Bump the all-go-deps group with 2 updates

[dependabot]

Bumps the all-go-deps group with 2 updates: filippo.io/sunlight and github.com/go-git/go-git/v5.

Updates filippo.io/sunlight from 0.8.1 to 0.9.0

Release notes

Sourced from filippo.io/sunlight's releases.

Sunlight v0.9.0

Breaking changes

The Skylight /logs.json format changed: it now serves an object with operator_name (from the new operatorname option) and logs, a list of log.v3.json URLs. This matches the operator metadata that Chrome announced it will require log operators to host starting February 1, 2027.

Witness mode now requires a storage backend and monitoringprefix; see the Witness mode section below.

Security fixes

The home page is now rendered with html/template. It includes the origin lines of the logs configured through witness log lists, which could somewhat plausibly be untrusted. (ANT-2026-GF97X3C4)

The witness no longer stores unverified checkpoint signatures. An attacker could include a fake signature from the witness's own key in a submitted checkpoint. If stored, it would then fail to verify when the witness re-opens the checkpoint with its own verifier, wedging the witness for that log. (ANT-2026-SAPGR4D6)

These vulnerabilities were discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research.

Sunlight

Checkpoints are now cosigned with ML-DSA-44 instead of Ed25519, with a key derived from the same log secret. No configuration changes are needed, and existing logs upgrade without downtime, but downgrading to v0.8.x is not supported once v0.9.0 has produced a checkpoint.

sunlight-keygen now prints the ML-DSA-44 verifier key instead of the Ed25519 public key, the -prefix flag was renamed to -log (the legacy name still works), and the new -json mode produces machine-readable output.

The new certificateprofile: mark option operates a Verified Mark Certificate log, which requires the VMC EKU (1.3.6.1.5.5.7.3.31) instead of serverAuth on submitted certificates. Thank you @​lsautia-godaddy.

The log.v3.json metadata now includes most fields of the "Operator-published CT Log Metadata" proposal: log_spec, mmd_seconds, status, status_timestamp, planned_changes, and the submission and monitoring endpoints. Serving this metadata will be required by Chrome starting November 1, 2026.

The home page is now served at the root of every submission prefix, shows the final tree of sunset logs (thank you @​mcpherrinm), and its title is configurable with the new name option (thank you @​pgporada).

The build version is now exposed in the Prometheus metrics of both Sunlight and Skylight. Thank you @​pgporada.

All commands now shut down cleanly on SIGTERM (as sent by systemd) in addition to SIGINT.

Requests interrupted by a client disconnection are now recorded with status code 499. Thank you @​mcpherrinm.

JSON logs are disabled if stdout is a terminal.

The go.mod specifies Go 1.25.0.

Witness mode

The witness can now also operate as a [c2sp.org/tlog-mirror][tlog-mirror], configured with the new mirrorname and mirrorloglists options, primarily intended for Merkle Tree Certificates issuance logs. [A testing mirroring cosigner running this implementation is available.][mtcs]

The witness now stores its public data (checkpoints, metadata, and mirrored logs) in a dedicated storage backend, configured with the new localdirectory or s3bucket options, and served at the new mandatory monitoringprefix (for example by Skylight). A witness configured without a backend is turned off with a warning.

Witness cosignatures are now produced with both the Ed25519 key and a new ML-DSA-44 key derived from the same secret.

The witness generates witness.v0.json and mirror.v0.json metadata files, including the cosigner ID and verifier keys.

The new /sign-subtree endpoint is implemented.

... (truncated)

Commits

• 0c0003b cmd: gracefully shutdown on SIGTERM
• ae1c67f internal/ctlog: fix TestSequenceLargeLog flakes on slow machines
• e80b328 internal/ctlog: reduce test log spam
• 9890f98 cmd/sunlight,internal/ctlog: add mark certificates profile support
• ae89b27 cmd/skylight,cmd/sunlight: serve home page at all prefixes
• 90348b0 cmd/heliograph-dashboard: add -node-job flag to select node_exporter label
• ad80cac internal/ctlog: make missing ML-DSA signature a warning
• a6369e5 cmd/sunlight-keygen: reject -witness if -log or -prefix are also set
• ec5c7b8 internal/ctlog: record HTTP 499 status code when the client disconnects
• ed0bc38 cmd/sunlight: fix mirror submission prefix
• Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.2

What's Changed

• build: Update module golang.org/x/crypto to v0.52.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2150
• build: Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2141
• build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2152
• git: Worktree: Add stores index entires with backslashes on Windows by @​joshblum in go-git/go-git#2262
• storage: dotgit, reject path traversal in reference names by @​pjbgf in go-git/go-git#2254
• build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2267
• build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2268
• [v5] git: worktree, make the filesystem wrapper a symlink-safe boundary by @​pjbgf in go-git/go-git#2277

Full Changelog: go-git/go-git@v5.19.1...v5.19.2

Commits

• 3eeb238 Merge pull request #2277 from go-git/checkout-v5
• 008a78f git: worktree, make the filesystem wrapper a symlink-safe boundary
• 2263fb5 Merge pull request #2268 from go-git/renovate/releases/v5.x-go-golang.org-x-t...
• 77b7625 build: Update module golang.org/x/text to v0.39.0 [SECURITY]
• 85ea767 Merge pull request #2267 from go-git/renovate/releases/v5.x-go-golang.org-x-n...
• 198675a build: Update module golang.org/x/net to v0.56.0 [SECURITY]
• 4a0e66d Merge pull request #2254 from pjbgf/v5-dotgit-ref-name-containment
• 3b306ef storage: dotgit, align reference-name safety with refname_is_safe
• f3d0cc1 storage: dotgit, reject path traversal in reference names
• 979cfe9 Merge pull request #2262 from joshblum/joshblum/to-slash-v5
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions