wandb Go SDK bumps go-git to 5.19.1 for packfile and worktree hardening

{
  "event_id": "event_6dbdb7e986a89619",
  "topic_id": "gpu_supply_and_compute_market",
  "event_type": "Dependency Update",
  "event_time": "2026-06-02T20:29:28Z",
  "title": "wandb Go SDK bumps go-git to 5.19.1 for packfile and worktree hardening",
  "summary": "The wandb experimental Go SDK upgrades go-git from v5.19.0 to v5.19.1, pulling in packfile parser hardening, format input bounds validation, and worktree filesystem safety fixes.",
  "contribution": "Upgrades go-git to v5.19.1, which tightens delta chain depth limits, bounds format decoder inputs, validates idxfile offsets, and adds a worktreeFilesystem wrapper to reduce path-traversal and malformed-integer risks in the Go SDK's git operations.",
  "impact": "Developers and CI pipelines using wandb's experimental Go SDK are less likely to hit panics or data-corruption paths when the SDK clones or inspects repositories, because the new go-git caps delta chain depth, rejects malformed variable-length integers, and bounds inflate sizes that previously could be exploited or cause uncontrolled memory growth. Watch for regressions in deeply-nested submodule cloning and SSH path-handling edge cases since the upstream release also changed symlink target validation and submodule relative-URL resolution.",
  "maturity": "Code",
  "confidence": 0,
  "importance_score": 0.45,
  "risk_flags": [
    "Deep Submodule Regression Risk",
    "Ssh Path Handling Edge Cases"
  ],
  "evidence_count": 1
}