Critical vulnerability reported by trivy in fleetdm/fleet:v4.62.0

[lucasmrod]

Output for the trivy command that scans fleetdm/fleet:v4.62.0 (found by a prospect):

trivy image --ignore-unfixed --pkg-types os,library --severity CRITICAL fleetdm/fleet:v4.62.0
[...]
fleetdm/fleet:v4.62.0 (alpine 3.21.0)

Total: 0 (CRITICAL: 0)

usr/bin/fleetctl (gobinary)

Total: 1 (CRITICAL: 1)

┌─────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────┐
│           Library           │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                    Title                     │
├─────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────┤
│ github.com/go-git/go-git/v5 │ CVE-2025-21613 │ CRITICAL │ fixed  │ v5.11.0           │ 5.13.0        │ go-git: argument injection via the URL field │
│                             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-21613   │
└─────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────┘

The vulnerability is on the fleetctl binary. Do we really need the fleetctl binary on the fleetdm/fleet image?

---

PS: I'll create a separate issue to perform trivy scanning on fleetdm/fleet images.