`github.com/hashicorp/go-getter`

Ecosystem:
go

Package URL:
pkg:golang/github.com/hashicorp/go-getter

Total PRs:
1,161 Dependabot PRs

Latest PR:
7 days ago

Unique Repositories:
559 repositories

Unique Repos (30 days):
30 repositories

Security Advisories

HashiCorp go-getter Vulnerable to Symlink Attacks

GHSA-wjrx-6529-hcj3 CVE-2025-8959 HIGH published 4 months ago • updated 9 days ago

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designa...

Data Amplification in HashiCorp go-getter

GHSA-jpxj-2jvg-6jv9 CVE-2023-0475 MODERATE published almost 3 years ago • updated 7 days ago

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

HashiCorp go-getter command injection

GHSA-x24g-9w7v-vprh CVE-2022-26945 CRITICAL published over 3 years ago • updated 9 days ago

HashiCorp go-getter before 2.0.2 allows Command Injection.

HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion

GHSA-28r2-q6m8-9hpx CVE-2022-30323 HIGH published over 3 years ago • updated 9 days ago

HashiCorp go-getter through 2.0.2 does not safely perform downloads. Asymmetric resource exhaustion could occur when go-getter processed malicious ...

HashiCorp go-getter unsafe downloads could lead to arbitrary host access

GHSA-cjr4-fv6c-f3mv CVE-2022-30322 HIGH published over 3 years ago • updated 9 days ago

HashiCorp go-getter through 2.0.2 does not safely perform downloads. Arbitrary host access was possible via go-getter path traversal, symlink proce...

View all 9 advisories

Recent PRs

Bump the go-modules group with 4 updates

paketo-buildpacks/node-engine #1301

1.8.0 → 1.8.1 Patch PR

Open 2 months ago

Bump the go-modules group with 4 updates

paketo-buildpacks/pip-install #504

1.8.0 → 1.8.1 Patch PR

Open 3 months ago

chore(deps): bump github.com/hashicorp/go-getter from 1.8.0 to 1.8.1

anchore/grype #2951

1.8.0 → 1.8.1 Patch PR

Merged 3 months ago

build(deps): bump github.com/hashicorp/go-getter from 1.8.0 to 1.8.1

helmfile/helmfile #2194

1.8.0 → 1.8.1 Patch PR

Open 3 months ago

chore(deps): bump github.com/hashicorp/go-getter from 1.7.8 to 1.8.1

chanzuckerberg/blessclient #317

1.7.8 → 1.8.1 Minor PR

Closed 3 months ago 1 comment

Bump the go-modules group across 1 directory with 86 updates

paketo-buildpacks/miniconda #648

1.7.9 → 1.8.0 Minor PR

Open 3 months ago 1 comment

Bump the go-modules group across 1 directory with 49 updates

paketo-buildpacks/go-build #889

1.7.9 → 1.8.0 Minor PR

Open 3 months ago

Bump the go-modules group across 1 directory with 47 updates

paketo-buildpacks/go-mod-vendor #926

1.7.9 → 1.8.0 Minor PR

Open 3 months ago 1 comment

chore(deps): bump the go_modules group across 1 directory with 6 updates

Kudora-Labs/kudora #32

1.7.5 → 1.7.9 Patch PR

Open 3 months ago 1 comment

chore(deps): bump the common group across 1 directory with 32 updates

aiflash/trivy #355

1.7.9 → 1.8.0 Minor PR

Open 3 months ago 2 comments

chore(deps): bump the common group across 1 directory with 54 updates

maggieZzy785/trivy #36

1.7.8 → 1.8.0 Minor PR

Open 3 months ago 1 comment

chore(deps): bump the common group across 1 directory with 54 updates

foo-bar-foo/trivy #50

1.7.8 → 1.8.0 Minor PR

Closed 3 months ago 1 comment

chore(deps): bump the common group with 23 updates

aquasecurity/trivy #9482

1.7.9 → 1.8.0 Minor PR

Open 3 months ago

chore(deps): bump the common group with 22 updates

aiflash/trivy #353

1.7.9 → 1.8.0 Minor PR

Closed 3 months ago 2 comments

Bump the go-dependencies group across 1 directory with 49 updates

radius-project/radius #10413

1.7.9 → 1.8.0 Minor PR

Open 3 months ago 2 comments

chore(deps): bump the common group across 1 directory with 31 updates

aiflash/trivy #350

1.7.9 → 1.8.0 Minor PR

Open 3 months ago 2 comments

chore(deps): bump the common group across 1 directory with 54 updates

riddopic/trivy #163

1.7.8 → 1.8.0 Minor PR

Closed 3 months ago 1 comment

chore(deps): bump the common group across 1 directory with 41 updates

sn0rlaxlife/trivy #80

1.7.8 → 1.8.0 Minor PR

Closed 3 months ago 1 comment

chore(deps): bump the common group across 1 directory with 41 updates

xycloops123/trivy #363

1.7.8 → 1.8.0 Minor PR

Closed 3 months ago 2 comments

Bump github.com/hashicorp/go-getter from 1.7.5 to 1.7.9 in /interchaintest

Kudora-Labs/kudora #19

1.7.5 → 1.7.9 Patch PR

Closed 3 months ago 1 comment

build(deps): bump github.com/hashicorp/go-getter from 1.7.9 to 1.7.10

hashicorp/nomad-pack #742

1.7.9 → 1.7.10 Patch PR

Closed 3 months ago 2 comments

chore(deps): bump the common group across 1 directory with 31 updates

tnir/trivy #268

1.7.9 → 1.8.0 Minor PR

Open 3 months ago

Bump the go-modules group across 1 directory with 85 updates

paketo-buildpacks/miniconda #645

1.7.9 → 1.8.0 Minor PR

Closed 3 months ago 2 comments

Bump the go-modules group across 1 directory with 56 updates

paketo-buildpacks/go-build #887

1.7.9 → 1.8.0 Minor PR

Open 3 months ago 1 comment

Bump the go-modules group across 1 directory with 56 updates

paketo-buildpacks/go-dist #1107

1.7.9 → 1.8.0 Minor PR

Open 3 months ago 2 comments

Bump the go-modules group across 1 directory with 56 updates

paketo-buildpacks/go-mod-vendor #924

1.7.9 → 1.8.0 Minor PR

Open 3 months ago

Bump the go-modules group across 1 directory with 55 updates

paketo-buildpacks/go-build #886

1.7.9 → 1.8.0 Minor PR

Open 3 months ago 1 comment

build(deps): Bump github.com/hashicorp/go-getter from 1.7.10 to 1.8.0

cosmos/cosmos-sdk #25337

1.7.10 → 1.8.0 Minor PR

Open 3 months ago

Bump the go-modules group across 1 directory with 55 updates

paketo-buildpacks/go-dist #1105

1.7.9 → 1.8.0 Minor PR

Closed 3 months ago 1 comment

Bump the go-modules group across 1 directory with 55 updates

paketo-buildpacks/go-mod-vendor #923

1.7.9 → 1.8.0 Minor PR

Open 3 months ago 1 comment

build(deps): bump the go-dependencies group across 1 directory with 33 updates

gruntwork-io/terragrunt #4817

1.7.9 → 1.8.0 Minor PR

Open 3 months ago 3 comments

Bump the go-modules group across 1 directory with 84 updates

paketo-buildpacks/miniconda #644

1.7.9 → 1.8.0 Minor PR

Closed 3 months ago 1 comment

Bump the go-modules group across 1 directory with 54 updates

paketo-buildpacks/go-dist #1104

1.7.9 → 1.8.0 Minor PR

Closed 3 months ago 1 comment

Bump the go-modules group with 21 updates

paketo-buildpacks/poetry-install #463

1.7.9 → 1.8.0 Minor PR

Merged 3 months ago

Bump the go-modules group across 1 directory with 54 updates

paketo-buildpacks/go-mod-vendor #922

1.7.9 → 1.8.0 Minor PR

Open 3 months ago 1 comment

Bump the go-modules group with 22 updates

paketo-buildpacks/pip-install #494

1.7.9 → 1.8.0 Minor PR

Open 3 months ago

chore(deps): bump the security group across 1 directory with 13 updates

replicatedhq/troubleshoot #1841

1.7.9 → 1.8.0 Minor PR

Open 3 months ago

Bump the go-modules group with 27 updates

paketo-buildpacks/poetry #483

1.7.9 → 1.8.0 Minor PR

Merged 3 months ago

Bump the go-modules group across 1 directory with 83 updates

paketo-buildpacks/miniconda #643

1.7.9 → 1.8.0 Minor PR

Closed 3 months ago 1 comment

Bump the go-modules group across 1 directory with 53 updates

paketo-buildpacks/go-build #884

1.7.9 → 1.8.0 Minor PR

Open 3 months ago

Bump the go-modules group across 1 directory with 53 updates

paketo-buildpacks/go-dist #1103

1.7.9 → 1.8.0 Minor PR

Open 3 months ago

build(deps): bump the all group across 1 directory with 25 updates

Checkmarx/kics #7708

1.7.9 → 1.8.0 Minor PR

Open 3 months ago 1 comment

chore(deps): bump the security group across 1 directory with 11 updates

replicatedhq/troubleshoot #1838

1.7.9 → 1.8.0 Minor PR

Closed 3 months ago 1 comment

build(deps): Bump github.com/hashicorp/go-getter from 1.6.2 to 1.8.0 in /tools/cosmovisor

huione-labs/cosmos-sdk #436

1.6.2 → 1.8.0 Minor PR

Closed 3 months ago 2 comments

build(deps): Bump github.com/hashicorp/go-getter from 1.6.2 to 1.8.0

crossfichain/cosmos-sdk #180

1.6.2 → 1.8.0 Minor PR

Closed 3 months ago 2 comments

build(deps): Bump github.com/hashicorp/go-getter from 1.7.1 to 1.8.0

terra-money/cosmos-sdk #955

1.7.1 → 1.8.0 Minor PR

Closed 3 months ago 2 comments

Bump github.com/hashicorp/go-getter from 1.5.11 to 1.8.0

riddopic/minikube #36

1.5.11 → 1.8.0 Minor PR

Closed 3 months ago 2 comments

build(deps): Bump github.com/hashicorp/go-getter from 1.6.2 to 1.8.0 in /tools/cosmovisor

Qone-Plus/cosmos-sdk #429

1.6.2 → 1.8.0 Minor PR

Closed 3 months ago 2 comments

build(deps): Bump github.com/hashicorp/go-getter from 1.7.0 to 1.8.0 in /x/upgrade

jatincr7/cosmos-sdk #2073

1.7.0 → 1.8.0 Minor PR

Closed 3 months ago 2 comments

chore(deps): bump the common group across 1 directory with 33 updates

tnir/trivy #267

1.7.9 → 1.8.0 Minor PR

Closed 3 months ago 1 comment

Package Details

Name:	`github.com/hashicorp/go-getter`
Ecosystem:	go
PURL Type:	golang
Package URL:	`pkg:golang/github.com/hashicorp/go-getter`
JSON API:	View JSON

Security Advisories

9

Active advisories

CRITICAL 2

HIGH 5

MODERATE 2

View All golang Advisories

Package Information

Description:

getter is a package for downloading files or directories from a variety of protocols. getter is unique in its ability to download both directories and files. It also detects certain source strings to be protocol-specific URLs. For example, "github.com/hashicorp/go-getter" would turn into a Git URL and use the Git protocol. Protocols and detectors are extensible. To get started, see Client.

Repository:	https://github.com/hashicorp/go-getter
Homepage:	https://github.com/hashicorp/go-getter
Latest Release:	`v1.7.8` 11 months ago
Dependent Repos:	6,872
Dependent Packages:	3,705
Ranking:	Top 0.0949% by dependent repos Top 0.0592% by dependent pkgs

PR Status

Open 694 (59.8%)

Merged 109 (9.4%)

Closed 341 (29.4%)

PR Types

Minor 399 (34.4%)

Patch 745 (64.2%)