build(deps): bump github.com/go-git/go-git/v5 from 5.12.0 to 5.19.0#26
build(deps): bump github.com/go-git/go-git/v5 from 5.12.0 to 5.19.0#26dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.12.0 to 5.19.0. - [Release notes](https://github.com/go-git/go-git/releases) - [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md) - [Commits](go-git/go-git@v5.12.0...v5.19.0) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.19.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default mode and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 6ea4196. Configure here.
| go 1.23.1 | ||
|
|
||
| toolchain go1.23.3 | ||
| go 1.25.0 |
There was a problem hiding this comment.
Go version bumped to 1.25 but CI uses 1.23
High Severity
The go directive was bumped from 1.23.1 to 1.25.0 (and the toolchain directive removed) as a side effect of updating go-git to v5.19.0, which requires Go 1.25. However, all five CI workflows (codeql-analysis.yml, lint.yml, performance.yml, release.yml, smoke.yml) still specify go-version: "1.23". While GOTOOLCHAIN=auto may cause Go 1.23 to auto-download Go 1.25, this makes the explicit setup-go step misleading and wasteful, and the major Go version jump (1.23→1.25) is likely unintended for a dependency-only PR.
Reviewed by Cursor Bugbot for commit 6ea4196. Configure here.
Bumps github.com/go-git/go-git/v5 from 5.12.0 to 5.19.0.
Release notes
Sourced from github.com/go-git/go-git/v5's releases.
... (truncated)
Commits
bc930f4Merge pull request #2065 from go-git/commit-v5d315264plumbing: object, Reset object before decode6e1d348plumbing: object, Align Tree handling with upstreame134ba3tests: Skip double checks in Git v2.111971422tests: Add git conformance tests for signing verificationa387aa8plumbing: object, Add ErrMalformedTagf415670plumbing: object, Decode Tag headers via a state machine5b0cd38plumbing: object, Reject multi-signature commits at Verifyfe8ed62plumbing: object, Align Tag.EncodeWithoutSignature with Commit98e337dplumbing: object, Add support for Tag.SignatureSHA256Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.