Update module github.com/hashicorp/go-getter/v2 to v2.2.0 [SECURITY]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/hashicorp/go-getter/v2	v2.1.0 → v2.2.0

---

Data Amplification in HashiCorp go-getter

CVE-2023-0475 / GHSA-jpxj-2jvg-6jv9

More information

Details

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

Severity

• CVSS Score: 4.2 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-0475
• https://discuss.hashicorp.com/t/hcsec-2023-4-go-getter-vulnerable-to-denial-of-service-via-malicious-compressed-archive/50125
• https://github.com/hashicorp/go-getter/commit/0edab85348271c843782993345b07b1ac98912e6
• https://github.com/hashicorp/go-getter/commit/78e6721a2a76266718dc92c3c03c1571dffdefdc
• https://github.com/advisories/GHSA-jpxj-2jvg-6jv9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

hashicorp/go-getter (github.com/hashicorp/go-getter/v2)

v2.2.0

Compare Source

What's Changed

• [v2] update s3, gcs and cmd to use most recent v2 module version by @​nywilken in #​400
• Port Decompression bomb security changes from v1 by @​nywilken in #​414
• Update Go-Getter V2 to use Go 1.18 by @​nywilken in #​381

Full Changelog: hashicorp/go-getter@v2.1.1...v2.2.0

v2.1.1

Compare Source

What's Changed

• Add Timeout to SmbClientGetter to go-getter/v2 by @​nywilken in #​369
• Upgrade AWS SDK version by @​kmoe in #​385

Other Changes

• Fix Go Tests for V2 by @​claire-labry in #​392
• Migrate go-getter v2 to GHA by @​claire-labry in #​388
• • Add Malformed S3 URL test by @​nywilken in #​380

New Contributors

• @​kmoe made their first contribution in #​385

Full Changelog: hashicorp/go-getter@v2.1.0...v2.1.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.