OCPBUGS-121303,OCPBUGS-121304: Bump go-git to v5.19.2 by ankitathomas · Pull Request #810 · openshift/operator-framework-operator-controller

ankitathomas · 2026-09-11T21:04:04Z

Description of the change:
Bumps github.com/go-git/go-git/v5 from v5.19.1 to v5.19.2

Motivation for the change:
Addresses GHSA-hc8v-wwc9-vgxm: A symlink traversal issue in go-git could allow worktree operations to modify files outside the intended worktree path. Patched in github.com/go-git/go-git/v5 v5.19.2

https://redhat.atlassian.net/browse/OCPBUGS-121303, https://redhat.atlassian.net/browse/OCPBUGS-121304

Summary by CodeRabbit

Chores
- Updated indirect Go module dependencies to newer versions.

openshift-ci · 2026-09-11T21:04:07Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-09-11T21:04:13Z

@ankitathomas: This pull request references Jira Issue OCPBUGS-121303, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.1.0) matches configured target version for branch (5.1.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

This pull request references Jira Issue OCPBUGS-121304, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.1.0) matches configured target version for branch (5.1.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Description of the change:
Bumps github.com/go-git/go-git/v5 from v5.19.1 to v5.19.2

Motivation for the change:
Addresses GHSA-hc8v-wwc9-vgxm: A symlink traversal issue in go-git could allow worktree operations to modify files outside the intended worktree path. Patched in github.com/go-git/go-git/v5 v5.19.2

https://redhat.atlassian.net/browse/OCPBUGS-121303, https://redhat.atlassian.net/browse/OCPBUGS-121304

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-09-11T21:04:19Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c6570be2-c99a-4367-8ae9-f0c2588a558c

📥 Commits

Reviewing files that changed from the base of the PR and between 0c85f96 and 7bb73c1.

⛔ Files ignored due to path filters (144)

openshift/default-catalog-consistency/go.sum is excluded by !**/*.sum
openshift/default-catalog-consistency/vendor/github.com/go-git/go-billy/v5/README.md is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/crypto/pbkdf2/pbkdf2.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/html/entity.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/html/escape.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/html/foreign.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/html/parse.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/html/render.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/html/token.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/client_conn_pool.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/config.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/http2.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/server.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/transport.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/writesched.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/writesched_priority_rfc7540.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/writesched_priority_rfc9218.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/writesched_random.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/http2/writesched_roundrobin.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/idna/go118.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/idna/idna10.0.0.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/idna/idna9.0.0.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/idna/pre_go118.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/idna/punycode.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/idna/tables10.0.0.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/idna/tables11.0.0.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/idna/tables12.0.0.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/idna/tables13.0.0.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/idna/tables15.0.0.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/idna/tables9.0.0.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/idna/trie12.0.0.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/idna/trie13.0.0.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/net/internal/httpcommon/request.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sync/errgroup/errgroup.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sync/semaphore/semaphore.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu_arm64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu_gccgo_arm64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu_linux_riscv64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu_loong64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu_other_arm64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu_riscv64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/cpu/cpu_windows_arm64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/plan9/syscall_plan9.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/affinity_linux.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/mkall.sh is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/mkerrors.sh is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/syscall_darwin.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/syscall_linux.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/syscall_linux_arm.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/syscall_openbsd.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_386.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_linux.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.s is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.s is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.s is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.s is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.s is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.s is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.s is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_386.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_386.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/aliases.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/dll_windows.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/security_windows.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/syscall_windows.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/types_windows.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/sys/windows/zsyscall_windows.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/text/cases/context.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/text/cases/map.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/text/unicode/norm/forminfo.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/text/unicode/norm/iter.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/text/unicode/norm/normalize.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/ast/edge/edge.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/packages/golist.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/packages/packages.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/go/types/objectpath/objectpath.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/gcimporter/iexport.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/gcimporter/iimport.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/gcimporter/ureader_yes.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/gocommand/version.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/pkgbits/version.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/stdlib/deps.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/stdlib/manifest.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/typeparams/coretype.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/typesinternal/element.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/typesinternal/types.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/typesinternal/zerovalue.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/golang.org/x/tools/internal/versions/features.go is excluded by !**/vendor/**
openshift/default-catalog-consistency/vendor/modules.txt is excluded by !**/vendor/**

📒 Files selected for processing (1)

openshift/default-catalog-consistency/go.mod

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

Walkthrough

The change updates indirect Go module dependencies in the default catalog consistency module. It upgrades go-billy, go-git, and selected golang.org/x modules.

Changes

Go dependency updates

Layer / File(s)	Summary
Indirect dependency refresh `openshift/default-catalog-consistency/go.mod`	Updates indirect `go-billy/v5`, `go-git/v5`, and selected `golang.org/x` dependency versions.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 93ff5

The targeted go-git security update is present with no actionable merge-blocking issue identified.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the related issues and the primary change: upgrading go-git to v5.19.2.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS. The PR changes only `openshift/default-catalog-consistency/go.mod`, `go.sum`, and vendored dependency files. The authoritative diff contains 145 changed files: 143 under `vendor/` and 2 dependen…
Test Structure And Quality	✅ Passed	PASS. The authoritative PR diff changes dependency manifests and vendored library files only. It changes 145 files, with zero `_test.go` files, zero Ginkgo-named paths, and zero test/e2e paths. Theref…
Microshift Test Compatibility	✅ Passed	The pull request changes only dependency declarations, checksums, and vendored dependency files. The review-scoped diff adds no Ginkgo e2e tests, test files, or `It()`, `Describe()`, `Context()`, or `…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request changes only dependency declarations, checksums, and vendored Go sources. The authoritative diff contains no added or modified *_test.go files and no added Ginkgo declarations s…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes only Go dependency metadata and vendored dependency sources. The reviewed diff contains go.mod, go.sum, vendor/modules.txt, and 143 files under vendor; it contains no YA…
Ote Binary Stdout Contract	✅ Passed	The pull request changes dependency metadata and vendored dependency code only. It does not change OTE process-level source, `main()`, suite setup, or `RunSpecs()` setup. Added diff lines contain no s…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request adds no Ginkgo or e2e test files. The only changed non-vendored files are `go.mod` and `go.sum`; the remaining changes are vendored dependency updates. No new `It`, `Describe`, …
No-Weak-Crypto	✅ Passed	PASS: The pull request changes dependency versions and vendored code only. The changed executable Go code adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, or ECB usage. The only crypto-related source chan…
Container-Privileges	✅ Passed	PASS: The pull request changes only Go dependency metadata and vendored Go source under `openshift/default-catalog-consistency`. It adds no container or Kubernetes manifest. Added-line searches found …
No-Sensitive-Data-In-Logs	✅ Passed	PASS. The PR changes dependency metadata and vendored dependencies. It adds no application logging. The only added logging call is a generic `log.Fatalf` for an importer package path; the base version…

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-09-11T21:05:53Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ankitathomas
Once this PR has been reviewed and has the lgtm label, please assign perdasilva for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2026-09-11T21:13:20Z

@ankitathomas: This pull request references Jira Issue OCPBUGS-121303, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.1.0) matches configured target version for branch (5.1.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

This pull request references Jira Issue OCPBUGS-121304, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.1.0) matches configured target version for branch (5.1.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Description of the change:
Bumps github.com/go-git/go-git/v5 from v5.19.1 to v5.19.2

Motivation for the change:
Addresses GHSA-hc8v-wwc9-vgxm: A symlink traversal issue in go-git could allow worktree operations to modify files outside the intended worktree path. Patched in github.com/go-git/go-git/v5 v5.19.2

https://redhat.atlassian.net/browse/OCPBUGS-121303, https://redhat.atlassian.net/browse/OCPBUGS-121304

Summary by CodeRabbit

Chores

Updated indirect Go module dependencies to newer versions.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Signed-off-by: Ankita Thomas <ankithom@redhat.com>

ankitathomas · 2026-09-14T14:06:44Z

/retest

openshift-ci · 2026-09-14T14:31:19Z

@ankitathomas: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/default-catalog-consistency	`93ff5ae`	link	true	`/test default-catalog-consistency`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci Bot requested review from dtfranz and fgiudici September 11, 2026 21:05

UPSTREAM: <carry>: bump go-git to v5.19.2

93ff5ae

Signed-off-by: Ankita Thomas <ankithom@redhat.com>

ankitathomas force-pushed the go-git-bump branch from 7bb73c1 to 93ff5ae Compare September 14, 2026 13:07

Navigation Menu

Uh oh!

OCPBUGS-121303,OCPBUGS-121304: Bump go-git to v5.19.2 - #810

OCPBUGS-121303,OCPBUGS-121304: Bump go-git to v5.19.2#810
ankitathomas wants to merge 1 commit into
openshift:mainfrom
ankitathomas:go-git-bump

ankitathomas commented Sep 11, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

openshift-ci Bot commented Sep 11, 2026

Uh oh!

openshift-ci-robot commented Sep 11, 2026

Uh oh!

coderabbitai Bot commented Sep 11, 2026 •

edited

Loading

Uh oh!

openshift-ci Bot commented Sep 11, 2026

Uh oh!

openshift-ci-robot commented Sep 11, 2026

Summary by CodeRabbit

Uh oh!

ankitathomas commented Sep 14, 2026

Uh oh!

openshift-ci Bot commented Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ankitathomas commented Sep 11, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci Bot commented Sep 11, 2026

Uh oh!

openshift-ci-robot commented Sep 11, 2026

Uh oh!

coderabbitai Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

openshift-ci Bot commented Sep 11, 2026

Uh oh!

openshift-ci-robot commented Sep 11, 2026

Summary by CodeRabbit

Uh oh!

ankitathomas commented Sep 14, 2026

Uh oh!

openshift-ci Bot commented Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ankitathomas commented Sep 11, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Sep 11, 2026 •

edited

Loading