The version of go-git that rb-gateway was using had a couple recent

security notices for critical issues. While it's unlikely that people

are using rb-gateway against potentially maliciously crafted Git

servers, the impact is bad enough that it's worth upgrading.
The only change that appears to have been necessary beyond the

dependency bump was updating the tests to explicitly allow creating

empty commits.

Ran all tests.