Update github.com/go-git/go-git/v5 (indirect) to v5.17.1 [SECURITY] (v14.0/forgejo) #11899

Merged

mfenniak merged 1 commit from renovate/v14.0/forgejo-go-github.com-go-git-go-git-v5-vulnerability into v14.0/forgejo

2026-03-31 00:49:03 +00:00

viceice-bot commented

2026-03-30 21:06:24 +00:00

Member

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-git/go-git/v5	`v5.16.5` → `v5.17.1`

go-git missing validation decoding Index v4 files leads to panic

CVE-2026-33762 / GHSA-gm2x-2g9h-ccm8

More information

Details

Impact

go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing.

This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue.

An attacker able to supply a crafted .git/index file can cause applications using go-git to panic while reading the index. If the application does not recover from panics, this results in process termination, leading to a denial-of-service (DoS) condition.

Exploitation requires the ability to modify or inject a Git index file within the local repository in disk. This typically implies write access to the .git directory.

Patches

Users should upgrade to v5.17.1, or the latest v6 pseudo-version, in order to mitigate this vulnerability.

Credit

go-git maintainers thank @kq5y for finding and reporting this issue privately to the go-git project.

Severity

CVSS Score: 2.8 / 10 (Low)
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

go-git: Maliciously crafted idx file can cause asymmetric memory consumption

CVE-2026-34165 / GHSA-jhf3-xxhw-2wpp

More information

Details

Impact

A vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a Denial of Service (DoS) condition.

Exploitation requires write access to the local repository's .git directory, it order to create or alter existing .idx files.

Patches

Users should upgrade to v5.17.1, or the latest v6 pseudo-version, in order to mitigate this vulnerability.

Credit

The go-git maintainers thank @kq5y for finding and reporting this issue privately to the go-git project.

Severity

CVSS Score: 5.0 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

go-git/go-git (github.com/go-git/go-git/v5)

`v5.17.1`

Compare Source

What's Changed

build: Update module github.com/cloudflare/circl to v1.6.3 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1930
[v5] plumbing: format/index, Improve v4 entry name validation by @pjbgf in #1935
[v5] plumbing: format/idxfile, Fix version and fanout checks by @pjbgf in #1937

Full Changelog: https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1

`v5.17.0`

Compare Source

What's Changed

build: Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1839
git: worktree, optimize infiles function for very large repos by @k-anshul in #1853
git: Add strict checks for supported extensions by @pjbgf in #1861
backport, git: Improve Status() speed with new index.ModTime check by @cedric-appdirect in #1862
storage: filesystem, Avoid overwriting loose obj files by @pjbgf in #1864

Full Changelog: https://github.com/go-git/go-git/compare/v5.16.5...v5.17.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.16.5` → `v5.17.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-git%2fgo-git%2fv5/v5.17.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-git%2fgo-git%2fv5/v5.16.5/v5.17.1?slim=true) | --- ### go-git missing validation decoding Index v4 files leads to panic [CVE-2026-33762](https://nvd.nist.gov/vuln/detail/CVE-2026-33762) / [GHSA-gm2x-2g9h-ccm8](https://github.com/advisories/GHSA-gm2x-2g9h-ccm8) <details> <summary>More information</summary> #### Details ##### Impact `go-git`’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (`go-git` supports only `v2` and `v3`) are not vulnerable to this issue. An attacker able to supply a crafted `.git/index` file can cause applications using go-git to panic while reading the index. If the application does not recover from panics, this results in process termination, leading to a denial-of-service (DoS) condition. Exploitation requires the ability to modify or inject a Git index file within the local repository in disk. This typically implies write access to the `.git` directory. ##### Patches Users should upgrade to `v5.17.1`, or the latest `v6` [pseudo-version](https://go.dev/ref/mod#pseudo-versions), in order to mitigate this vulnerability. ##### Credit go-git maintainers thank @kq5y for finding and reporting this issue privately to the `go-git` project. #### Severity - CVSS Score: 2.8 / 10 (Low) - Vector String: `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L` #### References - [https://github.com/go-git/go-git/security/advisories/GHSA-gm2x-2g9h-ccm8](https://github.com/go-git/go-git/security/advisories/GHSA-gm2x-2g9h-ccm8) - [https://github.com/go-git/go-git](https://github.com/go-git/go-git) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-gm2x-2g9h-ccm8) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### go-git: Maliciously crafted idx file can cause asymmetric memory consumption [CVE-2026-34165](https://nvd.nist.gov/vuln/detail/CVE-2026-34165) / [GHSA-jhf3-xxhw-2wpp](https://github.com/advisories/GHSA-jhf3-xxhw-2wpp) <details> <summary>More information</summary> #### Details ##### Impact A vulnerability has been identified in which a maliciously crafted `.idx` file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a Denial of Service (DoS) condition. Exploitation requires write access to the local repository's `.git` directory, it order to create or alter existing `.idx` files. ##### Patches Users should upgrade to `v5.17.1`, or the latest `v6` [pseudo-version](https://go.dev/ref/mod#pseudo-versions), in order to mitigate this vulnerability. ##### Credit The go-git maintainers thank @kq5y for finding and reporting this issue privately to the `go-git` project. #### Severity - CVSS Score: 5.0 / 10 (Medium) - Vector String: `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H` #### References - [https://github.com/go-git/go-git/security/advisories/GHSA-jhf3-xxhw-2wpp](https://github.com/go-git/go-git/security/advisories/GHSA-jhf3-xxhw-2wpp) - [https://github.com/go-git/go-git](https://github.com/go-git/go-git) - [https://github.com/go-git/go-git/releases/tag/v5.17.1](https://github.com/go-git/go-git/releases/tag/v5.17.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jhf3-xxhw-2wpp) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.17.1`](https://github.com/go-git/go-git/releases/tag/v5.17.1) [Compare Source](https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1) #### What's Changed - build: Update module github.com/cloudflare/circl to v1.6.3 \[SECURITY] (releases/v5.x) by [@go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#1930](https://github.com/go-git/go-git/pull/1930) - \[v5] plumbing: format/index, Improve v4 entry name validation by [@pjbgf](https://github.com/pjbgf) in [#1935](https://github.com/go-git/go-git/pull/1935) - \[v5] plumbing: format/idxfile, Fix version and fanout checks by [@pjbgf](https://github.com/pjbgf) in [#1937](https://github.com/go-git/go-git/pull/1937) **Full Changelog**: <https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1> ### [`v5.17.0`](https://github.com/go-git/go-git/releases/tag/v5.17.0) [Compare Source](https://github.com/go-git/go-git/compare/v5.16.5...v5.17.0) #### What's Changed - build: Update module github.com/go-git/go-git/v5 to v5.16.5 \[SECURITY] (releases/v5.x) by [@go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#1839](https://github.com/go-git/go-git/pull/1839) - git: worktree, optimize infiles function for very large repos by [@k-anshul](https://github.com/k-anshul) in [#1853](https://github.com/go-git/go-git/pull/1853) - git: Add strict checks for supported extensions by [@pjbgf](https://github.com/pjbgf) in [#1861](https://github.com/go-git/go-git/pull/1861) - backport, git: Improve Status() speed with new index.ModTime check by [@cedric-appdirect](https://github.com/cedric-appdirect) in [#1862](https://github.com/go-git/go-git/pull/1862) - storage: filesystem, Avoid overwriting loose obj files by [@pjbgf](https://github.com/pjbgf) in [#1864](https://github.com/go-git/go-git/pull/1864) **Full Changelog**: <https://github.com/go-git/go-git/compare/v5.16.5...v5.17.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

viceice-bot added the

test

not-needed

dependency-upgrade

labels

2026-03-30 21:06:24 +00:00

viceice-bot added 1 commit

2026-03-30 21:06:24 +00:00

Update github.com/go-git/go-git/v5 (indirect) to v5.17.1 [SECURITY]

issue-labels / release-notes (pull_request_target) Has been skipped

Details

issue-labels / cascade (pull_request_target) Has been skipped

Details

requirements / merge-conditions (pull_request) Successful in 7s

Details

testing / frontend-checks (pull_request) Successful in 1m54s

Details

testing / backend-checks (pull_request) Successful in 7m8s

Details

testing / test-unit (pull_request) Successful in 9m31s

Details

testing / test-e2e (pull_request) Successful in 29m2s

Details

testing / test-mysql (pull_request) Successful in 29m21s

Details

testing / test-remote-cacher (redis) (pull_request) Successful in 3m2s

Details

testing / test-remote-cacher (valkey) (pull_request) Successful in 3m17s

Details

testing / test-remote-cacher (garnet) (pull_request) Successful in 3m11s

Details

testing / test-remote-cacher (redict) (pull_request) Successful in 3m20s

Details

testing / test-sqlite (pull_request) Successful in 35m57s

Details

testing / test-pgsql (pull_request) Successful in 42m4s

Details

testing / security-check (pull_request) Successful in 2m26s

Details

issue-labels / backporting (pull_request_target) Has been skipped

Details

milestone / set (pull_request_target) Successful in 9s

Details

0eea81ae3e

viceice-bot requested review from Reviewers

2026-03-30 21:06:29 +00:00

viceice-bot commented

2026-03-30 21:06:30 +00:00

Author

Member

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

1 additional dependency was updated

Details:

Package	Change
`github.com/go-git/go-billy/v5`	`v5.6.2` -> `v5.8.0`

### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - 1 additional dependency was updated Details: | **Package** | **Change** | | :------------------------------ | :------------------- | | `github.com/go-git/go-billy/v5` | `v5.6.2` -> `v5.8.0` |

mfenniak approved these changes

2026-03-31 00:48:35 +00:00

mfenniak left a comment

The only usage of go-git in Forgejo is the Actions jobparser using it in hashFiles to understand gitignore, so this change is irrelevant -- but to avoid any security doubts it's fine to incorporate.

The only usage of go-git in Forgejo is the Actions jobparser using it in `hashFiles` to understand gitignore, so this change is irrelevant -- but to avoid any security doubts it's fine to incorporate.

mfenniak merged commit 206224aff5 into v14.0/forgejo

2026-03-31 00:49:03 +00:00

mfenniak referenced this pull request from a commit

2026-03-31 00:49:06 +00:00

Update github.com/go-git/go-git/v5 (indirect) to v5.17.1 [SECURITY] (v14.0/forgejo) (#11899)

mfenniak deleted branch renovate/v14.0/forgejo-go-github.com-go-git-go-git-v5-vulnerability

2026-03-31 00:49:13 +00:00