Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY] #467

renovate · 2024-08-11T05:40:55Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-git/go-git/v5	`v5.1.0` -> `v5.13.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2023-49569

Impact

A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.

Applications are only affected if they are using the ChrootOS, which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS or in-memory filesystems are not affected by this issue.
This is a go-git implementation issue and does not affect the upstream git cli.

Patches

Users running versions of go-git from v4 and above are recommended to upgrade to v5.11 in order to mitigate this vulnerability.

Workarounds

In cases where a bump to the latest version of go-git is not possible in a timely manner, we recommend limiting its use to only trust-worthy Git servers.

Credit

Thanks to Ionut Lalu for responsibly disclosing this vulnerability to us.

CVE-2023-49568

Impact

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients.

Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability.
This is a go-git implementation issue and does not affect the upstream git cli.

Patches

Users running versions of go-git from v4 and above are recommended to upgrade to v5.11 in order to mitigate this vulnerability.

Workarounds

In cases where a bump to the latest version of go-git is not possible, we recommend limiting its use to only trust-worthy Git servers.

Credit

Thanks to Ionut Lalu for responsibly disclosing this vulnerability to us.

References

GHSA-mw99-9chc-xw7r

CVE-2025-21613

Impact

An argument injection vulnerability was discovered in go-git versions prior to v5.13.

Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries.

Affected versions

Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.

Workarounds

In cases where a bump to the latest version of go-git is not possible, we recommend users to enforce restrict validation rules for values passed in the URL field.

Credit

Thanks to @vin01 for responsibly disclosing this vulnerability to us.

CVE-2025-21614

Impact

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients.

This is a go-git implementation issue and does not affect the upstream git cli.

Patches

Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.

Workarounds

In cases where a bump to the latest version of go-git is not possible, we recommend limiting its use to only trust-worthy Git servers.

Credit

Thanks to Ionut Lalu for responsibly disclosing this vulnerability to us.

Release Notes

go-git/go-git (github.com/go-git/go-git/v5)

`v5.13.0`

Compare Source

What's Changed

build: bump github.com/go-git/go-git/v5 from 5.11.0 to 5.12.0 in /cli/go-git by @dependabot in #1065
build: bump golang.org/x/net from 0.22.0 to 0.23.0 by @dependabot in #1068
build: bump golang.org/x/net from 0.23.0 to 0.24.0 by @dependabot in #1071
Properly support skipping of non-mandatory extensions by @codablock in #1066
git: Refine some codes in test and non-test. by @onee-only in #1077
plumbing: protocol/packp, client-side filter capability support by @edigaryev in #1000
build: bump golang.org/x/net from 0.22.0 to 0.23.0 in /cli/go-git by @dependabot in #1078
plumbing: fix sideband demux on flush by @aymanbagabas in #1084
storage: dotgit, head reference usually comes first by @aymanbagabas in #1085
build: bump golang.org/x/text from 0.14.0 to 0.15.0 by @dependabot in #1091
build: bump golang.org/x/crypto from 0.22.0 to 0.23.0 by @dependabot in #1094
build: bump golang.org/x/net from 0.24.0 to 0.25.0 by @dependabot in #1093
git: Added an example for Repository.Branches by @johnmatthiggins in #1088
git: worktree_commit, Modify checking empty commit. Fixes #723 by @onee-only in #1050
plumbing: transport/http, Wrap http errors to return reason. Fixes #1097 by @ggambetti in #1100
build: bump golang.org/x/sys from 0.20.0 to 0.21.0 by @dependabot in #1106
build: bump golang.org/x/text from 0.15.0 to 0.16.0 by @dependabot in #1107
Bumps Go versions and go-billy by @pjbgf in #1056
_examples: Fixed a dead link COMPATIBILITY.md by @gecko655 in #1109
build: bump github.com/jessevdk/go-flags from 1.5.0 to 1.6.1 in /cli/go-git by @dependabot in #1115
build: bump github.com/elazarl/goproxy from v0.0.0-20230808193330-2592e75ae04a to v0.0.0-20240618083138-03be62527ccb by @hbelmiro in #1124
build: bump golang.org/x/net from 0.25.0 to 0.26.0 by @dependabot in #1104
Add option approximating git clean -x flag. by @msuozzo in #995
Revert "Add option approximating git clean -x flag." by @pjbgf in #1129
Fix reference updated concurrently error for the filesystem storer by @Javier-varez in #1116
build: bump golang.org/x/net from 0.26.0 to 0.27.0 by @dependabot in #1134
utils: merkletrie, Align error message with upstream by @pjbgf in #1142
plumbing: transport/file, Change paths to absolute by @pjbgf in #1141
plumbing: gitignore, Fix loading of ignored .gitignore files. by @Achilleshiel in #1114
build: bump github.com/skeema/knownhosts from 1.2.2 to 1.3.0 by @dependabot in #1147
plumbing: transport/ssh, Add support for SSH @cert-authority. by @Javier-varez in #1157
build: run example tests during CI workflow by @crazybolillo in #1030
storage: filesystem, Fix object cache not working due to uninitialised objects being put into cache by @SatelliteMind in #1138
git: Fix fetching missing commits by @AriehSchneier in #1032
plumbing: format/packfile, remove duplicate checks in findMatch() by @edigaryev in #1152
git: worktree, Fix file reported as Untracked while it is committed by @rodrigocam in #1023
build: bump golang.org/x/sys from 0.22.0 to 0.23.0 by @dependabot in #1160
plumbing: filemode, Remove check for setting size of .git/index file by @nicholasSUSE in #1159
build: bump golang.org/x/net from 0.27.0 to 0.28.0 by @dependabot in #1163
Fix some lint warning and increase stalebot to 180 days by @pjbgf in #1128
adjust path extracted from file: url on Windows by @tomqwpl in #416
build: bump golang.org/x/sys from 0.23.0 to 0.24.0 by @dependabot in #1164
Add RestoreStaged to Worktree that mimics the behaviour of git restore --staged ... by @ben-tbotlabs in #493
plumbing: signature, support the same x509 signature formats as git by @yoavamit in #1169
fix: allow discovery of non bare repos in fsLoader by @jakobmoellerdev in #1170
build: bump golang.org/x/sys from 0.24.0 to 0.25.0 by @dependabot in #1178
build: bump golang.org/x/text from 0.17.0 to 0.18.0 by @dependabot in #1179
build: bump golang.org/x/net from 0.28.0 to 0.29.0 by @dependabot in #1184
Consume push URLs when they are provided by @mcepl in #1191
*: use gocheck's MkDir instead of TempDir for tests. Fixes #807 by @uragirii in #1194
build: bump golang.org/x/net from 0.29.0 to 0.30.0 by @dependabot in #1200
worktree: .git/index not correctly generated when running on Windows by @BeChris in #1198
git: worktree, Fix sparse reset. Fixes #90 by @onee-only in #1101
git: worktree, Pass context on updateSubmodules. Fixes #1098 by @onee-only in #1154
build: bump github.com/go-git/go-billy/v5 from 5.5.1-0.20240427054813-8453aa90c6ec to 5.6.0 by @dependabot in #1211
Update contributing guidelines by @pjbgf in #1217
build: bump github.com/ProtonMail/go-crypto from 1.0.0 to 1.1.1 by @dependabot in #1222
build: bump golang.org/x/sys from 0.26.0 to 0.27.0 by @dependabot in #1223
build: bump golang.org/x/crypto from 0.28.0 to 0.29.0 by @dependabot in #1221
build: bump github.com/ProtonMail/go-crypto from 1.1.1 to 1.1.2 by @dependabot in #1226
build: bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @dependabot in #1232
build: bump github.com/ProtonMail/go-crypto from 1.1.2 to 1.1.3 by @dependabot in #1231
build: General improvements around fuzzing by @pjbgf in #1229
build: bump golang.org/x/net from 0.30.0 to 0.32.0 by @dependabot in #1241
build: group dependabot updates for golang.org by @AriehSchneier in #1243
build: bump github/codeql-action from 2.22.11 to 3.27.6 by @dependabot in #1244
build: bump golang.org/x/crypto from 0.21.0 to 0.31.0 in /cli/go-git by @dependabot in #1246
build: bump golang.org/x/crypto from 0.30.0 to 0.31.0 by @dependabot in #1247
build: bump github.com/gliderlabs/ssh from 0.3.7 to 0.3.8 by @dependabot in #1248
add comment preventing people from creating invalid trees by @petar in #732
build: bump github/codeql-action from 3.27.6 to 3.27.9 by @dependabot in #1250
plumbing: Properly encode index version 4 by @BeChris in #1251
Fix typos by @deining in #1148
Fix reset files in subfolders by @linglo in #1177
git: update switch cases by @hezhizhen in #1182
build: bump golang.org/x/net from 0.32.0 to 0.33.0 in the golang-org group by @dependabot in #1256
fix(1212): Fix invalid reference name error while cloning branches containing /- by @varmakarthik12 in #1257
pktline : accept upercase hexadecimal value as pktline length information by @BeChris in #1220
build: bump github/codeql-action from 3.27.9 to 3.28.0 by @dependabot in #1260
build: bump github.com/elazarl/goproxy from 0.0.0-20240618083138-03be62527ccb to 1.2.1 by @dependabot in #1262
git: worktree_commit, sanitize author and commiter name and email before creating the commit object. Fixes #680 by @BeChris in #1261

New Contributors

@johnmatthiggins made their first contribution in #1088
@ggambetti made their first contribution in #1100
@gecko655 made their first contribution in #1109
@hbelmiro made their first contribution in #1124
@msuozzo made their first contribution in #995
@Javier-varez made their first contribution in #1116
@Achilleshiel made their first contribution in #1114
@crazybolillo made their first contribution in #1030
@SatelliteMind made their first contribution in #1138
@rodrigocam made their first contribution in #1023
@nicholasSUSE made their first contribution in #1159
@tomqwpl made their first contribution in #416
@ben-tbotlabs made their first contribution in #493
@yoavamit made their first contribution in #1169
@uragirii made their first contribution in #1194
@petar made their first contribution in #732
@deining made their first contribution in #1148
@linglo made their first contribution in #1177
@varmakarthik12 made their first contribution in #1257

Full Changelog: go-git/go-git@v5.12.0...v5.13.0

`v5.12.0`

Compare Source

What's Changed

git: Worktree.AddWithOptions: add skipStatus option when providing a specific path by @moranCohen26 in #994
git: Signer: fix usage of crypto.Signer interface by @wlynch in #1029
git: Remote, fetch, adds the prune option. by @juliens in #366
git: Add crypto.Signer option to CommitOptions. by @wlynch in #996
git: Worktree checkout tag hash id (#959) by @aymanbagabas in #966
git: Worktree, Don't panic on empty or root path when checking if it is valid by @tim775 in #1042
git: Add commit validation for Reset by @pjbgf in #1048
git: worktree_commit, Fix amend commit to apply changes. Fixes #1024 by @onee-only in #1045
git: Implement Merge function with initial FastForwardMerge support by @pjbgf in #1044
plumbing: object, Make first commit visible on logs filtered with filename. Fixes #191 by @onee-only in #1036
plumbing: no panic in printStats function. Fixes #177 by @nodivbyzero in #971
plumbing: object, Optimize logging with file. by @onee-only in #1046
plumbing: object, check legitimacy in (*Tree).Encode by @niukuo in #967
plumbing: format/gitattributes, close file in ReadAttributesFile by @prskr in #1018
plumbing: check setAuth error. Fixes #185 by @nodivbyzero in #969
plumbing: object, fix variable defaultUtf8CommitMessageEncoding name spell error by @Jerry-yz in #987
utils: merkletrie, calculate filesystem node's hash lazily. by @candid82 in #825
utils: update comment in node.go's Hash() by @codablock in #992
_example: fix 404 link and added ssh-agent clone link by @grinish21 in #1022
_example: checkout-branch example by @dlambda in #446
_example: example for git clone using ssh-agent by @pjbgf in #998

New Contributors

@candid82 made their first contribution in #825
@codablock made their first contribution in #992
@Jerry-yz made their first contribution in #987
@wlynch made their first contribution in #996
@moranCohen26 made their first contribution in #994
@grinish21 made their first contribution in #1022
@prskr made their first contribution in #1018
@dlambda made their first contribution in #446
@juliens made their first contribution in #366
@onee-only made their first contribution in #1036
@tim775 made their first contribution in #1042
@niukuo made their first contribution in #967
@avoidalone made their first contribution in #1047

Full Changelog: go-git/go-git@v5.11.0...v5.12.0

`v5.11.0`

Compare Source

What's Changed

git: validate reference names (#929) by @aymanbagabas in #950
git: stop iterating at oldest shallow when pulling. Fixes #305 by @dhoizner in #939
plumbing: object, enable renames in getFileStatsFromFilePatches by @djmoch in #941
storage: filesystem, Add option to set a specific FS for alternates by @pjbgf in #953
Align worktree validation with upstream and remove build warnings by @pjbgf in #958

New Contributors

@dhoizner made their first contribution in #939
@djmoch made their first contribution in #941

Full Changelog: go-git/go-git@v5.10.1...v5.11.0

`v5.10.1`

Compare Source

What's Changed

Worktree, ignore ModeSocket files by @steiler in #930
git: add tracer package by @aymanbagabas in #916
remote: Flip clause for fast-forward only check by @adityasaky in #875
plumbing: transport/ssh, Fix nil pointer dereference caused when an unreachable proxy server is set. Fixes #900 by @anandf in #901
plumbing: uppload-server-info, implement upload-server-info by @aymanbagabas in #896
plumbing: optimise memory consumption for filesystem storage by @pjbgf in #799
plumbing: format/packfile, Refactor patch delta by @pjbgf in #908
plumbing: fix empty uploadpack request error by @aymanbagabas in #932
plumbing: transport/git, Improve tests error message by @pjbgf in #752
plumbing: format/pktline, Respect pktline error-line errors by @aymanbagabas in #936
utils: remove ioutil.Pipe and use std library io.Pipe by @aymanbagabas in #922
utils: move trace to utils by @aymanbagabas in #931
cli: separate go module for cli by @aymanbagabas in #914
build: bump github.com/google/go-cmp from 0.5.9 to 0.6.0 by @dependabot in #887
build: bump actions/setup-go from 3 to 4 by @dependabot in #891
build: bump github.com/skeema/knownhosts from 1.2.0 to 1.2.1 by @dependabot in #888
build: bump actions/checkout from 3 to 4 by @dependabot in #890
build: bump golang.org/x/sys from 0.13.0 to 0.14.0 by @dependabot in #907
build: bump golang.org/x/text from 0.13.0 to 0.14.0 by @dependabot in #906
build: bump golang.org/x/crypto from 0.14.0 to 0.15.0 by @dependabot in #917
build: bump golang.org/x/net from 0.17.0 to 0.18.0 by @dependabot in #918

New Contributors

@anandf made their first contribution in #901
@steiler made their first contribution in #930

Full Changelog: go-git/go-git@v5.10.0...v5.10.1

`v5.10.0`

Compare Source

What's Changed

PlainInitOptions.Bare and allow using InitOptions with PlainInitWithOptions by @ThinkChaos in #782
Worktree, apply ProxyOption on Pull by @nodivbyzero in #840
Repository: add clone --shared feature by @enverbisevac in #860
build: Add github workflow to check commit message format by @pjbgf in #867
Improve handling of remote errors by @makkes in #866
build(deps): bump golang.org/x/net from 0.15.0 to 0.17.0 by @dependabot in #873
plumbing: commitgraph, Add generation v2 support by @zeripath in #869
plumbing: protocol/packp, Add validation for decodeLine by @pjbgf in #868
plumbing: parse the encoding header of the commit object by @liwenqiu in #761
plumbing: commitgraph, allow SHA256 commit-graphs by @zeripath in #853
plumbing: commitgraph, Allow reading commit-graph chains by @zeripath in #854
plumbing/object: Support mergetag in merge commits by @adityasaky in #847

New Contributors

@nodivbyzero made their first contribution in #840
@adityasaky made their first contribution in #847
@hezhizhen made their first contribution in #836
@0x34d made their first contribution in #855
@liwenqiu made their first contribution in #761
@enverbisevac made their first contribution in #860
@makkes made their first contribution in #866

Full Changelog: go-git/go-git@v5.9.0...v5.10.0

`v5.9.0`

Compare Source

What's Changed

git: worktree: add Amend option to CommitOptions by @john-cai in #438
git: worktree, reset ignored files that are part of the worktree: Fixes #819 by @daolis in #821
plumbing: Do not swallow http message coming from VCS providers by @matejrisek in #835
plumbing: transport, handle IPv6 while parsing endpoint. Fixes #740 by @ninedraft in #820
*: update goproxy dependency to fix CVE-2023-37788 vulnerability by @svghadi in #832
*: bump dependencies and Go to 1.19 by @pjbgf in #837

New Contributors

@svghadi made their first contribution in #832
@daolis made their first contribution in #821

Full Changelog: go-git/go-git@v5.8.1...v5.9.0

`v5.8.1`

Compare Source

What's Changed

*: Bump dependencies by @pjbgf in #815

Full Changelog: go-git/go-git@v5.8.0...v5.8.1

`v5.8.0`

Compare Source

What's Changed

git: Fix fetching after shallow clone. Fixes #305 by @AriehSchneier in #778
git: enable fetch with unqualified references by @AriehSchneier in #762
git: don't add to want if exists, shallow and depth 1 by @AriehSchneier in #763
git: Clone HEAD should not force master. Fixes #363 by @AriehSchneier in #758
git: fix the issue with submodules having the SCP style URL fail due to the wrong URL parsing by @matejrisek in #756
git: add a clone option to allow for shallow cloning of submodules by @matejrisek in #765
worktree: minor speedup for doAddDirectory by @ThinkChaos in #702
_examples: Remove wrong comment by @pascal-hofmann in #357
*: Handle paths starting with tilde by @ricci2511 in #808
*: Handle paths starting with ~Username by @AriehSchneier in #809
storage: filesystem/dotgit, add support for tmp_objdir prefix by @L11R in #812
plumbing: gitignore, replace user dir in path by @Jleagle in #772
plumbing: gitignore, fix incorrect parsing. Fixes #500 by @AriehSchneier in #781
plumbing: http, Fix empty repos on Git v2.41+ by @pjbgf in #802
plumbing: packp, A request is not empty if it contains shallows. Fixes #328 by @AriehSchneier in #792
plumbing: blame, Complete rewrite. Fixes #603 by @AriehSchneier in #789
plumbing: gitignore, Allow gitconfig to contain a gitignore relative to any user home. Fixes #578 by @AriehSchneier in #785

New Contributors

@Jleagle made their first contribution in #772
@pascal-hofmann made their first contribution in #357
@ricci2511 made their first contribution in #808
@L11R made their first contribution in #812

Full Changelog: go-git/go-git@v5.7.0...v5.7.1

`v5.7.0`

Compare Source

What's Changed

*: Add support for initializing SHA256 repositories by @pjbgf in #707
git: add mirror clone option by @aymanbagabas in #735
git: Add support to ls-remote with peeled references. Fixes #749 by @pjbgf in #750
git: fix cloning with branch name by @AriehSchneier in #755
git: Worktree, add check to see if file already checked in. Fixes #718 by @cbbm142 in #719
git: Worktree, git grep bare repositories by @aymanbagabas in #728
git: Add Depth to SubmoduleUpdateOptions by @matejrisek in #754
git: Testing, Fix tests not cleaning temp folders by @AriehSchneier in #769
git: remote, add support for a configurable timeout. by @andrewpollock in #753
git: Allow Initial Branch to be configurable by @techknowlogick in #764
storage: filesystem/dotgit, Improve load packed-refs by @fcharlie in #743
storage: filesystem, Populate index before use. Fixes #148 by @AriehSchneier in #722
plumbing: resolve non-external delta references by @ZauberNerd in #485
plumbing/transport: fix regression in scp-like match by @jotadrilo in #715
plumbing/transport: Add support for custom proxy settings by @aryan9600 in #744
*: small fixes across the codebase by @pjbgf in #770
*: bump github.com/cloudflare/circl from 1.1.0 to 1.3.3 by @dependabot in #776
*: bump dependencies by @pjbgf in #748
*: bump Go version to 1.18 on go.mod by @pjbgf in #774
*: add Codeql workflow and bump dependencies by @pjbgf in #775
ci: fix upstream git build for master branch by @pjbgf in #739

New Contributors

@ZauberNerd made their first contribution in #485
@jotadrilo made their first contribution in #715
@fcharlie made their first contribution in #743
@AriehSchneier made their first contribution in #755
@cbbm142 made their first contribution in #719
@aryan9600 made their first contribution in #744
@matejrisek made their first contribution in #754
@andrewpollock made their first contribution in #753
@techknowlogick made their first contribution in #764

Full Changelog: go-git/go-git@v5.6.1...v5.7.0

`v5.6.1`

Compare Source

What's Changed

plumbing/transport: don't use the firstErrLine when it is empty by @ThinkChaos in #682
plumbing/transport: ssh, unable to pass a custom HostKeyCallback func by @aymanbagabas in #655
storage/filesystem: dotgit: fix a filesystem race in Refs/walkReferencesTree by @MichaelMure in #659
*: bump golang.org/x/net from 0.2.0 to 0.7.0 by @dependabot in #684
*: bump dependencies by @pjbgf in #697
*: fix panic for empty revisions by @pjbgf in #696
ci: bump GitHub actions, enable go test race detection and stop using developer's GPG keys during test execution by @pjbgf in #701

Full Changelog: go-git/go-git@v5.6.0...v5.6.1

`v5.6.0`

Compare Source

What's Changed

Worktree, check for empty parent dirs during Reset (Fixes #670) by @mbohy in #671
*: remove need to build with CGO by @pjbgf in #688
plumbing: support SSH/X509 signed tags by @hiddeco in #690

Full Changelog: go-git/go-git@v5.5.2...v5.6.0

`v5.5.2`

Compare Source

What's Changed

*: update go-billy v5.4.0, removes data races. Fixes #629 by @mcuadros in #653
Worktree: Add, fix add removed files. Fixes #223 by @tfujiwar in #652

Full Changelog: go-git/go-git@v5.5.1...v5.5.2

`v5.5.1`

Compare Source

What's Changed

*: fix error when building with CGO_ENABLED=0 by @pjbgf in #625
plumbing: transport/ssh: fix panic on Windows 10 with paegent as ssh-agent by @doxsch in [#617](https://redire

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2024-08-11T05:40:55Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: downloading github.com/go-git/go-git/v5 v5.13.0
go: downloading golang.org/x/net v0.33.0
go: downloading github.com/fsnotify/fsnotify v1.4.9
go: downloading golang.org/x/crypto v0.31.0
go: downloading github.com/sirupsen/logrus v1.9.0
go: downloading golang.org/x/sync v0.10.0
go: downloading golang.org/x/text v0.21.0
go: downloading golang.org/x/term v0.27.0
go: downloading github.com/ProtonMail/go-crypto v1.1.3
go: downloading github.com/go-git/go-billy/v5 v5.6.0
go: downloading github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
go: downloading github.com/emirpasic/gods v1.18.1
go: downloading k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a
go: downloading github.com/rogpeppe/go-internal v1.11.0
go: downloading google.golang.org/protobuf v1.34.1
go: downloading github.com/cyphar/filepath-securejoin v0.2.5
go: downloading github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376
go: downloading github.com/pjbgf/sha1cd v0.3.0
go: downloading golang.org/x/mod v0.19.0
go: downloading github.com/cloudflare/circl v1.3.7
go: downloading github.com/kevinburke/ssh_config v1.2.0
go: downloading github.com/skeema/knownhosts v1.3.0
go: downloading github.com/xanzy/ssh-agent v0.3.3
go: downloading golang.org/x/tools v0.23.0
go: downloading golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1
go: downloading golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
go: downloading github.com/Microsoft/go-winio v0.6.2
go: github.com/qlik-oss/sense-installer/pkg/qliksense imports
	github.com/qlik-oss/k-apis/pkg/git imports
	github.com/go-git/go-git/v5 imports
	github.com/go-git/go-git/v5/plumbing/transport/client imports
	github.com/go-git/go-git/v5/plumbing/transport/file imports
	golang.org/x/sys/execabs: cannot find module providing package golang.org/x/sys/execabs

Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY]

3d84653

renovate bot force-pushed the renovate/go-github.com-go-git-go-git-v5-vulnerability branch from 77ae5aa to 3d84653 Compare January 7, 2025 07:13

renovate bot changed the title ~~Update module github.com/go-git/go-git/v5 to v5.11.0 [SECURITY]~~ Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY] Jan 7, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY] #467

Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY] #467

Uh oh!

renovate bot commented Aug 11, 2024 •

edited

Loading

Uh oh!

renovate bot commented Aug 11, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY] #467

Are you sure you want to change the base?

Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY] #467

Uh oh!

Conversation

renovate bot commented Aug 11, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

Credit

Impact

Patches

Workarounds

Credit

References

Impact

Affected versions

Workarounds

Credit

Impact

Patches

Workarounds

Credit

Release Notes

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

Configuration

Uh oh!

renovate bot commented Aug 11, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: go.sum

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Aug 11, 2024 •

edited

Loading

renovate bot commented Aug 11, 2024 •

edited

Loading