chore(deps): weekly safe go updates · 1 package

[mendral-app]

Packages bumped

Package	Old	New	Type
github.com/go-git/go-git/v5	v5.19.1	v5.19.2	patch

Per-package detail

github.com/go-git/go-git/v5 v5.19.1 → v5.19.2

Changelog highlights (security & bugfix release, published 2026-07-29):

• Security hardening: reject path traversal in reference names (dotgit storage)
• Security hardening: filesystem wrapper is now a symlink-safe boundary in worktree operations
• Bug fix: worktree stores index entries with backslashes on Windows
• Dependency security updates: golang.org/x/crypto, golang.org/x/net, golang.org/x/text

Impact on this codebase: go-git is used in backend/internal/repo/ (commit history), backend/internal/projects/ (git init, config), and backend/internal/handlers/ (workspace tests). The path-traversal and symlink-safety hardening directly strengthen how this service handles git repositories. No API changes — drop-in patch upgrade.

Files modified

• backend/go.mod
• backend/go.sum

Skipped this ecosystem

Package	Current	Latest	Reason
cuelang.org/go	v0.17.0	v0.17.1	Open PR #3 already covers this bump
github.com/gin-gonic/gin	v1.12.0	v1.12.0	Already at latest stable
github.com/joho/godotenv	v1.5.1	v1.5.1	Already at latest stable
golang.org/x/crypto	v0.54.0	v0.54.0	Already at latest
golang.org/x/net	v0.57.0	v0.57.0	Already at latest
golang.org/x/sys	v0.47.0	v0.47.0	Already at latest
golang.org/x/text	v0.40.0	v0.40.0	Already at latest
golang.org/x/sync	v0.22.0	v0.22.0	Already at latest
golang.org/x/oauth2	v0.36.0	v0.36.0	Already at latest
google.golang.org/protobuf	v1.36.11	v1.36.11	Already at latest

---

Note

Created by Mendral. Tag @mendral-app with feedback or questions.

• View implementation session