Bump the go_modules group across 2 directories with 6 updates by dependabot[bot] · Pull Request #393 · Shuffle/shuffle-shared

dependabot · 2026-05-19T16:06:58Z

Bumps the go_modules group with 4 updates in the / directory: github.com/go-git/go-billy/v5, github.com/go-git/go-git/v5, github.com/go-jose/go-jose/v4 and go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp.
Bumps the go_modules group with 4 updates in the /app_upload directory: github.com/go-git/go-billy/v5, github.com/go-git/go-git/v5, github.com/go-jose/go-jose/v4 and go.opentelemetry.io/otel/sdk.

Updates github.com/go-git/go-billy/v5 from 5.6.2 to 5.9.0

Release notes

Sourced from github.com/go-git/go-billy/v5's releases.

v5.9.0

What's Changed

Use path.Clean instead of filepath.Clean in iofs.Open by @puerco in go-git/go-billy#197

Deprecate ChrootOS in favour of BoundOS by @pjbgf in go-git/go-billy#201

General Improvements by @pjbgf in go-git/go-billy#203

osfs: ChrootOS eval baseDir on creation by @pjbgf in go-git/go-billy#205

Run go-git tests as part of integration tests by @pjbgf in go-git/go-billy#206

Full Changelog: go-git/go-billy@v5.8.0...v5.9.0

v5.8.0

What's Changed

build: Update module golang.org/x/net to v0.45.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-billy#183

v5: Ensure Chmod behaviour across BoundOS and ChrootOS by @pjbgf in go-git/go-billy#187

Full Changelog: go-git/go-billy@v5.7.0...v5.8.0

v5.7.0

What's Changed

Add support for Chmod on billy.Filesystem by @bitfehler in go-git/go-billy#171

build: Update module golang.org/x/net to v0.38.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-billy#177

Full Changelog: go-git/go-billy@v5.6.2...v5.7.0

Commits

237e529 Merge pull request #206 from pjbgf/v5-improvements
04edb39 build: Add go-git integration test
d8efefd osfs: preserve empty ChrootOS base
07f2a0b Merge pull request #205 from pjbgf/v5-improvements
25207c8 build: Bump Go versions in workflows
2fda229 osfs: ChrootOS eval baseDir on creation
427b27f Merge pull request #203 from pjbgf/v5-improvements
7d5a23e chroot: Reject symlink loops
2c2287a util: avoid following symlinks in RemoveAll fallback
cbd88e9 Fix mount path handling
Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.16.5 to 5.19.1

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.1

What's Changed

v5: plumbing: transport/ssh, Shell-quote path by @hiddeco in go-git/go-git#2068

v5: git: submodule, Fix relative URL resolution by @hiddeco in go-git/go-git#2070

v5: git: submodule, canonical remote for relative URLs by @hiddeco in go-git/go-git#2074

v5: git: submodule, error on remote without URLs by @hiddeco in go-git/go-git#2078

v5: plumbing: format/idxfile, Validate offset64 indices by @hiddeco in go-git/go-git#2084

v5: *: Reject malformed variable-length integers by @hiddeco in go-git/go-git#2092

v5: plumbing: format/packfile, Tighten delta validation by @hiddeco in go-git/go-git#2091

v5: Add worktreeFilesystem wrapper for worktree and hardening by @hiddeco in go-git/go-git#2100

v5: config: validate submodule names by @hiddeco in go-git/go-git#2082

build: Update module github.com/go-git/go-git/v5 to v5.19.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#2111

v5: git: Allow MkdirAll on worktree-root paths by @hiddeco in go-git/go-git#2117

v5: git: Stop validating symlink target paths by @pjbgf in go-git/go-git#2116

v5: plumbing: format decoder input bounds and contracts by @hiddeco in go-git/go-git#2125

plumbing: format/packfile, cap delta chain depth in parser by @pjbgf in go-git/go-git#2137

Full Changelog: go-git/go-git@v5.19.0...v5.19.1

v5.19.0

What's Changed

build: Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#2010

v5: Bump sha1cd and go-billy by @pjbgf in go-git/go-git#2060

v5: Align object encoding with upstream by @pjbgf in go-git/go-git#2065

Full Changelog: go-git/go-git@v5.18.0...v5.19.0

v5.18.0

What's Changed

plumbing: transport/http, Add support for followRedirects policy by @pjbgf in go-git/go-git#2004

Full Changelog: go-git/go-git@v5.17.2...v5.18.0

v5.17.2

What's Changed

build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#1941

dotgit: skip writing pack files that already exist on disk by @pjbgf in go-git/go-git#1944

⚠️ This release fixes a bug (go-git/go-git#1942) that blocked some users from upgrading to v5.17.1. Thanks @pskrbasu for reporting it. 🙇

Full Changelog: go-git/go-git@v5.17.1...v5.17.2

v5.17.1

What's Changed

build: Update module github.com/cloudflare/circl to v1.6.3 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#1930

[v5] plumbing: format/index, Improve v4 entry name validation by @pjbgf in go-git/go-git#1935

[v5] plumbing: format/idxfile, Fix version and fanout checks by @pjbgf in go-git/go-git#1937

... (truncated)

Commits

3c3be60 Merge pull request #2137 from go-git/validate-v5
3fba897 plumbing: format/packfile, cap delta chain depth in parser
a97d660 Merge pull request #2125 from hiddeco/v5/format-input-bounds
aeaa125 plumbing: format/objfile, require Header before Read
1f38e17 plumbing: format/packfile, bound inflate size
f7545a0 plumbing: format/idxfile, bound nr by file size
170b881 Merge pull request #2116 from pjbgf/symlink-v5
7b6d994 Merge pull request #2117 from hiddeco/v5/worktree-fs-mkdirall-root-noop
f0709b3 git: Stop validating symlink target paths
776d00f git: Allow MkdirAll on worktree-root paths
Additional commits viewable in compare view

Updates github.com/cloudflare/circl from 1.6.1 to 1.6.3

Release notes

Sourced from github.com/cloudflare/circl's releases.

CIRCL v1.6.3

Fix a bug on ecc/p384 scalar multiplication.

What's Changed

sign/mldsa: Check opts for nil value by @armfazh in cloudflare/circl#582

ecc/p384: Point addition must handle point doubling case. by @armfazh in cloudflare/circl#583

Release CIRCL v1.6.3 by @armfazh in cloudflare/circl#584

Full Changelog: cloudflare/circl@v1.6.2...v1.6.3

CIRCL v1.6.2

New SLH-DSA, improvements in ML-DSA for arm64.

Tested compilation on WASM.

What's Changed

Optimize pairing product computation by moving exponentiations to G1. by @dfaranha in cloudflare/circl#547

sign: Adding SLH-DSA signature by @armfazh in cloudflare/circl#512

Update code generators to CIRCL v1.6.1. by @armfazh in cloudflare/circl#548

ML-DSA: Add preliminary Wycheproof test vectors by @bwesterb in cloudflare/circl#552

go fmt by @bwesterb in cloudflare/circl#554

gz-compressing test vectors, use of HexBytes and ReadGzip functions. by @armfazh in cloudflare/circl#555

group: Removes use of elliptic Marshal and Unmarshal functions. by @armfazh in cloudflare/circl#556

Support encoding/decoding ML-DSA private keys (as long as they contain seeds) by @bwesterb in cloudflare/circl#559

Update to golangci-lint v2 by @bwesterb in cloudflare/circl#560

Preparation for ARM64 Implementation of poly operations for dilithium package. by @elementrics in cloudflare/circl#562

prepare power2Round for custom implementations in assembly by @elementrics in cloudflare/circl#564

ARM64 implementation for poly.PackLe16 by @elementrics in cloudflare/circl#563

add arm64 version of polyMulBy2toD by @elementrics in cloudflare/circl#565

add arm64 version of polySub by @elementrics in cloudflare/circl#566

group: add byteLen method for short groups and RandomScalar uses rand.Int by @armfazh in cloudflare/circl#568

add arm64 version of poly.Add/Sub by @elementrics in cloudflare/circl#572

group: Adding cryptobyte marshaling to scalars by @armfazh in cloudflare/circl#569

Bumping up to Go1.25 by @armfazh in cloudflare/circl#574

ci: Including WASM compilation. by @armfazh in cloudflare/circl#577

Revert to using package-declared HPKE errors for shortkem instead of standard library errors by @harshiniwho in cloudflare/circl#578

Release v1.6.2 by @armfazh in cloudflare/circl#579

New Contributors

@dfaranha made their first contribution in cloudflare/circl#547

@elementrics made their first contribution in cloudflare/circl#562

@harshiniwho made their first contribution in cloudflare/circl#578

Full Changelog: cloudflare/circl@v1.6.1...v1.6.2

Commits

24ae53c Release CIRCL v1.6.3
581020b Rename method to oddMultiplesProjective.
12209a4 Removing unused cmov for jacobian points.
fcba359 ecc/p384: use of complete projective formulas for scalar multiplication.
5e1bae8 ecc/p384: handle point doubling in point addition with Jacobian coordinates.
3416046 Check opts for nil value.
a763d47 Release CIRCL v1.6.2
3c70bf9 Bump x/crypto x/sys dependencies.
3f0f15b Revert to using package-declared HPKE errors for shortkem instead of standard...
23491bd Adding generic Power2Round method.
Additional commits viewable in compare view

Updates github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.4

What's Changed

Fixes Panic in JWE decryption. See GHSA-78h2-9frx-2jm8

Full Changelog: go-jose/go-jose@v4.1.3...v4.1.4

Commits

0e59876 Merge commit from fork
ddffdbc Bump actions/checkout from 5 to 6 (#213)
See full diff in compare view

Updates go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.36.0 to 1.43.0

Changelog

Sourced from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp's changelog.

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)

Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)

Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)

Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)

Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

Changed

Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)

Improve slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)

Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)

Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

Deprecated

Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

Fixed

Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to make the implementation spec-compliant. (#8027)

Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#8113)

Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#8096)

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)

... (truncated)

Commits

9276201 Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)
61b8c94 chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)
97a086e chore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)
5e363de limit response body size for OTLP HTTP exporters (#8108)
35214b6 Use an absolute path when calling bsd kenv (#8113)
290024c fix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)
e70658e fix: support getBody in otelploghttp (#8096)
4afe468 fix(deps): update googleapis to 9d38bb4 (#8117)
b9ca729 chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)
69472ec chore(deps): update fossas/fossa-action action to v1.9.0 (#8118)
Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0

Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)

Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)

Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)

Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)

Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

Changed

Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)

Improve slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)

Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)

Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

Deprecated

Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

Fixed

Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to make the implementation spec-compliant. (#8027)

Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#8113)

Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#8096)

Commits

9276201 Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)
61b8c94 chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)
97a086e chore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)
5e363de limit response body size for OTLP HTTP exporters (#8108)
35214b6 Use an absolute path when calling bsd kenv (#8113)
290024c fix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)
e70658e fix: support getBody in otelploghttp (#8096)
4afe468 fix(deps): update googleapis to 9d38bb4 (#8117)
b9ca729 chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)
69472ec chore(deps): update fossas/fossa-action action to v1.9.0 (#8118)
Additional commits viewable in compare view

Updates github.com/go-git/go-billy/v5 from 5.6.2 to 5.9.0

Release notes

Sourced from github.com/go-git/go-billy/v5's releases.

v5.9.0

What's Changed

Use path.Clean instead of filepath.Clean in iofs.Open by @puerco in go-git/go-billy#197

Deprecate ChrootOS in favour of BoundOS by @pjbgf in go-git/go-billy#201

General Improvements by @pjbgf in go-git/go-billy#203

osfs: ChrootOS eval baseDir on creation by @pjbgf in go-git/go-billy#205

Run go-git tests as part of integration tests by @pjbgf in go-git/go-billy#206

Full Changelog: go-git/go-billy@v5.8.0...v5.9.0

v5.8.0

What's Changed

build: Update module golang.org/x/net to v0.45.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-billy#183

v5: Ensure Chmod behaviour across BoundOS and ChrootOS by @pjbgf in go-git/go-billy#187

Full Changelog: go-git/go-billy@v5.7.0...v5.8.0

v5.7.0

What's Changed

Add support for Chmod on billy.Filesystem by @bitfehler in go-git/go-billy#171

build: Update module golang.org/x/net to v0.38.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-billy#177

Full Changelog: go-git/go-billy@v5.6.2...v5.7.0

Commits

237e529 Merge pull request #206 from pjbgf/v5-improvements
04edb39 build: Add go-git integration test
d8efefd osfs: preserve empty ChrootOS base
07f2a0b Merge pull request #205 from pjbgf/v5-improvements
25207c8 build: Bump Go versions in workflows
2fda229 osfs: ChrootOS eval baseDir on creation
427b27f Merge pull request #203 from pjbgf/v5-improvements
7d5a23e chroot: Reject symlink loops
2c2287a util: avoid following symlinks in RemoveAll fallback
cbd88e9 Fix mount path handling
Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.16.5 to 5.19.1

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.1

What's Changed

v5: plumbing: transport/ssh, Shell-quote path by @hiddeco in go-git/go-git#2068

v5: git: submodule, Fix relative URL resolution by @hiddeco in go-git/go-git#2070

v5: git: submodule, canonical remote for relative URLs by @hiddeco in go-git/go-git#2074

v5: git: submodule, error on remote without URLs by @hiddeco in go-git/go-git#2078

v5: plumbing: format/idxfile, Validate offset64 indices by @hiddeco in go-git/go-git#2084

v5: *: Reject malformed variable-length integers by @hiddeco in go-git/go-git#2092

v5: plumbing: format/packfile, Tighten delta validation by @hiddeco in go-git/go-git#2091

v5: Add worktreeFilesystem wrapper for worktree and hardening by @hiddeco in go-git/go-git#2100

v5: config: validate submodule names by @hiddeco in go-git/go-git#2082

build: Update module github.com/go-git/go-git/v5 to v5.19.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#2111

v5: git: Allow MkdirAll on worktree-root paths by @hiddeco in go-git/go-git#2117

v5: git: Stop validating symlink target paths by @pjbgf in go-git/go-git#2116

v5: plumbing: format decoder input bounds and contracts by @hiddeco in go-git/go-git#2125

plumbing: format/packfile, cap delta chain depth in parser by @pjbgf in go-git/go-git#2137

Full Changelog: go-git/go-git@v5.19.0...v5.19.1

v5.19.0

What's Changed

build: Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#2010

v5: Bump sha1cd and go-billy by @pjbgf in go-git/go-git#2060

v5: Align object encoding with upstream by @pjbgf in go-git/go-git#2065

Full Changelog: go-git/go-git@v5.18.0...v5.19.0

v5.18.0

What's Changed

plumbing: transport/http, Add support for followRedirects policy by @pjbgf in go-git/go-git#2004

Full Changelog: go-git/go-git@v5.17.2...v5.18.0

v5.17.2

What's Changed

build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#1941

dotgit: skip writing pack files that already exist on disk by @pjbgf in go-git/go-git#1944

⚠️ This release fixes a bug (go-git/go-git#1942) that blocked some users from upgrading to v5.17.1. Thanks @pskrbasu for reporting it. 🙇

Full Changelog: go-git/go-git@v5.17.1...v5.17.2

v5.17.1

What's Changed

build: Update module github.com/cloudflare/circl to v1.6.3 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#1930

[v5] plumbing: format/index, Improve v4 entry name validation by @pjbgf in go-git/go-git#1935

[v5] plumbing: format/idxfile, Fix version and fanout checks by @pjbgf in go-git/go-git#1937

... (truncated)

Commits

3c3be60 Merge pull request #2137 from go-git/validate-v5
3fba897 plumbing: format/packfile, cap delta chain depth in parser
a97d660 Merge pull request #2125 from hiddeco/v5/format-input-bounds
aeaa125 plumbing: format/objfile, require Header before Read
1f38e17 plumbing: format/packfile, bound inflate size
f7545a0 plumbing: format/idxfile, bound nr by file size
170b881 Merge pull request #2116 from pjbgf/symlink-v5
7b6d994 Merge pull request #2117 from hiddeco/v5/worktree-fs-mkdirall-root-noop
f0709b3 git: Stop validating symlink target paths
776d00f git: Allow MkdirAll on worktree-root paths
Additional commits viewable in compare view

Updates github.com/cloudflare/circl from 1.6.1 to 1.6.3

Release notes

Sourced from github.com/cloudflare/circl's releases.

CIRCL v1.6.3

Fix a bug on ecc/p384 scalar multiplication.

What's Changed

sign/mldsa: Check opts for nil value by @armfazh in cloudflare/circl#582

ecc/p384: Point addition must handle point doubling case. by @armfazh in cloudflare/circl#583

Release CIRCL v1.6.3 by @armfazh in cloudflare/circl#584

Full Changelog: cloudflare/circl@v1.6.2...v1.6.3

CIRCL v1.6.2

New SLH-DSA, improvements in ML-DSA for arm64.

Tested compilation on WASM.

What's Changed

Optimize pairing product computation by moving exponentiations to G1. by @dfaranha in cloudflare/circl#547

sign: Adding SLH-DSA signature by @armfazh in cloudflare/circl#512

Update code generators to CIRCL v1.6.1. by @armfazh in cloudflare/circl#548

ML-DSA: Add preliminary Wycheproof test vectors by @bwesterb in cloudflare/circl#552

go fmt by @bwesterb in cloudflare/circl#554

gz-compressing test vectors, use of HexBytes and ReadGzip functions. by @armfazh in cloudflare/circl#555

group: Removes use of elliptic Marshal and Unmarshal functions. by @armfazh in cloudflare/circl#556

Support encoding/decoding ML-DSA private keys (as long as they contain seeds) by @bwesterb in cloudflare/circl#559

Update to golangci-lint v2 by @bwesterb in cloudflare/circl#560

Preparation for ARM64 Implementation of poly operations for dilithium package. by @elementrics in cloudflare/circl#562

prepare power2Round for custom implementations in assembly by @elementrics in cloudflare/circl#564

ARM64 implementation for poly.PackLe16 by @elementrics in cloudflare/circl#563

add arm64 version of polyMulBy2toD by @elementrics in cloudflare/circl#565

add arm64 version of polySub by @elementrics in cloudflare/circl#566

group: add byteLen method for short groups and RandomScalar uses rand.Int by @armfazh in cloudflare/circl#568

add arm64 version of poly.Add/Sub by @elementrics in cloudflare/circl#572

group: Adding cryptobyte marshaling to scalars by @armfazh in cloudflare/circl#569

Bumping up to Go1.25 by @armfazh in cloudflare/circl#574

ci: Including WASM compilation. by @armfazh in cloudflare/circl#577

Revert to using package-declared HPKE errors for shortkem instead of standard library errors by @harshiniwho in

Bumps the go_modules group with 4 updates in the / directory: [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy), [github.com/go-git/go-git/v5](https://github.com/go-git/go-git), [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) and [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go). Bumps the go_modules group with 4 updates in the /app_upload directory: [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy), [github.com/go-git/go-git/v5](https://github.com/go-git/go-git), [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) and [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go). Updates `github.com/go-git/go-billy/v5` from 5.6.2 to 5.9.0 - [Release notes](https://github.com/go-git/go-billy/releases) - [Commits](go-git/go-billy@v5.6.2...v5.9.0) Updates `github.com/go-git/go-git/v5` from 5.16.5 to 5.19.1 - [Release notes](https://github.com/go-git/go-git/releases) - [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md) - [Commits](go-git/go-git@v5.16.5...v5.19.1) Updates `github.com/cloudflare/circl` from 1.6.1 to 1.6.3 - [Release notes](https://github.com/cloudflare/circl/releases) - [Commits](cloudflare/circl@v1.6.1...v1.6.3) Updates `github.com/go-jose/go-jose/v4` from 4.1.3 to 4.1.4 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.1.3...v4.1.4) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.36.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.36.0...v1.43.0) Updates `go.opentelemetry.io/otel/sdk` from 1.42.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.42.0...v1.43.0) Updates `github.com/go-git/go-billy/v5` from 5.6.2 to 5.9.0 - [Release notes](https://github.com/go-git/go-billy/releases) - [Commits](go-git/go-billy@v5.6.2...v5.9.0) Updates `github.com/go-git/go-git/v5` from 5.16.5 to 5.19.1 - [Release notes](https://github.com/go-git/go-git/releases) - [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md) - [Commits](go-git/go-git@v5.16.5...v5.19.1) Updates `github.com/cloudflare/circl` from 1.6.1 to 1.6.3 - [Release notes](https://github.com/cloudflare/circl/releases) - [Commits](cloudflare/circl@v1.6.1...v1.6.3) Updates `github.com/go-jose/go-jose/v4` from 4.1.3 to 4.1.4 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.1.3...v4.1.4) Updates `go.opentelemetry.io/otel/sdk` from 1.42.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.42.0...v1.43.0) --- updated-dependencies: - dependency-name: github.com/go-git/go-billy/v5 dependency-version: 5.9.0 dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.19.1 dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/cloudflare/circl dependency-version: 1.6.3 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.4 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/go-git/go-billy/v5 dependency-version: 5.9.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.19.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/cloudflare/circl dependency-version: 1.6.3 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.4 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-05-19T16:07:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability
golang.org/x/oauth2@v0.35.0
golang.org/x/crypto@v0.48.0 ⏵ v0.50.0	⁺¹
github.com/go-git/go-git/v5@v5.16.5 ⏵ v5.19.1	⁺¹	⁺²²
golang.org/x/sys@v0.41.0 ⏵ v0.43.0	⁺¹
github.com/go-git/go-billy/v5@v5.6.2 ⏵ v5.9.0	⁺¹	⁺¹⁸

View full report

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels May 19, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the go_modules group across 2 directories with 6 updates#393

Bump the go_modules group across 2 directories with 6 updates#393
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go_modules-f44f76f8a8

dependabot Bot commented on behalf of github May 19, 2026

Uh oh!

socket-security Bot commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 19, 2026

v5.9.0

What's Changed

v5.8.0

What's Changed

v5.7.0

What's Changed

v5.19.1

What's Changed

v5.19.0

What's Changed

v5.18.0

What's Changed

v5.17.2

What's Changed

v5.17.1

What's Changed

CIRCL v1.6.3

What's Changed

CIRCL v1.6.2

What's Changed

New Contributors

v4.1.4

What's Changed

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

Changed

Deprecated

Fixed

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

Changed

Deprecated

Fixed

v5.9.0

What's Changed

v5.8.0

What's Changed

v5.7.0

What's Changed

v5.19.1

What's Changed

v5.19.0

What's Changed

v5.18.0

What's Changed

v5.17.2

What's Changed

v5.17.1

What's Changed

CIRCL v1.6.3

What's Changed

CIRCL v1.6.2

What's Changed

Uh oh!

socket-security Bot commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants