[internal] Update GitHub Actions workflow files

Fix workflow failure by ensuring bin directory exists (#762 )
# **Note: This is a temporary fix until we get this to `ci-mgmt`** ## Summary Fixes the GoReleaser workflow failure that started on Feb 6, 2026. ## Root Cause Commit 491f7de deleted `bin/pulumi-language-python-exec`, which was the last file in the `bin/` directory. Since Git doesn't track empty directories, the `bin/` directory disappeared from the repository. When GoReleaser runs the post-build hook `make sign-goreleaser-exe-amd64`, it attempts to download `jsign-6.0.jar` to `bin/jsign-6.0.jar`, but fails with: ``` bin/jsign-6.0.jar: No such file or directory make: *** [Makefile:260: bin/jsign-6.0.jar] Error 1 ``` ## Changes Added `@mkdir -p bin` to Makefile targets that write to the `bin/` directory: - `bin/jsign-6.0.jar` target (line 260) - **Critical fix** - `bin/pulumi-gen-${PACK}` target (line 185) - Defensive fix This ensures the directory exists before attempting to create files in it. Fixes #756 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-12 13:17:17 +00:00 · 2026-02-11 15:31:19 +00:00 · 2026-02-11 10:27:46 +00:00 · 2026-02-11 06:04:08 +00:00 · 2026-02-10 17:51:07 +00:00 · 2026-02-10 00:50:46 +00:00
19 changed files with 734 additions and 892 deletions
--- a/.config/mise.toml
+++ b/.config/mise.toml
@@ -8,8 +8,7 @@ PULUMI_HOME = "{{config_root}}/.pulumi"
 [tools]

 # Runtimes
-# TODO: we may not need 'get_env' once https://github.com/jdx/mise/discussions/6339 is fixed
-go = "{{ get_env(name='GO_VERSION_MISE', default='latest') }}"
+go = "{{ env.GO_VERSION_MISE }}"
 node = '20.19.5'
 python = '3.11.8'
 "vfox:version-fox/vfox-dotnet" = "8.0.20" # vfox backend doesn't work on Windows, gives "error converting Lua table to PreInstall (no version returned from vfox plugin)" https://github.com/jdx/mise/discussions/5876 https://github.com/jdx/mise/discussions/5550
@@ -17,7 +16,7 @@ python = '3.11.8'
 java = 'corretto-11'

 # Executable tools
-"github:pulumi/pulumi" = "{{ get_env(name='PULUMI_VERSION_MISE', default='latest') }}"
+"github:pulumi/pulumi" = "{{ env.PULUMI_VERSION_MISE }}"
 "github:pulumi/pulumictl" = '0.0.50'
 "github:pulumi/schema-tools" = "0.6.0"
 "aqua:gradle/gradle-distributions" = '7.6.6'
--- a/.github/actions/setup-tools/action.yml
+++ b/.github/actions/setup-tools/action.yml
@@ -14,14 +14,13 @@ runs:
  using: "composite"
  steps:
    - name: Setup mise
-      uses: blampe/mise-action@blampe/plugins
+      uses: jdx/mise-action@c1a019b8d2586943b4dbebc456323b516910e310
      env:
        MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
      with:
-        version: 2026.1.1
+        version: 2026.2.10
        cache_save: ${{ inputs.cache }}
        github_token: ${{ inputs.github_token }}
-        plugin_install: https://github.com/pulumi/vfox-pulumi

    - name: Setup Go Cache
      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -56,13 +56,12 @@ jobs:
          PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
        run: gh pr checkout "$PR_NUMBER"
      - name: Setup mise
-        uses: blampe/mise-action@blampe/plugins
+        uses: jdx/mise-action@c1a019b8d2586943b4dbebc456323b516910e310
        env:
          MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
        with:
-          version: 2026.1.1
+          version: 2026.2.10
          github_token: ${{ secrets.GITHUB_TOKEN }}
-          plugin_install: https://github.com/pulumi/vfox-pulumi
          # only saving the cache in the prerequisites job
          cache_save: false
      - name: Prepare local workspace
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,4 +1,4 @@
-# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
+# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt

 name: lint

@@ -7,15 +7,6 @@ on:
    inputs: {}

 env:
-  PROVIDER: docker-build
-  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  TRAVIS_OS_NAME: linux
-  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  GOVERSION: "1.21.x"
-  NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
-  DOTNETVERSION: "8.0.x"
-  JAVAVERSION: "11"
  ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
  ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
  ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
@@ -29,29 +20,49 @@ env:
  GOOGLE_REGION: us-central1
  GOOGLE_ZONE: us-central1-a
  PULUMI_API: https://api.pulumi-staging.io
+  PULUMI_PULUMI_ENABLE_JOURNALING: "true"

 jobs:
  lint:
+    name: lint
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write # For ESC secrets.
    steps:
    - name: Checkout Repo
      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
-        lfs: true
-        persist-credentials: false
-        ref: ${{ env.PR_COMMIT_SHA }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+        persist-credentials: false    
+    - env:
+        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
+        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
+        ESC_ACTION_OIDC_AUTH: "true"
+        ESC_ACTION_OIDC_ORGANIZATION: pulumi
+        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
+      id: esc-secrets
+      name: Fetch secrets from ESC
+      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+    - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+      id: app-auth
      with:
+        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
+        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
+        owner: ${{ github.repository_owner }}
+    - name: Setup mise
+      uses: jdx/mise-action@c1a019b8d2586943b4dbebc456323b516910e310
+      env:
+        MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
+      with:
+        version: 2026.2.10
        github_token: ${{ steps.app-auth.outputs.token }}
-    - name: Disarm go:embed directives to enable linters that compile source code
-      run: git grep -l 'go:embed' -- provider | xargs --no-run-if-empty sed -i
-        's/go:embed/ goembed/g'
-    - name: golangci-lint provider pkg
-      uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
-      with:
-        install-mode: none # Handled by mise.
-        working-directory: .
-    name: lint
-    if: github.event_name == 'repository_dispatch' ||
-      github.event.pull_request.head.repo.full_name == github.repository
+        cache_save: false # A different job handles caching our tools.
+    - name: prepare workspace
+      continue-on-error: true
+      run: make prepare_local_workspace
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: lint
+      run: make lint
--- a/.github/workflows/run-acceptance-tests.yml
+++ b/.github/workflows/run-acceptance-tests.yml
@@ -536,26 +536,8 @@ jobs:
    - prerequisites
    - lint
  lint:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-      with:
-        lfs: true
-        persist-credentials: false
-        ref: ${{ env.PR_COMMIT_SHA }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
-      with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Disarm go:embed directives to enable linters that compile source code
-      run: git grep -l 'go:embed' -- provider | xargs --no-run-if-empty sed -i
-        's/go:embed/ goembed/g'
-    - name: golangci-lint provider pkg
-      uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
-      with:
-        install-mode: none # Handled by mise.
-        working-directory: .
-    name: lint
    if: github.event_name == 'repository_dispatch' ||
      github.event.pull_request.head.repo.full_name == github.repository
+    name: lint
+    uses: ./.github/workflows/lint.yml
+    secrets: inherit
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,39 +1,32 @@
-run:
-  timeout: 10m
+# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt

 linters:
-  enable-all: false
  enable:
-    - depguard
-    - errcheck
-    - exhaustive
-    - copyloopvar
-    - gci
-    - gocritic
-    - gofumpt
-    - goheader
-    - gosec
-    - govet
-    - importas
-    - ineffassign
-    - lll
-    - misspell
-    - nakedret
-    - nolintlint
-    - paralleltest
-    - perfsprint
-    - prealloc
-    - revive
-    - unconvert
-    - unused
-
+  - errcheck
+  - gci
+  - goconst
+  - gofmt
+  - gosec
+  - govet
+  - ineffassign
+  - lll
+  - gosimple
+  - staticcheck
+  - misspell
+  - nakedret
+  - revive
+  - unconvert
+  - unused
+  enable-all: false
+issues:
+  exclude-dirs:
+  - pkg/vendored
+  exclude-files:
+  - schema.go
+  - pulumiManifest.go
+run:
+  timeout: 20m
 linters-settings:
-  depguard:
-    rules:
-      protobuf:
-        deny:
-          - pkg: "github.com/golang/protobuf"
-            desc: Use google.golang.org/protobuf instead
  gci:
    sections:
      - standard # Standard section: captures all standard library packages.
@@ -42,63 +35,3 @@ linters-settings:
      - prefix(github.com/pulumi/) # Custom section: groups all imports with the github.com/pulumi/ prefix.
      - prefix(github.com/pulumi/pulumi-docker-build) # Custom section: local imports
    custom-order: true
-  gocritic:
-    enable-all: true
-    disabled-checks:
-      - hugeParam
-      - importShadow
-  goheader:
-    template: |-
-      Copyright 2024, Pulumi Corporation.
-
-      Licensed under the Apache License, Version 2.0 (the "License");
-      you may not use this file except in compliance with the License.
-      You may obtain a copy of the License at
-
-          http://www.apache.org/licenses/LICENSE-2.0
-
-      Unless required by applicable law or agreed to in writing, software
-      distributed under the License is distributed on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-      See the License for the specific language governing permissions and
-      limitations under the License.
-  govet:
-    enable:
-      - nilness
-      # Reject comparisons of reflect.Value with DeepEqual or '=='.
-      - reflectvaluecompare
-      # Reject sort.Slice calls with a non-slice argument.
-      - sortslice
-      # Detect write to struct/arrays by-value that aren't read again.
-      - unusedwrite
-  nakedret:
-    # Make an issue if func has more lines of code than this setting, and it has naked returns.
-    # Default: 30
-    max-func-lines: 60
-  nolintlint:
-    # Some linter exclusions are added to generated or templated files
-    # pre-emptively.
-    # Don't complain about these.
-    allow-unused: true
-
-issues:
-  exclude-use-default: false
-  exclude-rules:
-    # Don't warn on unused parameters.
-    # Parameter names are useful; replacing them with '_' is undesirable.
-    - linters: [revive]
-      text: 'unused-parameter: parameter \S+ seems to be unused, consider removing or renaming it as _'
-
-    # staticcheck already has smarter checks for empty blocks.
-    # revive's empty-block linter has false positives.
-    # For example, as of writing this, the following is not allowed.
-    #   for foo() { }
-    - linters: [revive]
-      text: "empty-block: this block is empty, you can remove it"
-
-    # We *frequently* use the term 'new' in the context of properties
-    # (new and old properties),
-    # and we rarely use the 'new' built-in function.
-    # It's fine to ignore these cases.
-    - linters: [revive]
-      text: "redefines-builtin-id: redefinition of the built-in function new"
--- a/2
+++ b/2
@@ -182,6 +182,7 @@ bin/${PROVIDER}: $(shell find ./provider -name '*.go') go.mod
 	(cd provider && go build -o ../bin/${PROVIDER} -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION_GENERIC}" $(PROJECT)/${PROVIDER_PATH}/cmd/$(PROVIDER))

 bin/pulumi-gen-${PACK}: # Required by CI
+	@mkdir -p bin
 	touch bin/pulumi-gen-${PACK}

 go.mod: $(shell find . -name '*.go')
@@ -257,6 +258,7 @@ AZURE_SIGNING_KEY_VAULT_URI ?=
 SKIP_SIGNING ?=

 bin/jsign-6.0.jar:
+	@mkdir -p bin
 	wget https://github.com/ebourg/jsign/releases/download/6.0/jsign-6.0.jar --output-document=bin/jsign-6.0.jar

 sign-goreleaser-exe-amd64: GORELEASER_ARCH := amd64_v1
--- a/examples/go/go.mod
+++ b/examples/go/go.mod
@@ -33,7 +33,7 @@ require (
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.6.2 // indirect
-	github.com/go-git/go-git/v5 v5.16.0 // indirect
+	github.com/go-git/go-git/v5 v5.16.5 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/glog v1.2.4 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
@@ -62,7 +62,7 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/term v1.1.0 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.21.0 // indirect
+	github.com/pulumi/esc v0.22.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 // indirect
--- a/examples/go/go.sum
+++ b/examples/go/go.sum
@@ -67,8 +67,8 @@ github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UN
 github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.16.0 h1:k3kuOEpkc0DeY7xlL6NaaNg39xdgQbtH5mwCafHO9AQ=
-github.com/go-git/go-git/v5 v5.16.0/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
+github.com/go-git/go-git/v5 v5.16.5 h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s=
+github.com/go-git/go-git/v5 v5.16.5/go.mod h1:QOMLpNf1qxuSY4StA/ArOdfFR2TrKEjJiye2kel2m+M=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
@@ -157,8 +157,8 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
-github.com/pulumi/esc v0.21.0 h1:TR8Ff22SU+z8cooTmUKkmk2FltXW/wDPrIwI9BP88Vk=
-github.com/pulumi/esc v0.21.0/go.mod h1:mkghIFn/TvN3XnP4jmCB4U5BG1I4UjGluARi39ckrCE=
+github.com/pulumi/esc v0.22.0 h1:Kbk0kIPsoIu6vnLgKtiE8AKRfl8B8bg6adiQuwJiBjA=
+github.com/pulumi/esc v0.22.0/go.mod h1:mkghIFn/TvN3XnP4jmCB4U5BG1I4UjGluARi39ckrCE=
 github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.12 h1:uzmw+0iic764m0Yvh4I/jRV1x3q49dVh5Ctq9RllsQ8=
 github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.12/go.mod h1:6zFMe786NvFDO03BVJwdw1R/Yms4F6vAU49iBHo8zbQ=
 github.com/pulumi/pulumi/sdk/v3 v3.209.0 h1:Ti0FohAset2HEgogTxTOWoyvQd2N2+pkTSIn5DW3W7s=
--- a/examples/nodejs/package.json
+++ b/examples/nodejs/package.json
@@ -5,6 +5,6 @@
  },
  "dependencies": {
    "typescript": "^4.0.0",
-    "@pulumi/pulumi": "3.219.0"
+    "@pulumi/pulumi": "3.220.0"
  }
 }
--- a/examples/tests/caching/package.json
+++ b/examples/tests/caching/package.json
@@ -4,6 +4,6 @@
    "@types/node": "^20.0.0"
  },
  "dependencies": {
-    "@pulumi/pulumi": "3.219.0"
+    "@pulumi/pulumi": "3.220.0"
  }
 }
--- a/examples/tests/caching/yarn.lock
+++ b/examples/tests/caching/yarn.lock
@@ -368,10 +368,10 @@
  resolved "https://registry.yarnpkg.com/@protobufjs/utf8/-/utf8-1.1.0.tgz#a777360b5b39a1a2e5106f8e858f2fd2d060c570"
  integrity sha512-Vvn3zZrhQZkkBE8LSuW3em98c0FwgO4nxzv6OdSxPKJIEKY2bGbHn+mhGIPerzI4twdxaP8/0+06HBpwf345Lw==

-"@pulumi/pulumi@3.219.0":
-  version "3.219.0"
-  resolved "https://registry.yarnpkg.com/@pulumi/pulumi/-/pulumi-3.219.0.tgz#23bbb6caf2845d6bbc20b22f72bae6d3f157c57a"
-  integrity sha512-0AO1ZBJooKALToZYvPj/93PpToGA2rEKvIGQi95zNHevTTC3ibQrKXJDLwQzjHy6HZrON2jbxzakKrU4C2w+hA==
+"@pulumi/pulumi@3.220.0":
+  version "3.220.0"
+  resolved "https://registry.yarnpkg.com/@pulumi/pulumi/-/pulumi-3.220.0.tgz#27e12fa10048f1beae0ca97a005826a784190201"
+  integrity sha512-WfFu4Qv5r/9uv4bh6jxZPKLc945RtdjIq29mDa6c9sIXzQtRtv/Voo58E6u6lhA1RKaK+ocymqgykZ6QV7OnGQ==
  dependencies:
    "@grpc/grpc-js" "^1.10.1"
    "@logdna/tail-file" "^2.0.6"
--- a/examples/tests/config/package.json
+++ b/examples/tests/config/package.json
@@ -4,6 +4,6 @@
    "@types/node": "^20.0.0"
  },
  "dependencies": {
-    "@pulumi/pulumi": "3.219.0"
+    "@pulumi/pulumi": "3.220.0"
  }
 }
--- a/examples/upgrade-node/package.json
+++ b/examples/upgrade-node/package.json
@@ -5,6 +5,6 @@
  },
  "dependencies": {
    "typescript": "^4.0.0",
-    "@pulumi/pulumi": "3.219.0"
+    "@pulumi/pulumi": "3.220.0"
  }
 }
--- a/go.mod
+++ b/go.mod
@@ -14,11 +14,11 @@ require (
 	github.com/muesli/reflow v0.3.0
 	github.com/otiai10/copy v1.14.0
 	github.com/pulumi/providertest v0.6.0
-	github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.100.0
+	github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.101.0
 	github.com/pulumi/pulumi-go-provider v1.3.0
 	github.com/pulumi/pulumi-java/pkg v1.16.0
-	github.com/pulumi/pulumi/pkg/v3 v3.219.1-0.20260208071218-1bd84f1343e1
-	github.com/pulumi/pulumi/sdk/v3 v3.219.1-0.20260208071218-1bd84f1343e1
+	github.com/pulumi/pulumi/pkg/v3 v3.220.0
+	github.com/pulumi/pulumi/sdk/v3 v3.220.0
 	github.com/regclient/regclient v0.7.1
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/afero v1.14.0
@@ -121,7 +121,7 @@ require (
 	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.6.2 // indirect
-	github.com/go-git/go-git/v5 v5.16.0 // indirect
+	github.com/go-git/go-git/v5 v5.16.5 // indirect
 	github.com/go-jose/go-jose/v3 v3.0.4 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
@@ -226,7 +226,7 @@ require (
 	github.com/prometheus/common v0.55.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.21.0 // indirect
+	github.com/pulumi/esc v0.22.0 // indirect
 	github.com/pulumi/inflector v0.2.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
--- a/go.sum
+++ b/go.sum
@@ -263,8 +263,8 @@ github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UN
 github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.16.0 h1:k3kuOEpkc0DeY7xlL6NaaNg39xdgQbtH5mwCafHO9AQ=
-github.com/go-git/go-git/v5 v5.16.0/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
+github.com/go-git/go-git/v5 v5.16.5 h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s=
+github.com/go-git/go-git/v5 v5.16.5/go.mod h1:QOMLpNf1qxuSY4StA/ArOdfFR2TrKEjJiye2kel2m+M=
 github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
 github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
@@ -598,22 +598,22 @@ github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0leargg
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
-github.com/pulumi/esc v0.21.0 h1:TR8Ff22SU+z8cooTmUKkmk2FltXW/wDPrIwI9BP88Vk=
-github.com/pulumi/esc v0.21.0/go.mod h1:mkghIFn/TvN3XnP4jmCB4U5BG1I4UjGluARi39ckrCE=
+github.com/pulumi/esc v0.22.0 h1:Kbk0kIPsoIu6vnLgKtiE8AKRfl8B8bg6adiQuwJiBjA=
+github.com/pulumi/esc v0.22.0/go.mod h1:mkghIFn/TvN3XnP4jmCB4U5BG1I4UjGluARi39ckrCE=
 github.com/pulumi/inflector v0.2.1 h1:bqyiish3tq//vLeLiEstSFE5K7RNjy/ce47ed4QATu8=
 github.com/pulumi/inflector v0.2.1/go.mod h1:HUFCjcPTz96YtTuUlwG3i3EZG4WlniBvR9bd+iJxCUY=
 github.com/pulumi/providertest v0.6.0 h1:ZnefsbhkPE+BpKienHgb38P/6SEtXjjOXGGdMEUIOgk=
 github.com/pulumi/providertest v0.6.0/go.mod h1:OBpIGSQrw1FW9VNaHBtKCRxEoTISvx8JsxECmRqRgRQ=
-github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.100.0 h1:vClTE1Z9N3CFXsFFu+fu3RtU/5rgHQXN1yB/yzPRYu0=
-github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.100.0/go.mod h1:m3hX/6Ia3vYwLc5I/z+i4SH73q8Lu3xY8NLuS1JaTiw=
+github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.101.0 h1:1VGECdAuWEJ6cTsxFmpcUcpu0nBt9Ze8fHI/+1DgSio=
+github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.101.0/go.mod h1:m3hX/6Ia3vYwLc5I/z+i4SH73q8Lu3xY8NLuS1JaTiw=
 github.com/pulumi/pulumi-go-provider v1.3.0 h1:y5vQal1PaxdwpNWk5OFqc/6yLPpNJNnA1eY80mnWaQ0=
 github.com/pulumi/pulumi-go-provider v1.3.0/go.mod h1:5k36le9qSSlcpHwkL56HQhSXTHskhHhrrJ+x4dsVavo=
 github.com/pulumi/pulumi-java/pkg v1.16.0 h1:8KCiIXWv2uxfIks0SdgOezyXg4HZIoPfHID9eMg4nuM=
 github.com/pulumi/pulumi-java/pkg v1.16.0/go.mod h1:VeMZ1s9LfXBypao4A1tRF3EB7fYnYZ1LwImyg6FBX0c=
-github.com/pulumi/pulumi/pkg/v3 v3.219.1-0.20260208071218-1bd84f1343e1 h1:dB6mvlr9GniWvs9yYHFe0jsrHfe4lQ3Si1/ZyeF9H/c=
-github.com/pulumi/pulumi/pkg/v3 v3.219.1-0.20260208071218-1bd84f1343e1/go.mod h1:cxmMnghuTrmDGqO+kMTFisJQ5WTIfS+i01Eang6zKKI=
-github.com/pulumi/pulumi/sdk/v3 v3.219.1-0.20260208071218-1bd84f1343e1 h1:58jlG8mvJ3Ko2nIlWlVHmldsIqqP5k+gmNKRFlqPMes=
-github.com/pulumi/pulumi/sdk/v3 v3.219.1-0.20260208071218-1bd84f1343e1/go.mod h1:ZOBPPC2NZOZf729AdCX+CctfNc5SN6aJh0bdqNdzQC4=
+github.com/pulumi/pulumi/pkg/v3 v3.220.0 h1:M2mg8ohi8HEceoub+5YSNxCgQ6WY/ycdeMzc0uZmlWI=
+github.com/pulumi/pulumi/pkg/v3 v3.220.0/go.mod h1:RjLYZtdMcBn6qmAWF5HFy4Xw8U/nwsL9QdirtETkarU=
+github.com/pulumi/pulumi/sdk/v3 v3.220.0 h1:TtdlW2VfvBWhFZSvaDN9lSUlSS4gGSdNWdca3RGPsBQ=
+github.com/pulumi/pulumi/sdk/v3 v3.220.0/go.mod h1:UGWJOz25OiFIN0QH79UFij8mffH94TYebKUgy9Wvug0=
 github.com/redis/go-redis/v9 v9.7.0 h1:HhLSs+B6O021gwzl+locl0zEDnyNkxMtf/Z3NNBMa9E=
 github.com/redis/go-redis/v9 v9.7.0/go.mod h1:f6zhXITC7JUJIlPEiBOTXxJgPLdZcA93GewI7inzyWw=
 github.com/regclient/regclient v0.7.1 h1:qEsJrTmZd98fZKjueAbrZCSNGU+ifnr6xjlSAs3WOPs=
--- a/sdk/go/dockerbuild/go.mod
+++ b/sdk/go/dockerbuild/go.mod
@@ -4,7 +4,7 @@ go 1.24.7

 require (
 	github.com/blang/semver v3.5.1+incompatible
-	github.com/pulumi/pulumi/sdk/v3 v3.219.0
+	github.com/pulumi/pulumi/sdk/v3 v3.220.0
 )

 require (
@@ -33,7 +33,7 @@ require (
 	github.com/frankban/quicktest v1.14.6 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.6.2 // indirect
-	github.com/go-git/go-git/v5 v5.16.0 // indirect
+	github.com/go-git/go-git/v5 v5.16.5 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/glog v1.2.4 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
@@ -63,7 +63,7 @@ require (
 	github.com/pkg/term v1.1.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.21.0 // indirect
+	github.com/pulumi/esc v0.22.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 // indirect
--- a/sdk/go/dockerbuild/go.sum
+++ b/sdk/go/dockerbuild/go.sum
@@ -68,8 +68,8 @@ github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UN
 github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.16.0 h1:k3kuOEpkc0DeY7xlL6NaaNg39xdgQbtH5mwCafHO9AQ=
-github.com/go-git/go-git/v5 v5.16.0/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
+github.com/go-git/go-git/v5 v5.16.5 h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s=
+github.com/go-git/go-git/v5 v5.16.5/go.mod h1:QOMLpNf1qxuSY4StA/ArOdfFR2TrKEjJiye2kel2m+M=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
@@ -160,10 +160,10 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
-github.com/pulumi/esc v0.21.0 h1:TR8Ff22SU+z8cooTmUKkmk2FltXW/wDPrIwI9BP88Vk=
-github.com/pulumi/esc v0.21.0/go.mod h1:mkghIFn/TvN3XnP4jmCB4U5BG1I4UjGluARi39ckrCE=
-github.com/pulumi/pulumi/sdk/v3 v3.219.0 h1:OwTSwk1ZuOI4hQUdSccWuIAuqs4fL/FcppesPOAKHQ8=
-github.com/pulumi/pulumi/sdk/v3 v3.219.0/go.mod h1:ZOBPPC2NZOZf729AdCX+CctfNc5SN6aJh0bdqNdzQC4=
+github.com/pulumi/esc v0.22.0 h1:Kbk0kIPsoIu6vnLgKtiE8AKRfl8B8bg6adiQuwJiBjA=
+github.com/pulumi/esc v0.22.0/go.mod h1:mkghIFn/TvN3XnP4jmCB4U5BG1I4UjGluARi39ckrCE=
+github.com/pulumi/pulumi/sdk/v3 v3.220.0 h1:TtdlW2VfvBWhFZSvaDN9lSUlSS4gGSdNWdca3RGPsBQ=
+github.com/pulumi/pulumi/sdk/v3 v3.220.0/go.mod h1:UGWJOz25OiFIN0QH79UFij8mffH94TYebKUgy9Wvug0=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
--- a/sdk/python/pulumi_docker_build/_inputs.py
+++ b/sdk/python/pulumi_docker_build/_inputs.py
Author	SHA1	Message	Date
Pulumi Bot	de507af39b	[internal] Update GitHub Actions workflow files	2026-02-12 13:17:17 +00:00
Alberto Pose	13a14388f2	Fix workflow failure by ensuring bin directory exists (#762 ) # Note: This is a temporary fix until we get this to `ci-mgmt` ## Summary Fixes the GoReleaser workflow failure that started on Feb 6, 2026. ## Root Cause Commit `491f7de` deleted `bin/pulumi-language-python-exec`, which was the last file in the `bin/` directory. Since Git doesn't track empty directories, the `bin/` directory disappeared from the repository. When GoReleaser runs the post-build hook `make sign-goreleaser-exe-amd64`, it attempts to download `jsign-6.0.jar` to `bin/jsign-6.0.jar`, but fails with: ``` bin/jsign-6.0.jar: No such file or directory make: * [Makefile:260: bin/jsign-6.0.jar] Error 1 ``` ## Changes Added `@mkdir -p bin` to Makefile targets that write to the `bin/` directory: - `bin/jsign-6.0.jar` target (line 260) - Critical fix** - `bin/pulumi-gen-${PACK}` target (line 185) - Defensive fix This ensures the directory exists before attempting to create files in it. Fixes #756 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>	2026-02-11 15:31:19 +00:00
pulumi-renovate[bot]	13acd934b6	Update first-party Pulumi dependencies (#760 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [github.com/pulumi/esc](https://redirect.github.com/pulumi/esc) \| indirect \| minor \| `v0.21.0` -> `v0.22.0` \| \| [github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi) \| require \| minor \| `v3.219.0` -> `v3.220.0` \| --- ### Release Notes <details> <summary>pulumi/esc (github.com/pulumi/esc)</summary> ### [`v0.22.0`](https://redirect.github.com/pulumi/esc/releases/tag/v0.22.0) [Compare Source](https://redirect.github.com/pulumi/esc/compare/v0.21.0...v0.22.0) ##### Improvements ##### Bug Fixes ##### Breaking changes </details> <details> <summary>pulumi/pulumi (github.com/pulumi/pulumi/pkg/v3)</summary> ### [`v3.220.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.220.0) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.219.0...v3.220.0) ##### 3.220.0 (2026-02-10) ##### Features - \[cli] Show environment variables that were set if a snapshot integrity error happens [#21709](https://redirect.github.com/pulumi/pulumi/pull/21709) - \[cli/{install,package}] Use the Pulumi Cloud Registry by default to resolve package names - \[engine] Pass replacement trigger through to Construct [#21408](https://redirect.github.com/pulumi/pulumi/pull/21408) - \[engine] Add EnvVarMappings resource option for provider resources, allowing environment variables to be remapped before being passed to the provider [#21572](https://redirect.github.com/pulumi/pulumi/pull/21572) - \[pkg] BREAKING: Deprecate github.com/pulumi/pulumi/pkg/v3/codegen/dotnet in favor of github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3/codegen. This package will be removed from pulumi/pulumi soon! [#21720](https://redirect.github.com/pulumi/pulumi/pull/21720) ##### Bug Fixes - \[cli] Retry `yarn install` when it fails (e.g. during `pulumi install`) [#21707](https://redirect.github.com/pulumi/pulumi/pull/21707) - \[engine] Deal with errors in elided journal entries correctly [#21576](https://redirect.github.com/pulumi/pulumi/pull/21576) - \[sdk/nodejs] Fix remote components with PULUMI_NODEJS_SKIP_COMPONENT_INPUTS - \[sdk/python] Fix `_LazyModule` to not trigger full module load for introspection attributes [#21620](https://redirect.github.com/pulumi/pulumi/pull/21620) - \[sdkgen/python] Remove workaround for slow typechecking with MyPy and PyCharm [#21722](https://redirect.github.com/pulumi/pulumi/pull/21722) ##### Miscellaneous - \[cli] Write logfile location if verbosity is >= 1 to stderr instead of stdout [#21663](https://redirect.github.com/pulumi/pulumi/pull/21663) </details> --- ### Configuration 📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - Monday through Friday ( * * * * 1-5 ) (UTC). 🚦 Automerge: Enabled. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 Immortal: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19--> --------- Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com> Co-authored-by: pulumi-bot <bot@pulumi.com> Co-authored-by: Ian Wahbe <me@iwahbe.com>	2026-02-11 10:27:46 +00:00
pulumi-provider-automation[bot]	8cb8d21332	Update GitHub Actions workflows. (#761 ) This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit f34bb277a6b5001ebd945cebced51ef890cdb7b9. Co-authored-by: Pulumi Bot <bot@pulumi.com>	2026-02-11 06:04:08 +00:00
pulumi-renovate[bot]	c11144e1b3	Update dependency @pulumi/pulumi to v3.220.0 (#759 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi) ([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs)) \| dependencies \| minor \| [`3.219.0` -> `3.220.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.219.0/3.220.0) \| --- ### Release Notes <details> <summary>pulumi/pulumi (@pulumi/pulumi)</summary> ### [`v3.220.0`](https://redirect.github.com/pulumi/pulumi/compare/v3.219.0...v3.220.0) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.219.0...v3.220.0) </details> --- ### Configuration 📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - Monday through Friday ( * * * * 1-5 ) (UTC). 🚦 Automerge: Enabled. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19--> Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>	2026-02-10 17:51:07 +00:00
pulumi-renovate[bot]	ca8a59a077	Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] (#758 ) This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [github.com/go-git/go-git/v5](https://redirect.github.com/go-git/go-git) \| indirect \| patch \| `v5.16.0` -> `v5.16.5` \| ### GitHub Vulnerability Alerts #### [CVE-2026-25934](https://redirect.github.com/go-git/go-git/security/advisories/GHSA-37cx-329c-33x3) ### Impact A vulnerability was discovered in `go-git` whereby data integrity values for `.pack` and `.idx` files were not properly verified. This resulted in `go-git` potentially consuming corrupted files, which would likely result in unexpected errors such as `object not found`. For context, clients fetch [`packfiles`](https://git-scm.com/docs/pack-protocol#_packfile_data) from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (`.idx`) are [generated](https://git-scm.com/docs/pack-format) locally by `go-git`, or the `git` cli, when new `.pack` files are received and processed. The integrity checks for both files were not being verified correctly. Note that the lack of verification of the packfile checksum has no impact on the trust relationship between the client and server, which is enforced based on the protocol being used (e.g. TLS in the case of `https://` or known hosts for `ssh://`). In other words, the packfile checksum verification does not provide any security benefits when connecting to a malicious or compromised Git server. ### Patches Users should upgrade to `v5.16.5`, or the latest `v6` [pseudo-version](https://go.dev/ref/mod#pseudo-versions), in order to mitigate this vulnerability. ### Workarounds In case updating to a fixed version of `go-git` is not possible, users can run [git fsck](https://git-scm.com/docs/git-fsck) from the `git` cli to check for data corruption on a given repository. ### Credit Thanks @N0zoM1z0 for finding and reporting this issue privately to the `go-git` project. --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.16.5`](https://redirect.github.com/go-git/go-git/releases/tag/v5.16.5) [Compare Source](https://redirect.github.com/go-git/go-git/compare/v5.16.4...v5.16.5) ##### What's Changed - build: Update module golang.org/x/crypto to v0.45.0 \[SECURITY] (releases/v5.x) by [@go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot] in[https://github.com/go-git/go-git/pull/1744](https://redirect.github.com/go-git/go-git/pull/1744)4 - build: Bump Go test versions to 1.23-1.25 (v5) by [@pjbgf](https://redirect.github.com/pjbgf) in [https://github.com/go-git/go-git/pull/1746](https://redirect.github.com/go-git/go-git/pull/1746) - \[v5] git: worktree, Don't delete local untracked files when resetting worktree by [@Ch00k](https://redirect.github.com/Ch00k) in [https://github.com/go-git/go-git/pull/1800](https://redirect.github.com/go-git/go-git/pull/1800) - Expand packfile checks by [@pjbgf](https://redirect.github.com/pjbgf) in [https://github.com/go-git/go-git/pull/1836](https://redirect.github.com/go-git/go-git/pull/1836) Full Changelog: https://github.com/go-git/go-git/compare/v5.16.4...v5.16.5 ### [`v5.16.4`](https://redirect.github.com/go-git/go-git/releases/tag/v5.16.4) [Compare Source](https://redirect.github.com/go-git/go-git/compare/v5.16.3...v5.16.4) ##### What's Changed - backport plumbing: format/idxfile, prevent panic by [@swills](https://redirect.github.com/swills) in [https://github.com/go-git/go-git/pull/1732](https://redirect.github.com/go-git/go-git/pull/1732) - \[backport] build: test, Fix build on Windows. by [@pjbgf](https://redirect.github.com/pjbgf) in [https://github.com/go-git/go-git/pull/1734](https://redirect.github.com/go-git/go-git/pull/1734) - build: Update module golang.org/x/net to v0.38.0 \[SECURITY] (releases/v5.x) by [@go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot] in[https://github.com/go-git/go-git/pull/1742](https://redirect.github.com/go-git/go-git/pull/1742)2 - build: Update module github.com/cloudflare/circl to v1.6.1 \[SECURITY] (releases/v5.x) by [@go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot] in[https://github.com/go-git/go-git/pull/1741](https://redirect.github.com/go-git/go-git/pull/1741)1 - build: Update module github.com/go-git/go-git/v5 to v5.13.0 \[SECURITY] (releases/v5.x) by [@go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot] in[https://github.com/go-git/go-git/pull/1743](https://redirect.github.com/go-git/go-git/pull/1743)3 Full Changelog: https://github.com/go-git/go-git/compare/v5.16.3...v5.16.4 ### [`v5.16.3`](https://redirect.github.com/go-git/go-git/releases/tag/v5.16.3) [Compare Source](https://redirect.github.com/go-git/go-git/compare/v5.16.2...v5.16.3) ##### What's Changed - internal: Expand regex to fix build \[5.x] by [@baloo](https://redirect.github.com/baloo) in [https://github.com/go-git/go-git/pull/1644](https://redirect.github.com/go-git/go-git/pull/1644) - build: raise timeouts for windows CI tests and disable CIFuzz \[5.x] by [@baloo](https://redirect.github.com/baloo) in [https://github.com/go-git/go-git/pull/1646](https://redirect.github.com/go-git/go-git/pull/1646) - plumbing: support commits extra headers, support jujutsu signed commit \[5.x] by [@baloo](https://redirect.github.com/baloo) in [https://github.com/go-git/go-git/pull/1633](https://redirect.github.com/go-git/go-git/pull/1633) Full Changelog: https://github.com/go-git/go-git/compare/v5.16.2...v5.16.3 ### [`v5.16.2`](https://redirect.github.com/go-git/go-git/releases/tag/v5.16.2) [Compare Source](https://redirect.github.com/go-git/go-git/compare/v5.16.1...v5.16.2) ##### What's Changed - utils: fix diff so subpaths work for sparse checkouts, fixes 1455 to releases/v5.x by [@kane8n](https://redirect.github.com/kane8n) in [https://github.com/go-git/go-git/pull/1567](https://redirect.github.com/go-git/go-git/pull/1567) Full Changelog: https://github.com/go-git/go-git/compare/v5.16.1...v5.16.2 ### [`v5.16.1`](https://redirect.github.com/go-git/go-git/releases/tag/v5.16.1) [Compare Source](https://redirect.github.com/go-git/go-git/compare/v5.16.0...v5.16.1) ##### What's Changed - utils: merkletrie, Fix diff on sparse-checkout index. Fixes [#1406](https://redirect.github.com/go-git/go-git/issues/1406) to releases/v5.x by [@kane8n](https://redirect.github.com/kane8n) in [https://github.com/go-git/go-git/pull/1561](https://redirect.github.com/go-git/go-git/pull/1561) ##### New Contributors - [@kane8n](https://redirect.github.com/kane8n) made their first contribution in [https://github.com/go-git/go-git/pull/1561](https://redirect.github.com/go-git/go-git/pull/1561) Full Changelog: https://github.com/go-git/go-git/compare/v5.16.0...v5.16.1 </details> --- ### Configuration 📅 Schedule: Branch creation - "" (UTC), Automerge - Monday through Friday ( * * * * 1-5 ) (UTC). 🚦 Automerge: Enabled. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19--> --------- Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com> Co-authored-by: pulumi-bot <bot@pulumi.com>	2026-02-10 00:50:46 +00:00