fix(deps): Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] by renovate[bot] · Pull Request #20 · datosh/pinned-actions

renovate · 2026-02-10T02:05:21Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-git/go-git/v5	`v5.13.0` → `v5.16.5`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2026-25934

Impact

A vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found.

For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly.

Note that the lack of verification of the packfile checksum has no impact on the trust relationship between the client and server, which is enforced based on the protocol being used (e.g. TLS in the case of https:// or known hosts for ssh://). In other words, the packfile checksum verification does not provide any security benefits when connecting to a malicious or compromised Git server.

Patches

Users should upgrade to v5.16.5, or the latest v6 pseudo-version, in order to mitigate this vulnerability.

Workarounds

In case updating to a fixed version of go-git is not possible, users can run git fsck from the git cli to check for data corruption on a given repository.

Credit

Thanks @N0zoM1z0 for finding and reporting this issue privately to the go-git project.

Release Notes

go-git/go-git (github.com/go-git/go-git/v5)

`v5.16.5`

Compare Source

What's Changed

build: Update module golang.org/x/crypto to v0.45.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1744
build: Bump Go test versions to 1.23-1.25 (v5) by @pjbgf in #1746
[v5] git: worktree, Don't delete local untracked files when resetting worktree by @Ch00k in #1800
Expand packfile checks by @pjbgf in #1836

Full Changelog: go-git/go-git@v5.16.4...v5.16.5

`v5.16.4`

Compare Source

What's Changed

backport plumbing: format/idxfile, prevent panic by @swills in #1732
[backport] build: test, Fix build on Windows. by @pjbgf in #1734
build: Update module golang.org/x/net to v0.38.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1742
build: Update module github.com/cloudflare/circl to v1.6.1 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1741
build: Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1743

Full Changelog: go-git/go-git@v5.16.3...v5.16.4

`v5.16.3`

Compare Source

What's Changed

internal: Expand regex to fix build [5.x] by @baloo in #1644
build: raise timeouts for windows CI tests and disable CIFuzz [5.x] by @baloo in #1646
plumbing: support commits extra headers, support jujutsu signed commit [5.x] by @baloo in #1633

Full Changelog: go-git/go-git@v5.16.2...v5.16.3

`v5.16.2`

Compare Source

What's Changed

utils: fix diff so subpaths work for sparse checkouts, fixes 1455 to releases/v5.x by @kane8n in #1567

Full Changelog: go-git/go-git@v5.16.1...v5.16.2

`v5.16.1`

Compare Source

What's Changed

utils: merkletrie, Fix diff on sparse-checkout index. Fixes #1406 to releases/v5.x by @kane8n in #1561

New Contributors

@kane8n made their first contribution in #1561

Full Changelog: go-git/go-git@v5.16.0...v5.16.1

`v5.16.0`

Compare Source

What's Changed

[v5] plumbing: support mTLS for HTTPS protocol by @hiddeco in #1510
v5: plumbing: transport, Reintroduce SetHostKeyCallback. Fix #1514 by @pjbgf in #1515

Full Changelog: go-git/go-git@v5.15.0...v5.16.0

`v5.15.0`

Compare Source

What's Changed

plumbing: add cert auth support to releases/v5.x by @Javier-varez in #1482
v5: Bump dependencies by @pjbgf in #1505

Full Changelog: go-git/go-git@v5.14.0...v5.15.0

`v5.14.0`

Compare Source

What's Changed

v5: Bump Go and dependencies to mitigate GO-2025-3487 by @pjbgf in #1436

⚠️ Note that this version requires Go 1.23, due to the bump to golang.org/x/crypto@v0.35.0 which mitigates the CVE above. User's that can't bump to Go 1.23 will need to remain on the previous v5.13.x release.

Full Changelog: go-git/go-git@v5.13.2...v5.14.0

`v5.13.2`

Compare Source

What's Changed

plumbing: use the correct user agent string. Fixes #883 by @uragirii in #1364
build: bump golang.org/x/sys from 0.28.0 to 0.29.0 in the golang-org group by @dependabot in #1365
build: bump the golang-org group with 2 updates by @dependabot in #1367
build: bump github.com/ProtonMail/go-crypto from 1.1.3 to 1.1.4 by @dependabot in #1368
build: bump github.com/go-git/go-billy/v5 from 5.6.1 to 5.6.2 by @dependabot in #1378
build: bump github/codeql-action from 3.28.0 to 3.28.1 by @dependabot in #1376
build: bump github.com/elazarl/goproxy from 1.2.3 to 1.4.0 by @dependabot in #1377
git: worktree, fix restoring dot slash files (backported to v5). Fixes #1176 by @BeChris in #1361
build: bump github.com/pjbgf/sha1cd from 0.3.0 to 0.3.2 by @dependabot in #1392
git: worktree_status, fix adding dot slash files to working tree (backported to v5). Fixes #1150 by @BeChris in #1359
build: bump github.com/ProtonMail/go-crypto from 1.1.4 to 1.1.5 by @dependabot in #1383

Full Changelog: go-git/go-git@v5.13.1...v5.13.2

`v5.13.1`

Compare Source

What's Changed

build: bump github.com/go-git/go-billy/v5 from 5.6.0 to 5.6.1 by @dependabot in #1327
build: bump github.com/elazarl/goproxy from 1.2.1 to 1.2.2 by @dependabot in #1329
build: bump github.com/elazarl/goproxy from 1.2.2 to 1.2.3 by @dependabot in #1340
Revert "plumbing: transport/ssh, Add support for SSH @cert-authority." by @pjbgf in #1346

Full Changelog: go-git/go-git@v5.13.0...v5.13.1

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

cloudflare-workers-and-pages · 2026-02-10T02:05:23Z

Deploying pinned-actions with Cloudflare Pages

Latest commit:	`551f511`
Status:	✅ Deploy successful!
Preview URL:	https://789b741f.pinned-actions.pages.dev
Branch Preview URL:	https://renovate-go-github-com-go-gi.pinned-actions.pages.dev

View logs

renovate · 2026-02-10T02:05:24Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

12 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.22.0` -> `1.24.0`
`github.com/Microsoft/go-winio`	`v0.6.1` -> `v0.6.2`
`github.com/ProtonMail/go-crypto`	`v1.1.3` -> `v1.1.6`
`github.com/cloudflare/circl`	`v1.3.7` -> `v1.6.1`
`github.com/cyphar/filepath-securejoin`	`v0.2.5` -> `v0.4.1`
`github.com/go-git/go-billy/v5`	`v5.6.0` -> `v5.6.2`
`github.com/golang/groupcache`	`v0.0.0-20210331224755-41bb18bfe9da` -> `v0.0.0-20241129210726-2c02b8208cf8`
`github.com/pjbgf/sha1cd`	`v0.3.0` -> `v0.3.2`
`github.com/sirupsen/logrus`	`v1.9.1` -> `v1.9.3`
`github.com/skeema/knownhosts`	`v1.3.0` -> `v1.3.1`
`golang.org/x/crypto`	`v0.31.0` -> `v0.45.0`
`golang.org/x/net`	`v0.33.0` -> `v0.47.0`
`golang.org/x/sys`	`v0.28.0` -> `v0.38.0`

…RITY]

renovate bot added the dependencies label Feb 10, 2026

fix(deps): Update module github.com/go-git/go-git/v5 to v5.16.5 [SECU…

551f511

…RITY]

renovate bot force-pushed the renovate/go-github.com-go-git-go-git-v5-vulnerability branch from 5151573 to 551f511 Compare February 12, 2026 18:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY]#20

fix(deps): Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY]#20
renovate[bot] wants to merge 1 commit intomainfrom
renovate/go-github.com-go-git-go-git-v5-vulnerability

renovate bot commented Feb 10, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages bot commented Feb 10, 2026 •

edited

Loading

Uh oh!

renovate bot commented Feb 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

Credit

Release Notes

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

Configuration

Uh oh!

cloudflare-workers-and-pages bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying pinned-actions with Cloudflare Pages

Uh oh!

renovate bot commented Feb 10, 2026

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Feb 10, 2026 •

edited

Loading

cloudflare-workers-and-pages bot commented Feb 10, 2026 •

edited

Loading