🌱 Bump the gomod group across 2 directories with 7 updates

[dependabot]

Bumps the gomod group with 7 updates in the / directory:

Package	From	To
github.com/go-git/go-git/v5	5.13.2	5.14.0
github.com/moby/buildkit	0.20.0	0.20.1
golang.org/x/text	0.22.0	0.23.0
mvdan.cc/sh/v3	3.10.0	3.11.0
github.com/onsi/ginkgo/v2	2.22.2	2.23.0
gitlab.com/gitlab-org/api/client-go	0.123.0	0.124.0
golang.org/x/oauth2	0.26.0	0.28.0

Bumps the gomod group with 5 updates in the /tools directory:

Package	From	To
github.com/go-git/go-git/v5	5.13.2	5.14.0
golang.org/x/text	0.22.0	0.23.0
github.com/onsi/ginkgo/v2	2.22.2	2.23.0
gitlab.com/gitlab-org/api/client-go	0.123.0	0.124.0
golang.org/x/oauth2	0.26.0	0.28.0

Updates github.com/go-git/go-git/v5 from 5.13.2 to 5.14.0

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.14.0

What's Changed

• v5: Bump Go and dependencies to mitigate GO-2025-3487 by @​pjbgf in go-git/go-git#1436

⚠️ Note that this version requires Go 1.23, due to the bump to golang.org/x/[email protected] which mitigates the CVE above. User's that can't bump to Go 1.23 will need to remain on the previous v5.13.x release.

Full Changelog: go-git/go-git@v5.13.2...v5.14.0

Commits

• 863c621 Merge pull request #1436 from pjbgf/v5-bumps
• 2e69e81 build: Bump dependencies
• b2c1ec9 build: Bump Go versions
• See full diff in compare view

Updates github.com/moby/buildkit from 0.20.0 to 0.20.1

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.20.1

Welcome to the v0.20.1 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• Akihiro Suda
• CrazyMax

Notable Changes

• Builtin Dockerfile frontend has been updated to v1.14.1
• Fix panic during CDI manager initialization. #5769 cncf-tags/container-device-interface#254
• Fix gRPC message size when writing SBOMs. #5798 containerd/containerd#11457
• Fix possible panic with libc-bin emulation in QEMU v9.2.0. #5808
• Update azblob client retries for GitHub Actions cache backend. #5797 tonistiigi/go-actions-cache#33

Dependency Changes

• github.com/containerd/containerd/v2 v2.0.2 -> v2.0.3
• github.com/tonistiigi/go-actions-cache 1a5174abd055 -> 3e9a6642607f
• tags.cncf.io/container-device-interface v0.8.0 -> v0.8.1

Previous release can be found at v0.20.0

Commits

• de56a3c Merge pull request #5803 from crazy-max/0.20_picks_0.20.1
• cc210c8 vendor: update containerd to v2.0.3
• 2c40436 dockerfile: normalize platform in image config
• bfe3c17 rootless: update docs and examples
• b1b594e update binfmt to v9.2.2
• b15731b vendor: update action-cache with longer azure retries
• 547d083 vendor: update cdi to v0.8.1 for panic fix
• See full diff in compare view

Updates golang.org/x/text from 0.22.0 to 0.23.0

Commits

• 566b44f go.mod: update golang.org/x dependencies
• d5156da collate/build: do not use println in tests
• 221d88c x/text: fix scientific notation by removing extraneous spaces
• b18c107 internal/export/unicode: change C comment to mention unassigned code points
• 835f8ac language: use a more straightforward return value
• ae68efb internal/export/unicode: add CategoryAliases, Cn, and LC
• 518d9c0 all: upgrade go directive to at least 1.23.0 [generated]
• See full diff in compare view

Updates mvdan.cc/sh/v3 from 3.10.0 to 3.11.0

Release notes

Sourced from mvdan.cc/sh/v3's releases.

v3.11.0

This release drops support for Go 1.22 and includes many enhancements.

• cmd/shfmt
  • Support -l=0 and -f=0 to split filenames with null bytes - #1096
• syntax
  • New iterator API: Parser.WordsSeq
  • Fix Parser.Incomplete and IsIncomplete to work well with Parser.Words - #937
  • Initial support for parsing incomplete shell via RecoverErrors
  • Expand LangError to include which language was used when parsing
• interp
  • Refactor setting variables to fix array declaration edge cases - #1108
  • Fix test read/write/exec operators to work correctly on directories - #1116
  • Replace the cancelreader dependency with os.File.SetReadDeadline
  • Avoid waiting for process substitutions, matching Bash
  • Skip OpenHandler when opening named pipes for process substitutions - #1120
  • Use TMPDIR if set via Env to create temporary files such as named pipes
• expand
  • New iterator API: FieldsSeq
  • Correctly handle repeated backslashes in double quotes - #1106
  • Don't expand backslashes inside here-documents - #1070

Consider becoming a sponsor if you benefit from the work that went into this release!

Binaries built on go version go1.24.0 linux/amd64 with:

CGO_ENABLED=0 go build -trimpath -ldflags="-w -s -X=main.version=v3.11.0"

Changelog

Sourced from mvdan.cc/sh/v3's changelog.

[3.11.0] - 2025-03-05

This release drops support for Go 1.22 and includes many enhancements.

• cmd/shfmt
  • Support -l=0 and -f=0 to split filenames with null bytes - #1096
• syntax
  • New iterator API: Parser.WordsSeq
  • Fix Parser.Incomplete and IsIncomplete to work well with Parser.Words - #937
  • Initial support for parsing incomplete shell via RecoverErrors
  • Expand LangError to include which language was used when parsing
• interp
  • Refactor setting variables to fix array declaration edge cases - #1108
  • Fix test read/write/exec operators to work correctly on directories - #1116
  • Replace the cancelreader dependency with os.File.SetReadDeadline
  • Avoid waiting for process substitutions, matching Bash
  • Skip OpenHandler when opening named pipes for process substitutions - #1120
  • Use TMPDIR if set via Env to create temporary files such as named pipes
• expand
  • New iterator API: FieldsSeq
  • Correctly handle repeated backslashes in double quotes - #1106
  • Don't expand backslashes inside here-documents - #1070

Consider becoming a sponsor if you benefit from the work that went into this release!

Commits

• 8a52daa CHANGELOG: add entry for v3.11.0
• 5d53055 interp: skip handler test using process substitutions on Windows
• aa99590 interp: only obey TMPDIR if it is an absolute dir
• fdbd6e1 update all dependencies
• 28603a4 interp: do not hard-code the use of os.TempDir for named pipes
• cce5c1c interp: do not open our own ProcSubst FIFO files via OpenHandler
• b5c9298 interp: test process substitutions with an OpenHandler
• 422f987 fileutil: shebang detection improvements
• b87b838 syntax: use LangError consistently and add a LangUsed field
• cbc2c7b syntax: make IsIncomplete more robust
• Additional commits viewable in compare view

Updates github.com/onsi/ginkgo/v2 from 2.22.2 to 2.23.0

Release notes

Sourced from github.com/onsi/ginkgo/v2's releases.

v2.23.0

2.23.0

Ginkgo 2.23.0 adds a handful of methods to GinkgoT() to make it compatible with the testing.TB interface in Go 1.24. GinkgoT().Context(), in particular, is a useful shorthand for generating a new context that will clean itself up in a DeferCleanup(). This has subtle behavior differences from the golang implementation but should make sense in a Ginkgo... um... context.

Features

• bump to go 1.24.0 - support new testing.TB methods and add a test to cover testing.TB regressions [37a511b]

Fixes

• fix edge case where build -o is pointing at an explicit file, not a directory [7556a86]
• Fix binary paths when precompiling multiple suites. [4df06c6]

Maintenance

• Fix: Correct Markdown list rendering in MIGRATING_TO_V2.md [cbcf39a]
• docs: fix test workflow badge (#1512) [9b261ff]
• Bump golang.org/x/net in /integration/_fixtures/version_mismatch_fixture (#1516) [00f19c8]
• Bump golang.org/x/tools from 0.28.0 to 0.30.0 (#1515) [e98a4df]
• Bump activesupport from 6.0.6.1 to 6.1.7.5 in /docs (#1504) [60cc4e2]
• Bump github-pages from 231 to 232 in /docs (#1447) [fea6f2d]
• Bump rexml from 3.2.8 to 3.3.9 in /docs (#1497) [31d7813]
• Bump webrick from 1.8.1 to 1.9.1 in /docs (#1501) [fc3bbd6]
• Code linting (#1500) [aee0d56]
• change interface{} to any (#1502) [809a710]

Changelog

Sourced from github.com/onsi/ginkgo/v2's changelog.

2.23.0

Ginkgo 2.23.0 adds a handful of methods to GinkgoT() to make it compatible with the testing.TB interface in Go 1.24. GinkgoT().Context(), in particular, is a useful shorthand for generating a new context that will clean itself up in a DeferCleanup(). This has subtle behavior differences from the golang implementation but should make sense in a Ginkgo... um... context.

Features

• bump to go 1.24.0 - support new testing.TB methods and add a test to cover testing.TB regressions [37a511b]

Fixes

• fix edge case where build -o is pointing at an explicit file, not a directory [7556a86]
• Fix binary paths when precompiling multiple suites. [4df06c6]

Maintenance

• Fix: Correct Markdown list rendering in MIGRATING_TO_V2.md [cbcf39a]
• docs: fix test workflow badge (#1512) [9b261ff]
• Bump golang.org/x/net in /integration/_fixtures/version_mismatch_fixture (#1516) [00f19c8]
• Bump golang.org/x/tools from 0.28.0 to 0.30.0 (#1515) [e98a4df]
• Bump activesupport from 6.0.6.1 to 6.1.7.5 in /docs (#1504) [60cc4e2]
• Bump github-pages from 231 to 232 in /docs (#1447) [fea6f2d]
• Bump rexml from 3.2.8 to 3.3.9 in /docs (#1497) [31d7813]
• Bump webrick from 1.8.1 to 1.9.1 in /docs (#1501) [fc3bbd6]
• Code linting (#1500) [aee0d56]
• change interface{} to any (#1502) [809a710]

Commits

• 1d705bc v2.23.0
• 37a511b bump to go 1.24.0 - support new testing.TB methods and add a test to cover te...
• 7556a86 fix edge case where build -o is pointing at an explicit file, not a directory
• 4df06c6 Fix binary paths when precompiling multiple suites.
• cbcf39a Fix: Correct Markdown list rendering in MIGRATING_TO_V2.md
• 9b261ff docs: fix test workflow badge (#1512)
• 00f19c8 Bump golang.org/x/net in /integration/_fixtures/version_mismatch_fixture (#1516)
• e98a4df Bump golang.org/x/tools from 0.28.0 to 0.30.0 (#1515)
• 60cc4e2 Bump activesupport from 6.0.6.1 to 6.1.7.5 in /docs (#1504)
• fea6f2d Bump github-pages from 231 to 232 in /docs (#1447)
• Additional commits viewable in compare view

Updates gitlab.com/gitlab-org/api/client-go from 0.123.0 to 0.124.0

Release notes

Sourced from gitlab.com/gitlab-org/api/client-go's releases.

v0.124.0

0.124.0 (2025-02-28)

Breaking Changes (4 changes)

• Refactor ShareWithGroup as a Named Struct instead of an Anonymous Struct by @​heidi.berry (merge request)
• Add support for instance member roles API, and align CreateMemberRoleOptions... by @​heidi.berry (merge request)
• Switch to using BasicMergeRequest for API endpoints that use it by @​heidi.berry (merge request)
• Add state option when listing project access tokens. This requires that... by @​heidi.berry (merge request)

Improvements (13 changes)

• Add bundled reviewable command for ease of local development by @​heidi.berry (merge request)
• Add function for uploading a wiki attachment by @​heidi.berry (merge request)
• Add internal flag when creating different types of notes. Update documentation... by @​heidi.berry (merge request)
• Add Internal support to CreateIssueNoteOptions by @​ebuildy (merge request)
• Add support for Secure Files API by @​heidi.berry (merge request)
• add ci_delete_pipelines_in_seconds to project edit and read by @​kingcrunch (merge request)
• Add filter to group variables update and delete by @​heidi.berry (merge request)
• Add support for group releases API by @​heidi.berry (merge request)
• Add description to personal access token APIs by @​heidi.berry (merge request)
• Add description to group access token APIs by @​heidi.berry (merge request)
• Add description to project access token APIs by @​heidi.berry (merge request)
• Add 'username' support to AddProjectMemberOptions by @​sy-be (merge request)
• Update Group Hooks to add missing options and fix documentation links by @​heidi.berry (merge request)

Breaking Change (1 change)

• Fix return value of CreateMergeRequestDependency to return a single... by @​llxp (merge request)

Features (1 change)

• Add support for project security settings API by @​heidi.berry (merge request)

Commits

• 04cfd77 Merge branch 'named-struct-for-shared-with-group' into 'main'
• 65524df Refactor ShareWithGroup as a Named Struct instead of an Anonymous Struct
• 1be3465 Merge branch 'support-instance-custom-roles' into 'main'
• 6d63332 Add support for instance member roles API, and align `CreateMemberRoleOptions...
• 8b50e96 Merge branch 'use-basic-merge-request' into 'main'
• 42ec248 Switch to using BasicMergeRequest for API endpoints that use it
• 34a1106 Merge branch 'add-reviewable-command' into 'main'
• fd06b55 Add bundled reviewable command for ease of local development
• 3d91c3a Merge branch 'add-wiki-attachment-uploads' into 'main'
• bf2d5c0 Add function for uploading a wiki attachment
• Additional commits viewable in compare view

Updates golang.org/x/oauth2 from 0.26.0 to 0.28.0

Commits

• 0042180 oauth2: Deep copy context client in NewClient
• ce350bf oauth2: remove unneeded TokenSource implementation in transport test
• 44967ab google: fix typos
• 9c82a8c oauth2.go: use a more straightforward return value
• 681b4d8 jws: split token into fixed number of parts
• 3f78298 all: upgrade go directive to at least 1.23.0 [generated]
• 109dabf endpoints: add links/provider for Discord
• ac571fa oauth2: fix docs for Config.DeviceAuth
• 314ee5b endpoints: add patreon endpoint
• See full diff in compare view

Updates github.com/go-git/go-git/v5 from 5.13.2 to 5.14.0

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.14.0

What's Changed

• v5: Bump Go and dependencies to mitigate GO-2025-3487 by @​pjbgf in go-git/go-git#1436

⚠️ Note that this version requires Go 1.23, due to the bump to golang.org/x/[email protected] which mitigates the CVE above. User's that can't bump to Go 1.23 will need to remain on the previous v5.13.x release.

Full Changelog: go-git/go-git@v5.13.2...v5.14.0

Commits

• 863c621 Merge pull request #1436 from pjbgf/v5-bumps
• 2e69e81 build: Bump dependencies
• b2c1ec9 build: Bump Go versions
• See full diff in compare view

Updates golang.org/x/text from 0.22.0 to 0.23.0

Commits

• 566b44f go.mod: update golang.org/x dependencies
• d5156da collate/build: do not use println in tests
• 221d88c x/text: fix scientific notation by removing extraneous spaces
• b18c107 internal/export/unicode: change C comment to mention unassigned code points
• 835f8ac language: use a more straightforward return value
• ae68efb internal/export/unicode: add CategoryAliases, Cn, and LC
• 518d9c0 all: upgrade go directive to at least 1.23.0 [generated]
• See full diff in compare view

Updates github.com/onsi/ginkgo/v2 from 2.22.2 to 2.23.0

Release notes

Sourced from github.com/onsi/ginkgo/v2's releases.

v2.23.0

2.23.0

Ginkgo 2.23.0 adds a handful of methods to GinkgoT() to make it compatible with the testing.TB interface in Go 1.24. GinkgoT().Context(), in particular, is a useful shorthand for generating a new context that will clean itself up in a DeferCleanup(). This has subtle behavior differences from the golang implementation but should make sense in a Ginkgo... um... context.

Features

• bump to go 1.24.0 - support new testing.TB methods and add a test to cover testing.TB regressions [37a511b]

Fixes

• fix edge case where build -o is pointing at an explicit file, not a directory [7556a86]
• Fix binary paths when precompiling multiple suites. [4df06c6]

Maintenance

• Fix: Correct Markdown list rendering in MIGRATING_TO_V2.md [cbcf39a]
• docs: fix test workflow badge (#1512) [9b261ff]
• Bump golang.org/x/net in /integration/_fixtures/version_mismatch_fixture (#1516) [00f19c8]
• Bump golang.org/x/tools from 0.28.0 to 0.30.0 (#1515) [e98a4df]
• Bump activesupport from 6.0.6.1 to 6.1.7.5 in /docs (#1504) [60cc4e2]
• Bump github-pages from 231 to 232 in /docs (#1447) [fea6f2d]
• Bump rexml from 3.2.8 to 3.3.9 in /docs (#1497) [31d7813]
• Bump webrick from 1.8.1 to 1.9.1 in /docs (#1501) [fc3bbd6]
• Code linting (#1500) [aee0d56]
• change interface{} to any (#1502) [809a710]

Changelog

Sourced from github.com/onsi/ginkgo/v2's changelog.

2.23.0

Ginkgo 2.23.0 adds a handful of methods to GinkgoT() to make it compatible with the testing.TB interface in Go 1.24. GinkgoT().Context(), in particular, is a useful shorthand for generating a new context that will clean itself up in a DeferCleanup(). This has subtle behavior differences from the golang implementation but should make sense in a Ginkgo... um... context.

Features

• bump to go 1.24.0 - support new testing.TB methods and add a test to cover testing.TB regressions [37a511b]

Fixes

• fix edge case where build -o is pointing at an explicit file, not a directory [7556a86]
• Fix binary paths when precompiling multiple suites. [4df06c6]

Maintenance

• Fix: Correct Markdown list rendering in MIGRATING_TO_V2.md [cbcf39a]
• docs: fix test workflow badge (#1512) [9b261ff]
• Bump golang.org/x/net in /integration/_fixtures/version_mismatch_fixture (#1516) [00f19c8]
• Bump golang.org/x/tools from 0.28.0 to 0.30.0 (#1515) [e98a4df]
• Bump activesupport from 6.0.6.1 to 6.1.7.5 in /docs (#1504) [60cc4e2]
• Bump github-pages from 231 to 232 in /docs (#1447) [fea6f2d]
• Bump rexml from 3.2.8 to 3.3.9 in /docs (#1497) [31d7813]
• Bump webrick from 1.8.1 to 1.9.1 in /docs (#1501) [fc3bbd6]
• Code linting (#1500) [aee0d56]
• change interface{} to any (#1502) [809a710]

Commits

• 1d705bc v2.23.0
• 37a511b bump to go 1.24.0 - support new testing.TB methods and add a test to cover te...
• 7556a86 fix edge case where build -o is pointing at an explicit file, not a directory
• 4df06c6 Fix binary paths when precompiling multiple suites.
• cbcf39a Fix: Correct Markdown list rendering in MIGRATING_TO_V2.md
• 9b261ff docs: fix test workflow badge (#1512)
• 00f19c8 Bump golang.org/x/net in /integration/_fixtures/version_mismatch_fixture (#1516)
• e98a4df Bump golang.org/x/tools from 0.28.0 to 0.30.0 (#1515)
• 60cc4e2 Bump activesupport from 6.0.6.1 to 6.1.7.5 in /docs (#1504)
• fea6f2d Bump github-pages from 231 to 232 in /docs (#1447)
• Additional commits viewable in compare view

Updates gitlab.com/gitlab-org/api/client-go from 0.123.0 to 0.124.0

Release notes

Sourced from gitlab.com/gitlab-org/api/client-go's releases.

v0.124.0

0.124.0 (2025-02-28)

Breaking Changes (4 changes)

• Refactor ShareWithGroup as a Named Struct instead of an Anonymous Struct by @​heidi.berry (merge request)
• Add support for instance member roles API, and align CreateMemberRoleOptions... by @​heidi.berry (merge request)
• Switch to using BasicMergeRequest for API endpoints that use it by @​heidi.berry (merge request)
• Add state option when listing project access tokens. This requires that... by @​heidi.berry (merge request)

Improvements (13 changes)

• Add bundled reviewable command for ease of local development by @​heidi.berry (merge request)
• Add function for uploading a wiki attachment by @​heidi.berry (merge request)
• Add internal flag when creating different types of notes. Update documentation... by @​heidi.berry (merge request)
• Add Internal support to CreateIssueNoteOptions by @​ebuildy (merge request)
• Add support for Secure Files API by @​heidi.berry (merge request)
• add ci_delete_pipelines_in_seconds to project edit and read by @​kingcrunch (merge request)
• Add filter to group variables update and delete by @​heidi.berry (merge request)
• Add support for group releases API by @​heidi.berry (merge request)
• Add description to personal access token APIs by @​heidi.berry (merge request)
• Add description to group access token APIs by @​heidi.berry (merge request)
• Add description to project access token APIs by @​heidi.berry (merge request)
• Add 'username' support to AddProjectMemberOptions by @​sy-be (merge request)
• Update Group Hooks to add missing options and fix documentation links by @​heidi.berry (merge request)

Breaking Change (1 change)

• Fix return value of CreateMergeRequestDependency to return a single... by @​llxp (merge request)

Features (1 change)

• Add support for project security settings API by @​heidi.berry (merge request)

Commits

• 04cfd77 Merge branch 'named-struct-for-shared-with-group' into 'main'
• 65524df Refactor ShareWithGroup as a Named Struct instead of an Anonymous Struct
• 1be3465 Merge branch 'support-instance-custom-roles' into 'main'
• 6d63332 Add support for instance member roles API, and align `CreateMemberRoleOptions...
• 8b50e96 Merge branch 'use-basic-merge-request' into 'main'
• 42ec248 Switch to using BasicMergeRequest for API endpoints that use it
• 34a1106 Merge branch 'add-reviewable-command' into 'main'
• fd06b55 Add bundled reviewable command for ease of local development
• 3d91c3a Merge branch 'add-wiki-attachment-uploads' into 'main'
• bf2d5c0 Add function for uploading a wiki attachment
• Additional commits viewable in compare view

Updates golang.org/x/oauth2 from 0.26.0 to 0.28.0

Commits

• 0042180 oauth2: Deep copy context client in NewClient
• ce350bf oauth2: remove unneeded TokenSource implementation in transport test
• 44967ab google: fix typos
• 9c82a8c oauth2.go: use a more straightforward return value
• 681b4d8 jws: split token into fixed number of parts
• 3f78298 all: upgrade go directive to at least 1.23.0 [generated]
• 109dabf endpoints: add links/provider for Discord
• ac571fa oauth2: fix docs for Config.DeviceAuth
• 314ee5b endpoints: add patreon endpoint
• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
gitlab.com/gitlab-org/api/client-go	[>= 0.118.a, < 0.119]
gitlab.com/gitlab-org/api/client-go	[>= 0.117.a, < 0.118]

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions