chore(deps): update gomod

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
github.com/Masterminds/semver/v3	v3.4.0 → v3.5.0			indirect	minor
github.com/cyphar/filepath-securejoin	v0.6.1 → v0.7.0			indirect	minor
github.com/docker/cli	v29.5.3+incompatible → v29.7.1+incompatible			indirect	minor	v29.7.2+incompatible
github.com/go-git/go-billy/v5	v5.8.0 → v5.9.1			indirect	minor
github.com/go-git/go-git/v5	v5.18.0 → v5.19.2			indirect	minor
github.com/go-openapi/swag	v0.27.1 → v0.28.0			indirect	minor
github.com/go-openapi/swag/cmdutils	v0.27.1 → v0.28.0			indirect	minor
github.com/go-openapi/swag/conv	v0.27.1 → v0.28.0			indirect	minor
github.com/go-openapi/swag/fileutils	v0.27.1 → v0.28.0			indirect	minor
github.com/go-openapi/swag/jsonutils	v0.27.1 → v0.28.0			indirect	minor
github.com/go-openapi/swag/loading	v0.27.1 → v0.28.0			indirect	minor
github.com/go-openapi/swag/mangling	v0.27.1 → v0.28.0			indirect	minor
github.com/go-openapi/swag/netutils	v0.27.1 → v0.28.0			indirect	minor
github.com/go-openapi/swag/pools	v0.27.1 → v0.28.0			indirect	minor
github.com/go-openapi/swag/stringutils	v0.27.1 → v0.28.0			indirect	minor
github.com/go-openapi/swag/typeutils	v0.27.1 → v0.28.0			indirect	minor
github.com/go-openapi/swag/yamlutils	v0.27.1 → v0.28.0			indirect	minor
github.com/google/go-querystring	v1.1.0 → v1.2.0			indirect	minor
github.com/google/pprof	b9395ee → ef3492d			indirect	digest
github.com/klauspost/compress	v1.18.6 → v1.19.1			indirect	minor	v1.19.2
github.com/klauspost/cpuid/v2	v2.3.0 → v2.4.0			indirect	minor
github.com/pjbgf/sha1cd	v0.5.0 → v0.6.0			indirect	minor
sigs.k8s.io/structured-merge-diff/v6	v6.4.1 → v6.4.2			indirect	patch

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

Masterminds/semver (github.com/Masterminds/semver/v3)

v3.5.0

Compare Source

What's Changed

• Adding more prerelease tests by @​mattfarina in #​273
• Update constraint error messages by @​mattfarina in #​278
• Fix edge cases by @​mattfarina in #​279
• Adding some checks in by @​mattfarina in #​280
• Updating deps by @​mattfarina in #​281
• Bump github/codeql-action from 4.35.1 to 4.35.2 by @​dependabot[bot] in #​282
• Bump actions/cache from 4.2.3 to 5.0.5 by @​dependabot[bot] in #​283
• Bump golangci/golangci-lint-action from 7.0.1 to 9.2.0 by @​dependabot[bot] in #​284
• Updating gitignore for devcontainers by @​mattfarina in #​286
• Fixing some quality issues by @​mattfarina in #​287

New Contributors

• @​dependabot[bot] made their first contribution in #​282

Full Changelog: Masterminds/semver@v3.4.0...v3.5.0

cyphar/filepath-securejoin (github.com/cyphar/filepath-securejoin)

v0.7.0: -- "You talk of times of peace for all, and then prepare for war."

Compare Source

Changed

• Update to cyphar.com/go-pathrs@0.2.5, which included a build-time API
  breakage that we needed to work around. The API of this library is unchanged
  by this, but users should make sure to update to v0.7.0 of
  filepath-securejoin if they use the libpathrs built tag and have update
  to libpathrs v0.2.5.

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

docker/cli (github.com/docker/cli)

v29.7.1+incompatible

Compare Source

v29.7.0+incompatible

Compare Source

v29.6.2+incompatible

Compare Source

v29.6.1+incompatible

Compare Source

v29.6.0+incompatible

Compare Source

go-git/go-billy (github.com/go-git/go-billy/v5)

v5.9.1

Compare Source

What's Changed

• build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​216
• build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​230
• build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​229

Full Changelog: go-git/go-billy@v5.9.0...v5.9.1

v5.9.0

Compare Source

What's Changed

• Use path.Clean instead of filepath.Clean in iofs.Open by @​puerco in #​197
• Deprecate ChrootOS in favour of BoundOS by @​pjbgf in #​201
• General Improvements by @​pjbgf in #​203
• osfs: ChrootOS eval baseDir on creation by @​pjbgf in #​205
• Run go-git tests as part of integration tests by @​pjbgf in #​206

Full Changelog: go-git/go-billy@v5.8.0...v5.9.0

go-git/go-git (github.com/go-git/go-git/v5)

v5.19.2

Compare Source

What's Changed

• build: Update module golang.org/x/crypto to v0.52.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​2150
• build: Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​2141
• build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​2152
• git: Worktree: Add stores index entires with backslashes on Windows by @​joshblum in #​2262
• storage: dotgit, reject path traversal in reference names by @​pjbgf in #​2254
• build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​2267
• build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​2268
• [v5] git: worktree, make the filesystem wrapper a symlink-safe boundary by @​pjbgf in #​2277

Full Changelog: go-git/go-git@v5.19.1...v5.19.2

v5.19.1

Compare Source

What's Changed

• v5: plumbing: transport/ssh, Shell-quote path by @​hiddeco in #​2068
• v5: git: submodule, Fix relative URL resolution by @​hiddeco in #​2070
• v5: git: submodule, canonical remote for relative URLs by @​hiddeco in #​2074
• v5: git: submodule, error on remote without URLs by @​hiddeco in #​2078
• v5: plumbing: format/idxfile, Validate offset64 indices by @​hiddeco in #​2084
• v5: *: Reject malformed variable-length integers by @​hiddeco in #​2092
• v5: plumbing: format/packfile, Tighten delta validation by @​hiddeco in #​2091
• v5: Add worktreeFilesystem wrapper for worktree and hardening by @​hiddeco in #​2100
• v5: config: validate submodule names by @​hiddeco in #​2082
• build: Update module github.com/go-git/go-git/v5 to v5.19.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​2111
• v5: git: Allow MkdirAll on worktree-root paths by @​hiddeco in #​2117
• v5: git: Stop validating symlink target paths by @​pjbgf in #​2116
• v5: plumbing: format decoder input bounds and contracts by @​hiddeco in #​2125
• plumbing: format/packfile, cap delta chain depth in parser by @​pjbgf in #​2137

Full Changelog: go-git/go-git@v5.19.0...v5.19.1

v5.19.0

Compare Source

What's Changed

• build: Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in #​2010
• v5: Bump sha1cd and go-billy by @​pjbgf in #​2060
• v5: Align object encoding with upstream by @​pjbgf in #​2065

Full Changelog: go-git/go-git@v5.18.0...v5.19.0

go-openapi/swag (github.com/go-openapi/swag)

v0.28.0

Compare Source

0.28.0 - 2026-07-27

Full Changelog: go-openapi/swag@v0.27.3...v0.28.0

3 commits in this release.

---

Implemented enhancements

• feat(conv): add support for AppendXXX formatting of numbers by @​fredbi in #​229 ...

Miscellaneous tasks

• chore: prepare release v0.28.0 by @​bot-go-openapi[bot] in #​230 ...

Updates

• build(deps): bump the development-dependencies group with 9 updates by @​dependabot[bot] in #​228 ...

---

People who contributed to this release

• @​fredbi

---

swag license terms

Per-module changes

---

conv (0.28.0)

Implemented enhancements

• feat(conv): add support for AppendXXX formatting of numbers by @​fredbi in #​229 ...

Miscellaneous tasks

• chore: prepare release v0.28.0 by @​bot-go-openapi[bot] in #​230 ...

---

jsonutils/adapters/easyjson (0.28.0)

Miscellaneous tasks

• chore: prepare release v0.28.0 by @​bot-go-openapi[bot] in #​230 ...

---

jsonutils/adapters/testintegration/benchmarks (0.28.0)

Miscellaneous tasks

• chore: prepare release v0.28.0 by @​bot-go-openapi[bot] in #​230 ...

---

jsonutils/adapters/testintegration (0.28.0)

Miscellaneous tasks

• chore: prepare release v0.28.0 by @​bot-go-openapi[bot] in #​230 ...

---

jsonutils (0.28.0)

Miscellaneous tasks

• chore: prepare release v0.28.0 by @​bot-go-openapi[bot] in #​230 ...

---

loading (0.28.0)

Miscellaneous tasks

• chore: prepare release v0.28.0 by @​bot-go-openapi[bot] in #​230 ...

---

yamlutils (0.28.0)

Miscellaneous tasks

• chore: prepare release v0.28.0 by @​bot-go-openapi[bot] in #​230 ...

v0.27.3

Compare Source

0.27.3 - 2026-07-20

Full Changelog: go-openapi/swag@v0.27.2...v0.27.3

2 commits in this release.

---

Fixed bugs

• fix: rooted path should also work on windows by @​fredbi in #​226 ...

Miscellaneous tasks

• chore: prepare release v0.27.3 by @​bot-go-openapi[bot] in #​227 ...

---

People who contributed to this release

• @​fredbi

---

swag license terms

Per-module changes

---

conv (0.27.3)

Miscellaneous tasks

• chore: prepare release v0.27.3 by @​bot-go-openapi[bot] in #​227 ...

---

jsonutils/adapters/easyjson (0.27.3)

Miscellaneous tasks

• chore: prepare release v0.27.3 by @​bot-go-openapi[bot] in #​227 ...

---

jsonutils/adapters/testintegration/benchmarks (0.27.3)

Miscellaneous tasks

• chore: prepare release v0.27.3 by @​bot-go-openapi[bot] in #​227 ...

---

jsonutils/adapters/testintegration (0.27.3)

Miscellaneous tasks

• chore: prepare release v0.27.3 by @​bot-go-openapi[bot] in #​227 ...

---

jsonutils (0.27.3)

Miscellaneous tasks

• chore: prepare release v0.27.3 by @​bot-go-openapi[bot] in #​227 ...

---

loading (0.27.3)

Fixed bugs

• fix: rooted path should also work on windows by @​fredbi in #​226 ...

Miscellaneous tasks

• chore: prepare release v0.27.3 by @​bot-go-openapi[bot] in #​227 ...

---

yamlutils (0.27.3)

Miscellaneous tasks

• chore: prepare release v0.27.3 by @​bot-go-openapi[bot] in #​227 ...

v0.27.2

Compare Source

0.27.2 - 2026-07-20

Full Changelog: go-openapi/swag@v0.27.1...v0.27.2

2 commits in this release.

---

Fixed bugs

• fix(loading): resolve absolute in-root paths under WithRoot by @​fredbi in #​224 ...

Miscellaneous tasks

• chore: prepare release v0.27.2 by @​bot-go-openapi[bot] in #​225 ...

---

People who contributed to this release

• @​fredbi

---

swag license terms

Per-module changes

---

conv (0.27.2)

Miscellaneous tasks

• chore: prepare release v0.27.2 by @​bot-go-openapi[bot] in #​225 ...

---

jsonutils/adapters/easyjson (0.27.2)

Miscellaneous tasks

• chore: prepare release v0.27.2 by @​bot-go-openapi[bot] in #​225 ...

---

jsonutils/adapters/testintegration/benchmarks (0.27.2)

Miscellaneous tasks

• chore: prepare release v0.27.2 by @​bot-go-openapi[bot] in #​225 ...

---

jsonutils/adapters/testintegration (0.27.2)

Miscellaneous tasks

• chore: prepare release v0.27.2 by @​bot-go-openapi[bot] in #​225 ...

---

jsonutils (0.27.2)

Miscellaneous tasks

• chore: prepare release v0.27.2 by @​bot-go-openapi[bot] in #​225 ...

---

loading (0.27.2)

Fixed bugs

• fix(loading): resolve absolute in-root paths under WithRoot by @​fredbi in #​224 ...

Miscellaneous tasks

• chore: prepare release v0.27.2 by @​bot-go-openapi[bot] in #​225 ...

---

yamlutils (0.27.2)

Miscellaneous tasks

• chore: prepare release v0.27.2 by @​bot-go-openapi[bot] in #​225 ...

google/go-querystring (github.com/google/go-querystring)

v1.2.0

Compare Source

A lot of version bumps, though mostly actually of GitHub Actions that have nothing to do with the package itself.

Two minor code optimizations:

• code opt: prioritize handling boundary conditions by @​hcraM41 in #​149
• code opt: replace bytes.Buffer with strings.Builder by @​hcraM41 in #​151

Full Changelog: google/go-querystring@v1.1.0...v1.2.0

klauspost/compress (github.com/klauspost/compress)

v1.19.1

Compare Source

What's Changed

• zstd: Validate SnappyConverter literal copies by @​klauspost in #​1170
• flate: use Peek instead of ReadByte for the bufio.Reader decode path by @​joechenrh in #​1169
• zstd: bump avo pin, regenerate arm64 asm by @​lizthegrey in #​1167

New Contributors

• @​joechenrh made their first contribution in #​1169

Full Changelog: klauspost/compress@v1.19.0...v1.19.1

v1.19.0

Compare Source

What's Changed

• zstd: Add true concurrent stream encoding by @​klauspost in #​1136
• zstd: arm64 decoder asm by @​lizthegrey in #​1160
• zstd: avoid unused BuildDict encoder allocation by @​snissn in #​1147
• flate: Add inflate checkpoints by @​klauspost in #​1154
• snappy/s2: Limit length of varint in decodedLen by @​eustas in #​1148
• gzhttp: match qvalue parameter case-insensitively (RFC 7231) by @​z9z in #​1149
• zip: add NameDecoder callback for legacy encoding rewrite by @​SAY-5 in #​1150
• huff0: Allow building tables from histogram. by @​klauspost in #​1155
• huff0: Allow building table from oversized histogram. by @​klauspost in #​1156
• s2sx: Clean symlink targets by @​klauspost in #​1163

New Contributors

• @​snissn made their first contribution in #​1147
• @​eustas made their first contribution in #​1148
• @​z9z made their first contribution in #​1149
• @​SAY-5 made their first contribution in #​1150
• @​HNO3Miracle made their first contribution in #​1165

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

v1.18.7

Compare Source

• Fix s2.NewDict OOB read.

Security release without other changes.

Full Changelog: klauspost/compress@v1.18.6...v1.18.7

klauspost/cpuid (github.com/klauspost/cpuid/v2)

v2.4.0

Compare Source

What's Changed

• Add riscv64 CPU feature detection by @​mengzhuo in #​173
• Add arm64 go feature id by @​klauspost in #​175
• Add AVX512BMM by @​klauspost in #​170
• Add FRED detection by @​riptl in #​172
• Upgrade CI to 1.26, fix arm64 noasm by @​klauspost in #​174
• Apply go fix by @​klauspost in #​176

New Contributors

• @​riptl made their first contribution in #​172
• @​mengzhuo made their first contribution in #​173

Full Changelog: klauspost/cpuid@v2.3.0...v2.4.0

pjbgf/sha1cd (github.com/pjbgf/sha1cd)

v0.6.0

Compare Source

What's Changed

• Change the nightly fuzzer to weekly by @​pjbgf in #​200
• build(deps): Bump actions/checkout from 4.2.2 to 6.0.1 by @​dependabot[bot] in #​204
• build(deps): Bump github/codeql-action from 3.29.2 to 4.31.9 by @​dependabot[bot] in #​203
• build(deps): Bump golang from 1.24 to 1.25 by @​dependabot[bot] in #​202
• build(deps): Bump actions/setup-go from 5.5.0 to 6.1.0 by @​dependabot[bot] in #​201
• Performance improvements for AMD64 and Generic by @​pjbgf in #​205
• Remove self-registration via crypto.RegisterHash by @​pjbgf in #​206

Full Changelog: pjbgf/sha1cd@v0.5.0...v0.6.0

kubernetes-sigs/structured-merge-diff (sigs.k8s.io/structured-merge-diff/v6)

v6.4.2

Compare Source

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "before 7am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[dsimansk]

/ok-to-test

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux-kflux-prd-rh02[bot]
Once this PR has been reviewed and has the lgtm label, please assign therealjon for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@red-hat-konflux-kflux-prd-rh02[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.