[dependabot]

Bumps github.com/go-git/go-git/v5 from 5.16.2 to 5.19.3.

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.3

What's Changed

• [v5] git: repository, Ensure commondir is closed. by @​arcaven in go-git/go-git#2285
• config: read repositoryformatversion in unmarshalCore by @​c-tonneslan in go-git/go-git#2167
• build: Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2304
• [v5] plumbing: revlist, Skip path validation in the object walk by @​r0h1tb in go-git/go-git#2305
• build: Update module golang.org/x/crypto to v0.55.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2348
• [v5] plumbing: transport/http, Contain credentials across redirects by @​hiddeco in go-git/go-git#2358
• build: Fix workflows for Go 1.27 (v5) by @​pjbgf in go-git/go-git#2364
• plumbing: format/packfile, Stop running TestChecksumMismatch and TestMalformedPack in parallel by @​akashchamp in go-git/go-git#2421
• build: Update module golang.org/x/crypto to v0.56.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2357
• plumbing: format/packfile, Break cyclic delta chains instead of recur… by @​jgoosens in go-git/go-git#2340
• build: Drop Go 1.25 by @​pjbgf in go-git/go-git#2451
• build: Update module github.com/go-git/go-billy/v5 to v5.9.2 (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2467
• build: Bump pjbgf/sha1cd to v0.7.0 by @​pjbgf in go-git/go-git#2468

New Contributors

• @​arcaven made their first contribution in go-git/go-git#2285
• @​c-tonneslan made their first contribution in go-git/go-git#2167
• @​r0h1tb made their first contribution in go-git/go-git#2305
• @​akashchamp made their first contribution in go-git/go-git#2421
• @​jgoosens made their first contribution in go-git/go-git#2340

Full Changelog: go-git/go-git@v5.19.2...v5.19.3

v5.19.2

What's Changed

• build: Update module golang.org/x/crypto to v0.52.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2150
• build: Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2141
• build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2152
• git: Worktree: Add stores index entires with backslashes on Windows by @​joshblum in go-git/go-git#2262
• storage: dotgit, reject path traversal in reference names by @​pjbgf in go-git/go-git#2254
• build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2267
• build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2268
• [v5] git: worktree, make the filesystem wrapper a symlink-safe boundary by @​pjbgf in go-git/go-git#2277

Full Changelog: go-git/go-git@v5.19.1...v5.19.2

v5.19.1

What's Changed

• v5: plumbing: transport/ssh, Shell-quote path by @​hiddeco in go-git/go-git#2068
• v5: git: submodule, Fix relative URL resolution by @​hiddeco in go-git/go-git#2070
• v5: git: submodule, canonical remote for relative URLs by @​hiddeco in go-git/go-git#2074
• v5: git: submodule, error on remote without URLs by @​hiddeco in go-git/go-git#2078
• v5: plumbing: format/idxfile, Validate offset64 indices by @​hiddeco in go-git/go-git#2084
• v5: *: Reject malformed variable-length integers by @​hiddeco in go-git/go-git#2092
• v5: plumbing: format/packfile, Tighten delta validation by @​hiddeco in go-git/go-git#2091
• v5: Add worktreeFilesystem wrapper for worktree and hardening by @​hiddeco in go-git/go-git#2100
• v5: config: validate submodule names by @​hiddeco in go-git/go-git#2082

... (truncated)

Commits

• bdae57c Merge pull request #2468 from go-git/bump-pjbgf
• 372805d build: Bump pjbgf/sha1cd to v0.7.0
• e28bfff Merge pull request #2467 from go-git/renovate/releases/v5.x-go-git
• dbfe60f build: Update module github.com/go-git/go-billy/v5 to v5.9.2
• a3fa9b3 Merge pull request #2451 from go-git/drop-go-1.25
• 1fc0e47 build: Drop Go 1.25
• 4f28503 Merge pull request #2340 from jgoosens/releases/v5.x
• 5a01a03 Merge pull request #2357 from go-git/renovate/releases/v5.x-go-golang.org-x-c...
• 5372bc7 Merge pull request #2421 from akashchamp/fix/packfile-parallel-test-race
• 3d20ded plumbing: format/packfile, Stop running TestChecksumMismatch and TestMalforme...
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
github.com/go-git/go-git/v5	[>= 5.13.1.a, < 5.13.2]

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[Farjaad]

@dependabot rebase

[Farjaad]

Dependency review: safe to merge after one step (keep this PR, close #428)

Note: the branch name and commit trailer still say 5.16.3, but Dependabot updated the PR today and the diff now goes to 5.19.3, newer than #428's 5.19.2.

• Scope: Only src/go.mod and src/go.sum change. Every other module change (go-billy 5.9.2, sha1cd, filepath-securejoin, circl, x/*, testify) comes from go-git's own requirements.
• How we use it: Only fillGitInfo in src/cmd/deploy.go, which calls git.PlainOpen, Head() and CommitObject(). None of those APIs changed between 5.16 and 5.19.3.
• Breaking changes: None that affect us. Most of the release notes are security hardening: path traversal in reference names, symlink-safe worktrees, packfile/delta validation, and no longer sending credentials across HTTP redirects. Those touch clone, push and transport code we don't use. 5.19.3 requires Go 1.26; we're on 1.26.4.
• Verification: The Tests workflow didn't run because its path filter doesn't match src/go.mod. Locally, go mod verify, go build ./..., go vet and the common tests pass. opslevel create deploy --dry-run fills in commit details correctly. The cmd/e2e tests fail only with 401s from the live API (no token), and main fails the same way.

Before merging: Dependabot's update removed the Changie changelog entry. Re-add the dependencies label to regenerate it, or add one by hand.