DoDiODev opened a new pull request, #9055: URL: https://github.com/apache/devlake/pull/9055
### Summary | Module | From | To | |---|---|---| | `github.com/go-git/go-git/v5` | v5.12.0 | v5.19.2 | | `github.com/go-git/go-billy/v5` | v5.5.0 | v5.9.0 (pulled in) | | `github.com/cloudflare/circl` | v1.3.7 | v1.6.3 (pulled in) | 16 known advisories across the three modules. `govulncheck` reports **12 reachable findings** before the bump (8 in go-git, 2 in go-billy, 2 in circl) and **none** after. The go-git ones include GO-2025-3367 / GO-2025-3368 (argument injection through crafted URLs) and GO-2026-4909 / GO-2026-4910. Overall, `govulncheck ./...` in `backend/` goes from **30** reachable findings on `upstream/main` to **11** with this PR (remainder: `go-jose/v3` 2, `jwt/v5` 1 + stdlib) — the MVS-driven `x/crypto` / `x/net` / `x/text` bump clears those too. ### Where go-git is used Exactly one file: `plugins/gitextractor/parser/repo_gogit.go`. It opens an **already cloned** repository with `PlainOpen` and walks commits, tags, branches and trees, and only when `UseGoGit` is set. Cloning is done by the git CLI (`parser.NewGitcliCloner`), so the go-git transports are not on the path — this bump does not change how DevLake talks to remotes. ### Test coverage That collector had **no tests at all**, which makes any go-git upgrade a leap of faith. The first commit adds `repo_gogit_test.go`: it builds a repository on disk with a known shape (3 commits, 1 tag, a second branch checked out so HEAD is not the default branch) and asserts `CountCommits`, `CountTags`, `CountBranches`, that the counting helpers stop on a cancelled context, and that opening a non-repository fails. The test is committed **before** the bump and passes on both v5.12.0 and v5.19.2 — unchanged behaviour across the upgrade, and the history stays bisectable. ### Verification - `go mod tidy` — clean - `go build ./...` / `make build` — green - `go test ./plugins/gitextractor/...` — green on old and new version - `govulncheck ./...` — 12 → 0 reachable findings in these modules ### Notes MVS also pulls up `x/crypto`, `x/net`, `x/sys`, `x/text`, `x/tools`, `ProtonMail/go-crypto`, `pjbgf/sha1cd`, `skeema/knownhosts`, `cyphar/filepath-securejoin`, `Microsoft/go-winio`, `klauspost/cpuid` and `golang/protobuf`. ### CI Verified on a fork run of the same workflows before opening this PR: [8/8 green](https://github.com/DoDiODev/devlake/actions/runs/32008086058) (lint, unit-test, e2e MySQL, migration-script-lint, config-ui, license header, grafana dashboards, builder image). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
