….com-go-git-go-git-v5-vulnerability

build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (releases/v5.x)

…t on disk

PackWriter.save() used fs.Create() unconditionally for .idx and .pack
files. After the first write, fixPermissions() sets these to read-only
(0o444), so a subsequent fetch/pull producing the same pack hash would
fail with "permission denied" when Create() tried to truncate the
existing read-only file.

Each file (.idx, .pack, .rev) is now checked individually with Lstat
before creation — if it already exists, the write is skipped. This
mirrors the existing pattern in ObjectWriter.save() for loose objects.

Also switches ObjectWriter.save() from Stat to Lstat for consistency.

Signed-off-by: Paulo Gomes <paulo@entire.io>
Assisted-by: Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 98ea9828f0ce

dotgit: skip writing pack files that already exist on disk

Back-port from #1997.

Signed-off-by: Paulo Gomes <paulo@entire.io>

plumbing: transport/http, Add support for followRedirects policy