Skip to content

chore(deps): bump the go-modules group in /dependency/retrieval with 28 updates - #285

Merged
paketo-bot merged 1 commit into
mainfrom
dependabot/go_modules/dependency/retrieval/go-modules-6df6577bc0
Aug 6, 2026
Merged

chore(deps): bump the go-modules group in /dependency/retrieval with 28 updates#285
paketo-bot merged 1 commit into
mainfrom
dependabot/go_modules/dependency/retrieval/go-modules-6df6577bc0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-modules group in /dependency/retrieval with 28 updates:

Package From To
github.com/Masterminds/semver/v3 3.4.0 3.5.0
github.com/joshuatcasey/libdependency 0.22.0 0.25.0
github.com/paketo-buildpacks/packit/v2 2.25.0 2.25.6
dario.cat/mergo 1.0.1 1.0.2
github.com/BurntSushi/toml 1.5.0 1.6.0
github.com/Microsoft/go-winio 0.6.2 0.6.3-0.20251027160822-ad3df93bed29
github.com/ProtonMail/go-crypto 1.2.0 1.4.1
github.com/anchore/packageurl-go 0.1.1-0.20250220190351-d62adb6e1115 0.2.0
github.com/cloudflare/circl 1.6.1 1.6.3
github.com/cyphar/filepath-securejoin 0.4.1 0.6.1
github.com/gabriel-vasile/mimetype 1.4.9 1.4.15
github.com/go-enry/go-license-detector/v4 4.3.0 4.3.1
github.com/go-git/go-billy/v5 5.6.2 5.9.0
github.com/go-git/go-git/v5 5.16.2 5.19.1
github.com/google/go-querystring 1.1.0 1.2.0
github.com/joshuatcasey/collections 0.4.0 0.5.0
github.com/kevinburke/ssh_config 1.2.0 1.6.0
github.com/montanaflynn/stats 0.6.6 0.7.0
github.com/pjbgf/sha1cd 0.3.2 0.6.0
github.com/shogo82148/go-shuffle 1.0.1 1.1.1
github.com/skeema/knownhosts 1.3.1 1.3.2
github.com/ulikunitz/xz 0.5.15 0.5.16
golang.org/x/crypto 0.41.0 0.54.0
golang.org/x/exp 0.0.0-20250620022241-b7579e27df2b 0.0.0-20260410095643-746e56fc9e2f
golang.org/x/net 0.43.0 0.57.0
golang.org/x/sys 0.35.0 0.47.0
golang.org/x/text 0.28.0 0.40.0
gonum.org/v1/gonum 0.12.0 0.17.0

Updates github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0

Release notes

Sourced from github.com/Masterminds/semver/v3's releases.

v3.5.0

What's Changed

New Contributors

Full Changelog: Masterminds/semver@v3.4.0...v3.5.0

Changelog

Sourced from github.com/Masterminds/semver/v3's changelog.

Changelog

Commits
  • 8b89c86 Merge pull request #287 from mattfarina/fix-da-issues
  • 29d51d0 Fixing some quality issues
  • 87f651d Merge pull request #286 from mattfarina/update-devcontainer
  • 158a685 Updating gitignore for devcontainers
  • 7e83c08 Merge pull request #284 from Masterminds/dependabot/github_actions/golangci/g...
  • 697e27f Merge pull request #283 from Masterminds/dependabot/github_actions/actions/ca...
  • 1591f8e Merge pull request #282 from Masterminds/dependabot/github_actions/github/cod...
  • 3f5ff17 Bump golangci/golangci-lint-action from 7.0.1 to 9.2.0
  • 04baa33 Bump actions/cache from 4.2.3 to 5.0.5
  • 45939fe Bump github/codeql-action from 4.35.1 to 4.35.2
  • Additional commits viewable in compare view

Updates github.com/joshuatcasey/libdependency from 0.22.0 to 0.25.0

Release notes

Sourced from github.com/joshuatcasey/libdependency's releases.

v0.25.0

What's Changed

New Contributors

Full Changelog: joshuatcasey/libdependency@v0.24.0...v0.25.0

v0.24.0

Relax the github release tag/name rules. Only return the tags/names that are valid semver versions instead of fast-failing.

Full Changelog: joshuatcasey/libdependency@v0.23.0...v0.24.0

v0.23.0

Add fetch.GetSHA256OfRemoteFile()

Full Changelog: joshuatcasey/libdependency@v0.22.0...v0.23.0

Commits
  • 71b46e8 Merge pull request #25 from robdimsdale/fail-on-non-200-response-codes
  • 6601b4e Run 'go get -u -t ./...'
  • f98af5b Fix linting issue
  • 10bd646 Fail on non-200 response codes.
  • 6df308f Run 'go get -u all'
  • 61f7a93 Relax the github release tag/name rules. Only return the tags/names that are ...
  • 57a54af Add fetch.GetSHA256OfRemoteFile()
  • cba295c Update go dependencies
  • See full diff in compare view

Updates github.com/paketo-buildpacks/packit/v2 from 2.25.0 to 2.25.6

Release notes

Sourced from github.com/paketo-buildpacks/packit/v2's releases.

v2.25.6

What's Changed

Full Changelog: paketo-buildpacks/packit@v2.25.5...v2.25.6

... (truncated)

Commits
  • eae5870 Bump modernc.org/sqlite from 1.54.0 to 1.55.0
  • b593e32 Bump github.com/anchore/syft from 1.49.0 to 1.50.0
  • f8411a1 Bump github.com/gabriel-vasile/mimetype from 1.4.14 to 1.4.15
  • 7603877 Bump github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.14
  • e19d4d4 Bump google.golang.org/grpc from 1.80.0 to 1.82.1
  • 1a87967 Bump github.com/anchore/syft from 1.48.0 to 1.49.0
  • 30fcd41 Bump github.com/ulikunitz/xz from 0.5.15 to 0.5.16
  • 4b9a792 Bump modernc.org/sqlite from 1.53.0 to 1.54.0
  • 816e2b1 Bump github.com/anchore/syft from 1.46.0 to 1.48.0
  • 0305ab5 Bump github.com/anchore/syft from 1.45.1 to 1.46.0
  • Additional commits viewable in compare view

Updates dario.cat/mergo from 1.0.1 to 1.0.2

Release notes

Sourced from dario.cat/mergo's releases.

v1.0.2

What's Changed

  • Drops gopkg.in/yaml.v3, only used for loading fixtures. Thanks @​trim21 for bringing to my attention (#262) that this library is no longer maintained.

Full Changelog: darccio/mergo@v1.0.1...v1.0.2

Commits
  • 7b33b2b refactor: migrate from YAML to JSON for test data and update related functions
  • 229a214 chore(.well-known): add funding manifest URLs file
  • 6be20c6 chore(SECURITY.md): update supported versions to reflect current versioning
  • 9007623 chore(README) : remove kubernetes from the list of users
  • 2b1eb9c Update FUNDING.yml
  • 2ceb994 Create FUNDING.json
  • See full diff in compare view

Updates github.com/BurntSushi/toml from 1.5.0 to 1.6.0

Release notes

Sourced from github.com/BurntSushi/toml's releases.

v1.6.0

TOML 1.1 is now enabled by default. The TOML changelog has an overview of changes: https://github.com/toml-lang/toml/blob/main/CHANGELOG.md

Also two small fixes:

  • Encode large floats as exponent syntax so that round-tripping things like 5e+22 is correct.

  • Using duplicate array keys would not give an error:

    arr = [1]
arr = [2]

    This will now correctly give a "Key 'arr' has already been defined" error.

Commits
  • 5253492 Enable TOML 1.1 by default (#457)
  • e954445 Reject duplicate arrays (#455)
  • 6b16cbd Update toml-test test cases from upstream (#456)
  • 011fa2b Ensure constant format strings in wf calls
  • 4b439bf Remove itemNil
  • a473c12 Add test for out of range float64
  • b535ff8 Add some boring tests for lex.go
  • 6011ef0 Remove unreachable condition in lexTableNameStart
  • c8ca9e6 Remove unreachable condition
  • 1121f81 Make tomlv read from stdin
  • Additional commits viewable in compare view

Updates github.com/Microsoft/go-winio from 0.6.2 to 0.6.3-0.20251027160822-ad3df93bed29

Commits

Updates github.com/ProtonMail/go-crypto from 1.2.0 to 1.4.1

Release notes

Sourced from github.com/ProtonMail/go-crypto's releases.

Release v1.4.1

What's Changed

Full Changelog: ProtonMail/go-crypto@v1.4.0...v1.4.1

Release v1.4.1-proton

This release is v1.4.1 with support for the following non-standardized features:

Release v1.4.0

What's Changed

Full Changelog: ProtonMail/go-crypto@v1.3.0...v1.4.0

Release v1.4.0-proton

This release is v1.4.0 with support for the following non-standardized features:

Release v1.3.0

What's Changed

Full Changelog: ProtonMail/go-crypto@v1.2.0...v1.3.0

Release v1.3.0-proton

This release is v1.3.0 with support for the following non-standardized features:

Commits
  • 2e73b11 Properly handle ECC keys with invalid points (#304)
  • a8cc4f0 Merge pull request #298 from ProtonMail/feat/cleartext-hash-header
  • 57f891b Merge branch 'main' into feat/cleartext-hash-header
  • da5c190 Merge pull request #299 from ProtonMail/fix/ecdh-low-order-curve-points
  • 3cc59b0 Merge branch 'main' into feat/cleartext-hash-header
  • b11bd23 fix(ecdh): Do not allow low order public key points
  • b6bdd12 Merge pull request #294 from ProtonMail/chore/bump-go-and-circl
  • b1ff3d5 Bump crypto dependencies and min go version to 1.23
  • cfb2af9 fix(cleartext): Check hashes in headers
  • de87788 Add InsecureGenerateNonCriticalSignatureCreationTime option to generate non-c...
  • Additional commits viewable in compare view

Updates github.com/anchore/packageurl-go from 0.1.1-0.20250220190351-d62adb6e1115 to 0.2.0

Release notes

Sourced from github.com/anchore/packageurl-go's releases.

v0.2.0

Initial release 🎉

Commits

Updates github.com/cloudflare/circl from 1.6.1 to 1.6.3

Release notes

Sourced from github.com/cloudflare/circl's releases.

CIRCL v1.6.3

Fix a bug on ecc/p384 scalar multiplication.

What's Changed

Full Changelog: cloudflare/circl@v1.6.2...v1.6.3

CIRCL v1.6.2

  • New SLH-DSA, improvements in ML-DSA for arm64.
  • Tested compilation on WASM.

What's Changed

New Contributors

Full Changelog: cloudflare/circl@v1.6.1...v1.6.2

Commits
  • 24ae53c Release CIRCL v1.6.3
  • 581020b Rename method to oddMultiplesProjective.
  • 12209a4 Removing unused cmov for jacobian points.
  • fcba359 ecc/p384: use of complete projective formulas for scalar multiplication.
  • 5e1bae8 ecc/p384: handle point doubling in point addition with Jacobian coordinates.
  • 3416046 Check opts for nil value.
  • a763d47 Release CIRCL v1.6.2
  • 3c70bf9 Bump x/crypto x/sys dependencies.
  • 3f0f15b Revert to using package-declared HPKE errors for shortkem instead of standard...
  • 23491bd Adding generic Power2Round method.
  • Additional commits viewable in compare view

Updates github.com/cyphar/filepath-securejoin from 0.4.1 to 0.6.1

Release notes

Sourced from github.com/cyphar/filepath-securejoin's releases.

v0.6.0 -- "By the Power of Greyskull!"

While quite small code-wise, this release marks a very key point in the development of filepath-securejoin.

filepath-securejoin was originally intended (back in 2017) to simply be a single-purpose library that would take some common code used in container runtimes (specifically, Docker's FollowSymlinksInScope) and make it more general-purpose (with the eventual goals of it ending up in the Go stdlib).

Of course, I quickly discovered that this problem was actually far more complicated to solve when dealing with racing attackers, which lead to me developing openat2(2) and libpathrs. I had originally planned for libpathrs to completely replace filepath-securejoin "once it was ready" but in the interim we needed to fix several race attacks in runc as part of security advisories. Obviously we couldn't require the usage of a pre-0.1 Rust library in runc so it was necessary to port bits of libpathrs into filepath-securejoin. (Ironically the first prototypes of libpathrs were originally written in Go and then rewritten to Rust, so the code in filepath-securejoin is actually Go code that was rewritten to Rust then re-rewritten to Go.)

It then became clear that pure-Go libraries will likely not be willing to require CGo for all of their builds, so it was necessary to accept that filepath-securejoin will need to stay. As such, in v0.5.0 we provided more pure-Go implementations of features from libpathrs but moved them into pathrs-lite subpackage to clarify what purpose these helpers serve.

This release finally closes the loop and makes it so that pathrs-lite can transparently use libpathrs (via a libpathrs build-tag). This means that upstream libraries can use the pure Go version if they prefer, but downstreams (either downstream library users or even downstream distributions) are able to migrate to libpathrs for all usages of pathrs-lite in an entire Go binary.

I should make it clear that I do not plan to port the rest of libpathrs to Go, as I do not wish to maintain two copies of the same codebase. pathrs-lite already provides the core essentials necessary to operate on paths safely for most modern systems. Users who want additional hardening or more ergonomic APIs are free to use cyphar.com/go-pathrs (libpathrs's Go bindings).

Breaking

  • The deprecated MkdirAll, MkdirAllHandle, OpenInRoot, OpenatInRoot and Reopen wrappers have been removed. Please switch to using pathrs-lite directly.

Added

  • pathrs-lite now has support for using libpathrs as a backend. This is opt-in and can be enabled at build time with the libpathrs build tag. The intention is to allow for downstream libraries and other projects to

... (truncated)

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.6.1] - 2025-11-19

At last up jumped the cunning spider, and fiercely held her fast.

Fixed

  • Our logic for deciding whether to use openat2(2) or fallback to an O_PATH resolver would cache the result to avoid doing needless test runs of openat2(2). However, this causes issues when pathrs-lite is being used by a program that applies new seccomp-bpf filters onto itself -- if the filter denies openat2(2) then we would return that error rather than falling back to the O_PATH resolver. To resolve this issue, we no longer cache the result if openat2(2) was successful, only if there was an error.
  • A file descriptor leak in our openat2 wrapper (when doing the necessary dup for RESOLVE_IN_ROOT) has been removed.

[0.5.2] - 2025-11-19

"Will you walk into my parlour?" said a spider to a fly.

Fixed

  • Our logic for deciding whether to use openat2(2) or fallback to an O_PATH resolver would cache the result to avoid doing needless test runs of openat2(2). However, this causes issues when pathrs-lite is being used by a program that applies new seccomp-bpf filters onto itself -- if the filter denies openat2(2) then we would return that error rather than falling back to the O_PATH resolver. To resolve this issue, we no longer cache the result if openat2(2) was successful, only if there was an error.
  • A file descriptor leak in our openat2 wrapper (when doing the necessary dup for RESOLVE_IN_ROOT) has been removed.

[0.6.0] - 2025-11-03

By the Power of Greyskull!

Breaking

  • The deprecated MkdirAll, MkdirAllHandle, OpenInRoot, OpenatInRoot and Reopen wrappers have been removed. Please switch to using pathrs-lite directly.

Added

  • pathrs-lite now has support for using libpathrs as a backend. This is opt-in and can be enabled at build time with the libpathrs build tag. The intention is to allow for downstream libraries and other projects to make use of the pure-Go github.com/cyphar/filepath-securejoin/pathrs-lite package and distributors can then opt-in to using libpathrs for the entire binary if they wish.

[0.5.1] - 2025-10-31

Spooky scary skeletons send shivers down your spine!

... (truncated)

Commits
  • 9c4135b VERSION: release 0.6.1
  • d952bef merge v0.5.x branch into main
  • deb72a4 CHANGELOG: fix unreleased links
  • 336bf8f merge #87 into cyphar/filepath-securejoin:v0.5.x
  • 23c6e21 VERSION: back to development
  • 6311ca8 VERSION: release v0.5.2
  • 91da803 merge #86 into cyphar/filepath-securejoin:v0.5.x
  • 4dbce7c gopathrs: close the fd after dup in openat2
  • 1eaadd6 merge #85 into cyphar/filepath-securejoin:main
  • c1c2a53 gopathrs: close the fd after dup in openat2
  • Additional commits viewable in compare view

Updates github.com/gabriel-vasile/mimetype from 1.4.9 to 1.4.15

Release notes

Sourced from github.com/gabriel-vasile/mimetype's releases.

v1.4.14 pyc, pcap, cycloned, gedcom support

Media type changes

  • newly added: application/x-bytecode.python, application/vnd.tcpdump.pcap, application/vnd.cyclonedx+xml, application/vnd.cyclonedx+json, text/vnd.familysearch.gedcom
  • superseded and demoted to aliases: image/vnd.mozilla.apng superseded by image/apng video/x-matroska superseded by video/matroska application/x-rar-compressed superseded by application/vnd.rar

Full changelog

New Contributors

Full Changelog: gabriel-vasile/mimetype@v1.4.13...v1.4.14

v1.4.14-rc1 pyc, pcap, cycloned support

Media type changes

  • new media types: image/apng, video/matroska, application/vnd.rar, application/x-bytecode.python, application/vnd.tcpdump.pcap, application/vnd.cyclonedx+xml, application/vnd.cyclonedx+json
  • media types demoted to aliases: image/vnd.mozilla.apng, video/x-matroska, application/x-rar-compressed

Full changelog

... (truncated)

Commits

@dependabot
chore(deps): bump the go-modules group
373a955 
Bumps the go-modules group in /dependency/retrieval with 28 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver) | `3.4.0` | `3.5.0` |
| [github.com/joshuatcasey/libdependency](https://github.com/joshuatcasey/libdependency) | `0.22.0` | `0.25.0` |
| [github.com/paketo-buildpacks/packit/v2](https://github.com/paketo-buildpacks/packit) | `2.25.0` | `2.25.6` |
| [dario.cat/mergo](https://github.com/imdario/mergo) | `1.0.1` | `1.0.2` |
| [github.com/BurntSushi/toml](https://github.com/BurntSushi/toml) | `1.5.0` | `1.6.0` |
| [github.com/Microsoft/go-winio](https://github.com/Microsoft/go-winio) | `0.6.2` | `0.6.3-0.20251027160822-ad3df93bed29` |
| [github.com/ProtonMail/go-crypto](https://github.com/ProtonMail/go-crypto) | `1.2.0` | `1.4.1` |
| [github.com/anchore/packageurl-go](https://github.com/anchore/packageurl-go) | `0.1.1-0.20250220190351-d62adb6e1115` | `0.2.0` |
| [github.com/cloudflare/circl](https://github.com/cloudflare/circl) | `1.6.1` | `1.6.3` |
| [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) | `0.4.1` | `0.6.1` |
| [github.com/gabriel-vasile/mimetype](https://github.com/gabriel-vasile/mimetype) | `1.4.9` | `1.4.15` |
| [github.com/go-enry/go-license-detector/v4](https://github.com/go-enry/go-license-detector) | `4.3.0` | `4.3.1` |
| [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) | `5.6.2` | `5.9.0` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.16.2` | `5.19.1` |
| [github.com/google/go-querystring](https://github.com/google/go-querystring) | `1.1.0` | `1.2.0` |
| [github.com/joshuatcasey/collections](https://github.com/joshuatcasey/collections) | `0.4.0` | `0.5.0` |
| [github.com/kevinburke/ssh_config](https://github.com/kevinburke/ssh_config) | `1.2.0` | `1.6.0` |
| [github.com/montanaflynn/stats](https://github.com/montanaflynn/stats) | `0.6.6` | `0.7.0` |
| [github.com/pjbgf/sha1cd](https://github.com/pjbgf/sha1cd) | `0.3.2` | `0.6.0` |
| [github.com/shogo82148/go-shuffle](https://github.com/shogo82148/go-shuffle) | `1.0.1` | `1.1.1` |
| [github.com/skeema/knownhosts](https://github.com/skeema/knownhosts) | `1.3.1` | `1.3.2` |
| [github.com/ulikunitz/xz](https://github.com/ulikunitz/xz) | `0.5.15` | `0.5.16` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.41.0` | `0.54.0` |
| [golang.org/x/exp](https://github.com/golang/exp) | `0.0.0-20250620022241-b7579e27df2b` | `0.0.0-20260410095643-746e56fc9e2f` |
| [golang.org/x/net](https://github.com/golang/net) | `0.43.0` | `0.57.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.35.0` | `0.47.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.28.0` | `0.40.0` |
| [gonum.org/v1/gonum](https://github.com/gonum/gonum) | `0.12.0` | `0.17.0` |


Updates `github.com/Masterminds/semver/v3` from 3.4.0 to 3.5.0
- [Release notes](https://github.com/Masterminds/semver/releases)
- [Changelog](https://github.com/Masterminds/semver/blob/master/CHANGELOG.md)
- [Commits](Masterminds/semver@v3.4.0...v3.5.0)

Updates `github.com/joshuatcasey/libdependency` from 0.22.0 to 0.25.0
- [Release notes](https://github.com/joshuatcasey/libdependency/releases)
- [Commits](joshuatcasey/libdependency@v0.22.0...v0.25.0)

Updates `github.com/paketo-buildpacks/packit/v2` from 2.25.0 to 2.25.6
- [Release notes](https://github.com/paketo-buildpacks/packit/releases)
- [Commits](paketo-buildpacks/packit@v2.25.0...v2.25.6)

Updates `dario.cat/mergo` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/imdario/mergo/releases)
- [Commits](darccio/mergo@v1.0.1...v1.0.2)

Updates `github.com/BurntSushi/toml` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/BurntSushi/toml/releases)
- [Commits](BurntSushi/toml@v1.5.0...v1.6.0)

Updates `github.com/Microsoft/go-winio` from 0.6.2 to 0.6.3-0.20251027160822-ad3df93bed29
- [Release notes](https://github.com/Microsoft/go-winio/releases)
- [Commits](https://github.com/Microsoft/go-winio/commits)

Updates `github.com/ProtonMail/go-crypto` from 1.2.0 to 1.4.1
- [Release notes](https://github.com/ProtonMail/go-crypto/releases)
- [Commits](ProtonMail/go-crypto@v1.2.0...v1.4.1)

Updates `github.com/anchore/packageurl-go` from 0.1.1-0.20250220190351-d62adb6e1115 to 0.2.0
- [Release notes](https://github.com/anchore/packageurl-go/releases)
- [Commits](https://github.com/anchore/packageurl-go/commits/v0.2.0)

Updates `github.com/cloudflare/circl` from 1.6.1 to 1.6.3
- [Release notes](https://github.com/cloudflare/circl/releases)
- [Commits](cloudflare/circl@v1.6.1...v1.6.3)

Updates `github.com/cyphar/filepath-securejoin` from 0.4.1 to 0.6.1
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases)
- [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md)
- [Commits](cyphar/filepath-securejoin@v0.4.1...v0.6.1)

Updates `github.com/gabriel-vasile/mimetype` from 1.4.9 to 1.4.15
- [Release notes](https://github.com/gabriel-vasile/mimetype/releases)
- [Commits](gabriel-vasile/mimetype@v1.4.9...v1.4.15)

Updates `github.com/go-enry/go-license-detector/v4` from 4.3.0 to 4.3.1
- [Release notes](https://github.com/go-enry/go-license-detector/releases)
- [Commits](go-enry/go-license-detector@v4.3.0...v4.3.1)

Updates `github.com/go-git/go-billy/v5` from 5.6.2 to 5.9.0
- [Release notes](https://github.com/go-git/go-billy/releases)
- [Commits](go-git/go-billy@v5.6.2...v5.9.0)

Updates `github.com/go-git/go-git/v5` from 5.16.2 to 5.19.1
- [Release notes](https://github.com/go-git/go-git/releases)
- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md)
- [Commits](go-git/go-git@v5.16.2...v5.19.1)

Updates `github.com/google/go-querystring` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/google/go-querystring/releases)
- [Commits](google/go-querystring@v1.1.0...v1.2.0)

Updates `github.com/joshuatcasey/collections` from 0.4.0 to 0.5.0
- [Release notes](https://github.com/joshuatcasey/collections/releases)
- [Commits](joshuatcasey/collections@v0.4.0...v0.5.0)

Updates `github.com/kevinburke/ssh_config` from 1.2.0 to 1.6.0
- [Changelog](https://github.com/kevinburke/ssh_config/blob/master/CHANGELOG.md)
- [Commits](kevinburke/ssh_config@v1.2...v1.6.0)

Updates `github.com/montanaflynn/stats` from 0.6.6 to 0.7.0
- [Release notes](https://github.com/montanaflynn/stats/releases)
- [Changelog](https://github.com/montanaflynn/stats/blob/master/CHANGELOG.md)
- [Commits](montanaflynn/stats@v0.6.6...v0.7.0)

Updates `github.com/pjbgf/sha1cd` from 0.3.2 to 0.6.0
- [Release notes](https://github.com/pjbgf/sha1cd/releases)
- [Commits](pjbgf/sha1cd@v0.3.2...v0.6.0)

Updates `github.com/shogo82148/go-shuffle` from 1.0.1 to 1.1.1
- [Release notes](https://github.com/shogo82148/go-shuffle/releases)
- [Commits](shogo82148/go-shuffle@v1.0.1...v1.1.1)

Updates `github.com/skeema/knownhosts` from 1.3.1 to 1.3.2
- [Commits](skeema/knownhosts@v1.3.1...v1.3.2)

Updates `github.com/ulikunitz/xz` from 0.5.15 to 0.5.16
- [Commits](ulikunitz/xz@v0.5.15...v0.5.16)

Updates `golang.org/x/crypto` from 0.41.0 to 0.54.0
- [Commits](golang/crypto@v0.41.0...v0.54.0)

Updates `golang.org/x/exp` from 0.0.0-20250620022241-b7579e27df2b to 0.0.0-20260410095643-746e56fc9e2f
- [Commits](https://github.com/golang/exp/commits)

Updates `golang.org/x/net` from 0.43.0 to 0.57.0
- [Commits](golang/net@v0.43.0...v0.57.0)

Updates `golang.org/x/sys` from 0.35.0 to 0.47.0
- [Commits](golang/sys@v0.35.0...v0.47.0)

Updates `golang.org/x/text` from 0.28.0 to 0.40.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.28.0...v0.40.0)

Updates `gonum.org/v1/gonum` from 0.12.0 to 0.17.0
- [Release notes](https://github.com/gonum/gonum/releases)
- [Commits](gonum/gonum@v0.12.0...v0.17.0)

---
updated-dependencies:
- dependency-name: github.com/Masterminds/semver/v3
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/joshuatcasey/libdependency
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/paketo-buildpacks/packit/v2
  dependency-version: 2.25.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: dario.cat/mergo
  dependency-version: 1.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: github.com/BurntSushi/toml
  dependency-version: 1.6.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/Microsoft/go-winio
  dependency-version: 0.6.3-0.20251027160822-ad3df93bed29
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: github.com/ProtonMail/go-crypto
  dependency-version: 1.4.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/anchore/packageurl-go
  dependency-version: 0.2.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/cloudflare/circl
  dependency-version: 1.6.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: github.com/cyphar/filepath-securejoin
  dependency-version: 0.6.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/gabriel-vasile/mimetype
  dependency-version: 1.4.15
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: github.com/go-enry/go-license-detector/v4
  dependency-version: 4.3.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: github.com/go-git/go-billy/v5
  dependency-version: 5.9.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.19.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/google/go-querystring
  dependency-version: 1.2.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/joshuatcasey/collections
  dependency-version: 0.5.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/kevinburke/ssh_config
  dependency-version: 1.6.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/montanaflynn/stats
  dependency-version: 0.7.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/pjbgf/sha1cd
  dependency-version: 0.6.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/shogo82148/go-shuffle
  dependency-version: 1.1.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/skeema/knownhosts
  dependency-version: 1.3.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: github.com/ulikunitz/xz
  dependency-version: 0.5.16
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: golang.org/x/crypto
  dependency-version: 0.54.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: golang.org/x/exp
  dependency-version: 0.0.0-20260410095643-746e56fc9e2f
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: golang.org/x/net
  dependency-version: 0.57.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: golang.org/x/sys
  dependency-version: 0.47.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: golang.org/x/text
  dependency-version: 0.40.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: gonum.org/v1/gonum
  dependency-version: 0.17.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 6, 2026
@dependabot
dependabot Bot requested review from a team as code owners August 6, 2026 14:41
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 6, 2026
@paketo-bot paketo-bot added the semver:patch A change requiring a patch version bump label Aug 6, 2026
@paketo-bot
paketo-bot merged commit 6c23a60 into main Aug 6, 2026
11 of 12 checks passed
@paketo-bot
paketo-bot deleted the dependabot/go_modules/dependency/retrieval/go-modules-6df6577bc0 branch August 6, 2026 15:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@paketo-bot-reviewer paketo-bot-reviewer paketo-bot-reviewer approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code semver:patch A change requiring a patch version bump

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@paketo-bot-reviewer @paketo-bot