🌱 Bump github.com/go-git/go-git/v5 from 5.12.0 to 5.16.5 in /hack/tools #248
Conversation
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.12.0 to 5.16.5. - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](go-git/go-git@v5.12.0...v5.16.5) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.16.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a spectrocloud member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![bulwark-spectrocloud[bot]](https://avatars.githubusercontent.com/u/36211249?s=60&v=4){kind=small}
There was a problem hiding this comment.
- GO-2025-3754
- Module: github.com/cloudflare/circl
- Found in: v1.3.7
- Fixed in: v1.6.1
- Example Traces:
1. cmd/clusterctl/internal/test/fake_github.go:24:2: test.init calls github.init, which eventually calls ed25519.init
2. cmd/clusterctl/internal/test/fake_github.go:24:2: test.init calls github.init, which eventually calls ecc.init
3. cmd/clusterctl/internal/test/fake_github.go:24:2: test.init calls github.init, which eventually calls ed25519.init
4. cmd/clusterctl/internal/test/fake_github.go:24:2: test.init calls github.init, which eventually calls goldilocks.init
5. cmd/clusterctl/internal/test/fake_github.go:24:2: test.init calls github.init, which eventually calls ed448.init
Please review these findings and fix the issues before merging.
There was a problem hiding this comment.
- G115: integer overflow conversion int64 -> int32, Severity: HIGH
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/cluster/cluster_controller_status.go:107:63
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/cluster/cluster_controller_status.go:104:70
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/internal/contract/types.go:129:22
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/internal/test/envtest/environment.go:93:47
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller_status.go:189:26
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller_status.go:123:26
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller.go:1214:37
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller.go:1213:33
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller.go:1212:40
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller.go:1211:28
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:678:26
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:666:27
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:241:33
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:226:35
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/internal/controllers/machinedeployment/mdutil/util.go:726:14
- ... (truncated), run gosec locally to capture all failure for the rule G115
-
- G404: Use of weak random number generator (math/rand or math/rand/v2 instead of crypto/rand), Severity: HIGH
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/util/util.go:61:8
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/util/conversion/conversion.go:160:18
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/test/infrastructure/inmemory/internal/controllers/inmemorymachine_controller.go:616:43
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/test/infrastructure/inmemory/internal/controllers/inmemorymachine_controller.go:478:33
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/test/infrastructure/inmemory/internal/controllers/inmemorymachine_controller.go:468:40
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/test/infrastructure/inmemory/internal/controllers/inmemorymachine_controller.go:411:43
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/test/infrastructure/inmemory/internal/controllers/inmemorymachine_controller.go:307:43
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/test/infrastructure/inmemory/internal/controllers/inmemorymachine_controller.go:269:43
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/test/infrastructure/docker/exp/internal/controllers/dockermachinepool_controller_phases.go:95:18
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/test/framework/machinedeployment_helpers.go:379:100
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/test/framework/machinedeployment_helpers.go:378:96
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/test/framework/machinedeployment_helpers.go:377:93
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/test/e2e/clusterclass_rollout.go:226:46
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/test/e2e/clusterclass_rollout.go:225:81
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/test/e2e/clusterclass_rollout.go:224:77
- ... (truncated), run gosec locally to capture all failure for the rule G404
-
- G402: TLS InsecureSkipVerify set true., Severity: HIGH
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/test/infrastructure/inmemory/pkg/server/mux.go:466:24
-
- File: /home/runner/_work/bulwark/bulwark/target-repo/controlplane/kubeadm/internal/workload_cluster.go:469:62
-
Please review these findings and fix the issues before merging.
|
This PR is related to - https://spectrocloud.atlassian.net/browse/PCP-6007 |
2 participants
Bumps github.com/go-git/go-git/v5 from 5.12.0 to 5.16.5.
Release notes
Sourced from github.com/go-git/go-git/v5's releases.
... (truncated)
Commits
48a1ae0Merge pull request #1836 from go-git/check-v542bdf1fstorage: filesystem, Verify idx matches pack file4146a56plumbing: format/idxfile, Verify idxfile's checksum63d78ecplumbing: format/packfile, Add new ErrMalformedPackFile25f1624Merge pull request #1800 from Ch00k/no-delete-untracked-v5600fb13git: worktree, Don't delete local untracked files when resetting worktree390a569Merge pull request #1746 from pjbgf/bump-go61c8b85build: Bump Go test versions to 1.23-1.25 (v5)e5a05ecMerge pull request #1744 from go-git/renovate/releases/v5.x-go-golang.org-x-c...1495930plumbing: Remove use of non-constant format stringsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.