Search code, repositories, users, issues, pull requests...

What's Changed

v5: plumbing: transport/ssh, Shell-quote path by @hiddeco in #2068
v5: git: submodule, Fix relative URL resolution by @hiddeco in #2070
v5: git: submodule, canonical remote for relative URLs by @hiddeco in #2074
v5: git: submodule, error on remote without URLs by @hiddeco in #2078
v5: plumbing: format/idxfile, Validate offset64 indices by @hiddeco in #2084
v5: *: Reject malformed variable-length integers by @hiddeco in #2092
v5: plumbing: format/packfile, Tighten delta validation by @hiddeco in #2091
v5: Add worktreeFilesystem wrapper for worktree and hardening by @hiddeco in #2100
v5: config: validate submodule names by @hiddeco in #2082
build: Update module github.com/go-git/go-git/v5 to v5.19.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #2111
v5: git: Allow MkdirAll on worktree-root paths by @hiddeco in #2117
v5: git: Stop validating symlink target paths by @pjbgf in #2116
v5: plumbing: format decoder input bounds and contracts by @hiddeco in #2125
plumbing: format/packfile, cap delta chain depth in parser by @pjbgf in #2137

Full Changelog: go-git/go-git@v5.19.0...v5.19.1

`v5.19.0`

What's Changed

build: Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #2010
v5: Bump sha1cd and go-billy by @pjbgf in #2060
v5: Align object encoding with upstream by @pjbgf in #2065

Full Changelog: go-git/go-git@v5.18.0...v5.19.0

`v5.18.0`

What's Changed

plumbing: transport/http, Add support for followRedirects policy by @pjbgf in #2004

Full Changelog: go-git/go-git@v5.17.2...v5.18.0

`v5.17.2`

What's Changed

build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1941
dotgit: skip writing pack files that already exist on disk by @pjbgf in #1944

⚠️ This release fixes a bug (#1942) that blocked some users from upgrading to v5.17.1. Thanks @pskrbasu for reporting it. 🙇

Full Changelog: go-git/go-git@v5.17.1...v5.17.2

`v5.17.1`

What's Changed

build: Update module github.com/cloudflare/circl to v1.6.3 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1930
[v5] plumbing: format/index, Improve v4 entry name validation by @pjbgf in #1935
[v5] plumbing: format/idxfile, Fix version and fanout checks by @pjbgf in #1937

Full Changelog: go-git/go-git@v5.17.0...v5.17.1

`v5.17.0`

What's Changed

build: Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1839
git: worktree, optimize infiles function for very large repos by @k-anshul in #1853
git: Add strict checks for supported extensions by @pjbgf in #1861
backport, git: Improve Status() speed with new index.ModTime check by @cedric-appdirect in #1862
storage: filesystem, Avoid overwriting loose obj files by @pjbgf in #1864

Full Changelog: go-git/go-git@v5.16.5...v5.17.0

`v5.16.5`

What's Changed

build: Update module golang.org/x/crypto to v0.45.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1744
build: Bump Go test versions to 1.23-1.25 (v5) by @pjbgf in #1746
[v5] git: worktree, Don't delete local untracked files when resetting worktree by @Ch00k in #1800
Expand packfile checks by @pjbgf in #1836

Full Changelog: go-git/go-git@v5.16.4...v5.16.5

`v5.16.4`

What's Changed

backport plumbing: format/idxfile, prevent panic by @swills in #1732
[backport] build: test, Fix build on Windows. by @pjbgf in #1734
build: Update module golang.org/x/net to v0.38.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1742
build: Update module github.com/cloudflare/circl to v1.6.1 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1741
build: Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1743

Full Changelog: go-git/go-git@v5.16.3...v5.16.4

`v5.16.3`

What's Changed

internal: Expand regex to fix build [5.x] by @baloo in #1644
build: raise timeouts for windows CI tests and disable CIFuzz [5.x] by @baloo in #1646
plumbing: support commits extra headers, support jujutsu signed commit [5.x] by @baloo in #1633

Full Changelog: go-git/go-git@v5.16.2...v5.16.3

`v5.16.2`

What's Changed

utils: fix diff so subpaths work for sparse checkouts, fixes 1455 to releases/v5.x by @kane8n in #1567

Full Changelog: go-git/go-git@v5.16.1...v5.16.2

`v5.16.1`

What's Changed

utils: merkletrie, Fix diff on sparse-checkout index. Fixes #1406 to releases/v5.x by @kane8n in #1561

New Contributors

@kane8n made their first contribution in #1561

Full Changelog: go-git/go-git@v5.16.0...v5.16.1

`v5.16.0`

What's Changed

[v5] plumbing: support mTLS for HTTPS protocol by @hiddeco in #1510
v5: plumbing: transport, Reintroduce SetHostKeyCallback. Fix #1514 by @pjbgf in #1515

Full Changelog: go-git/go-git@v5.15.0...v5.16.0

`v5.15.0`

What's Changed

plumbing: add cert auth support to releases/v5.x by @Javier-varez in #1482
v5: Bump dependencies by @pjbgf in #1505

Full Changelog: go-git/go-git@v5.14.0...v5.15.0

`v5.14.0`

What's Changed

v5: Bump Go and dependencies to mitigate GO-2025-3487 by @pjbgf in #1436

⚠️ Note that this version requires Go 1.23, due to the bump to golang.org/x/crypto@v0.35.0 which mitigates the CVE above. User's that can't bump to Go 1.23 will need to remain on the previous v5.13.x release.

Full Changelog: go-git/go-git@v5.13.2...v5.14.0

`v5.13.2`

What's Changed

plumbing: use the correct user agent string. Fixes #883 by @uragirii in #1364
build: bump golang.org/x/sys from 0.28.0 to 0.29.0 in the golang-org group by @dependabot in #1365
build: bump the golang-org group with 2 updates by @dependabot in #1367
build: bump github.com/ProtonMail/go-crypto from 1.1.3 to 1.1.4 by @dependabot in #1368
build: bump github.com/go-git/go-billy/v5 from 5.6.1 to 5.6.2 by @dependabot in #1378
build: bump github/codeql-action from 3.28.0 to 3.28.1 by @dependabot in #1376
build: bump github.com/elazarl/goproxy from 1.2.3 to 1.4.0 by @dependabot in #1377
git: worktree, fix restoring dot slash files (backported to v5). Fixes #1176 by @BeChris in #1361
build: bump github.com/pjbgf/sha1cd from 0.3.0 to 0.3.2 by @dependabot in #1392
git: worktree_status, fix adding dot slash files to working tree (backported to v5). Fixes #1150 by @BeChris in #1359
build: bump github.com/ProtonMail/go-crypto from 1.1.4 to 1.1.5 by @dependabot in #1383

Full Changelog: go-git/go-git@v5.13.1...v5.13.2

`v5.13.1`

What's Changed

build: bump github.com/go-git/go-billy/v5 from 5.6.0 to 5.6.1 by @dependabot in #1327
build: bump github.com/elazarl/goproxy from 1.2.1 to 1.2.2 by @dependabot in #1329
build: bump github.com/elazarl/goproxy from 1.2.2 to 1.2.3 by @dependabot in #1340
Revert "plumbing: transport/ssh, Add support for SSH @cert-authority." by @pjbgf in #1346

Full Changelog: go-git/go-git@v5.13.0...v5.13.1

`v5.13.0`

What's Changed

build: bump github.com/go-git/go-git/v5 from 5.11.0 to 5.12.0 in /cli/go-git by @dependabot in #1065
build: bump golang.org/x/net from 0.22.0 to 0.23.0 by @dependabot in #1068
build: bump golang.org/x/net from 0.23.0 to 0.24.0 by @dependabot in #1071
Properly support skipping of non-mandatory extensions by @codablock in #1066
git: Refine some codes in test and non-test. by @onee-only in #1077
plumbing: protocol/packp, client-side filter capability support by @edigaryev in #1000
build: bump golang.org/x/net from 0.22.0 to 0.23.0 in /cli/go-git by @dependabot in #1078
plumbing: fix sideband demux on flush by @aymanbagabas in #1084
storage: dotgit, head reference usually comes first by @aymanbagabas in #1085
build: bump golang.org/x/text from 0.14.0 to 0.15.0 by @dependabot in #1091
build: bump golang.org/x/crypto from 0.22.0 to 0.23.0 by @dependabot in #1094
build: bump golang.org/x/net from 0.24.0 to 0.25.0 by @dependabot in #1093
git: Added an example for Repository.Branches by @johnmatthiggins in #1088
git: worktree_commit, Modify checking empty commit. Fixes #723 by @onee-only in #1050
plumbing: transport/http, Wrap http errors to return reason. Fixes #1097 by @ggambetti in #1100
build: bump golang.org/x/sys from 0.20.0 to 0.21.0 by @dependabot in #1106
build: bump golang.org/x/text from 0.15.0 to 0.16.0 by @dependabot in #1107
Bumps Go versions and go-billy by @pjbgf in #1056
_examples: Fixed a dead link COMPATIBILITY.md by @gecko655 in #1109
build: bump github.com/jessevdk/go-flags from 1.5.0 to 1.6.1 in /cli/go-git by @dependabot in #1115
build: bump github.com/elazarl/goproxy from v0.0.0-20230808193330-2592e75ae04a to v0.0.0-20240618083138-03be62527ccb by @hbelmiro in #1124
build: bump golang.org/x/net from 0.25.0 to 0.26.0 by @dependabot in #1104
Add option approximating git clean -x flag. by @msuozzo in #995
Revert "Add option approximating git clean -x flag." by @pjbgf in #1129
Fix reference updated concurrently error for the filesystem storer by @Javier-varez in #1116
build: bump golang.org/x/net from 0.26.0 to 0.27.0 by @dependabot in #1134
utils: merkletrie, Align error message with upstream by @pjbgf in #1142
plumbing: transport/file, Change paths to absolute by @pjbgf in #1141
plumbing: gitignore, Fix loading of ignored .gitignore files. by @Achilleshiel in #1114
build: bump github.com/skeema/knownhosts from 1.2.2 to 1.3.0 by @dependabot in #1147
plumbing: transport/ssh, Add support for SSH @cert-authority. by @Javier-varez in #1157
build: run example tests during CI workflow by @crazybolillo in #1030
storage: filesystem, Fix object cache not working due to uninitialised objects being put into cache by @SatelliteMind in #1138
git: Fix fetching missing commits by @AriehSchneier in #1032
plumbing: format/packfile, remove duplicate checks in findMatch() by @edigaryev in #1152
git: worktree, Fix file reported as Untracked while it is committed by @rodrigocam in #1023
build: bump golang.org/x/sys from 0.22.0 to 0.23.0 by @dependabot in #1160
plumbing: filemode, Remove check for setting size of .git/index file by @nicholasSUSE in #1159
build: bump golang.org/x/net from 0.27.0 to 0.28.0 by @dependabot in #1163
Fix some lint warning and increase stalebot to 180 days by @pjbgf in #1128
adjust path extracted from file: url on Windows by @tomqwpl in #416
build: bump golang.org/x/sys from 0.23.0 to 0.24.0 by @dependabot in #1164
Add RestoreStaged to Worktree that mimics the behaviour of git restore --staged ... by @ben-tbotlabs in #493
plumbing: signature, support the same x509 signature formats as git by @yoavamit in #1169
fix: allow discovery of non bare repos in fsLoader by @jakobmoellerdev in #1170
build: bump golang.org/x/sys from 0.24.0 to 0.25.0 by @dependabot in #1178
build: bump golang.org/x/text from 0.17.0 to 0.18.0 by @dependabot in #1179
build: bump golang.org/x/net from 0.28.0 to 0.29.0 by @dependabot in #1184
Consume push URLs when they are provided by @mcepl in #1191
*: use gocheck's MkDir instead of TempDir for tests. Fixes #807 by @uragirii in #1194
build: bump golang.org/x/net from 0.29.0 to 0.30.0 by @dependabot in #1200
worktree: .git/index not correctly generated when running on Windows by @BeChris in #1198
git: worktree, Fix sparse reset. Fixes #90 by @onee-only in #1101
git: worktree, Pass context on updateSubmodules. Fixes #1098 by @onee-only in #1154
build: bump github.com/go-git/go-billy/v5 from 5.5.1-0.20240427054813-8453aa90c6ec to 5.6.0 by @dependabot in #1211
Update contributing guidelines by @pjbgf in #1217
build: bump github.com/ProtonMail/go-crypto from 1.0.0 to 1.1.1 by @dependabot in #1222
build: bump golang.org/x/sys from 0.26.0 to 0.27.0 by @dependabot in #1223
build: bump golang.org/x/crypto from 0.28.0 to 0.29.0 by @dependabot in #1221
build: bump github.com/ProtonMail/go-crypto from 1.1.1 to 1.1.2 by @dependabot in #1226
build: bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @dependabot in #1232
build: bump github.com/ProtonMail/go-crypto from 1.1.2 to 1.1.3 by @dependabot in #1231
build: General improvements around fuzzing by @pjbgf in #1229
build: bump golang.org/x/net from 0.30.0 to 0.32.0 by @dependabot in #1241
build: group dependabot updates for golang.org by @AriehSchneier in #1243
build: bump github/codeql-action from 2.22.11 to 3.27.6 by @dependabot in #1244
build: bump golang.org/x/crypto from 0.21.0 to 0.31.0 in /cli/go-git by @dependabot in #1246
build: bump golang.org/x/crypto from 0.30.0 to 0.31.0 by @dependabot in #1247
build: bump github.com/gliderlabs/ssh from 0.3.7 to 0.3.8 by @dependabot in #1248
add comment preventing people from creating invalid trees by @petar in #732
build: bump github/codeql-action from 3.27.6 to 3.27.9 by @dependabot in #1250
plumbing: Properly encode index version 4 by @BeChris in #1251
Fix typos by @deining in #1148
Fix reset files in subfolders by @linglo in #1177
git: update switch cases by @hezhizhen in #1182
build: bump golang.org/x/net from 0.32.0 to 0.33.0 in the golang-org group by @dependabot in #1256
fix(1212): Fix invalid reference name error while cloning branches containing /- by @varmakarthik12 in #1257
pktline : accept upercase hexadecimal value as pktline length information by @BeChris in #1220
build: bump github/codeql-action from 3.27.9 to 3.28.0 by @dependabot in #1260
build: bump github.com/elazarl/goproxy from 0.0.0-20240618083138-03be62527ccb to 1.2.1 by @dependabot in #1262
git: worktree_commit, sanitize author and commiter name and email before creating the commit object. Fixes #680 by @BeChris in #1261

New Contributors

@johnmatthiggins made their first contribution in #1088
@ggambetti made their first contribution in #1100
@gecko655 made their first contribution in #1109
@hbelmiro made their first contribution in #1124
@msuozzo made their first contribution in #995
@Javier-varez made their first contribution in #1116
@Achilleshiel made their first contribution in #1114
@crazybolillo made their first contribution in #1030
@SatelliteMind made their first contribution in #1138
@rodrigocam made their first contribution in #1023
@nicholasSUSE made their first contribution in #1159
@tomqwpl made their first contribution in #416
@ben-tbotlabs made their first contribution in #493
@yoavamit made their first contribution in #1169
@uragirii made their first contribution in #1194
@petar made their first contribution in #732
@deining made their first contribution in #1148
@linglo made their first contribution in #1177
@varmakarthik12 made their first contribution in #1257

Full Changelog: go-git/go-git@v5.12.0...v5.13.0

`v5.12.0`

What's Changed

git: Worktree.AddWithOptions: add skipStatus option when providing a specific path by @moranCohen26 in #994
git: Signer: fix usage of crypto.Signer interface by @wlynch in #1029
git: Remote, fetch, adds the prune option. by @juliens in #366
git: Add crypto.Signer option to CommitOptions. by @wlynch in #996
git: Worktree checkout tag hash id (#959) by @aymanbagabas in #966
git: Worktree, Don't panic on empty or root path when checking if it is valid by @tim775 in #1042
git: Add commit validation for Reset by @pjbgf in #1048
git: worktree_commit, Fix amend commit to apply changes. Fixes #1024 by @onee-only in #1045
git: Implement Merge function with initial FastForwardMerge support by @pjbgf in #1044
plumbing: object, Make first commit visible on logs filtered with filename. Fixes #191 by @onee-only in #1036
plumbing: no panic in printStats function. Fixes #177 by @nodivbyzero in #971
plumbing: object, Optimize logging with file. by @onee-only in #1046
plumbing: object, check legitimacy in (*Tree).Encode by @niukuo in #967
plumbing: format/gitattributes, close file in ReadAttributesFile by @prskr in #1018
plumbing: check setAuth error. Fixes #185 by @nodivbyzero in #969
plumbing: object, fix variable defaultUtf8CommitMessageEncoding name spell error by @Jerry-yz in #987
utils: merkletrie, calculate filesystem node's hash lazily. by @candid82 in #825
utils: update comment in node.go's Hash() by @codablock in #992
_example: fix 404 link and added ssh-agent clone link by @grinish21 in #1022
_example: checkout-branch example by @dlambda in #446
_example: example for git clone using ssh-agent by @pjbgf in #998

New Contributors

@candid82 made their first contribution in #825
@codablock made their first contribution in #992
@Jerry-yz made their first contribution in #987
@wlynch made their first contribution in #996
@moranCohen26 made their first contribution in #994
@grinish21 made their first contribution in #1022
@prskr made their first contribution in #1018
@dlambda made their first contribution in #446
@juliens made their first contribution in #366
@onee-only made their first contribution in #1036
@tim775 made their first contribution in #1042
@niukuo made their first contribution in #967
@avoidalone made their first contribution in #1047

Full Changelog: go-git/go-git@v5.11.0...v5.12.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

openshift-ci · 2026-04-04T14:19:44Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux[bot]

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

sonarqubecloud · 2026-04-15T02:16:52Z

❌ The last analysis has failed.

sonarqubecloud · 2026-04-21T10:24:32Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-04-25T02:22:45Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-04-26T10:21:04Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-04-28T10:32:31Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-05-06T11:47:19Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-05-08T10:30:28Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-05-22T18:27:28Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-05-28T06:40:03Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-06-05T18:39:06Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-06-29T05:28:33Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

sonarqubecloud · 2026-07-09T01:16:21Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code