fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-git/go-git/v5	v5.12.0 → v5.19.1

---

Release Notes

go-git/go-git (github.com/go-git/go-git/v5)

v5.19.1

Compare Source

What's Changed

• v5: plumbing: transport/ssh, Shell-quote path by @​hiddeco in #​2068
• v5: git: submodule, Fix relative URL resolution by @​hiddeco in #​2070
• v5: git: submodule, canonical remote for relative URLs by @​hiddeco in #​2074
• v5: git: submodule, error on remote without URLs by @​hiddeco in #​2078
• v5: plumbing: format/idxfile, Validate offset64 indices by @​hiddeco in #​2084
• v5: *: Reject malformed variable-length integers by @​hiddeco in #​2092
• v5: plumbing: format/packfile, Tighten delta validation by @​hiddeco in #​2091
• v5: Add worktreeFilesystem wrapper for worktree and hardening by @​hiddeco in #​2100
• v5: config: validate submodule names by @​hiddeco in #​2082
• build: Update module github.com/go-git/go-git/v5 to v5.19.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​2111
• v5: git: Allow MkdirAll on worktree-root paths by @​hiddeco in #​2117
• v5: git: Stop validating symlink target paths by @​pjbgf in #​2116
• v5: plumbing: format decoder input bounds and contracts by @​hiddeco in #​2125
• plumbing: format/packfile, cap delta chain depth in parser by @​pjbgf in #​2137

Full Changelog: go-git/go-git@v5.19.0...v5.19.1

v5.19.0

Compare Source

What's Changed

• build: Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​2010
• v5: Bump sha1cd and go-billy by @​pjbgf in #​2060
• v5: Align object encoding with upstream by @​pjbgf in #​2065

Full Changelog: go-git/go-git@v5.18.0...v5.19.0

v5.18.0

Compare Source

What's Changed

• plumbing: transport/http, Add support for followRedirects policy by @​pjbgf in #​2004

Full Changelog: go-git/go-git@v5.17.2...v5.18.0

v5.17.2

Compare Source

What's Changed

• build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​1941
• dotgit: skip writing pack files that already exist on disk by @​pjbgf in #​1944

⚠️ This release fixes a bug (#​1942) that blocked some users from upgrading to v5.17.1. Thanks @​pskrbasu for reporting it. 🙇

Full Changelog: go-git/go-git@v5.17.1...v5.17.2

v5.17.1

Compare Source

What's Changed

• build: Update module github.com/cloudflare/circl to v1.6.3 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​1930
• [v5] plumbing: format/index, Improve v4 entry name validation by @​pjbgf in #​1935
• [v5] plumbing: format/idxfile, Fix version and fanout checks by @​pjbgf in #​1937

Full Changelog: go-git/go-git@v5.17.0...v5.17.1

v5.17.0

Compare Source

What's Changed

• build: Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​1839
• git: worktree, optimize infiles function for very large repos by @​k-anshul in #​1853
• git: Add strict checks for supported extensions by @​pjbgf in #​1861
• backport, git: Improve Status() speed with new index.ModTime check by @​cedric-appdirect in #​1862
• storage: filesystem, Avoid overwriting loose obj files by @​pjbgf in #​1864

Full Changelog: go-git/go-git@v5.16.5...v5.17.0

v5.16.5

Compare Source

What's Changed

• build: Update module golang.org/x/crypto to v0.45.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​1744
• build: Bump Go test versions to 1.23-1.25 (v5) by @​pjbgf in #​1746
• [v5] git: worktree, Don't delete local untracked files when resetting worktree by @​Ch00k in #​1800
• Expand packfile checks by @​pjbgf in #​1836

Full Changelog: go-git/go-git@v5.16.4...v5.16.5

v5.16.4

Compare Source

What's Changed

• backport plumbing: format/idxfile, prevent panic by @​swills in #​1732
• [backport] build: test, Fix build on Windows. by @​pjbgf in #​1734
• build: Update module golang.org/x/net to v0.38.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​1742
• build: Update module github.com/cloudflare/circl to v1.6.1 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​1741
• build: Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​1743

Full Changelog: go-git/go-git@v5.16.3...v5.16.4

v5.16.3

Compare Source

What's Changed

• internal: Expand regex to fix build [5.x] by @​baloo in #​1644
• build: raise timeouts for windows CI tests and disable CIFuzz [5.x] by @​baloo in #​1646
• plumbing: support commits extra headers, support jujutsu signed commit [5.x] by @​baloo in #​1633

Full Changelog: go-git/go-git@v5.16.2...v5.16.3

v5.16.2

Compare Source

What's Changed

• utils: fix diff so subpaths work for sparse checkouts, fixes 1455 to releases/v5.x by @​kane8n in #​1567

Full Changelog: go-git/go-git@v5.16.1...v5.16.2

v5.16.1

Compare Source

What's Changed

• utils: merkletrie, Fix diff on sparse-checkout index. Fixes #​1406 to releases/v5.x by @​kane8n in #​1561

New Contributors

• @​kane8n made their first contribution in #​1561

Full Changelog: go-git/go-git@v5.16.0...v5.16.1

v5.16.0

Compare Source

What's Changed

• [v5] plumbing: support mTLS for HTTPS protocol by @​hiddeco in #​1510
• v5: plumbing: transport, Reintroduce SetHostKeyCallback. Fix #​1514 by @​pjbgf in #​1515

Full Changelog: go-git/go-git@v5.15.0...v5.16.0

v5.15.0

Compare Source

What's Changed

• plumbing: add cert auth support to releases/v5.x by @​Javier-varez in #​1482
• v5: Bump dependencies by @​pjbgf in #​1505

Full Changelog: go-git/go-git@v5.14.0...v5.15.0

v5.14.0

Compare Source

What's Changed

• v5: Bump Go and dependencies to mitigate GO-2025-3487 by @​pjbgf in #​1436

⚠️ Note that this version requires Go 1.23, due to the bump to golang.org/x/crypto@v0.35.0 which mitigates the CVE above. User's that can't bump to Go 1.23 will need to remain on the previous v5.13.x release.

Full Changelog: go-git/go-git@v5.13.2...v5.14.0

v5.13.2

Compare Source

What's Changed

• plumbing: use the correct user agent string. Fixes #​883 by @​uragirii in #​1364
• build: bump golang.org/x/sys from 0.28.0 to 0.29.0 in the golang-org group by @​dependabot in #​1365
• build: bump the golang-org group with 2 updates by @​dependabot in #​1367
• build: bump github.com/ProtonMail/go-crypto from 1.1.3 to 1.1.4 by @​dependabot in #​1368
• build: bump github.com/go-git/go-billy/v5 from 5.6.1 to 5.6.2 by @​dependabot in #​1378
• build: bump github/codeql-action from 3.28.0 to 3.28.1 by @​dependabot in #​1376
• build: bump github.com/elazarl/goproxy from 1.2.3 to 1.4.0 by @​dependabot in #​1377
• git: worktree, fix restoring dot slash files (backported to v5). Fixes #​1176 by @​BeChris in #​1361
• build: bump github.com/pjbgf/sha1cd from 0.3.0 to 0.3.2 by @​dependabot in #​1392
• git: worktree_status, fix adding dot slash files to working tree (backported to v5). Fixes #​1150 by @​BeChris in #​1359
• build: bump github.com/ProtonMail/go-crypto from 1.1.4 to 1.1.5 by @​dependabot in #​1383

Full Changelog: go-git/go-git@v5.13.1...v5.13.2

v5.13.1

Compare Source

What's Changed

• build: bump github.com/go-git/go-billy/v5 from 5.6.0 to 5.6.1 by @​dependabot in #​1327
• build: bump github.com/elazarl/goproxy from 1.2.1 to 1.2.2 by @​dependabot in #​1329
• build: bump github.com/elazarl/goproxy from 1.2.2 to 1.2.3 by @​dependabot in #​1340
• Revert "plumbing: transport/ssh, Add support for SSH @​cert-authority." by @​pjbgf in #​1346

Full Changelog: go-git/go-git@v5.13.0...v5.13.1

v5.13.0

Compare Source

What's Changed

• build: bump github.com/go-git/go-git/v5 from 5.11.0 to 5.12.0 in /cli/go-git by @​dependabot in #​1065
• build: bump golang.org/x/net from 0.22.0 to 0.23.0 by @​dependabot in #​1068
• build: bump golang.org/x/net from 0.23.0 to 0.24.0 by @​dependabot in #​1071
• Properly support skipping of non-mandatory extensions by @​codablock in #​1066
• git: Refine some codes in test and non-test. by @​onee-only in #​1077
• plumbing: protocol/packp, client-side filter capability support by @​edigaryev in #​1000
• build: bump golang.org/x/net from 0.22.0 to 0.23.0 in /cli/go-git by @​dependabot in #​1078
• plumbing: fix sideband demux on flush by @​aymanbagabas in #​1084
• storage: dotgit, head reference usually comes first by @​aymanbagabas in #​1085
• build: bump golang.org/x/text from 0.14.0 to 0.15.0 by @​dependabot in #​1091
• build: bump golang.org/x/crypto from 0.22.0 to 0.23.0 by @​dependabot in #​1094
• build: bump golang.org/x/net from 0.24.0 to 0.25.0 by @​dependabot in #​1093
• git: Added an example for Repository.Branches by @​johnmatthiggins in #​1088
• git: worktree_commit, Modify checking empty commit. Fixes #​723 by @​onee-only in #​1050
• plumbing: transport/http, Wrap http errors to return reason. Fixes #​1097 by @​ggambetti in #​1100
• build: bump golang.org/x/sys from 0.20.0 to 0.21.0 by @​dependabot in #​1106
• build: bump golang.org/x/text from 0.15.0 to 0.16.0 by @​dependabot in #​1107
• Bumps Go versions and go-billy by @​pjbgf in #​1056
• _examples: Fixed a dead link COMPATIBILITY.md by @​gecko655 in #​1109
• build: bump github.com/jessevdk/go-flags from 1.5.0 to 1.6.1 in /cli/go-git by @​dependabot in #​1115
• build: bump github.com/elazarl/goproxy from v0.0.0-20230808193330-2592e75ae04a to v0.0.0-20240618083138-03be62527ccb by @​hbelmiro in #​1124
• build: bump golang.org/x/net from 0.25.0 to 0.26.0 by @​dependabot in #​1104
• Add option approximating git clean -x flag. by @​msuozzo in #​995
• Revert "Add option approximating git clean -x flag." by @​pjbgf in #​1129
• Fix reference updated concurrently error for the filesystem storer by @​Javier-varez in #​1116
• build: bump golang.org/x/net from 0.26.0 to 0.27.0 by @​dependabot in #​1134
• utils: merkletrie, Align error message with upstream by @​pjbgf in #​1142
• plumbing: transport/file, Change paths to absolute by @​pjbgf in #​1141
• plumbing: gitignore, Fix loading of ignored .gitignore files. by @​Achilleshiel in #​1114
• build: bump github.com/skeema/knownhosts from 1.2.2 to 1.3.0 by @​dependabot in #​1147
• plumbing: transport/ssh, Add support for SSH @​cert-authority. by @​Javier-varez in #​1157
• build: run example tests during CI workflow by @​crazybolillo in #​1030
• storage: filesystem, Fix object cache not working due to uninitialised objects being put into cache by @​SatelliteMind in #​1138
• git: Fix fetching missing commits by @​AriehSchneier in #​1032
• plumbing: format/packfile, remove duplicate checks in findMatch() by @​edigaryev in #​1152
• git: worktree, Fix file reported as Untracked while it is committed by @​rodrigocam in #​1023
• build: bump golang.org/x/sys from 0.22.0 to 0.23.0 by @​dependabot in #​1160
• plumbing: filemode, Remove check for setting size of .git/index file by @​nicholasSUSE in #​1159
• build: bump golang.org/x/net from 0.27.0 to 0.28.0 by @​dependabot in #​1163
• Fix some lint warning and increase stalebot to 180 days by @​pjbgf in #​1128
• adjust path extracted from file: url on Windows by @​tomqwpl in #​416
• build: bump golang.org/x/sys from 0.23.0 to 0.24.0 by @​dependabot in #​1164
• Add RestoreStaged to Worktree that mimics the behaviour of git restore --staged ... by @​ben-tbotlabs in #​493
• plumbing: signature, support the same x509 signature formats as git by @​yoavamit in #​1169
• fix: allow discovery of non bare repos in fsLoader by @​jakobmoellerdev in #​1170
• build: bump golang.org/x/sys from 0.24.0 to 0.25.0 by @​dependabot in #​1178
• build: bump golang.org/x/text from 0.17.0 to 0.18.0 by @​dependabot in #​1179
• build: bump golang.org/x/net from 0.28.0 to 0.29.0 by @​dependabot in #​1184
• Consume push URLs when they are provided by @​mcepl in #​1191
• *: use gocheck's MkDir instead of TempDir for tests. Fixes #​807 by @​uragirii in #​1194
• build: bump golang.org/x/net from 0.29.0 to 0.30.0 by @​dependabot in #​1200
• worktree: .git/index not correctly generated when running on Windows by @​BeChris in #​1198
• git: worktree, Fix sparse reset. Fixes #​90 by @​onee-only in #​1101
• git: worktree, Pass context on updateSubmodules. Fixes #​1098 by @​onee-only in #​1154
• build: bump github.com/go-git/go-billy/v5 from 5.5.1-0.20240427054813-8453aa90c6ec to 5.6.0 by @​dependabot in #​1211
• Update contributing guidelines by @​pjbgf in #​1217
• build: bump github.com/ProtonMail/go-crypto from 1.0.0 to 1.1.1 by @​dependabot in #​1222
• build: bump golang.org/x/sys from 0.26.0 to 0.27.0 by @​dependabot in #​1223
• build: bump golang.org/x/crypto from 0.28.0 to 0.29.0 by @​dependabot in #​1221
• build: bump github.com/ProtonMail/go-crypto from 1.1.1 to 1.1.2 by @​dependabot in #​1226
• build: bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @​dependabot in #​1232
• build: bump github.com/ProtonMail/go-crypto from 1.1.2 to 1.1.3 by @​dependabot in #​1231
• build: General improvements around fuzzing by @​pjbgf in #​1229
• build: bump golang.org/x/net from 0.30.0 to 0.32.0 by @​dependabot in #​1241
• build: group dependabot updates for golang.org by @​AriehSchneier in #​1243
• build: bump github/codeql-action from 2.22.11 to 3.27.6 by @​dependabot in #​1244
• build: bump golang.org/x/crypto from 0.21.0 to 0.31.0 in /cli/go-git by @​dependabot in #​1246
• build: bump golang.org/x/crypto from 0.30.0 to 0.31.0 by @​dependabot in #​1247
• build: bump github.com/gliderlabs/ssh from 0.3.7 to 0.3.8 by @​dependabot in #​1248
• add comment preventing people from creating invalid trees by @​petar in #​732
• build: bump github/codeql-action from 3.27.6 to 3.27.9 by @​dependabot in #​1250
• plumbing: Properly encode index version 4 by @​BeChris in #​1251
• Fix typos by @​deining in #​1148
• Fix reset files in subfolders by @​linglo in #​1177
• git: update switch cases by @​hezhizhen in #​1182
• build: bump golang.org/x/net from 0.32.0 to 0.33.0 in the golang-org group by @​dependabot in #​1256
• fix(1212): Fix invalid reference name error while cloning branches containing /- by @​varmakarthik12 in #​1257
• pktline : accept upercase hexadecimal value as pktline length information by @​BeChris in #​1220
• build: bump github/codeql-action from 3.27.9 to 3.28.0 by @​dependabot in #​1260
• build: bump github.com/elazarl/goproxy from 0.0.0-20240618083138-03be62527ccb to 1.2.1 by @​dependabot in #​1262
• git: worktree_commit, sanitize author and commiter name and email before creating the commit object. Fixes #​680 by @​BeChris in #​1261

New Contributors

• @​johnmatthiggins made their first contribution in #​1088
• @​ggambetti made their first contribution in #​1100
• @​gecko655 made their first contribution in #​1109
• @​hbelmiro made their first contribution in #​1124
• @​msuozzo made their first contribution in #​995
• @​Javier-varez made their first contribution in #​1116
• @​Achilleshiel made their first contribution in #​1114
• @​crazybolillo made their first contribution in #​1030
• @​SatelliteMind made their first contribution in #​1138
• @​rodrigocam made their first contribution in #​1023
• @​nicholasSUSE made their first contribution in #​1159
• @​tomqwpl made their first contribution in #​416
• @​ben-tbotlabs made their first contribution in #​493
• @​yoavamit made their first contribution in #​1169
• @​uragirii made their first contribution in #​1194
• @​petar made their first contribution in #​732
• @​deining made their first contribution in #​1148
• @​linglo made their first contribution in #​1177
• @​varmakarthik12 made their first contribution in #​1257

Full Changelog: go-git/go-git@v5.12.0...v5.13.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 16 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.21 -> 1.23.0
github.com/Microsoft/go-winio	v0.6.1 -> v0.6.2
github.com/ProtonMail/go-crypto	v1.0.0 -> v1.1.6
github.com/cloudflare/circl	v1.3.7 -> v1.6.1
github.com/cyphar/filepath-securejoin	v0.2.4 -> v0.4.1
github.com/go-git/go-billy/v5	v5.5.0 -> v5.6.2
github.com/golang/groupcache	v0.0.0-20210331224755-41bb18bfe9da -> v0.0.0-20241129210726-2c02b8208cf8
github.com/pjbgf/sha1cd	v0.3.0 -> v0.3.2
github.com/skeema/knownhosts	v1.2.2 -> v1.3.1
golang.org/x/crypto	v0.26.0 -> v0.37.0
golang.org/x/exp	v0.0.0-20240613232115-7f521ea00fb8 -> v0.0.0-20240719175910-8a7402abbf56
golang.org/x/mod	v0.18.0 -> v0.19.0
golang.org/x/net	v0.28.0 -> v0.39.0
golang.org/x/sync	v0.8.0 -> v0.13.0
golang.org/x/sys	v0.24.0 -> v0.32.0
golang.org/x/text	v0.17.0 -> v0.24.0
golang.org/x/tools	v0.22.0 -> v0.23.0

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 17 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.21 -> 1.25.0
github.com/Microsoft/go-winio	v0.6.1 -> v0.6.2
github.com/ProtonMail/go-crypto	v1.0.0 -> v1.1.6
github.com/cloudflare/circl	v1.3.7 -> v1.6.3
github.com/cyphar/filepath-securejoin	v0.2.4 -> v0.6.1
github.com/go-git/go-billy/v5	v5.5.0 -> v5.9.0
github.com/golang/groupcache	v0.0.0-20210331224755-41bb18bfe9da -> v0.0.0-20241129210726-2c02b8208cf8
github.com/klauspost/cpuid/v2	v2.2.8 -> v2.3.0
github.com/pjbgf/sha1cd	v0.3.0 -> v0.6.0
github.com/skeema/knownhosts	v1.2.2 -> v1.3.1
golang.org/x/crypto	v0.26.0 -> v0.50.0
golang.org/x/exp	v0.0.0-20240613232115-7f521ea00fb8 -> v0.0.0-20260410095643-746e56fc9e2f
golang.org/x/mod	v0.18.0 -> v0.35.0
golang.org/x/net	v0.28.0 -> v0.53.0
golang.org/x/sync	v0.8.0 -> v0.20.0
golang.org/x/sys	v0.24.0 -> v0.43.0
golang.org/x/text	v0.17.0 -> v0.36.0
golang.org/x/tools	v0.22.0 -> v0.44.0

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud