chore(deps): update module github.com/go-git/go-git/v6 to v6.0.0-alpha.5

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/go-git/go-git/v6	v6.0.0-20251224103503-78aff6aa5ea9 → v6.0.0-alpha.5

---

Release Notes

go-git/go-git (github.com/go-git/go-git/v6)

v6.0.0-alpha.5

Compare Source

What's Changed

• plumbing: format/packfile, allow injecting a custom ObjectSelector by @​Soph in #​2142
• storage: pool .pack file descriptors via internal/packhandle by @​hiddeco in #​2132
• build: Update module golang.org/x/crypto to v0.52.0 [SECURITY] (main) by @​go-git-renovate[bot] in #​2148
• build: Update module golang.org/x/net to v0.55.0 [SECURITY] (main) by @​go-git-renovate[bot] in #​2151
• plumbing, storage: add CloseIdleDescriptors soft-close primitive by @​hiddeco in #​2133
• *: harden format parsers against unbounded loops by @​hiddeco in #​2162
• storage: pack read optimisations and storage-wide LRU FD pool by @​hiddeco in #​2134
• plumbing: format/packfile, fix delta-base parsing bugs by @​hiddeco in #​2163
• git: worktree, hoist Config() calls out of per-file loops by @​cedric-appdirect in #​1990
• storage: filesystem, pool FSObject reads via PackHandle by @​hiddeco in #​2154
• plumbing: format/index, accept empty trailing checksum on decode by @​pjbgf in #​2181
• build: Update golang (main) by @​go-git-renovate[bot] in #​2182
• build: Update module golang.org/x/net to v0.56.0 (main) by @​go-git-renovate[bot] in #​2191
• *: speed up multi-pack reads via Index fanout probes by @​hiddeco in #​2147
• Fix URL insteadOf to use longest match when multiple values exist by @​AriehSchneier in #​2189
• transport/http, backend, utils/ioutil: fix HTTP data races on the fetch and serve paths by @​georg in #​2128
• plumbing: protocol/packp, handle shallow-only no-op push in UpdateRequests.Decode by @​yuzhuo in #​2172
• git: signer, add context.Context to Sign by @​pjbgf in #​2202
• plumbing: transport/http, Expose typed auth error for Azure DevOps /_signin redirects by @​jfjrh2014 in #​2201
• plumbing: format, faster diff patch generation by @​pjbgf in #​2186
• plumbing: transport, Protocol v2 for upload-pack by @​blmayer in #​2188
• plumbing: pktline, use Scanner for decoding by @​aymanbagabas in #​2038
• internal: server/git, Fix TestGitServer_Timeout flakiness on Windows CI by @​aymanbagabas in #​2129
• plumbing: packp, validate push options to prevent invalid characters by @​aymanbagabas in #​2057
• plumbing: packp/capability, Zero-value-safe types and capability cleanup (1/11) by @​aymanbagabas in #​2206
• plumbing: object, skip path validation in tree diff walk by @​pjbgf in #​2222
• plumbing: packp/transport, Slice-based AdvRefs and v1 handling (2/11) by @​aymanbagabas in #​2225
• plumbing: transport, Add options and result struct to GetRemoteRefs (3/11) by @​aymanbagabas in #​2226
• git: Expose AlternatesFS on PlainOpenOptions by @​andrew in #​2101
• plumbing: packp, Protocol v2 wire types with caller-owned packfile streaming (4/11) by @​aymanbagabas in #​2227
• plumbing/transport: receive_pack, add ReceivePackHooks with PreReceive/PostReceive by @​andrew in #​2236
• plumbing: transport, Protocol v2 session handshake and Command (5/11) by @​aymanbagabas in #​2228
• plumbing: transport, ls-refs over Protocol v2 for GetRemoteRefs (6/11) by @​aymanbagabas in #​2229
• plumbing: transport, fetch over Protocol v2 with caller-owned packfile (7/11) by @​aymanbagabas in #​2230
• plumbing: transport, Wire Protocol v2 across HTTP and share the client core (8/11) by @​aymanbagabas in #​2231
• plumbing: transport, Refactor server-side Protocol v2 onto packp types (9/11) by @​aymanbagabas in #​2232
• plumbing: transport, git archive over HTTP (10/11) by @​aymanbagabas in #​2233
• plumbing: transport, Run the upload-pack suite across v0/v1/v2 (11/11) by @​aymanbagabas in #​2234
• plumbing: optimize Tree.Decode with ReadSlice and io.ReadFull by @​Bluebugs in #​1736
• plumbing: object, Isolate tests from host git config. by @​cedric-appdirect in #​2122
• plumbing: default to wire protocol v2 and close client/server conformance gaps by @​pjbgf in #​2237
• build: Update module golang.org/x/text to v0.39.0 (main) by @​go-git-renovate[bot] in #​2241
• build: Update golang (main) by @​go-git-renovate[bot] in #​2246
• plumbing: object, include submodules in patches by @​upuddu in #​2243
• storage: dotgit, reject path traversal in reference names by @​Sahana2524 in #​2247
• plumbing: transport/http, redact credentials in error messages by @​Sahana2524 in #​2252
• git: worktree, checkout reuse a single os.Root per reset. by @​cedric-appdirect in #​2259
• git: Worktree: Add stores index entires with backslashes on Windows by @​joshblum in #​2253
• storage: dotgit, align reference-name safety with refname_is_safe by @​pjbgf in #​2257
• git: fetch, refuse to clobber existing tags by @​Sahana2524 in #​2250
• internal: v2, skip closeReader on a cancelled context by @​georg in #​2269
• git: include shallow references in object walker by @​erka in #​1792
• plumbing: protocol/packp, reject control bytes in daemon request by @​Sahana2524 in #​2263
• plumbing: protocol/packp, compare zero object ids by value in Action by @​Sahana2524 in #​2264
• plumbing: gitignore, Clarify pattern and matcher parameters by @​ahmojo in #​2248
• storage: filesystem, Make ObjectStorage a pointer field by @​AriehSchneier in #​2118
• plumbing: format/index, sort entries by Name and Stage by @​wacky6 in #​2158
• Fix CodeQL warnings by @​AriehSchneier in #​2126
• git: worktree, fix RemoveGlob on root-level files by @​NoahStarkenburg in #​2219
• internal: revision, fix resolution for tags containing @​ and / by @​tmchow in #​1957
• git: submodule, skip .gitmodules entries missing from the index by @​gecube in #​2256
• build: Update module github.com/go-git/go-billy/v6 to v6.0.0-alpha.2 (main) by @​go-git-renovate[bot] in #​2270
• build: re-enable go-billy renovate updates on v5.x by @​pjbgf in #​2272
• build: Update github-actions (main) by @​go-git-renovate[bot] in #​2273
• build: Update github-actions to v7 (main) (major) by @​go-git-renovate[bot] in #​2274
• plumbing: format/gitignore, fix trailing ** matching unrelated paths by @​glitch-ux in #​2279
• build: Update github-actions (main) by @​go-git-renovate[bot] in #​2280
• git: worktree, make the filesystem wrapper a symlink-safe boundary by @​pjbgf in #​2276

New Contributors

• @​jfjrh2014 made their first contribution in #​2201
• @​upuddu made their first contribution in #​2243
• @​Sahana2524 made their first contribution in #​2247
• @​erka made their first contribution in #​1792
• @​ahmojo made their first contribution in #​2248
• @​wacky6 made their first contribution in #​2158
• @​NoahStarkenburg made their first contribution in #​2219
• @​gecube made their first contribution in #​2256
• @​glitch-ux made their first contribution in #​2279

Full Changelog: go-git/go-git@v6.0.0-alpha.4...v6.0.0-alpha.5

v6.0.0-alpha.4

Compare Source

What's Changed

• plumbing: transport/ssh, Shell-quote path and args by @​hiddeco in #​2067
• git: submodule, canonical remote for relative URLs by @​hiddeco in #​2071
• storage: filesystem, Use repository object format for writing loose objects by @​pjbgf in #​2073
• git: submodule, error on remote without URLs by @​hiddeco in #​2076
• plumbing: objfile, Pass object format into Reader by @​pjbgf in #​2077
• git: submodule, Add relative URL regression tests by @​hiddeco in #​2072
• plumbing: format/idxfile, Validate offset64 indices by @​hiddeco in #​2083
• storage: filesystem, Search alternates in HashesWithPrefix by @​andrew in #​2087
• *: Reject malformed variable-length integers by @​hiddeco in #​2090
• Add worktreeFilesystem wrapper for worktree by @​pjbgf in #​2081
• tests: fix three recurring CI flakes by @​hiddeco in #​2093
• plumbing: format/packfile, Test patchDeltaWriter cap by @​hiddeco in #​2086
• plumbing: format/packfile, Tighten delta validation by @​hiddeco in #​2089
• git: worktree path hardening by @​hiddeco in #​2097
• build: Update module github.com/go-git/go-git-fixtures/v6 to v6.0.0-20260502205956-66bffbe5a6ff (main) by @​go-git-renovate[bot] in #​2102
• build: Update golang (main) by @​go-git-renovate[bot] in #​2099
• config: validate submodule names by @​hiddeco in #​2079
• build: Update go-git (main) by @​go-git-renovate[bot] in #​2103
• worktree: skip ignored directories during Reset walk by @​Soph in #​2075
• plumbing: format/pktline, validate reader/writer inputs by @​pjbgf in #​2104
• build: Update module github.com/go-git/go-git-fixtures/v6 to v6.0.0-alpha.1 (main) by @​go-git-renovate[bot] in #​2110
• plumbing: object, tree entry validation by @​hiddeco in #​2105
• git: Stop validating symlink target paths by @​pjbgf in #​2114
• git: Allow MkdirAll on worktree-root paths by @​hiddeco in #​2115
• git: add repository and remote archive support by @​aymanbagabas in #​2013
• Fix file handle leaks by calling Repository.Close() and adding transactional.Storage.Close() by @​AriehSchneier in #​1999
• plumbing: fuzz on-disk format decoders by @​hiddeco in #​2120
• plumbing: format decoder input bounds and contracts by @​hiddeco in #​2119
• plumbing: fuzz packp and capability decoders by @​hiddeco in #​2121
• storage: dotgit, fix hasIncomingObjects race by @​hiddeco in #​2131
• plumbing: format/packfile, use ReadAt in FSObject.Reader() for concurrency safety. by @​cedric-appdirect in #​1998
• plumbing: format/packfile, harden malformed pack handling by @​pjbgf in #​2113

New Contributors

• @​andrew made their first contribution in #​2087

Full Changelog: go-git/go-git@v6.0.0-alpha.3...v6.0.0-alpha.4

v6.0.0-alpha.3

Compare Source

What's Changed

• plumbing: transport, add git-upload-archive support by @​aymanbagabas in #​1986
• utils: sync, Make zlib compression pluggable via x/plugin by @​stiak in #​2012
• build: establish DCO sign-off requirement for all contributions by @​pjbgf in #​1914
• docs: update CONTRIBUTING.md, README.md and add HISTORY.md by @​pjbgf in #​1946
• storage: filesystem, close packfile iterators after use by @​aymanbagabas in #​2027
• Add .github/copilot-instructions.md with PR review guidelines by @​Copilot in #​2040
• docs: update comment to reflect support for the last 2 stable Go versions by @​alexandear in #​2041
• *: clone, resolve relative local URLs against CWD in CloneOptions.Validate by @​AriehSchneier in #​1891
• SHA256: Support submodules in SHA256 repositories by @​pjbgf in #​1979
• plumbing: ssh, fix concurrent test failures due to cert key generation by @​aymanbagabas in #​2043
• storage: filesystem, dedupe object iteration by @​pjbgf in #​2042
• build: Update module github.com/go-git/go-git-fixtures/v6 to v6.0.0-20260422085740-0c07409f52ec (main) by @​go-git-renovate[bot] in #​2045
• Implement Git-compatible wildmatch for gitignore patterns by @​AriehSchneier in #​1940
• git: worktree, fix treeContainsDirs test to build a new tree for each… by @​aymanbagabas in #​2047
• _examples: remove deprecated usage of io/ioutil by @​alexandear in #​2046
• plumbing: transport/upload_pack multi round bugs by @​manland in #​2016
• plumbing: filemode, fix typo in comment by @​shawntoffel in #​2003
• build: Update module github.com/go-git/go-billy/v6 to v6.0.0-20260424211911-732291493fb8 (main) by @​go-git-renovate[bot] in #​2051
• plumbing: packp, refactor AdvRefs and capability packages by @​aymanbagabas in #​1987
• worktree: skip ignored directories during Status walk by @​Soph in #​2048
• build: Update module github.com/pjbgf/sha1cd to v0.6.0 (main) by @​go-git-renovate[bot] in #​2059
• internal: servers, add git server implementation by @​aymanbagabas in #​2014
• Remove use of ChrootOS by @​pjbgf in #​2061
• plumbing: transport, Align flush size with upstream git by @​pjbgf in #​2000
• internal: git, add server timeout test small tolerance by @​aymanbagabas in #​2064
• Align object encoding with upstream by @​pjbgf in #​2066

New Contributors

• @​Copilot made their first contribution in #​2040
• @​shawntoffel made their first contribution in #​2003

Full Changelog: go-git/go-git@v6.0.0-alpha.2...v6.0.0-alpha.3

v6.0.0-alpha.2

Compare Source

🚀 Release Summary

⚠️ v6 Alpha Release

This is an alpha release of go-git v6.

We encourage users to test this version in real-world scenarios and help us validate the new transport layer and features.

👉 Please report any issues, bugs, or unexpected behavior via GitHub issues.

This release brings major improvements across transport, performance, and Git feature support, along with significant internal modernization.

🚀 Highlights

• Major refactor of the plumbing/transport API with a new design, improving extensibility and aligning behaviour more closely with upstream Git.
• Performance improvements in remote operations, including faster send-pack.
• Significant improvements to HTTP transport robustness and protocol correctness.
• File transport: added support for gitfile and improved repository detection logic.

🐛 Bug Fixes

• repository: fix DeleteBranch failing when using full ref names (#​1951)
• worktree: fix Add silently failing for absolute paths (#​1949)
• transport/http: fix multi-round pack negotiation (#​1992)
• transport/http: harden redirect handling to match canonical Git (#​1997)
• transport/http: fix data race in dumb HTTP test server (#​1960)
• transport: avoid emitting duplicate NAK after empty ACKs (#​1989)
• updreq: support multiple shallow records in upload request decoding (#​1952)
• file transport: fix Windows file handle leak (#​1976)
• worktree tests: fix Windows file handle leaks (#​1996)
• transport tests: correct receive-pack usage (#​1988)

✨ Enhancements

• remote: faster send-pack implementation (#​1947)
• object: improved object walk painting (#​1973)
• repository: add gitfile support and improve loader detection (#​1994)
• config: introduce ConfigLoader plugins aligned with upstream Git (#​1924)

🔧 Refactoring

• plumbing/transport: replace transport API with new design (#​1972)
• plumbing/transport: follow-up API refactoring and cleanup (#​1983)

📚 Documentation

• docs: updates and introduction of AI Policy (#​1913)

📋 Full Changelog

What's Changed

• git: repository, fix DeleteBranch failing with full ref name by @​tmchow in #​1951
• build: Update golang (main) by @​go-git-renovate[bot] in #​1931
• git: worktree, fix Add silently failing for absolute paths by @​tmchow in #​1949
• build: Update github.com/go-git/go-git-fixtures/v5 digest to eda62fa (main) by @​go-git-renovate[bot] in #​1834
• fix(updreq): support multiple shallow records in upload request decoding by @​yuzhuo in #​1952
• plumbing: transport/http, Fix data race in dumb HTTP test server by preventing sendfile optimization. by @​MotanOfficial in #​1960
• build: Update go-git (main) by @​go-git-renovate[bot] in #​1969
• Update docs and introduce AI Policy by @​pjbgf in #​1913
• Faster send pack for remote by @​stiak in #​1947
• plumbing: transport, replace transport API with new design by @​aymanbagabas in #​1972
• plumbing/transport API Refactoring by @​pjbgf in #​1983
• plumbing: transport, correct the test to use the correct receive-pack… by @​aymanbagabas in #​1988
• Object walk painting by @​stiak in #​1973
• build: Update golang (main) by @​go-git-renovate[bot] in #​1975
• Fix Windows file handle leak in file transport by @​AriehSchneier in #​1976
• plumbing/transport: don't emit a second NAK after encoding empty ACKs by @​Soph in #​1989
• Fix file handle leaks in worktree tests on Windows by @​AriehSchneier in #​1996
• Add gitfile support and fix loader repository detection by @​AriehSchneier in #​1994
• plumbing: transport/http, fix multi-round pack negotiation by @​stiak in #​1992
• Implement ConfigLoader plugins that aligns with upstream behaviour by @​pjbgf in #​1924
• plumbing: transport/http, harden redirect handling to match canonical git by @​aymanbagabas in #​1997

New Contributors

• @​tmchow made their first contribution in #​1951
• @​MotanOfficial made their first contribution in #​1960
• @​stiak made their first contribution in #​1947

Full Changelog: go-git/go-git@v6.0.0-alpha.1...v6.0.0-alpha.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 8 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.24.3 -> 1.25.0
github.com/ProtonMail/go-crypto	v1.3.0 -> v1.4.1
github.com/cloudflare/circl	v1.6.1 -> v1.6.3
github.com/go-git/go-billy/v6	v6.0.0-20251209065551-8afc3eb64e4d -> v6.0.0-alpha.2
github.com/kevinburke/ssh_config	v1.4.0 -> v1.6.0
github.com/pjbgf/sha1cd	v0.5.0 -> v0.6.0
golang.org/x/crypto	v0.46.0 -> v0.54.0
golang.org/x/net	v0.48.0 -> v0.57.0
golang.org/x/sys	v0.39.0 -> v0.47.0