The version of go-git that rb-gateway was using had a couple recent security notices for critical issues. While it's unlikely that people are using rb-gateway against potentially maliciously crafted Git servers, the impact is bad enough that it's worth upgrading. The only change that appears to have been necessary beyond the dependency bump was updating the tests to explicitly allow creating empty commits. Testing Done: Ran unit tests.