fix(deps): update module github.com/go-git/go-git/v5 to v5.16.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/go-git/go-git/v5	v5.12.0 -> v5.16.2

---

Release Notes

go-git/go-git (github.com/go-git/go-git/v5)

v5.16.2

Compare Source

What's Changed

• utils: fix diff so subpaths work for sparse checkouts, fixes 1455 to releases/v5.x by @​kane8n in https://github.com/go-git/go-git/pull/1567

Full Changelog: go-git/go-git@v5.16.1...v5.16.2

v5.16.1

Compare Source

What's Changed

• utils: merkletrie, Fix diff on sparse-checkout index. Fixes #​1406 to releases/v5.x by @​kane8n in https://github.com/go-git/go-git/pull/1561

New Contributors

• @​kane8n made their first contribution in https://github.com/go-git/go-git/pull/1561

Full Changelog: go-git/go-git@v5.16.0...v5.16.1

v5.16.0

Compare Source

What's Changed

• [v5] plumbing: support mTLS for HTTPS protocol by @​hiddeco in https://github.com/go-git/go-git/pull/1510
• v5: plumbing: transport, Reintroduce SetHostKeyCallback. Fix #​1514 by @​pjbgf in https://github.com/go-git/go-git/pull/1515

Full Changelog: go-git/go-git@v5.15.0...v5.16.0

v5.15.0

Compare Source

What's Changed

• plumbing: add cert auth support to releases/v5.x by @​Javier-varez in https://github.com/go-git/go-git/pull/1482
• v5: Bump dependencies by @​pjbgf in https://github.com/go-git/go-git/pull/1505

Full Changelog: go-git/go-git@v5.14.0...v5.15.0

v5.14.0

Compare Source

What's Changed

• v5: Bump Go and dependencies to mitigate GO-2025-3487 by @​pjbgf in https://github.com/go-git/go-git/pull/1436

⚠️ Note that this version requires Go 1.23, due to the bump to golang.org/x/crypto@v0.35.0 which mitigates the CVE above. User's that can't bump to Go 1.23 will need to remain on the previous v5.13.x release.

Full Changelog: go-git/go-git@v5.13.2...v5.14.0

v5.13.2

Compare Source

What's Changed

• plumbing: use the correct user agent string. Fixes #​883 by @​uragirii in https://github.com/go-git/go-git/pull/1364
• build: bump golang.org/x/sys from 0.28.0 to 0.29.0 in the golang-org group by @​dependabot in https://github.com/go-git/go-git/pull/1365
• build: bump the golang-org group with 2 updates by @​dependabot in https://github.com/go-git/go-git/pull/1367
• build: bump github.com/ProtonMail/go-crypto from 1.1.3 to 1.1.4 by @​dependabot in https://github.com/go-git/go-git/pull/1368
• build: bump github.com/go-git/go-billy/v5 from 5.6.1 to 5.6.2 by @​dependabot in https://github.com/go-git/go-git/pull/1378
• build: bump github/codeql-action from 3.28.0 to 3.28.1 by @​dependabot in https://github.com/go-git/go-git/pull/1376
• build: bump github.com/elazarl/goproxy from 1.2.3 to 1.4.0 by @​dependabot in https://github.com/go-git/go-git/pull/1377
• git: worktree, fix restoring dot slash files (backported to v5). Fixes #​1176 by @​BeChris in https://github.com/go-git/go-git/pull/1361
• build: bump github.com/pjbgf/sha1cd from 0.3.0 to 0.3.2 by @​dependabot in https://github.com/go-git/go-git/pull/1392
• git: worktree_status, fix adding dot slash files to working tree (backported to v5). Fixes #​1150 by @​BeChris in https://github.com/go-git/go-git/pull/1359
• build: bump github.com/ProtonMail/go-crypto from 1.1.4 to 1.1.5 by @​dependabot in https://github.com/go-git/go-git/pull/1383

Full Changelog: go-git/go-git@v5.13.1...v5.13.2

v5.13.1

Compare Source

What's Changed

• build: bump github.com/go-git/go-billy/v5 from 5.6.0 to 5.6.1 by @​dependabot in https://github.com/go-git/go-git/pull/1327
• build: bump github.com/elazarl/goproxy from 1.2.1 to 1.2.2 by @​dependabot in https://github.com/go-git/go-git/pull/1329
• build: bump github.com/elazarl/goproxy from 1.2.2 to 1.2.3 by @​dependabot in https://github.com/go-git/go-git/pull/1340
• Revert "plumbing: transport/ssh, Add support for SSH @​cert-authority." by @​pjbgf in #​1346

Full Changelog: go-git/go-git@v5.13.0...v5.13.1

v5.13.0

Compare Source

What's Changed

• build: bump github.com/go-git/go-git/v5 from 5.11.0 to 5.12.0 in /cli/go-git by @​dependabot in https://github.com/go-git/go-git/pull/1065
• build: bump golang.org/x/net from 0.22.0 to 0.23.0 by @​dependabot in https://github.com/go-git/go-git/pull/1068
• build: bump golang.org/x/net from 0.23.0 to 0.24.0 by @​dependabot in https://github.com/go-git/go-git/pull/1071
• Properly support skipping of non-mandatory extensions by @​codablock in https://github.com/go-git/go-git/pull/1066
• git: Refine some codes in test and non-test. by @​onee-only in https://github.com/go-git/go-git/pull/1077
• plumbing: protocol/packp, client-side filter capability support by @​edigaryev in https://github.com/go-git/go-git/pull/1000
• build: bump golang.org/x/net from 0.22.0 to 0.23.0 in /cli/go-git by @​dependabot in https://github.com/go-git/go-git/pull/1078
• plumbing: fix sideband demux on flush by @​aymanbagabas in https://github.com/go-git/go-git/pull/1084
• storage: dotgit, head reference usually comes first by @​aymanbagabas in https://github.com/go-git/go-git/pull/1085
• build: bump golang.org/x/text from 0.14.0 to 0.15.0 by @​dependabot in https://github.com/go-git/go-git/pull/1091
• build: bump golang.org/x/crypto from 0.22.0 to 0.23.0 by @​dependabot in https://github.com/go-git/go-git/pull/1094
• build: bump golang.org/x/net from 0.24.0 to 0.25.0 by @​dependabot in https://github.com/go-git/go-git/pull/1093
• git: Added an example for Repository.Branches by @​johnmatthiggins in https://github.com/go-git/go-git/pull/1088
• git: worktree_commit, Modify checking empty commit. Fixes #​723 by @​onee-only in https://github.com/go-git/go-git/pull/1050
• plumbing: transport/http, Wrap http errors to return reason. Fixes #​1097 by @​ggambetti in https://github.com/go-git/go-git/pull/1100
• build: bump golang.org/x/sys from 0.20.0 to 0.21.0 by @​dependabot in https://github.com/go-git/go-git/pull/1106
• build: bump golang.org/x/text from 0.15.0 to 0.16.0 by @​dependabot in https://github.com/go-git/go-git/pull/1107
• Bumps Go versions and go-billy by @​pjbgf in https://github.com/go-git/go-git/pull/1056
• _examples: Fixed a dead link COMPATIBILITY.md by @​gecko655 in https://github.com/go-git/go-git/pull/1109
• build: bump github.com/jessevdk/go-flags from 1.5.0 to 1.6.1 in /cli/go-git by @​dependabot in https://github.com/go-git/go-git/pull/1115
• build: bump github.com/elazarl/goproxy from v0.0.0-20230808193330-2592e75ae04a to v0.0.0-20240618083138-03be62527ccb by @​hbelmiro in https://github.com/go-git/go-git/pull/1124
• build: bump golang.org/x/net from 0.25.0 to 0.26.0 by @​dependabot in https://github.com/go-git/go-git/pull/1104
• Add option approximating git clean -x flag. by @​msuozzo in https://github.com/go-git/go-git/pull/995
• Revert "Add option approximating git clean -x flag." by @​pjbgf in https://github.com/go-git/go-git/pull/1129
• Fix reference updated concurrently error for the filesystem storer by @​Javier-varez in https://github.com/go-git/go-git/pull/1116
• build: bump golang.org/x/net from 0.26.0 to 0.27.0 by @​dependabot in https://github.com/go-git/go-git/pull/1134
• utils: merkletrie, Align error message with upstream by @​pjbgf in https://github.com/go-git/go-git/pull/1142
• plumbing: transport/file, Change paths to absolute by @​pjbgf in https://github.com/go-git/go-git/pull/1141
• plumbing: gitignore, Fix loading of ignored .gitignore files. by @​Achilleshiel in https://github.com/go-git/go-git/pull/1114
• build: bump github.com/skeema/knownhosts from 1.2.2 to 1.3.0 by @​dependabot in https://github.com/go-git/go-git/pull/1147
• plumbing: transport/ssh, Add support for SSH @​cert-authority. by @​Javier-varez in https://github.com/go-git/go-git/pull/1157
• build: run example tests during CI workflow by @​crazybolillo in https://github.com/go-git/go-git/pull/1030
• storage: filesystem, Fix object cache not working due to uninitialised objects being put into cache by @​SatelliteMind in https://github.com/go-git/go-git/pull/1138
• git: Fix fetching missing commits by @​AriehSchneier in https://github.com/go-git/go-git/pull/1032
• plumbing: format/packfile, remove duplicate checks in findMatch() by @​edigaryev in https://github.com/go-git/go-git/pull/1152
• git: worktree, Fix file reported as Untracked while it is committed by @​rodrigocam in https://github.com/go-git/go-git/pull/1023
• build: bump golang.org/x/sys from 0.22.0 to 0.23.0 by @​dependabot in https://github.com/go-git/go-git/pull/1160
• plumbing: filemode, Remove check for setting size of .git/index file by @​nicholasSUSE in https://github.com/go-git/go-git/pull/1159
• build: bump golang.org/x/net from 0.27.0 to 0.28.0 by @​dependabot in https://github.com/go-git/go-git/pull/1163
• Fix some lint warning and increase stalebot to 180 days by @​pjbgf in https://github.com/go-git/go-git/pull/1128
• adjust path extracted from file: url on Windows by @​tomqwpl in https://github.com/go-git/go-git/pull/416
• build: bump golang.org/x/sys from 0.23.0 to 0.24.0 by @​dependabot in https://github.com/go-git/go-git/pull/1164
• Add RestoreStaged to Worktree that mimics the behaviour of git restore --staged ... by @​ben-tbotlabs in https://github.com/go-git/go-git/pull/493
• plumbing: signature, support the same x509 signature formats as git by @​yoavamit in https://github.com/go-git/go-git/pull/1169
• fix: allow discovery of non bare repos in fsLoader by @​jakobmoellerdev in https://github.com/go-git/go-git/pull/1170
• build: bump golang.org/x/sys from 0.24.0 to 0.25.0 by @​dependabot in https://github.com/go-git/go-git/pull/1178
• build: bump golang.org/x/text from 0.17.0 to 0.18.0 by @​dependabot in https://github.com/go-git/go-git/pull/1179
• build: bump golang.org/x/net from 0.28.0 to 0.29.0 by @​dependabot in https://github.com/go-git/go-git/pull/1184
• Consume push URLs when they are provided by @​mcepl in https://github.com/go-git/go-git/pull/1191
• *: use gocheck's MkDir instead of TempDir for tests. Fixes #​807 by @​uragirii in https://github.com/go-git/go-git/pull/1194
• build: bump golang.org/x/net from 0.29.0 to 0.30.0 by @​dependabot in https://github.com/go-git/go-git/pull/1200
• worktree: .git/index not correctly generated when running on Windows by @​BeChris in https://github.com/go-git/go-git/pull/1198
• git: worktree, Fix sparse reset. Fixes #​90 by @​onee-only in https://github.com/go-git/go-git/pull/1101
• git: worktree, Pass context on updateSubmodules. Fixes #​1098 by @​onee-only in https://github.com/go-git/go-git/pull/1154
• build: bump github.com/go-git/go-billy/v5 from 5.5.1-0.20240427054813-8453aa90c6ec to 5.6.0 by @​dependabot in https://github.com/go-git/go-git/pull/1211
• Update contributing guidelines by @​pjbgf in https://github.com/go-git/go-git/pull/1217
• build: bump github.com/ProtonMail/go-crypto from 1.0.0 to 1.1.1 by @​dependabot in https://github.com/go-git/go-git/pull/1222
• build: bump golang.org/x/sys from 0.26.0 to 0.27.0 by @​dependabot in https://github.com/go-git/go-git/pull/1223
• build: bump golang.org/x/crypto from 0.28.0 to 0.29.0 by @​dependabot in https://github.com/go-git/go-git/pull/1221
• build: bump github.com/ProtonMail/go-crypto from 1.1.1 to 1.1.2 by @​dependabot in https://github.com/go-git/go-git/pull/1226
• build: bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @​dependabot in https://github.com/go-git/go-git/pull/1232
• build: bump github.com/ProtonMail/go-crypto from 1.1.2 to 1.1.3 by @​dependabot in https://github.com/go-git/go-git/pull/1231
• build: General improvements around fuzzing by @​pjbgf in https://github.com/go-git/go-git/pull/1229
• build: bump golang.org/x/net from 0.30.0 to 0.32.0 by @​dependabot in https://github.com/go-git/go-git/pull/1241
• build: group dependabot updates for golang.org by @​AriehSchneier in https://github.com/go-git/go-git/pull/1243
• build: bump github/codeql-action from 2.22.11 to 3.27.6 by @​dependabot in https://github.com/go-git/go-git/pull/1244
• build: bump golang.org/x/crypto from 0.21.0 to 0.31.0 in /cli/go-git by @​dependabot in https://github.com/go-git/go-git/pull/1246
• build: bump golang.org/x/crypto from 0.30.0 to 0.31.0 by @​dependabot in https://github.com/go-git/go-git/pull/1247
• build: bump github.com/gliderlabs/ssh from 0.3.7 to 0.3.8 by @​dependabot in https://github.com/go-git/go-git/pull/1248
• add comment preventing people from creating invalid trees by @​petar in https://github.com/go-git/go-git/pull/732
• build: bump github/codeql-action from 3.27.6 to 3.27.9 by @​dependabot in https://github.com/go-git/go-git/pull/1250
• plumbing: Properly encode index version 4 by @​BeChris in https://github.com/go-git/go-git/pull/1251
• Fix typos by @​deining in https://github.com/go-git/go-git/pull/1148
• Fix reset files in subfolders by @​linglo in https://github.com/go-git/go-git/pull/1177
• git: update switch cases by @​hezhizhen in https://github.com/go-git/go-git/pull/1182
• build: bump golang.org/x/net from 0.32.0 to 0.33.0 in the golang-org group by @​dependabot in https://github.com/go-git/go-git/pull/1256
• fix(1212): Fix invalid reference name error while cloning branches containing /- by @​varmakarthik12 in https://github.com/go-git/go-git/pull/1257
• pktline : accept upercase hexadecimal value as pktline length information by @​BeChris in https://github.com/go-git/go-git/pull/1220
• build: bump github/codeql-action from 3.27.9 to 3.28.0 by @​dependabot in https://github.com/go-git/go-git/pull/1260
• build: bump github.com/elazarl/goproxy from 0.0.0-20240618083138-03be62527ccb to 1.2.1 by @​dependabot in https://github.com/go-git/go-git/pull/1262
• git: worktree_commit, sanitize author and commiter name and email before creating the commit object. Fixes #​680 by @​BeChris in https://github.com/go-git/go-git/pull/1261

New Contributors

• @​johnmatthiggins made their first contribution in https://github.com/go-git/go-git/pull/1088
• @​ggambetti made their first contribution in https://github.com/go-git/go-git/pull/1100
• @​gecko655 made their first contribution in https://github.com/go-git/go-git/pull/1109
• @​hbelmiro made their first contribution in https://github.com/go-git/go-git/pull/1124
• @​msuozzo made their first contribution in https://github.com/go-git/go-git/pull/995
• @​Javier-varez made their first contribution in https://github.com/go-git/go-git/pull/1116
• @​Achilleshiel made their first contribution in https://github.com/go-git/go-git/pull/1114
• @​crazybolillo made their first contribution in https://github.com/go-git/go-git/pull/1030
• @​SatelliteMind made their first contribution in https://github.com/go-git/go-git/pull/1138
• @​rodrigocam made their first contribution in https://github.com/go-git/go-git/pull/1023
• @​nicholasSUSE made their first contribution in https://github.com/go-git/go-git/pull/1159
• @​tomqwpl made their first contribution in https://github.com/go-git/go-git/pull/416
• @​ben-tbotlabs made their first contribution in https://github.com/go-git/go-git/pull/493
• @​yoavamit made their first contribution in https://github.com/go-git/go-git/pull/1169
• @​uragirii made their first contribution in https://github.com/go-git/go-git/pull/1194
• @​petar made their first contribution in https://github.com/go-git/go-git/pull/732
• @​deining made their first contribution in https://github.com/go-git/go-git/pull/1148
• @​linglo made their first contribution in https://github.com/go-git/go-git/pull/1177
• @​varmakarthik12 made their first contribution in https://github.com/go-git/go-git/pull/1257

Full Changelog: go-git/go-git@v5.12.0...v5.13.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 10 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.22 -> 1.23.0
github.com/ProtonMail/go-crypto	v1.0.0 -> v1.1.6
github.com/cloudflare/circl	v1.3.9 -> v1.6.1
github.com/cyphar/filepath-securejoin	v0.3.1 -> v0.4.1
github.com/go-git/go-billy/v5	v5.5.0 -> v5.6.2
github.com/golang/groupcache	v0.0.0-20210331224755-41bb18bfe9da -> v0.0.0-20241129210726-2c02b8208cf8
github.com/pjbgf/sha1cd	v0.3.0 -> v0.3.2
github.com/skeema/knownhosts	v1.3.0 -> v1.3.1
golang.org/x/crypto	v0.26.0 -> v0.37.0
golang.org/x/net	v0.28.0 -> v0.39.0
golang.org/x/sys	v0.23.0 -> v0.32.0