build(deps): bump go-git v5.12.0 -> v5.19.2 and cover the go-git collector with tests - #9055
Merged
Conversation
The go-git based collector (used when UseGoGit is set) had no test coverage at all, which makes any go-git upgrade a leap of faith. Adds a test that builds a repository on disk with a known shape -- three commits, one tag, a second branch checked out so HEAD is not the default branch -- and asserts CountCommits, CountTags and CountBranches, that the counting helpers stop on a cancelled context, and that opening a directory which is not a repository fails. The test passes both on go-git v5.12.0 and on the version this branch upgrades to, so it documents unchanged behaviour across the bump. Signed-off-by: DoDiODev <DoDiDev@proton.me>
github.com/go-git/go-git/v5 v5.12.0 -> v5.19.2 github.com/go-git/go-billy/v5 v5.5.0 -> v5.9.0 (pulled in) github.com/cloudflare/circl v1.3.7 -> v1.6.3 (pulled in) 16 known CVEs in total across the three modules. govulncheck reports 12 of them as reachable from this code base before the bump (8 in go-git, 2 in go-billy, 2 in circl) and none after. The go-git ones include GO-2025-3367 and GO-2025-3368 (argument injection through crafted URLs) and GO-2026-4909/4910. go-git is used in exactly one place: plugins/gitextractor/parser/repo_gogit.go opens an already cloned repository with PlainOpen and walks commits, tags, branches and trees. Cloning is done by the git CLI (parser.NewGitcliCloner), so the go-git transports are not on the path -- this bump does not change how DevLake talks to remotes. No source change was required. Verified with the collector test added in the previous commit, which passes on both the old and the new version. Minimal version selection also pulls up golang.org/x/crypto, x/net, x/sys, x/text, x/tools, ProtonMail/go-crypto, pjbgf/sha1cd, skeema/knownhosts, cyphar/filepath-securejoin, Microsoft/go-winio, klauspost/cpuid and golang/protobuf. Signed-off-by: DoDiODev <DoDiDev@proton.me>
klesh
previously approved these changes
Aug 18, 2026
klesh
left a comment
klesh
left a comment
Contributor
There was a problem hiding this comment.
LGTM
Thanks for your contribution.
# Conflicts: # backend/go.mod # backend/go.sum
klesh
approved these changes
Aug 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
github.com/go-git/go-git/v5github.com/go-git/go-billy/v5github.com/cloudflare/circl16 known advisories across the three modules.
govulncheckreports 12reachable findings before the bump (8 in go-git, 2 in go-billy, 2 in circl) and
none after. The go-git ones include GO-2025-3367 / GO-2025-3368 (argument
injection through crafted URLs) and GO-2026-4909 / GO-2026-4910.
Overall,
govulncheck ./...inbackend/goes from 30 reachable findings onupstream/mainto 11 with this PR (remainder:go-jose/v32,jwt/v51 +stdlib) — the MVS-driven
x/crypto/x/net/x/textbump clears those too.Where go-git is used
Exactly one file:
plugins/gitextractor/parser/repo_gogit.go. It opens analready cloned repository with
PlainOpenand walks commits, tags, branchesand trees, and only when
UseGoGitis set. Cloning is done by the git CLI(
parser.NewGitcliCloner), so the go-git transports are not on the path — thisbump does not change how DevLake talks to remotes.
Test coverage
That collector had no tests at all, which makes any go-git upgrade a leap of
faith. The first commit adds
repo_gogit_test.go: it builds a repository on diskwith a known shape (3 commits, 1 tag, a second branch checked out so HEAD is not
the default branch) and asserts
CountCommits,CountTags,CountBranches,that the counting helpers stop on a cancelled context, and that opening a
non-repository fails.
The test is committed before the bump and passes on both v5.12.0 and
v5.19.2 — unchanged behaviour across the upgrade, and the history stays
bisectable.
Verification
go mod tidy— cleango build ./.../make build— greengo test ./plugins/gitextractor/...— green on old and new versiongovulncheck ./...— 12 → 0 reachable findings in these modulesNotes
MVS also pulls up
x/crypto,x/net,x/sys,x/text,x/tools,ProtonMail/go-crypto,pjbgf/sha1cd,skeema/knownhosts,cyphar/filepath-securejoin,Microsoft/go-winio,klauspost/cpuidandgolang/protobuf.CI
Verified on a fork run of the same workflows before opening this PR:
8/8 green
(lint, unit-test, e2e MySQL, migration-script-lint, config-ui, license header,
grafana dashboards, builder image).