chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0#3848
chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0#3848dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.18.0 to 5.19.0. - [Release notes](https://github.com/go-git/go-git/releases) - [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md) - [Commits](go-git/go-git@v5.18.0...v5.19.0) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.19.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security review (dependency bump)
Scope: go.mod / go.sum only — go-git/v5 5.18.0 → 5.19.0 and transitive updates (go-billy, filepath-securejoin, golang.org/x/crypto, x/net, x/sys, x/term, etc.), plus the module go directive 1.24.6 → 1.25.0.
Findings: No medium, high, or critical issues tied to this diff. Semaphore’s git integration code is unchanged; there is no new sink or control change to analyze. go-git 5.18.0 already sits on the post-advisory line for smart-HTTP redirect handling; 5.19.0 is a subsequent maintenance release (dependency bumps, object encoding alignment per upstream release notes), not a known regression vector from published advisories reviewed for this assessment.
Note: Any risk from cloning/fetching attacker-influenced repository URLs (e.g. SSRF, credential forwarding to unexpected hosts) remains a product/architecture concern in existing GoGitClient usage and is not introduced by this PR.
Prior automation assessment threads were cleared so this review is the active one.
Sent by Cursor Automation: Find vulnerabilities
|
Superseded by #3869. |
dependabot
Bot
deleted the
dependabot/go_modules/github.com/go-git/go-git/v5-5.19.0
branch
Bumps github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0.
Release notes
Sourced from github.com/go-git/go-git/v5's releases.
Commits
bc930f4Merge pull request #2065 from go-git/commit-v5d315264plumbing: object, Reset object before decode6e1d348plumbing: object, Align Tree handling with upstreame134ba3tests: Skip double checks in Git v2.111971422tests: Add git conformance tests for signing verificationa387aa8plumbing: object, Add ErrMalformedTagf415670plumbing: object, Decode Tag headers via a state machine5b0cd38plumbing: object, Reject multi-signature commits at Verifyfe8ed62plumbing: object, Align Tag.EncodeWithoutSignature with Commit98e337dplumbing: object, Add support for Tag.SignatureSHA256Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.