Looks like the version of go-git used in this repo has several CVEs against it: * 2023-49568 * 2023-49569 * 2025-21613 * 2025-21614