build(deps): bump the go_modules group across 1 directory with 4 updates#689
build(deps): bump the go_modules group across 1 directory with 4 updates#689dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps the go_modules group with 3 updates in the / directory: [github.com/go-git/go-git/v5](https://github.com/go-git/go-git), [github.com/distribution/distribution/v3](https://github.com/distribution/distribution) and [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go). Updates `github.com/go-git/go-git/v5` from 5.16.5 to 5.17.1 - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](go-git/go-git@v5.16.5...v5.17.1) Updates `github.com/distribution/distribution/v3` from 3.0.0 to 3.1.0 - [Release notes](https://github.com/distribution/distribution/releases) - [Commits](distribution/distribution@v3.0.0...v3.1.0) Updates `github.com/go-jose/go-jose/v4` from 4.1.3 to 4.1.4 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.1.3...v4.1.4) Updates `go.opentelemetry.io/otel/sdk` from 1.42.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.42.0...v1.43.0) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.17.1 dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/distribution/distribution/v3 dependency-version: 3.1.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.4 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 9a751c7. Configure here.
| github.com/docker/docker v28.5.1+incompatible | ||
| github.com/fatih/color v1.18.0 | ||
| github.com/go-git/go-git/v5 v5.16.5 | ||
| github.com/go-git/go-git/v5 v5.17.1 |
There was a problem hiding this comment.
go-git v5.17.1 rejects repos with worktreeConfig extension
Medium Severity
Bumping go-git/go-git/v5 from v5.16.5 to v5.17.1 introduces strict Git extension validation (go-git/go-git#1861) that rejects repositories with unsupported extensions like worktreeConfig. Git automatically sets extensions.worktreeConfig=true when using git worktree add, a common workflow. The gitSHABranch() function calls git.PlainOpenWithOptions() which will now fail with an error like "repositoryformatversion does not support extension: worktreeconfig" for these repos. This is a confirmed upstream issue (go-git/go-git#1943) with no fix planned for v5. The --auto flag for replicated release create will break for affected users.
Reviewed by Cursor Bugbot for commit 9a751c7. Configure here.
|
Superseded by #690. |
Bumps the go_modules group with 3 updates in the / directory: github.com/go-git/go-git/v5, github.com/distribution/distribution/v3 and go.opentelemetry.io/otel/sdk.
Updates
github.com/go-git/go-git/v5from 5.16.5 to 5.17.1Release notes
Sourced from github.com/go-git/go-git/v5's releases.
Commits
5e23dfdMerge pull request #1937 from pjbgf/idx-v56b38a32Merge pull request #1935 from pjbgf/index-v5cd757fcplumbing: format/idxfile, Fix version and fanout checks3ec0d70plumbing: format/index, Fix tree extension invalidated entry parsingdbe10b6plumbing: format/index, Align V2/V3 long name and V4 prefix encoding with Gite9b65dfplumbing: format/index, Improve v4 entry name validationadad18dMerge pull request #1930 from go-git/renovate/releases/v5.x-go-github.com-clo...29470bdbuild: Update module github.com/cloudflare/circl to v1.6.3 [SECURITY]bdf0688Merge pull request #1864 from pjbgf/v5-issue-555290e52storage: filesystem, Avoid overwriting loose obj files. Fixes #55Updates
github.com/distribution/distribution/v3from 3.0.0 to 3.1.0Release notes
Sourced from github.com/distribution/distribution/v3's releases.
... (truncated)
Commits
708f8d6chore(ci): Prep for v3.1 release (#4841)b1d5dbcchore(ci): Prep for v3.1 release078b078Merge commit from forkcccd0d4fix(vendor): fix broke vendor validation (#4839)49447e8fix(vendor): fix broke vendpor validationcc5d5faMerge commit from fork4cfa178build(deps): bump actions/configure-pages from 5.0.0 to 6.0.0 (#4834)c4bac3bbuild(deps): bump codecov/codecov-action from 5.5.4 to 6.0.0 (#4836)2f2ce9fOpt: refactor tag list pagination support (#4353)6a02a0eOpt: refactor tag list pagination supportUpdates
github.com/go-jose/go-jose/v4from 4.1.3 to 4.1.4Release notes
Sourced from github.com/go-jose/go-jose/v4's releases.
Commits
0e59876Merge commit from forkddffdbcBump actions/checkout from 5 to 6 (#213)Updates
go.opentelemetry.io/otel/sdkfrom 1.42.0 to 1.43.0Changelog
Sourced from go.opentelemetry.io/otel/sdk's changelog.
Commits
9276201Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)61b8c94chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)97a086echore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)5e363delimit response body size for OTLP HTTP exporters (#8108)35214b6Use an absolute path when calling bsd kenv (#8113)290024cfix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)e70658efix: support getBody in otelploghttp (#8096)4afe468fix(deps): update googleapis to 9d38bb4 (#8117)b9ca729chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)69472ecchore(deps): update fossas/fossa-action action to v1.9.0 (#8118)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.