Bump the go-modules group across 1 directory with 6 updates #947

dependabot · 2025-10-06T20:02:40Z

Bumps the go-modules group with 6 updates in the / directory:

Package	From	To
github.com/paketo-buildpacks/packit/v2	`2.25.1`	`2.25.2`
github.com/docker/cli	`28.4.0+incompatible`	`28.5.0+incompatible`
github.com/go-git/go-git/v5	`5.16.2`	`5.16.3`
github.com/go-jose/go-jose/v4	`4.1.2`	`4.1.3`
github.com/hashicorp/go-getter	`1.8.1`	`1.8.2`
github.com/nwaples/rardecode/v2	`2.1.1`	`2.2.0`

Updates github.com/paketo-buildpacks/packit/v2 from 2.25.1 to 2.25.2

Release notes

Sourced from github.com/paketo-buildpacks/packit/v2's releases.

v2.25.2

What's Changed

Reverting commit with additional logging data by @pacostas in paketo-buildpacks/packit#693

Full Changelog: paketo-buildpacks/packit@v2.25.1...v2.25.2

Commits

65b2869 fix: reverting loging with additional data (#693)
See full diff in compare view

Updates github.com/docker/cli from 28.4.0+incompatible to 28.5.0+incompatible

Commits

887030f Merge pull request #6522 from thaJeztah/28.x_bump_moby
9c6a0e0 Merge pull request #6531 from thaJeztah/28.x_backport_bump_macos
f784471 vendor: github.com/docker/docker cd048300a487 (v28.5.0-dev)
d7afcf9 Merge pull request #6529 from thaJeztah/28.x_backport_deprecate_ResolveDefaul...
9d9adf6 gha: add macOS 15, remove macOS 13 (deprecated)
d4b7734 cli/command: deprecate ResolveDefaultContext
a106161 Merge pull request #6519 from thaJeztah/28.x_backport_authconfig_no_direct_cast
5e42f82 Merge pull request #6518 from thaJeztah/28.x_backport_memstore_notfounderr
645c23b Merge pull request #6514 from thaJeztah/28.x_backport_manifeststore_notfound
e491078 cli/command: explicitly map AuthConfig fields instead of a direct cast
Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.16.2 to 5.16.3

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.16.3

What's Changed

internal: Expand regex to fix build [5.x] by @baloo in go-git/go-git#1644

build: raise timeouts for windows CI tests and disable CIFuzz [5.x] by @baloo in go-git/go-git#1646

plumbing: support commits extra headers, support jujutsu signed commit [5.x] by @baloo in go-git/go-git#1633

Full Changelog: go-git/go-git@v5.16.2...v5.16.3

Commits

ad9a3a5 Merge pull request #1633 from baloo/baloo/release-5.x/jj-signed-commits
f2c3467 plumbing: support extra headers, support jujutsu signed commit [5.x]
c12263d Merge pull request #1646 from baloo/baloo/release-5.x/fixup-windows-ci
111f374 build: disable fuzzing on maintenance branch
15d46ce build: raise timeouts for windows CI tests
ce83ba1 Merge pull request #1644 from baloo/baloo/release-5.x/fixup-build
b486201 internal: Expand regex to fix build
See full diff in compare view

Updates github.com/go-jose/go-jose/v4 from 4.1.2 to 4.1.3

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.3

This release drops Go 1.23 support as that Go release is no longer supported. With that, we can drop x/crypto and no longer have any external dependencies in go-jose outside of the standard library!

This release fixes a bug where a critical b64 header was ignored if in an unprotected header. It is now rejected instead of ignored.

What's Changed

Remove Go 1.23 support by @mcpherrinm in go-jose/go-jose#205

Reject JWS with an unprotected critical b64 header by @mcpherrinm in go-jose/go-jose#210

Full Changelog: go-jose/go-jose@v4.1.2...v4.1.3

Commits

5348b9a Reject JWS with an unprotected critical b64 header (#210)
9153a5e Bump actions/setup-python from 5 to 6 (#208)
2126e17 Bump actions/setup-go from 5 to 6 (#209)
9860c65 Bump actions/checkout from 4 to 5 (#206)
14239fd Remove Go 1.23 support (#205)
a16e158 Update CI to run on Go 1.24 and 1.25 (#204)
See full diff in compare view

Updates github.com/hashicorp/go-getter from 1.8.1 to 1.8.2

Release notes

Sourced from github.com/hashicorp/go-getter's releases.

v1.8.2

What's Changed

Ensure temporary directory symlinks do not cause errors by @cam-stitt in hashicorp/go-getter#560

New Contributors

@cam-stitt made their first contribution in hashicorp/go-getter#560

Full Changelog: hashicorp/go-getter@v1.8.1...v1.8.2

Commits

60a3d53 Ensure temporary directory symlinks do not cause errors (#560)
See full diff in compare view

Updates github.com/nwaples/rardecode/v2 from 2.1.1 to 2.2.0

Commits

52fb4e8 allow max dictionary size to be set, with default now at 4GB
9f4b0d1 dont let the dictionary be larger than the unpacked file size
153fdf5 Merge pull request #47 from nwaples/bytereader
3f140e5 document RarFS methods
b4fc922 change os.FileMode to fs.FileMode
edb01e7 add Seek support for uncompressed files
710bda2 add initial Seek support for limitedReader
9deacfb save offset in packetFileReader
4f0a750 change limitedReader to save offset internally
1c32663 split volume into readerVolume and fileVolume
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go-modules group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/paketo-buildpacks/packit/v2](https://github.com/paketo-buildpacks/packit) | `2.25.1` | `2.25.2` | | [github.com/docker/cli](https://github.com/docker/cli) | `28.4.0+incompatible` | `28.5.0+incompatible` | | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.16.2` | `5.16.3` | | [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.1.2` | `4.1.3` | | [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter) | `1.8.1` | `1.8.2` | | [github.com/nwaples/rardecode/v2](https://github.com/nwaples/rardecode) | `2.1.1` | `2.2.0` | Updates `github.com/paketo-buildpacks/packit/v2` from 2.25.1 to 2.25.2 - [Release notes](https://github.com/paketo-buildpacks/packit/releases) - [Commits](paketo-buildpacks/packit@v2.25.1...v2.25.2) Updates `github.com/docker/cli` from 28.4.0+incompatible to 28.5.0+incompatible - [Commits](docker/cli@v28.4.0...v28.5.0) Updates `github.com/go-git/go-git/v5` from 5.16.2 to 5.16.3 - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](go-git/go-git@v5.16.2...v5.16.3) Updates `github.com/go-jose/go-jose/v4` from 4.1.2 to 4.1.3 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.1.2...v4.1.3) Updates `github.com/hashicorp/go-getter` from 1.8.1 to 1.8.2 - [Release notes](https://github.com/hashicorp/go-getter/releases) - [Changelog](https://github.com/hashicorp/go-getter/blob/main/.goreleaser.yml) - [Commits](hashicorp/go-getter@v1.8.1...v1.8.2) Updates `github.com/nwaples/rardecode/v2` from 2.1.1 to 2.2.0 - [Commits](nwaples/rardecode@v2.1.1...v2.2.0) --- updated-dependencies: - dependency-name: github.com/paketo-buildpacks/packit/v2 dependency-version: 2.25.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/docker/cli dependency-version: 28.5.0+incompatible dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.16.3 dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.3 dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/hashicorp/go-getter dependency-version: 1.8.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/nwaples/rardecode/v2 dependency-version: 2.2.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot · 2025-10-07T20:02:43Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 6, 2025

dependabot bot requested a review from a team as a code owner October 6, 2025 20:02

dependabot bot requested review from jericop and paketo-bot-reviewer October 6, 2025 20:02

dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 6, 2025

paketo-bot added the semver:patch A change requiring a patch version bump label Oct 6, 2025

dependabot bot closed this Oct 7, 2025

dependabot bot deleted the dependabot/go_modules/go-modules-b37fefd2fe branch October 7, 2025 20:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the go-modules group across 1 directory with 6 updates #947

Bump the go-modules group across 1 directory with 6 updates #947

Uh oh!

dependabot bot commented on behalf of github Oct 6, 2025 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Oct 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bump the go-modules group across 1 directory with 6 updates #947

Bump the go-modules group across 1 directory with 6 updates #947

Uh oh!

Conversation

dependabot bot commented on behalf of github Oct 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.25.2

What's Changed

v5.16.3

What's Changed

v4.1.3

What's Changed

v1.8.2

What's Changed

New Contributors

Uh oh!

dependabot bot commented on behalf of github Oct 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Oct 6, 2025 •

edited

Loading