Skip to content

build(deps): bump the go_modules group across 2 directories with 1 update - #2120

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/dot-claude/skills/datadog-operations/datadog-skill-go/go_modules-19fab2bdf3
Open

build(deps): bump the go_modules group across 2 directories with 1 update#2120
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/dot-claude/skills/datadog-operations/datadog-skill-go/go_modules-19fab2bdf3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the go_modules group with 1 update in the /.claude/skills/datadog-operations/datadog-skill-go directory: github.com/go-git/go-git/v5.
Bumps the go_modules group with 1 update in the /dd-skill-test/datadog-skill-go directory: github.com/go-git/go-git/v5.

Updates github.com/go-git/go-git/v5 from 5.17.1 to 5.19.0

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.0

What's Changed

Full Changelog: go-git/go-git@v5.18.0...v5.19.0

v5.18.0

What's Changed

Full Changelog: go-git/go-git@v5.17.2...v5.18.0

v5.17.2

What's Changed

⚠️ This release fixes a bug (go-git/go-git#1942) that blocked some users from upgrading to v5.17.1. Thanks @​pskrbasu for reporting it. 🙇

Full Changelog: go-git/go-git@v5.17.1...v5.17.2

Commits
  • bc930f4 Merge pull request #2065 from go-git/commit-v5
  • d315264 plumbing: object, Reset object before decode
  • 6e1d348 plumbing: object, Align Tree handling with upstream
  • e134ba3 tests: Skip double checks in Git v2.11
  • 1971422 tests: Add git conformance tests for signing verification
  • a387aa8 plumbing: object, Add ErrMalformedTag
  • f415670 plumbing: object, Decode Tag headers via a state machine
  • 5b0cd38 plumbing: object, Reject multi-signature commits at Verify
  • fe8ed62 plumbing: object, Align Tag.EncodeWithoutSignature with Commit
  • 98e337d plumbing: object, Add support for Tag.SignatureSHA256
  • Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.17.1 to 5.19.0

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.0

What's Changed

Full Changelog: go-git/go-git@v5.18.0...v5.19.0

v5.18.0

What's Changed

Full Changelog: go-git/go-git@v5.17.2...v5.18.0

v5.17.2

What's Changed

⚠️ This release fixes a bug (go-git/go-git#1942) that blocked some users from upgrading to v5.17.1. Thanks @​pskrbasu for reporting it. 🙇

Full Changelog: go-git/go-git@v5.17.1...v5.17.2

Commits
  • bc930f4 Merge pull request #2065 from go-git/commit-v5
  • d315264 plumbing: object, Reset object before decode
  • 6e1d348 plumbing: object, Align Tree handling with upstream
  • e134ba3 tests: Skip double checks in Git v2.11
  • 1971422 tests: Add git conformance tests for signing verification
  • a387aa8 plumbing: object, Add ErrMalformedTag
  • f415670 plumbing: object, Decode Tag headers via a state machine
  • 5b0cd38 plumbing: object, Reject multi-signature commits at Verify
  • fe8ed62 plumbing: object, Align Tag.EncodeWithoutSignature with Commit
  • 98e337d plumbing: object, Add support for Tag.SignatureSHA256
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump the go_modules group across 2 directories with 1 up…
da38396 
…date

Bumps the go_modules group with 1 update in the /.claude/skills/datadog-operations/datadog-skill-go directory: [github.com/go-git/go-git/v5](https://github.com/go-git/go-git).
Bumps the go_modules group with 1 update in the /dd-skill-test/datadog-skill-go directory: [github.com/go-git/go-git/v5](https://github.com/go-git/go-git).


Updates `github.com/go-git/go-git/v5` from 5.17.1 to 5.19.0
- [Release notes](https://github.com/go-git/go-git/releases)
- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md)
- [Commits](go-git/go-git@v5.17.1...v5.19.0)

Updates `github.com/go-git/go-git/v5` from 5.17.1 to 5.19.0
- [Release notes](https://github.com/go-git/go-git/releases)
- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md)
- [Commits](go-git/go-git@v5.17.1...v5.19.0)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.19.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.19.0
  dependency-type: direct:production
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels May 11, 2026
@dependabot
dependabot Bot requested a review from ryanmaclean as a code owner May 11, 2026 15:50
@github-actions

github-actions Bot commented May 11, 2026

Copy link
Copy Markdown
Contributor

PR Analysis 📊

Changed Files Summary:

  • JavaScript/TypeScript files: 0
  • Test files: 0
  • Documentation files: 0
  • Configuration files: 0

CI Status: Running automated checks...

@github-actions

github-actions Bot commented May 11, 2026

Copy link
Copy Markdown
Contributor

Dependency Audit Results

# npm audit report

@babel/plugin-transform-modules-systemjs  7.12.0 - 7.29.0
Severity: high
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input - https://github.com/advisories/GHSA-fv7c-fp4j-7gwp
fix available via `npm audit fix`
node_modules/@babel/plugin-transform-modules-systemjs

@opentelemetry/auto-instrumentations-node  <=0.74.0
Severity: high
Depends on vulnerable versions of @opentelemetry/sdk-node
Prometheus exporter process crash via malformed HTTP request - https://github.com/advisories/GHSA-q7rr-3cgh-j5r3
fix available via `npm audit fix --force`
Will install @opentelemetry/auto-instrumentations-node@0.75.0, which is a breaking change
node_modules/@opentelemetry/auto-instrumentations-node

@opentelemetry/exporter-prometheus  <0.217.0
Severity: high
Prometheus exporter process crash via malformed HTTP request - https://github.com/advisories/GHSA-q7rr-3cgh-j5r3
fix available via `npm audit fix --force`
Will install @opentelemetry/exporter-prometheus@0.217.0, which is a breaking change
node_modules/@opentelemetry/exporter-prometheus
node_modules/@opentelemetry/sdk-node/node_modules/@opentelemetry/exporter-prometheus
  @opentelemetry/sdk-node  <=0.216.0
  Depends on vulnerable versions of @opentelemetry/exporter-prometheus
  node_modules/@opentelemetry/sdk-node


aws-sdk  >=2.0.1
JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3 - https://github.com/advisories/GHSA-j965-2qgj-vjmq
fix available via `npm audit fix --force`
Will install aws-sdk@1.18.0, which is a breaking change
node_modules/aws-sdk

basic-ftp  <=5.3.0
Severity: high
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering - https://github.com/advisories/GHSA-rpmf-866q-6p89
fix available via `npm audit fix`
node_modules/basic-ftp

fast-uri  <=3.1.1
Severity: high
fast-uri vulnerable to path traversal via percent-encoded dot segments - https://github.com/advisories/GHSA-q3j6-qgpj-74h6
fast-uri vulnerable to host confusion via percent-encoded authority delimiters - https://github.com/advisories/GHSA-v39h-62p7-jpjc
fix available via `npm audit fix`
node_modules/fast-uri

fast-xml-builder  <=1.1.6
Severity: high
fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes - https://github.com/advisories/GHSA-5wm8-gmm8-39j9
fast-xml-builder Comment Value regex can be bypassed - https://github.com/advisories/GHSA-45c6-75p6-83cc
fix available via `npm audit fix`
node_modules/fast-xml-builder

hono  <=4.12.17
Severity: moderate
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests - https://github.com/advisories/GHSA-9vqf-7f2p-gf9v
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection - https://github.com/advisories/GHSA-69xw-7hcm-h432
Hono has CSS Declaration Injection via Style Object Values in JSX SSR - https://github.com/advisories/GHSA-qp7p-654g-cw7p
Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() - https://github.com/advisories/GHSA-hm8q-7f3q-5f36
Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage - https://github.com/advisories/GHSA-p77w-8qqv-26rm
fix available via `npm audit fix`
node_modules/hono

ip-address  <=10.1.0
Severity: moderate
ip-address has XSS in Address6 HTML-emitting methods - https://github.com/advisories/GHSA-v2v4-37r5-5v8g
fix available via `npm audit fix`
node_modules/ip-address
  express-rate-limit  8.0.1 - 8.5.0
  Depends on vulnerable versions of ip-address
  node_modules/express-rate-limit

next  9.3.4-canary.0 - 16.3.0-canary.5
Severity: high
Next.js Vulnerable to Denial of Service with Server Components - https://github.com/advisories/GHSA-8h8q-6873-q5fj
Depends on vulnerable versions of postcss
fix available via `npm audit fix --force`
Will install next@16.2.6, which is outside the stated dependency range
node_modules/next

postcss  <8.5.10
Severity: moderate
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - https://github.com/advisories/GHSA-qx2v-qp2m-jg93
fix available via `npm audit fix --force`
Will install next@16.2.6, which is outside the stated dependency range
node_modules/next/node_modules/postcss

13 vulnerabilities (1 low, 4 moderate, 8 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

@github-actions

github-actions Bot commented May 11, 2026

Copy link
Copy Markdown
Contributor

Quick Checks Results

Check Status
ESLint ✅
TypeScript ✅

✅ All quick checks passed!

@github-actions

github-actions Bot commented May 11, 2026

Copy link
Copy Markdown
Contributor

Build Status ✅ Build successful

✅ Build completed successfully!

@github-actions

github-actions Bot commented May 11, 2026

Copy link
Copy Markdown
Contributor

Test Results ✅ Passed

Test Suites: 78 failed, 5 skipped, 468 passed, 546 of 551 total
Tests: 556 failed, 104 skipped, 42 todo, 10478 passed, 11180 total

✅ All tests passed! Ready for review.

View test output

Check the Actions tab for detailed test output.

@github-actions

github-actions Bot commented May 11, 2026

Copy link
Copy Markdown
Contributor

PR Status Summary

Check Status
Quick Checks ✅ Passed
Tests ✅ Passed
Build ✅ Passed

✅ All checks passed! This PR is ready to merge. 🎉

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ryanmaclean ryanmaclean Awaiting requested review from ryanmaclean ryanmaclean is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants