[dependabot]

Bumps the go-minor-patch group with 4 updates in the / directory: github.com/go-git/go-git/v5, go.mongodb.org/mongo-driver, golang.org/x/crypto and golang.org/x/oauth2.

Updates github.com/go-git/go-git/v5 from 5.19.2 to 5.19.3

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.3

What's Changed

• [v5] git: repository, Ensure commondir is closed. by @​arcaven in go-git/go-git#2285
• config: read repositoryformatversion in unmarshalCore by @​c-tonneslan in go-git/go-git#2167
• build: Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2304
• [v5] plumbing: revlist, Skip path validation in the object walk by @​r0h1tb in go-git/go-git#2305
• build: Update module golang.org/x/crypto to v0.55.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2348
• [v5] plumbing: transport/http, Contain credentials across redirects by @​hiddeco in go-git/go-git#2358
• build: Fix workflows for Go 1.27 (v5) by @​pjbgf in go-git/go-git#2364
• plumbing: format/packfile, Stop running TestChecksumMismatch and TestMalformedPack in parallel by @​akashchamp in go-git/go-git#2421
• build: Update module golang.org/x/crypto to v0.56.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2357
• plumbing: format/packfile, Break cyclic delta chains instead of recur… by @​jgoosens in go-git/go-git#2340
• build: Drop Go 1.25 by @​pjbgf in go-git/go-git#2451
• build: Update module github.com/go-git/go-billy/v5 to v5.9.2 (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2467
• build: Bump pjbgf/sha1cd to v0.7.0 by @​pjbgf in go-git/go-git#2468

New Contributors

• @​arcaven made their first contribution in go-git/go-git#2285
• @​c-tonneslan made their first contribution in go-git/go-git#2167
• @​r0h1tb made their first contribution in go-git/go-git#2305
• @​akashchamp made their first contribution in go-git/go-git#2421
• @​jgoosens made their first contribution in go-git/go-git#2340

Full Changelog: go-git/go-git@v5.19.2...v5.19.3

Commits

• bdae57c Merge pull request #2468 from go-git/bump-pjbgf
• 372805d build: Bump pjbgf/sha1cd to v0.7.0
• e28bfff Merge pull request #2467 from go-git/renovate/releases/v5.x-go-git
• dbfe60f build: Update module github.com/go-git/go-billy/v5 to v5.9.2
• a3fa9b3 Merge pull request #2451 from go-git/drop-go-1.25
• 1fc0e47 build: Drop Go 1.25
• 4f28503 Merge pull request #2340 from jgoosens/releases/v5.x
• 5a01a03 Merge pull request #2357 from go-git/renovate/releases/v5.x-go-golang.org-x-c...
• 5372bc7 Merge pull request #2421 from akashchamp/fix/packfile-parallel-test-race
• 3d20ded plumbing: format/packfile, Stop running TestChecksumMismatch and TestMalforme...
• Additional commits viewable in compare view

Updates go.mongodb.org/mongo-driver from 1.17.9 to 1.17.10

Release notes

Sourced from go.mongodb.org/mongo-driver's releases.

MongoDB Go Driver 1.17.10

The MongoDB Go Driver Team is pleased to release version 1.17.10 of the official MongoDB Go Driver.

Release Highlights

[!WARNING]
Go Driver versions v1.0.0 through v1.17.9 and v2.0.0 through v2.9.0 are affected by a security issue CVE-2026-88031 in the GridFS delete methods. This release resolves that security issue in Go Driver v1. Users are encouraged to upgrade to Go Driver v1.17.10 as soon as possible. For the fix in Go Driver v2, see the v2.9.1 release.

This release addresses CVE-2026-88031, a security issue in GridFS delete methods where the file ID lookup could match more loosely than intended, potentially causing unintended file (and chunk) deletions instead of an exact match on the given file ID.

Users can manually restrict the file ID with a $eq operator before passing it to GridFSBucket methods using code like the following.

func exactMatch(id any) bson.D {
	return bson.D{{"$eq", id}}
}
// e.g., for v1, (*Bucket).DeleteContext() with an exact match on the file ID.
bucket.DeleteContext(context.TODO(), exactMatch(id))

What's Changed

🐛 Fixed

• GODRIVER-4081: Use exact match for file ID in GridFS delete methods. by @​qingyang-hu

Full Changelog: mongodb/mongo-go-driver@v1.17.9...v1.17.10

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

Commits

• d13e5a5 BUMP v1.17.10
• 1cdec85 Merge pull request #2596 from prestonvasquez/pin-det-to-890a93bdb
• 9635a5f Pin DET to 890a93bdb
• 65af5ff bump github tools for release to 89904229
• e8462ed bump github tools for release to 89904229
• 2428d94 Merge commit from fork
• 6da3d8f update spec test cases
• 806e132 GODRIVER-4081 Use exact match for file ID in GridFS delete methods.
• See full diff in compare view

Updates golang.org/x/crypto from 0.56.0 to 0.58.0

Commits

• 8fdf07b go.mod: update golang.org/x dependencies
• 2437861 salsa20: fix keystream reuse in LoongArch LSX tail
• c3db4df acme: prefer test log helpers in test contexts
• 4e01a84 acme: adds support for profiles draft
• 8f0f111 ssh: check that no Unicode-aware string function is used
• b39ff6d ssh: add certificate algorithms for ML-DSA keys
• 4465db3 ssh: add the ML-DSA public key algorithms
• 83e695b ssh: implement ETM mode for CBC ciphers
• 946083a ssh: only drop a trailing carriage return
• 543dde9 ssh: accept known_hosts entries with a multi-word comment
• Additional commits viewable in compare view

Updates golang.org/x/oauth2 from 0.36.0 to 0.37.0

Commits

• c624b89 google: change the snake case endpoint to kebab-case
• 09a82f6 all: upgrade go directive to at least 1.26.0 [generated]
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions