.1

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.