fix(snyk): remediate high-and-above vulnerabilities blocking PRIM-100/cli-provenance-attestations-ff-9.19.0

[prodsec-github-automation]

Snyk agentic fix

The Snyk Open Source quality gate blocked PRIM-100/cli-provenance-attestations-ff-9.19.0. This branch was produced by snyk fix --agentic, working on vulnerabilities at or above high severity — the same threshold that gate is configured with.

3 of 3 fixed.

These changes are generated. Review them as you would any dependency bump — check the changelogs of the upgraded packages before merging.

Fixed

Severity	Vulnerability	Where	Breaking-change risk
High	Directory Traversal	cliv2/go.mod	Low — This is a patch version upgrade from v5.19.1 to v5.19.2. The release contains security updates and bug fixes. Key Changes: - Updates to dependencies such as golang.org/x/crypto and golang.org/x/net for security purposes. [1] - A security fix to reject path traversal in reference names. [1] - A bug fix for handling backslashes in index entries on Windows. [1] There are no documented breaking API changes in this patch release. The changes are focused on improving security and fixing platform-specific bugs. Source: GitHub Release Notes
High	Directory Traversal	cliv2/go.mod	Medium — This is a patch version upgrade that includes several security fixes and hardening measures. A key change directly impacting the storage/filesystem/dotgit package is the introduction of stricter validation to reject path traversal in reference names. While this is a security enhancement, it is a behavioral change that could cause issues if an application was inadvertently relying on the previous, less strict validation. This change elevates the risk to medium, as it may require verification. Other changes include dependency updates and a fix for handling backslashes on Windows. Recommendation: Verify that any logic creating or handling git reference names does not rely on paths that could now be rejected as traversal attempts.
High	Inefficient Algorithmic Complexity	package.json	Medium — This is a patch version upgrade from 4.3.0 to 4.3.1. Specific release notes or changelog entries for the transition from version 4.3.0 to 4.3.1 were not found in the package's official documentation or GitHub repository. While patch releases are typically for bug fixes and are not expected to contain breaking changes, the absence of clear documentation introduces uncertainty. Recommendation: The risk is assessed as medium due to the lack of information. It is advisable to perform routine testing to ensure no unexpected behavior has been introduced. Source: Package documentation

This is not necessarily a complete fix. The build on this pull request runs the same quality gate that blocked PRIM-100/cli-provenance-attestations-ff-9.19.0, so its result — not this description — is the verdict on what is left.

Changes

 cliv2/go.mod      |  8 ++++----
 cliv2/go.sum      | 20 ++++++++++----------
 package-lock.json | 18 +++++++++---------
 3 files changed, 23 insertions(+), 23 deletions(-)

_{Snyk ProdSec orb · build 635742 · model claude-opus-4-8}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 8 relevant code sections from 1 files (average relevance: 0.66) package-lock.json (8 segments, lines 3665-3922)

🤖 Repository instructions applied (from AGENTS.md)