build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (releases/v5.x) by go-git-renovate[bot] · Pull Request #1941 · go-git/go-git

go-git-renovate · 2026-03-31T06:17:55Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-git/go-git/v5	`v5.16.5` → `v5.17.1`

go-git: Maliciously crafted idx file can cause asymmetric memory consumption

CVE-2026-34165 / GHSA-jhf3-xxhw-2wpp

More information

Details

Impact

A vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a Denial of Service (DoS) condition.

Exploitation requires write access to the local repository's .git directory, it order to create or alter existing .idx files.

Patches

Users should upgrade to v5.17.1, or the latest v6 pseudo-version, in order to mitigate this vulnerability.

Credit

The go-git maintainers thank @kq5y for finding and reporting this issue privately to the go-git project.

Severity

CVSS Score: 5.0 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

go-git missing validation decoding Index v4 files leads to panic

CVE-2026-33762 / GHSA-gm2x-2g9h-ccm8

More information

Details

Impact

go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing.

This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue.

An attacker able to supply a crafted .git/index file can cause applications using go-git to panic while reading the index. If the application does not recover from panics, this results in process termination, leading to a denial-of-service (DoS) condition.

Exploitation requires the ability to modify or inject a Git index file within the local repository in disk. This typically implies write access to the .git directory.

Patches

Users should upgrade to v5.17.1, or the latest v6 pseudo-version, in order to mitigate this vulnerability.

Credit

go-git maintainers thank @kq5y for finding and reporting this issue privately to the go-git project.

Severity

CVSS Score: 2.8 / 10 (Low)
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

go-git/go-git (github.com/go-git/go-git/v5)

`v5.17.1`

Compare Source

What's Changed

build: Update module github.com/cloudflare/circl to v1.6.3 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1930
[v5] plumbing: format/index, Improve v4 entry name validation by @pjbgf in #1935
[v5] plumbing: format/idxfile, Fix version and fanout checks by @pjbgf in #1937

Full Changelog: v5.17.0...v5.17.1

`v5.17.0`

Compare Source

What's Changed

build: Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1839
git: worktree, optimize infiles function for very large repos by @k-anshul in #1853
git: Add strict checks for supported extensions by @pjbgf in #1861
backport, git: Improve Status() speed with new index.ModTime check by @cedric-appdirect in #1862
storage: filesystem, Avoid overwriting loose obj files by @pjbgf in #1864

Full Changelog: v5.16.5...v5.17.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

go-git-renovate · 2026-03-31T06:17:57Z

ℹ️ Artifact update notice

File name: cli/go-git/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

1 additional dependency was updated

Details:

Package	Change
`github.com/go-git/go-billy/v5`	`v5.6.2` -> `v5.8.0`

This PR contains the following updates: | Package | Type | Update | Change | OpenSSF | |---|---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | require | patch | `v5.17.1` → `v5.17.2` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/go-git/go-git/badge)](https://securityscorecards.dev/viewer/?uri=github.com/go-git/go-git) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/23) for more information. --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.17.2`](https://github.com/go-git/go-git/releases/tag/v5.17.2) [Compare Source](go-git/go-git@v5.17.1...v5.17.2) #### What's Changed - build: Update module github.com/go-git/go-git/v5 to v5.17.1 \[SECURITY] (releases/v5.x) by [@go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#1941](go-git/go-git#1941) - dotgit: skip writing pack files that already exist on disk by [@pjbgf](https://github.com/pjbgf) in [#1944](go-git/go-git#1944) :warning: This release fixes a bug ([#1942](go-git/go-git#1942)) that blocked some users from upgrading to `v5.17.1`. Thanks [@pskrbasu](https://github.com/pskrbasu) for reporting it. 🙇 **Full Changelog**: <go-git/go-git@v5.17.1...v5.17.2> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday ( * 0-4,22-23 * * 1-5 ), Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://altlinux.space/stapler/stplr/pulls/385 Co-authored-by: Renovate Bot <stapler-helper-bot@noreply.altlinux.space> Co-committed-by: Renovate Bot <stapler-helper-bot@noreply.altlinux.space>

…forgejo) (#12174) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.17.1` → `v5.18.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-git%2fgo-git%2fv5/v5.18.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-git%2fgo-git%2fv5/v5.17.1/v5.18.0?slim=true) | --- ### go-git: Credential leak via cross-host redirect in smart HTTP transport [GHSA-3xc5-wrhm-f963](GHSA-3xc5-wrhm-f963) <details> <summary>More information</summary> #### Details ##### Impact `go-git` may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. If a remote repository responds to the initial `/info/refs` request with a redirect to a different host, go-git updates the session endpoint to the redirected location and reuses the original authentication for subsequent requests. This can result in the credentials (e.g. Authorization headers) being sent to an unintended host. An attacker controlling or influencing the redirect target can capture these credentials and potentially reuse them to access the victim’s repositories or other resources, depending on the scope of the credential. **Clients using `go-git` exclusively with trusted remotes (for example, GitHub or GitLab), and over a secure HTTPS connection, are not affected by this issue.** The risk arises when interacting with untrusted or misconfigured Git servers, or when using unsecured HTTP connections, which is not recommended. Such configurations also expose clients to a broader class of security risks beyond this issue, including credential interception and tampering of repository data. ##### Patches Users should upgrade to `v5.18.0`, or `v6.0.0-alpha.2`, in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported `go-git` version. The patched versions add support for configuring [followRedirects](https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpfollowRedirects). In line with upstream behaviour, the default is now `initial`, while users can opt into `FollowRedirects` or `NoFollowRedirects` programmatically. ##### Credit Thanks to the 3 separate reports from @celinke97, @N0zoM1z0 and @AyushParkara. Thanks for finding and reporting this issue privately to the `go-git` project. 🙇 #### Severity - CVSS Score: 4.7 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N` #### References - [https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963](https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963) - [https://github.com/go-git/go-git](https://github.com/go-git/go-git) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-3xc5-wrhm-f963) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.18.0`](https://github.com/go-git/go-git/releases/tag/v5.18.0) [Compare Source](go-git/go-git@v5.17.2...v5.18.0) #### What's Changed - plumbing: transport/http, Add support for followRedirects policy by [@pjbgf](https://github.com/pjbgf) in [#2004](go-git/go-git#2004) **Full Changelog**: <go-git/go-git@v5.17.2...v5.18.0> ### [`v5.17.2`](https://github.com/go-git/go-git/releases/tag/v5.17.2) [Compare Source](go-git/go-git@v5.17.1...v5.17.2) #### What's Changed - build: Update module github.com/go-git/go-git/v5 to v5.17.1 \[SECURITY] (releases/v5.x) by [@go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#1941](go-git/go-git#1941) - dotgit: skip writing pack files that already exist on disk by [@pjbgf](https://github.com/pjbgf) in [#1944](go-git/go-git#1944) :warning: This release fixes a bug ([#1942](go-git/go-git#1942)) that blocked some users from upgrading to `v5.17.1`. Thanks [@pskrbasu](https://github.com/pskrbasu) for reporting it. 🙇 **Full Changelog**: <go-git/go-git@v5.17.1...v5.17.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12174 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> Co-authored-by: Renovate Bot <bot@kriese.eu> Co-committed-by: Renovate Bot <bot@kriese.eu>

…v15.0/forgejo) (#12177) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.17.1` → `v5.18.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-git%2fgo-git%2fv5/v5.18.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-git%2fgo-git%2fv5/v5.17.1/v5.18.0?slim=true) | --- ### go-git: Credential leak via cross-host redirect in smart HTTP transport [GHSA-3xc5-wrhm-f963](GHSA-3xc5-wrhm-f963) <details> <summary>More information</summary> #### Details ##### Impact `go-git` may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. If a remote repository responds to the initial `/info/refs` request with a redirect to a different host, go-git updates the session endpoint to the redirected location and reuses the original authentication for subsequent requests. This can result in the credentials (e.g. Authorization headers) being sent to an unintended host. An attacker controlling or influencing the redirect target can capture these credentials and potentially reuse them to access the victim’s repositories or other resources, depending on the scope of the credential. **Clients using `go-git` exclusively with trusted remotes (for example, GitHub or GitLab), and over a secure HTTPS connection, are not affected by this issue.** The risk arises when interacting with untrusted or misconfigured Git servers, or when using unsecured HTTP connections, which is not recommended. Such configurations also expose clients to a broader class of security risks beyond this issue, including credential interception and tampering of repository data. ##### Patches Users should upgrade to `v5.18.0`, or `v6.0.0-alpha.2`, in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported `go-git` version. The patched versions add support for configuring [followRedirects](https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpfollowRedirects). In line with upstream behaviour, the default is now `initial`, while users can opt into `FollowRedirects` or `NoFollowRedirects` programmatically. ##### Credit Thanks to the 3 separate reports from @celinke97, @N0zoM1z0 and @AyushParkara. Thanks for finding and reporting this issue privately to the `go-git` project. 🙇 #### Severity - CVSS Score: 4.7 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N` #### References - [https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963](https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963) - [https://github.com/go-git/go-git](https://github.com/go-git/go-git) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-3xc5-wrhm-f963) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.18.0`](https://github.com/go-git/go-git/releases/tag/v5.18.0) [Compare Source](go-git/go-git@v5.17.2...v5.18.0) #### What's Changed - plumbing: transport/http, Add support for followRedirects policy by [@pjbgf](https://github.com/pjbgf) in [#2004](go-git/go-git#2004) **Full Changelog**: <go-git/go-git@v5.17.2...v5.18.0> ### [`v5.17.2`](https://github.com/go-git/go-git/releases/tag/v5.17.2) [Compare Source](go-git/go-git@v5.17.1...v5.17.2) #### What's Changed - build: Update module github.com/go-git/go-git/v5 to v5.17.1 \[SECURITY] (releases/v5.x) by [@go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#1941](go-git/go-git#1941) - dotgit: skip writing pack files that already exist on disk by [@pjbgf](https://github.com/pjbgf) in [#1944](go-git/go-git#1944) :warning: This release fixes a bug ([#1942](go-git/go-git#1942)) that blocked some users from upgrading to `v5.17.1`. Thanks [@pskrbasu](https://github.com/pskrbasu) for reporting it. 🙇 **Full Changelog**: <go-git/go-git@v5.17.1...v5.17.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12177 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> Co-authored-by: Renovate Bot <bot@kriese.eu> Co-committed-by: Renovate Bot <bot@kriese.eu>

…0/forgejo) (#12175) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.17.1` → `v5.18.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-git%2fgo-git%2fv5/v5.18.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-git%2fgo-git%2fv5/v5.17.1/v5.18.0?slim=true) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2779) for more information. --- ### go-git: Credential leak via cross-host redirect in smart HTTP transport [GHSA-3xc5-wrhm-f963](GHSA-3xc5-wrhm-f963) <details> <summary>More information</summary> #### Details ##### Impact `go-git` may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. If a remote repository responds to the initial `/info/refs` request with a redirect to a different host, go-git updates the session endpoint to the redirected location and reuses the original authentication for subsequent requests. This can result in the credentials (e.g. Authorization headers) being sent to an unintended host. An attacker controlling or influencing the redirect target can capture these credentials and potentially reuse them to access the victim’s repositories or other resources, depending on the scope of the credential. **Clients using `go-git` exclusively with trusted remotes (for example, GitHub or GitLab), and over a secure HTTPS connection, are not affected by this issue.** The risk arises when interacting with untrusted or misconfigured Git servers, or when using unsecured HTTP connections, which is not recommended. Such configurations also expose clients to a broader class of security risks beyond this issue, including credential interception and tampering of repository data. ##### Patches Users should upgrade to `v5.18.0`, or `v6.0.0-alpha.2`, in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported `go-git` version. The patched versions add support for configuring [followRedirects](https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpfollowRedirects). In line with upstream behaviour, the default is now `initial`, while users can opt into `FollowRedirects` or `NoFollowRedirects` programmatically. ##### Credit Thanks to the 3 separate reports from @celinke97, @N0zoM1z0 and @AyushParkara. Thanks for finding and reporting this issue privately to the `go-git` project. 🙇 #### Severity - CVSS Score: 4.7 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N` #### References - [https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963](https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963) - [https://github.com/go-git/go-git](https://github.com/go-git/go-git) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-3xc5-wrhm-f963) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.18.0`](https://github.com/go-git/go-git/releases/tag/v5.18.0) [Compare Source](go-git/go-git@v5.17.2...v5.18.0) #### What's Changed - plumbing: transport/http, Add support for followRedirects policy by [@pjbgf](https://github.com/pjbgf) in [#2004](go-git/go-git#2004) **Full Changelog**: <go-git/go-git@v5.17.2...v5.18.0> ### [`v5.17.2`](https://github.com/go-git/go-git/releases/tag/v5.17.2) [Compare Source](go-git/go-git@v5.17.1...v5.17.2) #### What's Changed - build: Update module github.com/go-git/go-git/v5 to v5.17.1 \[SECURITY] (releases/v5.x) by [@go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#1941](go-git/go-git#1941) - dotgit: skip writing pack files that already exist on disk by [@pjbgf](https://github.com/pjbgf) in [#1944](go-git/go-git#1944) :warning: This release fixes a bug ([#1942](go-git/go-git#1942)) that blocked some users from upgrading to `v5.17.1`. Thanks [@pskrbasu](https://github.com/pskrbasu) for reporting it. 🙇 **Full Changelog**: <go-git/go-git@v5.17.1...v5.17.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12175 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> Co-authored-by: Renovate Bot <bot@kriese.eu> Co-committed-by: Renovate Bot <bot@kriese.eu>

…v14.0/forgejo) (#12176) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.17.1` → `v5.18.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-git%2fgo-git%2fv5/v5.18.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-git%2fgo-git%2fv5/v5.17.1/v5.18.0?slim=true) | --- ### go-git: Credential leak via cross-host redirect in smart HTTP transport [GHSA-3xc5-wrhm-f963](GHSA-3xc5-wrhm-f963) <details> <summary>More information</summary> #### Details ##### Impact `go-git` may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. If a remote repository responds to the initial `/info/refs` request with a redirect to a different host, go-git updates the session endpoint to the redirected location and reuses the original authentication for subsequent requests. This can result in the credentials (e.g. Authorization headers) being sent to an unintended host. An attacker controlling or influencing the redirect target can capture these credentials and potentially reuse them to access the victim’s repositories or other resources, depending on the scope of the credential. **Clients using `go-git` exclusively with trusted remotes (for example, GitHub or GitLab), and over a secure HTTPS connection, are not affected by this issue.** The risk arises when interacting with untrusted or misconfigured Git servers, or when using unsecured HTTP connections, which is not recommended. Such configurations also expose clients to a broader class of security risks beyond this issue, including credential interception and tampering of repository data. ##### Patches Users should upgrade to `v5.18.0`, or `v6.0.0-alpha.2`, in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported `go-git` version. The patched versions add support for configuring [followRedirects](https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpfollowRedirects). In line with upstream behaviour, the default is now `initial`, while users can opt into `FollowRedirects` or `NoFollowRedirects` programmatically. ##### Credit Thanks to the 3 separate reports from @celinke97, @N0zoM1z0 and @AyushParkara. Thanks for finding and reporting this issue privately to the `go-git` project. 🙇 #### Severity - CVSS Score: 4.7 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N` #### References - [https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963](https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963) - [https://github.com/go-git/go-git](https://github.com/go-git/go-git) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-3xc5-wrhm-f963) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.18.0`](https://github.com/go-git/go-git/releases/tag/v5.18.0) [Compare Source](go-git/go-git@v5.17.2...v5.18.0) #### What's Changed - plumbing: transport/http, Add support for followRedirects policy by [@pjbgf](https://github.com/pjbgf) in [#2004](go-git/go-git#2004) **Full Changelog**: <go-git/go-git@v5.17.2...v5.18.0> ### [`v5.17.2`](https://github.com/go-git/go-git/releases/tag/v5.17.2) [Compare Source](go-git/go-git@v5.17.1...v5.17.2) #### What's Changed - build: Update module github.com/go-git/go-git/v5 to v5.17.1 \[SECURITY] (releases/v5.x) by [@go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#1941](go-git/go-git#1941) - dotgit: skip writing pack files that already exist on disk by [@pjbgf](https://github.com/pjbgf) in [#1944](go-git/go-git#1944) :warning: This release fixes a bug ([#1942](go-git/go-git#1942)) that blocked some users from upgrading to `v5.17.1`. Thanks [@pskrbasu](https://github.com/pskrbasu) for reporting it. 🙇 **Full Changelog**: <go-git/go-git@v5.17.1...v5.17.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12176 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> Co-authored-by: Renovate Bot <bot@kriese.eu> Co-committed-by: Renovate Bot <bot@kriese.eu>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.17.1` → `v5.18.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-git%2fgo-git%2fv5/v5.18.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-git%2fgo-git%2fv5/v5.17.1/v5.18.0?slim=true) | --- ### go-git: Credential leak via cross-host redirect in smart HTTP transport [GHSA-3xc5-wrhm-f963](GHSA-3xc5-wrhm-f963) <details> <summary>More information</summary> #### Details ##### Impact `go-git` may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. If a remote repository responds to the initial `/info/refs` request with a redirect to a different host, go-git updates the session endpoint to the redirected location and reuses the original authentication for subsequent requests. This can result in the credentials (e.g. Authorization headers) being sent to an unintended host. An attacker controlling or influencing the redirect target can capture these credentials and potentially reuse them to access the victim’s repositories or other resources, depending on the scope of the credential. **Clients using `go-git` exclusively with trusted remotes (for example, GitHub or GitLab), and over a secure HTTPS connection, are not affected by this issue.** The risk arises when interacting with untrusted or misconfigured Git servers, or when using unsecured HTTP connections, which is not recommended. Such configurations also expose clients to a broader class of security risks beyond this issue, including credential interception and tampering of repository data. ##### Patches Users should upgrade to `v5.18.0`, or `v6.0.0-alpha.2`, in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported `go-git` version. The patched versions add support for configuring [followRedirects](https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpfollowRedirects). In line with upstream behaviour, the default is now `initial`, while users can opt into `FollowRedirects` or `NoFollowRedirects` programmatically. ##### Credit Thanks to the 3 separate reports from @celinke97, @N0zoM1z0 and @AyushParkara. Thanks for finding and reporting this issue privately to the `go-git` project. 🙇 #### Severity - CVSS Score: 4.7 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N` #### References - [https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963](https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963) - [https://github.com/go-git/go-git](https://github.com/go-git/go-git) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-3xc5-wrhm-f963) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.18.0`](https://github.com/go-git/go-git/releases/tag/v5.18.0) [Compare Source](go-git/go-git@v5.17.2...v5.18.0) #### What's Changed - plumbing: transport/http, Add support for followRedirects policy by [@pjbgf](https://github.com/pjbgf) in [#2004](go-git/go-git#2004) **Full Changelog**: <go-git/go-git@v5.17.2...v5.18.0> ### [`v5.17.2`](https://github.com/go-git/go-git/releases/tag/v5.17.2) [Compare Source](go-git/go-git@v5.17.1...v5.17.2) #### What's Changed - build: Update module github.com/go-git/go-git/v5 to v5.17.1 \[SECURITY] (releases/v5.x) by [@go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#1941](go-git/go-git#1941) - dotgit: skip writing pack files that already exist on disk by [@pjbgf](https://github.com/pjbgf) in [#1944](go-git/go-git#1944) :warning: This release fixes a bug ([#1942](go-git/go-git#1942)) that blocked some users from upgrading to `v5.17.1`. Thanks [@pskrbasu](https://github.com/pskrbasu) for reporting it. 🙇 **Full Changelog**: <go-git/go-git@v5.17.1...v5.17.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1485 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.code.forgejo.org>

build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY]

ebb2d7d

go-git-renovate Bot added the dependencies Pull requests that update a dependency file label Mar 31, 2026

pjbgf approved these changes Mar 31, 2026

View reviewed changes

pjbgf merged commit 2212dc7 into releases/v5.x Mar 31, 2026
14 checks passed

pjbgf deleted the renovate/releases/v5.x-go-github.com-go-git-go-git-v5-vulnerability branch March 31, 2026 09:59

campaigner-prod Bot mentioned this pull request Apr 23, 2026

fix(deps): vuln minor upgrades — 15 packages (minor: 7 · patch: 8) DataDog/vault#87

Closed

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (releases/v5.x)#1941

build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (releases/v5.x)#1941
pjbgf merged 1 commit intoreleases/v5.xfrom
renovate/releases/v5.x-go-github.com-go-git-go-git-v5-vulnerability

go-git-renovate Bot commented Mar 31, 2026

Uh oh!

go-git-renovate Bot commented Mar 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

go-git-renovate Bot commented Mar 31, 2026

go-git: Maliciously crafted idx file can cause asymmetric memory consumption

Details

Impact

Patches

Credit

Severity

References

go-git missing validation decoding Index v4 files leads to panic

Details

Impact

Patches

Credit

Severity

References

Release Notes

v5.17.1

What's Changed

v5.17.0

What's Changed

Configuration

Uh oh!

go-git-renovate Bot commented Mar 31, 2026

ℹ️ Artifact update notice

File name: cli/go-git/go.mod

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`v5.17.1`

`v5.17.0`