Bump github.com/go-git/go-git/v5 from 5.16.2 to 5.19.1 in the oc-mirror-v2-security-updates group across 1 directory#1381
Conversation
dependabot
Bot
added
dependencies
WalkthroughUpdates the module directive to Go 1.25.0 and bumps versions for multiple dependencies in go.mod, including golang.org/x/crypto, golang.org/x/sync, golang.org/x/term, github.com/go-git/*, github.com/cyphar/filepath-securejoin, and several indirect golang.org/x packages. ChangesDependency Version Bumps
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 5 | ❌ 10❌ Failed checks (10 inconclusive)
✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Tools execution failed with the following error: Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error) Comment |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/ok-to-test |
openshift-ci
Bot
added
ok-to-test
aguidirh
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@dependabot[bot]: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
needs-rebase
|
rebase DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@dependabot rebase |
Bumps the oc-mirror-v2-security-updates group with 1 update in the / directory: [github.com/go-git/go-git/v5](https://github.com/go-git/go-git). Updates `github.com/go-git/go-git/v5` from 5.16.2 to 5.19.1 - [Release notes](https://github.com/go-git/go-git/releases) - [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md) - [Commits](go-git/go-git@v5.16.2...v5.19.1) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.17.1 dependency-type: indirect dependency-group: oc-mirror-v2-security-updates ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/go_modules/oc-mirror-v2-security-updates-f67f74747b
branch
from
79b1082 to
f403b62
Compare
openshift-ci
Bot
removed
the
needs-rebase
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: aguidirh, dependabot[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 29-32: The go.mod update lists bumped modules (golang.org/x/crypto
v0.50.0, golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f, golang.org/x/sync
v0.20.0, golang.org/x/term v0.42.0) but lacks verification evidence; run an OSV
querybatch for those exact module@version identifiers and retrieve the Go proxy
metadata (the `@v/`<version>.info JSON) for each module version (or attach the CI
artifact that contains that metadata) and include both sets of outputs in the PR
so reviewers can see there are no OSV/CVE matches and that none of the versions
are yanked or pre-release. Ensure the attached evidence explicitly references
the four module@version strings above and make it easy to inspect (e.g., raw
JSON or CI job artifact links).
- Line 3: The go.mod line "go 1.25.0" may pin a toolchain newer than CI/build
images support; verify all CI jobs, Dockerfiles/Containerfiles, Makefile
targets, and any workflow YAMLs reference or use a Go version that supports 1.25
(search for golang:*, GO_VERSION, toolchain go1.* entries), and either update
those images/vars to golang:1.25.x or lower the go.mod "go" directive to the
highest Go minor version guaranteed in CI; after aligning versions, run the
provided shell checks and CI locally to confirm builds/tests pass before
merging.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: fbaf069e-be4e-494a-80ae-8ea9ba5e8c8e
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| module github.com/openshift/oc-mirror/v2 | ||
|
|
||
| go 1.24.3 | ||
| go 1.25.0 |
There was a problem hiding this comment.
Validate CI/tooling support for Go 1.25.0 before merge.
Please confirm all build/test images and CI jobs are already on Go 1.25.x; otherwise this can cause immediate pipeline breakage after merge.
#!/bin/bash
set -euo pipefail
echo "== Files that pin Go/toolchain versions =="
fd -i '(^|\.)(go\.mod|Dockerfile|Containerfile|Makefile|\.yml|\.yaml)$' . \
| xargs -r rg -n -C2 -e '\bgo\s+1\.' -e 'golang:1\.' -e 'GO_VERSION' -e 'toolchain\s+go1\.'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 3, The go.mod line "go 1.25.0" may pin a toolchain newer than
CI/build images support; verify all CI jobs, Dockerfiles/Containerfiles,
Makefile targets, and any workflow YAMLs reference or use a Go version that
supports 1.25 (search for golang:*, GO_VERSION, toolchain go1.* entries), and
either update those images/vars to golang:1.25.x or lower the go.mod "go"
directive to the highest Go minor version guaranteed in CI; after aligning
versions, run the provided shell checks and CI locally to confirm builds/tests
pass before merging.
| golang.org/x/crypto v0.50.0 | ||
| golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect | ||
| golang.org/x/sync v0.20.0 // indirect | ||
| golang.org/x/term v0.42.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify exact versions and release stability for the bumped modules in go.mod
mods=(
"golang.org/x/crypto@v0.50.0"
"golang.org/x/exp@v0.0.0-20260410095643-746e56fc9e2f"
"golang.org/x/sync@v0.20.0"
"golang.org/x/term@v0.42.0"
"github.com/cyphar/filepath-securejoin@v0.6.1"
"github.com/go-git/go-billy/v5@v5.9.0"
"github.com/go-git/go-git/v5@v5.19.1"
"golang.org/x/net@v0.53.0"
"golang.org/x/sys@v0.43.0"
"golang.org/x/text@v0.36.0"
)
echo "== OSV check (querybatch) =="
payload="$(printf '%s\n' "${mods[@]}" | awk -F@ '{printf "{\"package\":{\"ecosystem\":\"Go\",\"name\":\"%s\"},\"version\":\"%s\"}\n",$1,$2}' | jq -s '{queries:.}')"
curl -sS https://api.osv.dev/v1/querybatch \
-H 'content-type: application/json' \
-d "$payload" | jq .
echo "== Go proxy metadata (sanity: version exists) =="
for m in "${mods[@]}"; do
mod="${m%@*}"
ver="${m#*@}"
enc_mod="${mod//\//%2F}"
echo "--- $m"
curl -fsS "https://proxy.golang.org/${mod}/@v/${ver}.info" | jq . || echo "missing on proxy: $m"
doneRepository: openshift/oc-mirror
Length of output: 1925
Add OSV/CVE and yanked/pre-release verification evidence for bumped go.mod modules
The dependency versions are pinned, but there’s no attached output showing the bumped modules are free of OSV advisories and are not yanked/pre-release. Attach the OSV querybatch results and Go proxy @v/<version>.info metadata (or the CI artifact) for at least: golang.org/x/crypto@v0.50.0, golang.org/x/exp@v0.0.0-20260410095643-746e56fc9e2f, golang.org/x/sync@v0.20.0, golang.org/x/term@v0.42.0.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 29 - 32, The go.mod update lists bumped modules
(golang.org/x/crypto v0.50.0, golang.org/x/exp
v0.0.0-20260410095643-746e56fc9e2f, golang.org/x/sync v0.20.0, golang.org/x/term
v0.42.0) but lacks verification evidence; run an OSV querybatch for those exact
module@version identifiers and retrieve the Go proxy metadata (the
`@v/`<version>.info JSON) for each module version (or attach the CI artifact that
contains that metadata) and include both sets of outputs in the PR so reviewers
can see there are no OSV/CVE matches and that none of the versions are yanked or
pre-release. Ensure the attached evidence explicitly references the four
module@version strings above and make it easy to inspect (e.g., raw JSON or CI
job artifact links).
|
@dependabot[bot]: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Bumps the oc-mirror-v2-security-updates group with 1 update in the / directory: github.com/go-git/go-git/v5.
Updates
github.com/go-git/go-git/v5from 5.16.2 to 5.19.1Release notes
Sourced from github.com/go-git/go-git/v5's releases.
... (truncated)
Commits
3c3be60Merge pull request #2137 from go-git/validate-v53fba897plumbing: format/packfile, cap delta chain depth in parsera97d660Merge pull request #2125 from hiddeco/v5/format-input-boundsaeaa125plumbing: format/objfile, require Header before Read1f38e17plumbing: format/packfile, bound inflate sizef7545a0plumbing: format/idxfile, bound nr by file size170b881Merge pull request #2116 from pjbgf/symlink-v57b6d994Merge pull request #2117 from hiddeco/v5/worktree-fs-mkdirall-root-noopf0709b3git: Stop validating symlink target paths776d00fgit: Allow MkdirAll on worktree-root pathsSummary by CodeRabbit