ContributionUpgrades go-git to v5.19.1, which tightens delta chain depth limits, bounds format decoder inputs, validates idxfile offsets, and adds a worktreeFilesystem wrapper to reduce path-traversal and malformed-integer risks in the Go SDK's git operations.
ImpactDevelopers and CI pipelines using wandb's experimental Go SDK are less likely to hit panics or data-corruption paths when the SDK clones or inspects repositories, because the new go-git caps delta chain depth, rejects malformed variable-length integers, and bounds inflate sizes that previously could be exploited or cause uncontrolled memory growth. Watch for regressions in deeply-nested submodule cloning and SSH path-handling edge cases since the upstream release also changed symlink target validation and submodule relative-URL resolution.