What's Changed

• build: Update module golang.org/x/crypto to v0.45.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1744
• build: Bump Go test versions to 1.23-1.25 (v5) by @pjbgf in #1746
• [v5] git: worktree, Don't delete local untracked files when resetting worktree by @Ch00k in #1800
• Expand packfile checks by @pjbgf in #1836

Full Changelog: v5.16.4...v5.16.5

What's Changed

• backport plumbing: format/idxfile, prevent panic by @swills in #1732
• [backport] build: test, Fix build on Windows. by @pjbgf in #1734
• build: Update module golang.org/x/net to v0.38.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1742
• build: Update module github.com/cloudflare/circl to v1.6.1 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1741
• build: Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1743

Full Changelog: v5.16.3...v5.16.4

What's Changed

• internal: Expand regex to fix build [5.x] by @baloo in #1644
• build: raise timeouts for windows CI tests and disable CIFuzz [5.x] by @baloo in #1646
• plumbing: support commits extra headers, support jujutsu signed commit [5.x] by @baloo in #1633

Full Changelog: v5.16.2...v5.16.3

What's Changed

• utils: fix diff so subpaths work for sparse checkouts, fixes 1455 to releases/v5.x by @kane8n in #1567

Full Changelog: v5.16.1...v5.16.2

What's Changed

• utils: merkletrie, Fix diff on sparse-checkout index. Fixes #1406 to releases/v5.x by @kane8n in #1561

New Contributors

• @kane8n made their first contribution in #1561

Full Changelog: v5.16.0...v5.16.1

What's Changed

• [v5] plumbing: support mTLS for HTTPS protocol by @hiddeco in #1510
• v5: plumbing: transport, Reintroduce SetHostKeyCallback. Fix #1514 by @pjbgf in #1515

Full Changelog: v5.15.0...v5.16.0

What's Changed

• plumbing: add cert auth support to releases/v5.x by @Javier-varez in #1482
• v5: Bump dependencies by @pjbgf in #1505

Full Changelog: v5.14.0...v5.15.0

What's Changed

• v5: Bump Go and dependencies to mitigate GO-2025-3487 by @pjbgf in #1436

⚠️ Note that this version requires Go 1.23, due to the bump to golang.org/x/crypto@v0.35.0 which mitigates the CVE above. User's that can't bump to Go 1.23 will need to remain on the previous v5.13.x release.

Full Changelog: v5.13.2...v5.14.0

What's Changed

• plumbing: use the correct user agent string. Fixes #883 by @uragirii in #1364
• build: bump golang.org/x/sys from 0.28.0 to 0.29.0 in the golang-org group by @dependabot in #1365
• build: bump the golang-org group with 2 updates by @dependabot in #1367
• build: bump github.com/ProtonMail/go-crypto from 1.1.3 to 1.1.4 by @dependabot in #1368
• build: bump github.com/go-git/go-billy/v5 from 5.6.1 to 5.6.2 by @dependabot in #1378
• build: bump github/codeql-action from 3.28.0 to 3.28.1 by @dependabot in #1376
• build: bump github.com/elazarl/goproxy from 1.2.3 to 1.4.0 by @dependabot in #1377
• git: worktree, fix restoring dot slash files (backported to v5). Fixes #1176 by @BeChris in #1361
• build: bump github.com/pjbgf/sha1cd from 0.3.0 to 0.3.2 by @dependabot in #1392
• git: worktree_status, fix adding dot slash files to working tree (backported to v5). Fixes #1150 by @BeChris in #1359
• build: bump github.com/ProtonMail/go-crypto from 1.1.4 to 1.1.5 by @dependabot in #1383

Full Changelog: v5.13.1...v5.13.2

What's Changed

• build: bump github.com/go-git/go-billy/v5 from 5.6.0 to 5.6.1 by @dependabot in #1327
• build: bump github.com/elazarl/goproxy from 1.2.1 to 1.2.2 by @dependabot in #1329
• build: bump github.com/elazarl/goproxy from 1.2.2 to 1.2.3 by @dependabot in #1340
• Revert "plumbing: transport/ssh, Add support for SSH @cert-authority." by @pjbgf in #1346

Full Changelog: v5.13.0...v5.13.1