Bump the go-modules group across 1 directory with 8 updates

[dependabot]

Bumps the go-modules group with 8 updates in the / directory:

Package	From	To
github.com/paketo-buildpacks/packit/v2	2.25.1	2.25.2
cloud.google.com/go/auth	0.16.5	0.17.0
github.com/docker/cli	28.4.0+incompatible	28.5.0+incompatible
github.com/docker/docker-credential-helpers	0.9.3	0.9.4
github.com/go-git/go-git/v5	5.16.2	5.16.3
github.com/go-jose/go-jose/v4	4.1.2	4.1.3
github.com/hashicorp/go-getter	1.8.1	1.8.2
github.com/nwaples/rardecode/v2	2.1.1	2.2.0

Updates github.com/paketo-buildpacks/packit/v2 from 2.25.1 to 2.25.2

Release notes

Sourced from github.com/paketo-buildpacks/packit/v2's releases.

v2.25.2

What's Changed

• Reverting commit with additional logging data by @​pacostas in paketo-buildpacks/packit#693

Full Changelog: paketo-buildpacks/packit@v2.25.1...v2.25.2

Commits

• 65b2869 fix: reverting loging with additional data (#693)
• See full diff in compare view

Updates cloud.google.com/go/auth from 0.16.5 to 0.17.0

Release notes

Sourced from cloud.google.com/go/auth's releases.

auth 0.17.0

0.17.0 (2025-10-02)

Features

• add trust boundary support for external accounts (#12864) (a67a146)

• Add trust boundary support for service accounts and impersonation (HTTP/gRPC) (#11870) (5c2b665)

Changelog

Sourced from cloud.google.com/go/auth's changelog.

v0.17.0

• firestore BREAKING CHANGES:

  • Remove UpdateMap and UpdateStruct; rename UpdatePaths to Update. Change docref.UpdateMap(ctx, map[string]interface{}{"a.b", 1}) to docref.Update(ctx, []firestore.Update{{Path: "a.b", Value: 1}})

    Change docref.UpdateStruct(ctx, []string{"Field"}, aStruct) to docref.Update(ctx, []firestore.Update{{Path: "Field", Value: aStruct.Field}})

  • Rename MergePaths to Merge; require args to be FieldPaths

  • A value stored as an integer can be read into a floating-point field, and vice versa.

• bigtable/cmd/cbt:
  • Support deleting a column.
  • Add regex option for row read.
• spanner: Mark stable.
• storage:
  • Add Reader.ContentEncoding method.
  • Fix handling of SignedURL headers.
• bigquery:
  • If Uploader.Put is called with no rows, it returns nil without making a call.
  • Schema inference supports the "nullable" option in struct tags for non-required fields.
  • TimePartitioning supports "Field".

v0.16.0

• Other bigquery changes:

  • JobIterator.Next returns *Job; removed JobInfo (BREAKING CHANGE).
  • UseStandardSQL is deprecated; set UseLegacySQL to true if you need Legacy SQL.
  • Uploader.Put will generate a random insert ID if you do not provide one.
  • Support time partitioning for load jobs.
  • Support dry-run queries.
  • A Job remembers its last retrieved status.
  • Support retrieving job configuration.
  • Support labels for jobs and tables.
  • Support dataset access lists.
  • Improve support for external data sources, including data from Bigtable and Google Sheets, and tables with external data.
  • Support updating a table's view configuration.
  • Fix uploading civil times with nanoseconds.

• storage:

  • Support PubSub notifications.

... (truncated)

Commits

• 050b16d all: update version and README
• def6812 storage: fix SignedURL integration test
• ff434d4 all: make tests pass with go1.10beta1
• ad7ff91 storage: add header sanitisation for SignedURL.
• b97d364 internal/fields: fix test to match next Go version
• 6856ba4 bigquery: support inference of nullable fields
• 5fa930e bigquery: support time-partitioning field
• 9cfa4d0 bigtable: link to the cbt installation instructions in the cbt docs
• 3051b91 datatransfer: move into bigquery dir
• 5733118 firestore: remove UpdateMap and UpdateStruct
• Additional commits viewable in compare view

Updates github.com/docker/cli from 28.4.0+incompatible to 28.5.0+incompatible

Commits

• 887030f Merge pull request #6522 from thaJeztah/28.x_bump_moby
• 9c6a0e0 Merge pull request #6531 from thaJeztah/28.x_backport_bump_macos
• f784471 vendor: github.com/docker/docker cd048300a487 (v28.5.0-dev)
• d7afcf9 Merge pull request #6529 from thaJeztah/28.x_backport_deprecate_ResolveDefaul...
• 9d9adf6 gha: add macOS 15, remove macOS 13 (deprecated)
• d4b7734 cli/command: deprecate ResolveDefaultContext
• a106161 Merge pull request #6519 from thaJeztah/28.x_backport_authconfig_no_direct_cast
• 5e42f82 Merge pull request #6518 from thaJeztah/28.x_backport_memstore_notfounderr
• 645c23b Merge pull request #6514 from thaJeztah/28.x_backport_manifeststore_notfound
• e491078 cli/command: explicitly map AuthConfig fields instead of a direct cast
• Additional commits viewable in compare view

Updates github.com/docker/docker-credential-helpers from 0.9.3 to 0.9.4

Release notes

Sourced from github.com/docker/docker-credential-helpers's releases.

v0.9.4

What's Changed

• update to go1.25.1 docker/docker-credential-helpers#387
• wincred: fix unsafe uintptr usage to be GC-safe on go1.25 docker/docker-credential-helpers#386
• gha: add macos-15-intel, remove macos-13 (deprecated) docker/docker-credential-helpers#384
• deb: Dockerfile: update to debian bookworm, ubuntu jammy (22.04) docker/docker-credential-helpers#385
• Dockerfile: update xx to v1.7.0 docker/docker-credential-helpers#383
• Dockerfile: update golangci-lint to v2.5 docker/docker-credential-helpers#386
• Dockerfile: merge build stages docker/docker-credential-helpers#249
• build(deps): bump github.com/danieljoos/wincred v1.2.3 docker/docker-credential-helpers#388
• build(deps): bump softprops/action-gh-release from 2.2.1 to 2.3.2 docker/docker-credential-helpers#373
• build(deps): bump actions/checkout from 4 to 5 docker/docker-credential-helpers#376
• build(deps): bump actions/setup-go from 5 to 6 docker/docker-credential-helpers#377
• build(deps): bump actions/github-script from 7 to 8 docker/docker-credential-helpers#378
• build(deps): bump softprops/action-gh-release from 2.3.2 to 2.3.3 docker/docker-credential-helpers#379

Full Changelog: docker/docker-credential-helpers@v0.9.3...v0.9.4

Commits

• 84c3413 Merge pull request #387 from thaJeztah/bump_go1.25
• fcb0b66 update to go1.25.1
• cf4e41f Merge pull request #388 from thaJeztah/bump_wincred
• 53f7bdc vendor: github.com/danieljoos/wincred v1.2.3
• d4602cd Merge pull request #249 from crazy-max/upd-dockerfile
• ae84c25 Dockerfile: merge build stages
• 2adf3cf Merge pull request #383 from thaJeztah/bump_go_deps
• 1fdce4c Dockerfile: update xx to v1.7.0
• 962a779 update to go1.24.7
• ec5efac Merge pull request #386 from thaJeztah/bump_golangci_lint
• Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.16.2 to 5.16.3

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.16.3

What's Changed

• internal: Expand regex to fix build [5.x] by @​baloo in go-git/go-git#1644
• build: raise timeouts for windows CI tests and disable CIFuzz [5.x] by @​baloo in go-git/go-git#1646
• plumbing: support commits extra headers, support jujutsu signed commit [5.x] by @​baloo in go-git/go-git#1633

Full Changelog: go-git/go-git@v5.16.2...v5.16.3

Commits

• ad9a3a5 Merge pull request #1633 from baloo/baloo/release-5.x/jj-signed-commits
• f2c3467 plumbing: support extra headers, support jujutsu signed commit [5.x]
• c12263d Merge pull request #1646 from baloo/baloo/release-5.x/fixup-windows-ci
• 111f374 build: disable fuzzing on maintenance branch
• 15d46ce build: raise timeouts for windows CI tests
• ce83ba1 Merge pull request #1644 from baloo/baloo/release-5.x/fixup-build
• b486201 internal: Expand regex to fix build
• See full diff in compare view

Updates github.com/go-jose/go-jose/v4 from 4.1.2 to 4.1.3

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.3

This release drops Go 1.23 support as that Go release is no longer supported. With that, we can drop x/crypto and no longer have any external dependencies in go-jose outside of the standard library!

This release fixes a bug where a critical b64 header was ignored if in an unprotected header. It is now rejected instead of ignored.

What's Changed

• Remove Go 1.23 support by @​mcpherrinm in go-jose/go-jose#205
• Reject JWS with an unprotected critical b64 header by @​mcpherrinm in go-jose/go-jose#210

Full Changelog: go-jose/go-jose@v4.1.2...v4.1.3

Commits

• 5348b9a Reject JWS with an unprotected critical b64 header (#210)
• 9153a5e Bump actions/setup-python from 5 to 6 (#208)
• 2126e17 Bump actions/setup-go from 5 to 6 (#209)
• 9860c65 Bump actions/checkout from 4 to 5 (#206)
• 14239fd Remove Go 1.23 support (#205)
• a16e158 Update CI to run on Go 1.24 and 1.25 (#204)
• See full diff in compare view

Updates github.com/hashicorp/go-getter from 1.8.1 to 1.8.2

Release notes

Sourced from github.com/hashicorp/go-getter's releases.

v1.8.2

What's Changed

• Ensure temporary directory symlinks do not cause errors by @​cam-stitt in hashicorp/go-getter#560

New Contributors

• @​cam-stitt made their first contribution in hashicorp/go-getter#560

Full Changelog: hashicorp/go-getter@v1.8.1...v1.8.2

Commits

• 60a3d53 Ensure temporary directory symlinks do not cause errors (#560)
• See full diff in compare view

Updates github.com/nwaples/rardecode/v2 from 2.1.1 to 2.2.0

Commits

• 52fb4e8 allow max dictionary size to be set, with default now at 4GB
• 9f4b0d1 dont let the dictionary be larger than the unpacked file size
• 153fdf5 Merge pull request #47 from nwaples/bytereader
• 3f140e5 document RarFS methods
• b4fc922 change os.FileMode to fs.FileMode
• edb01e7 add Seek support for uncompressed files
• 710bda2 add initial Seek support for limitedReader
• 9deacfb save offset in packetFileReader
• 4f0a750 change limitedReader to save offset internally
• 1c32663 split volume into readerVolume and fileVolume
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.