go-getter v1.8.8 - Git Destination Security Fix

go-getter v1.8.8, published on August 12, 2026, is a focused security maintenance release. Its main change removes an existing .git entry from the destination before git init, including the case where .git is a file rather than a directory. The release also moves upstream builds to Go 1.26.5.

The full release notes and downloads are on the GitHub release page.

The Git getter now removes .git from the destination directory before running git init. The project classifies this as a security fix, and the implementation is tracked in GH 634.

The order matters. Initialization should start from a destination without existing Git metadata. That gives callers a defined starting state instead of allowing a prior .git entry to remain present while initialization begins. For data pipelines and build systems, the relevant boundary is the working directory supplied to go-getter.

Operators should pay particular attention to jobs that reuse work directories, restore caches, or stage repositories into a destination that was populated earlier. Those patterns can leave metadata behind between runs. The release notes do not claim a change to transport protocols, repository authentication, or source validation, so the scope should stay narrow: this fix concerns destination state immediately before Git initialization.

No CVE, severity rating, affected version range, or exploit sequence appears in the notes. It is appropriate to treat v1.8.8 as security relevant, but there is no basis in the supplied material for assigning a broader impact.

The less obvious part of the fix is type handling. A .git entry is not always a directory. It can also be a file, and v1.8.8 removes it in that form before initialization.

That distinction matters in automated web processing and source ingestion. Cleanup code that only expects a directory can miss a file at the same path. The result is inconsistent destination preparation based on filesystem object type. With this release, both forms are covered by the cleanup described in the notes.

Teams that wrap go-getter with their own staging logic should check for the same assumption. A directory only guard around .git cleanup is weaker than handling the path as an entry whose type must be inspected. This is an operational lesson from the fix, not a new go-getter option or configuration key.

The second release item updates the project build to Go 1.26.5 through GH 657. This matters mainly for maintainers who reproduce upstream builds, validate vendored dependencies, or compare results across controlled toolchains.

The note does not describe an API change, a new minimum Go version, or a change to module behavior. Do not read the build update as an undocumented compatibility break. Instead, record Go 1.26.5 when matching the upstream release environment, and keep downstream compiler requirements tied to the module metadata and the constraints of the consuming application.

There are no migration steps, CLI flags, configuration keys, or schema changes in the release notes. The practical upgrade case is therefore concentrated on the Git destination cleanup. Test any pipeline that deliberately preserves .git state in a reused destination, since v1.8.8 now removes that entry before initialization.