{"id":3635748,"name":"github.com/go-git/go-git/v5","ecosystem":"go","description":"A highly extensible git implementation in pure Go.","homepage":"https://github.com/go-git/go-git","licenses":"Apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/go-git/go-git","keywords_array":[],"namespace":"github.com/go-git/go-git","versions_count":39,"first_release_published_at":"2020-03-15T20:18:32.000Z","latest_release_published_at":"2026-10-04T13:39:40.000Z","latest_release_number":"v5.19.3","last_synced_at":"2026-10-15T07:19:25.636Z","created_at":"2022-04-11T08:41:25.430Z","updated_at":"2026-10-15T07:19:25.636Z","registry_url":"https://pkg.go.dev/github.com/go-git/go-git/v5","install_command":"go get github.com/go-git/go-git/v5","documentation_url":"https://pkg.go.dev/github.com/go-git/go-git/v5#section-documentation","metadata":null,"repo_metadata":{"id":37359492,"uuid":"229030654","full_name":"go-git/go-git","owner":"go-git","description":"A highly extensible Git implementation in pure Go.","archived":false,"fork":false,"pushed_at":"2026-10-09T07:33:45.000Z","size":10961,"stargazers_count":7790,"open_issues_count":258,"forks_count":1054,"subscribers_count":44,"default_branch":"main","last_synced_at":"2026-10-09T10:16:12.853Z","etag":null,"topics":["git","git-client","git-library","git-server","go-git","golang"],"latest_commit_sha":null,"homepage":"https://pkg.go.dev/github.com/go-git/go-git/v6","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/go-git.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","claude":null,"gemini":null,"cursor":null,"copilot":".github/copilot-instructions.md","dco":null,"cla":null,"disclosure":null}},"created_at":"2019-12-19T10:27:02.000Z","updated_at":"2026-10-09T07:33:47.000Z","dependencies_parsed_at":"2026-10-09T06:41:18.536Z","dependency_job_id":null,"html_url":"https://github.com/go-git/go-git","commit_stats":{"total_commits":1612,"total_committers":281,"mean_commits":5.736654804270462,"dds":0.7295285359801489,"last_synced_commit":"9d9aa3689f31b24e14c2a48ae579a3513e58b4de"},"previous_names":[],"tags_count":98,"template":false,"template_full_name":null,"purl":"pkg:github/go-git/go-git","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/go-git","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/sbom","scorecard":{"id":431831,"data":{"date":"2025-08-11","repo":{"name":"github.com/go-git/go-git","commit":"6aaf1933ecab8f057fcc3cd37f0a311f2c9065bc"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":8.7,"checks":[{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":1,"reason":"dependency not pinned by hash detected -- score normalized to 1","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/cifuzz.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/go-git/go-git/cifuzz.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cifuzz.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/go-git/go-git/cifuzz.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cifuzz.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/go-git/go-git/cifuzz.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cifuzz.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/go-git/go-git/cifuzz.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/git.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/go-git/go-git/git.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/git.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/go-git/go-git/git.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/pr-validation.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/go-git/go-git/pr-validation.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/stale-issues-bot.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/go-git/go-git/stale-issues-bot.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/go-git/go-git/test.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/go-git/go-git/test.yml/main?enable=pin","Info:   3 out of  10 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   3 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Token-Permissions","score":10,"reason":"GitHub workflow tokens follow principle of least privilege","details":["Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:20","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:21","Info: jobLevel 'contents' permission set to 'read': .github/workflows/git.yml:25","Info: jobLevel 'contents' permission set to 'read': .github/workflows/pr-validation.yml:18","Info: jobLevel 'contents' permission set to 'read': .github/workflows/test.yml:21","Info: found token with 'none' permissions: .github/workflows/cifuzz.yml:1","Info: found token with 'none' permissions: .github/workflows/codeql.yml:1","Info: found token with 'none' permissions: .github/workflows/git.yml:1","Info: found token with 'none' permissions: .github/workflows/pr-validation.yml:1","Info: found token with 'none' permissions: .github/workflows/stale-issues-bot.yaml:1","Info: found token with 'none' permissions: .github/workflows/test.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Fuzzing","score":10,"reason":"project is fuzzed","details":["Info: OSSFuzz integration found","Info: GoBuiltInFuzzer integration found: internal/revision/parser_test.go:406","Info: GoBuiltInFuzzer integration found: plumbing/format/config/decoder_test.go:114","Info: GoBuiltInFuzzer integration found: plumbing/format/packfile/delta_test.go:184","Info: GoBuiltInFuzzer integration found: plumbing/object/signature_test.go:195","Info: GoBuiltInFuzzer integration found: plumbing/transport/transport_test.go:147"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":6,"reason":"branch protection is not maximal on development and all release branches","details":["Info: 'allow deletion' disabled on branch 'main'","Info: 'allow deletion' disabled on branch 'releases/v5.x'","Info: 'force pushes' disabled on branch 'main'","Info: 'force pushes' disabled on branch 'releases/v5.x'","Warn: 'branch protection settings apply to administrators' is disabled on branch 'main'","Warn: 'branch protection settings apply to administrators' is disabled on branch 'releases/v5.x'","Info: 'stale review dismissal' is required to merge on branch 'main'","Info: 'stale review dismissal' is required to merge on branch 'releases/v5.x'","Warn: required approving review count is 1 on branch 'main'","Warn: required approving review count is 1 on branch 'releases/v5.x'","Warn: codeowners review is not required on branch 'main'","Warn: codeowners review is not required on branch 'releases/v5.x'","Info: 'last push approval' is required to merge on branch 'main'","Info: 'last push approval' is required to merge on branch 'releases/v5.x'","Warn: no status checks found to merge onto branch 'main'","Warn: no status checks found to merge onto branch 'releases/v5.x'","Info: PRs are required in order to make changes on branch 'main'","Info: PRs are required in order to make changes on branch 'releases/v5.x'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":9,"reason":"SAST tool detected but not run on all commits","details":["Info: SAST configuration detected: CodeQL","Warn: 29 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-19T03:33:04.438Z","repository_id":37359492,"created_at":"2025-08-19T03:33:04.438Z","updated_at":"2025-08-19T03:33:04.438Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":343680568,"owners_count":38144101,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-09T02:00:07.585Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"go-git","name":"go-git","uuid":"57653224","kind":"organization","description":"A highly extensible Git implementation in pure Go.","email":null,"website":null,"location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/57653224?v=4","repositories_count":9,"last_synced_at":"2026-10-09T10:16:38.254Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/go-git","funding_links":[],"total_stars":8241,"followers":92,"following":0,"created_at":"2022-11-15T00:42:35.065Z","updated_at":"2026-10-09T10:16:38.283Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/go-git","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/go-git/repositories"},"tags":[{"name":"v5.19.3","sha":"bdae57cc427f94a6f7c627201bfe14508b5e19bd","kind":"commit","published_at":"2026-10-04T13:39:40.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.19.3","html_url":"https://github.com/go-git/go-git/releases/tag/v5.19.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.19.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.19.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.19.3/manifests"},{"name":"v6.0.0-beta.1","sha":"6be1dea3298d6a079f2e2e17dbdcea2a1b30c120","kind":"commit","published_at":"2026-10-04T12:09:27.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v6.0.0-beta.1","html_url":"https://github.com/go-git/go-git/releases/tag/v6.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v6.0.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v6.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v6.0.0-beta.1/manifests"},{"name":"v6.0.0-alpha.5","sha":"fc18716c90bcd8e8c935742431e26e260ab7ef60","kind":"commit","published_at":"2026-07-29T09:01:20.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v6.0.0-alpha.5","html_url":"https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v6.0.0-alpha.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v6.0.0-alpha.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v6.0.0-alpha.5/manifests"},{"name":"v5.19.2","sha":"3eeb238da61eb9c7a324f3ee04f990ce89175642","kind":"commit","published_at":"2026-07-29T09:01:16.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.19.2","html_url":"https://github.com/go-git/go-git/releases/tag/v5.19.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.19.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.19.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.19.2/manifests"},{"name":"v5.19.1","sha":"3c3be601aa6c0fd0d536c0d1e4f898b4c60e65fe","kind":"commit","published_at":"2026-05-18T20:10:55.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.19.1","html_url":"https://github.com/go-git/go-git/releases/tag/v5.19.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.19.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.19.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.19.1/manifests"},{"name":"v6.0.0-alpha.4","sha":"d9a69831082341eab799c062e10ad28b3204c08a","kind":"commit","published_at":"2026-05-18T13:59:25.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v6.0.0-alpha.4","html_url":"https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v6.0.0-alpha.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v6.0.0-alpha.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v6.0.0-alpha.4/manifests"},{"name":"v6.0.0-alpha.3","sha":"c4e48f81a870ba54402cc6f3fdef8efbecd563fc","kind":"commit","published_at":"2026-05-06T15:08:24.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v6.0.0-alpha.3","html_url":"https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v6.0.0-alpha.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v6.0.0-alpha.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v6.0.0-alpha.3/manifests"},{"name":"v5.19.0","sha":"bc930f4cbe095a3e1d49273655f73fcef7d41a42","kind":"commit","published_at":"2026-05-06T14:56:44.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.19.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.19.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.19.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.19.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.19.0/manifests"},{"name":"v5.18.0","sha":"ea3e7ec9dfc54f577a01afb4dd601c0284604264","kind":"commit","published_at":"2026-04-16T21:27:33.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.18.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.18.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.18.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.18.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.18.0/manifests"},{"name":"v6.0.0-alpha.2","sha":"137874facf9259abed21263b16fae92bae3b4f21","kind":"commit","published_at":"2026-04-16T20:39:29.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v6.0.0-alpha.2","html_url":"https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v6.0.0-alpha.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v6.0.0-alpha.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v6.0.0-alpha.2/manifests"},{"name":"v6.0.0-alpha.1","sha":"5c776e15a11be5d2dfc6df27692bf867a69c37d8","kind":"commit","published_at":"2026-04-01T21:50:00.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v6.0.0-alpha.1","html_url":"https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v6.0.0-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v6.0.0-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v6.0.0-alpha.1/manifests"},{"name":"v5.17.2","sha":"45ae193b3a60aa8ec8a3e373f7265a7819473d5f","kind":"commit","published_at":"2026-03-31T12:44:26.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.17.2","html_url":"https://github.com/go-git/go-git/releases/tag/v5.17.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.17.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.17.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.17.2/manifests"},{"name":"v5.17.1","sha":"5e23dfd02db92644dc4a3358ceb297fce875b772","kind":"commit","published_at":"2026-03-28T14:26:55.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.17.1","html_url":"https://github.com/go-git/go-git/releases/tag/v5.17.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.17.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.17.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.17.1/manifests"},{"name":"v5.17.0","sha":"bdf06885bdaa3631cf6a2017108086c6f53dcf69","kind":"commit","published_at":"2026-02-25T12:41:51.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.17.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.17.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.17.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.17.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.17.0/manifests"},{"name":"v5.16.5","sha":"48a1ae05eec4fff4dd0343744a00bf8d6a7a0b4b","kind":"commit","published_at":"2026-02-09T12:45:10.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.16.5","html_url":"https://github.com/go-git/go-git/releases/tag/v5.16.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.16.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.16.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.16.5/manifests"},{"name":"v5.16.4","sha":"de8ecc3b52e6a37b24a5a8ca362b54cafed2bc0b","kind":"commit","published_at":"2025-11-23T22:36:40.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.16.4","html_url":"https://github.com/go-git/go-git/releases/tag/v5.16.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.16.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.16.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.16.4/manifests"},{"name":"v5.16.3","sha":"ad9a3a542e845d368853848ef5a2de9ec1f79b1a","kind":"commit","published_at":"2025-09-17T10:22:49.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.16.3","html_url":"https://github.com/go-git/go-git/releases/tag/v5.16.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.16.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.16.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.16.3/manifests"},{"name":"v5.16.2","sha":"ed8216c4a2c3fdb7e4e31ce242bf7847356623c9","kind":"commit","published_at":"2025-06-06T16:15:07.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.16.2","html_url":"https://github.com/go-git/go-git/releases/tag/v5.16.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.16.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.16.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.16.2/manifests"},{"name":"v5.16.1","sha":"fd1a83688236df0299d5cd677f04dccad073500c","kind":"commit","published_at":"2025-06-04T09:28:06.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.16.1","html_url":"https://github.com/go-git/go-git/releases/tag/v5.16.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.16.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.16.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.16.1/manifests"},{"name":"v5.16.0","sha":"6d4a5c61232251b48ae4238d39830ccc894ef4d8","kind":"commit","published_at":"2025-04-14T17:01:23.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.16.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.16.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.16.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.16.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.16.0/manifests"},{"name":"v5.15.0","sha":"6f444d35965438cb7c9e5d1dd41c093031ccbc0b","kind":"commit","published_at":"2025-04-10T12:26:41.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.15.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.15.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.15.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.15.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.15.0/manifests"},{"name":"v5.14.0","sha":"863c621c8bed1fef118c564ac79e4b025f3f3c98","kind":"commit","published_at":"2025-02-27T13:12:35.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.14.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.14.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.14.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.14.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.14.0/manifests"},{"name":"v5.13.2","sha":"2c6824768b483ea030ba312972e508c23e62d75c","kind":"commit","published_at":"2025-01-22T19:47:12.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.13.2","html_url":"https://github.com/go-git/go-git/releases/tag/v5.13.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.13.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.13.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.13.2/manifests"},{"name":"v5.13.1","sha":"b6bc0c0bf2d0ab9ec5e943222de091bd8af37faf","kind":"commit","published_at":"2025-01-02T17:13:53.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.13.1","html_url":"https://github.com/go-git/go-git/releases/tag/v5.13.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.13.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.13.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.13.1/manifests"},{"name":"v5.13.0","sha":"94bd4af1deb15a64e90c6287eaf9e9f09b192a1f","kind":"commit","published_at":"2024-12-28T08:08:26.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.13.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.13.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.13.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.13.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.13.0/manifests"},{"name":"v5.12.0","sha":"302dddeda962e4bb3477a8e4080bc6f5a253e2bb","kind":"commit","published_at":"2024-03-19T13:39:15.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.12.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.12.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.12.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.12.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.12.0/manifests"},{"name":"v5.11.0","sha":"5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca","kind":"commit","published_at":"2023-12-08T09:39:38.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.11.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.11.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.11.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.11.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.11.0/manifests"},{"name":"v5.10.1","sha":"90348bd4c40c24fb123c574811642e1563cc368f","kind":"commit","published_at":"2023-11-25T09:46:04.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.10.1","html_url":"https://github.com/go-git/go-git/releases/tag/v5.10.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.10.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.10.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.10.1/manifests"},{"name":"v5.10.0","sha":"72ce9961c676b73c9bdd0678b64af7b0a42253f8","kind":"commit","published_at":"2023-10-13T22:06:19.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.10.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.10.0/manifests"},{"name":"v5.9.0","sha":"e24e0f714c4ecaf086b5783f099a885e6a2c9a1a","kind":"commit","published_at":"2023-09-12T09:26:49.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.9.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.9.0/manifests"},{"name":"v5.8.1","sha":"36477e82f22623018ff170af8afc10c2c9bd50c5","kind":"commit","published_at":"2023-07-24T09:00:51.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.8.1","html_url":"https://github.com/go-git/go-git/releases/tag/v5.8.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.8.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.8.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.8.1/manifests"},{"name":"v5.8.0","sha":"1a1bc149278ecdffe85d8890f5733d02abf58b8f","kind":"commit","published_at":"2023-07-21T06:49:01.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.8.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.8.0/manifests"},{"name":"v5.7.0","sha":"84d9be20ca15d29bebc629e5b6f29dab78cc69ba","kind":"commit","published_at":"2023-05-23T08:44:23.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.7.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.7.0/manifests"},{"name":"v5.6.1","sha":"3f1cfde283c93f33218c807602e93d47f72f7b90","kind":"commit","published_at":"2023-03-07T22:08:21.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.6.1","html_url":"https://github.com/go-git/go-git/releases/tag/v5.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.6.1/manifests"},{"name":"v5.6.0","sha":"b826c51299a84a2a6b191e98172b57b2a53fcf60","kind":"commit","published_at":"2023-02-28T22:48:44.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.6.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.6.0/manifests"},{"name":"v5.5.2","sha":"5dabd83e3712e2554745c736b55df405a0ba4f33","kind":"commit","published_at":"2023-01-05T09:35:52.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.5.2","html_url":"https://github.com/go-git/go-git/releases/tag/v5.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.5.2/manifests"},{"name":"v5.5.1","sha":"736622fb5d9a058a887667d57c91dc1b58aca6ea","kind":"commit","published_at":"2022-12-11T10:52:06.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.5.1","html_url":"https://github.com/go-git/go-git/releases/tag/v5.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.5.1/manifests"},{"name":"v5.5.0","sha":"3e07c5030b4e3b2fcbcb461f9f6b23212f978335","kind":"commit","published_at":"2022-11-30T09:32:27.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.5.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.5.0/manifests"},{"name":"v5.4.2","sha":"da810275bf682d29a530ed819aff175f47bd7634","kind":"commit","published_at":"2021-06-02T09:03:28.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.4.2","html_url":"https://github.com/go-git/go-git/releases/tag/v5.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.4.2/manifests"},{"name":"v5.4.1","sha":"db4233e9e8b3b2e37259ed4e7952faaed16218b9","kind":"commit","published_at":"2021-05-24T20:07:59.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.4.1","html_url":"https://github.com/go-git/go-git/releases/tag/v5.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.4.1/manifests"},{"name":"v5.4.0","sha":"720c192831a890d0a36b4c6720b60411fa4a0159","kind":"commit","published_at":"2021-05-12T20:42:07.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.4.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.4.0/manifests"},{"name":"v5.3.0","sha":"d5ed15d99d9b5c375dc15b0a009c915ac4edc6f7","kind":"commit","published_at":"2021-03-29T08:59:42.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.3.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.3.0/manifests"},{"name":"v5.2.0","sha":"97741e72346716fd90e534a1b9bd9f7643cd0c80","kind":"commit","published_at":"2020-10-09T09:49:30.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.2.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.2.0/manifests"},{"name":"v5.1.0","sha":"8019144b6534ff58ad234a355e5b143f1c99b45e","kind":"commit","published_at":"2020-05-24T17:25:08.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.1.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.1.0/manifests"},{"name":"v5.0.0","sha":"9d0f15c4fa712cdacfa3887e9baac918f093fbf6","kind":"commit","published_at":"2020-03-15T20:18:32.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v5.0.0","html_url":"https://github.com/go-git/go-git/releases/tag/v5.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v5.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v5.0.0/manifests"},{"name":"v4.13.1","sha":"0d1a009cbb604db18be960db5f1525b99a55d727","kind":"commit","published_at":"2019-08-01T15:22:48.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.13.1","html_url":"https://github.com/go-git/go-git/releases/tag/v4.13.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.13.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.13.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.13.1/manifests"},{"name":"v4.13.0","sha":"6241d0e70427cb0db4ca00182717af88f638268c","kind":"commit","published_at":"2019-07-29T16:21:52.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.13.0","html_url":"https://github.com/go-git/go-git/releases/tag/v4.13.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.13.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.13.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.13.0/manifests"},{"name":"v4.12.0","sha":"f9a30199e7083bdda8adad3a4fa2ec42d25c1fdb","kind":"commit","published_at":"2019-06-18T21:59:11.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.12.0","html_url":"https://github.com/go-git/go-git/releases/tag/v4.12.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.12.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.12.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.12.0/manifests"},{"name":"v4.11.0","sha":"aa6f288c256ff8baf8a7745546a9752323dc0d89","kind":"commit","published_at":"2019-04-18T10:42:43.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.11.0","html_url":"https://github.com/go-git/go-git/releases/tag/v4.11.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.11.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.11.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.11.0/manifests"},{"name":"v4.10.0","sha":"db6c41c156481962abf9a55a324858674c25ab08","kind":"commit","published_at":"2019-02-14T11:35:30.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.10.0","html_url":"https://github.com/go-git/go-git/releases/tag/v4.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.10.0/manifests"},{"name":"v4.9.1","sha":"a1f6ef44dfed1253ef7f3bc049f66b15f8fc2ab2","kind":"commit","published_at":"2019-01-30T18:12:31.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.9.1","html_url":"https://github.com/go-git/go-git/releases/tag/v4.9.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.9.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.9.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.9.1/manifests"},{"name":"v4.9.0","sha":"434611b74cb54538088c6aeed4ed27d3044064fa","kind":"commit","published_at":"2019-01-11T01:22:06.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.9.0","html_url":"https://github.com/go-git/go-git/releases/tag/v4.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.9.0/manifests"},{"name":"v4.8.1","sha":"3dbfb89e0f5bce0008724e547b999fe3af9f60db","kind":"commit","published_at":"2018-11-27T15:22:18.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.8.1","html_url":"https://github.com/go-git/go-git/releases/tag/v4.8.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.8.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.8.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.8.1/manifests"},{"name":"v4.8.0","sha":"f62cd8e3495579a8323455fa0c4e6c44bb0d5e09","kind":"commit","published_at":"2018-11-19T22:23:42.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.8.0","html_url":"https://github.com/go-git/go-git/releases/tag/v4.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.8.0/manifests"},{"name":"v4.7.1","sha":"cd64b4d630b6c2d2b3d72e9615e14f9d58bb5787","kind":"commit","published_at":"2018-10-16T09:19:22.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.7.1","html_url":"https://github.com/go-git/go-git/releases/tag/v4.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.7.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.7.1/manifests"},{"name":"v4.7.0","sha":"d3cec13ac0b195bfb897ed038a08b5130ab9969e","kind":"commit","published_at":"2018-09-06T20:05:00.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.7.0","html_url":"https://github.com/go-git/go-git/releases/tag/v4.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.7.0/manifests"},{"name":"v4.6.0","sha":"7b6c1266556f59ac436fada3fa6106d4a84f9b56","kind":"commit","published_at":"2018-08-17T09:17:46.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.6.0","html_url":"https://github.com/go-git/go-git/releases/tag/v4.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.6.0/manifests"},{"name":"v4.5.0","sha":"3bd5e82b2512d85becae9677fa06b5a973fd4cfb","kind":"commit","published_at":"2018-07-10T09:34:51.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.5.0","html_url":"https://github.com/go-git/go-git/releases/tag/v4.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.5.0/manifests"},{"name":"v4.4.1","sha":"b23570073eaee3489e5e3d666f22ba5cbeb53243","kind":"commit","published_at":"2018-06-08T07:32:46.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.4.1","html_url":"https://github.com/go-git/go-git/releases/tag/v4.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.4.1/manifests"},{"name":"v4.4.0","sha":"57570e84f8c5739f0f4a59387493e590e709dde9","kind":"commit","published_at":"2018-05-16T04:54:13.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.4.0","html_url":"https://github.com/go-git/go-git/releases/tag/v4.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.4.0/manifests"},{"name":"v4.3.1","sha":"b30763cb64afa91c016b23e905af0a378eb1b76d","kind":"commit","published_at":"2018-04-17T12:31:19.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.3.1","html_url":"https://github.com/go-git/go-git/releases/tag/v4.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.3.1/manifests"},{"name":"v4.3.0","sha":"0db54e829f81a28f71c22d54c03daba5ec144c8d","kind":"commit","published_at":"2018-04-11T08:19:49.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.3.0","html_url":"https://github.com/go-git/go-git/releases/tag/v4.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.3.0/manifests"},{"name":"v4.2.1","sha":"247cf690745dfd67ccd9f0c07878e6dd85e6c9ed","kind":"commit","published_at":"2018-04-03T07:57:09.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.2.1","html_url":"https://github.com/go-git/go-git/releases/tag/v4.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.2.1/manifests"},{"name":"v4.2.0","sha":"1d28459504251497e0ce6132a0fadd5eb44ffd22","kind":"commit","published_at":"2018-03-12T08:38:00.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.2.0","html_url":"https://github.com/go-git/go-git/releases/tag/v4.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.2.0/manifests"},{"name":"v4.1.1","sha":"886dc83f3ed518a78772055497bcc7d7621b468e","kind":"commit","published_at":"2018-02-17T11:34:12.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.1.1","html_url":"https://github.com/go-git/go-git/releases/tag/v4.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.1.1/manifests"},{"name":"v4.1.0","sha":"e9247ce9c5ce12126f646ca3ddf0066e4829bd14","kind":"commit","published_at":"2018-01-16T13:25:37.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.1.0","html_url":"https://github.com/go-git/go-git/releases/tag/v4.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.1.0/manifests"},{"name":"v4.0.0","sha":"bf3b1f1fb9e0a04d0f87511a7ded2562b48a19d8","kind":"commit","published_at":"2018-01-08T13:05:52.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0/manifests"},{"name":"v4.0.0-rc15","sha":"f9879dd043f84936a1f8acb8a53b74332a7ae135","kind":"commit","published_at":"2017-09-04T17:43:36.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0-rc15","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0-rc15","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0-rc15","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc15","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc15/manifests"},{"name":"v4.0.0-rc14","sha":"7aa9d15d395282144f31a09c0fac230da3f65360","kind":"commit","published_at":"2017-08-28T18:38:58.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0-rc14","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0-rc14","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0-rc14","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc14","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc14/manifests"},{"name":"v4.0.0-rc13","sha":"8ddbecf782c2e340fd85bb4ba4d00dc73d749f87","kind":"commit","published_at":"2017-07-28T19:58:40.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0-rc13","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0-rc13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0-rc13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc13/manifests"},{"name":"v4.0.0-rc12","sha":"d3c7400c39f86a4c59340c7a9cda8497186e00fc","kind":"commit","published_at":"2017-07-17T07:50:24.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0-rc12","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0-rc12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0-rc12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc12/manifests"},{"name":"v4.0.0-rc11","sha":"ad02bf020460c210660db4fffda7f926b6aae95a","kind":"commit","published_at":"2017-06-21T18:17:04.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0-rc11","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0-rc11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0-rc11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc11/manifests"},{"name":"v4.0.0-rc10","sha":"7e249dfcf28765939bde8f38784b3274b522f880","kind":"commit","published_at":"2017-05-24T09:42:54.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0-rc10","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0-rc10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0-rc10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc10/manifests"},{"name":"v4.0.0-rc9","sha":"a9920b123ba1f6819a8c03209582d4d28e9fd831","kind":"commit","published_at":"2017-02-01T09:50:14.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0-rc9","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0-rc9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0-rc9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc9/manifests"},{"name":"v4.0.0-rc8","sha":"f84e3bbfe59f5438c90000e6a89b41ec8eab51fb","kind":"commit","published_at":"2017-01-31T09:48:14.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0-rc8","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0-rc8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0-rc8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc8/manifests"},{"name":"v4.0.0-rc7","sha":"441713897ef5604e8105379f45ebb982ab2c9a75","kind":"commit","published_at":"2017-01-19T13:14:07.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0-rc7","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0-rc7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0-rc7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc7/manifests"},{"name":"v4.0.0-rc6","sha":"e42e10f112ec93fbca3d972dffa9566b94a0f6f8","kind":"commit","published_at":"2016-12-19T16:33:56.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0-rc6","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0-rc6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0-rc6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc6/manifests"},{"name":"v4.0.0-rc5","sha":"c9353b2bd7c1cbdf8f78dad6deac64ed2f2ed9eb","kind":"commit","published_at":"2016-12-16T21:23:40.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0-rc5","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0-rc5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0-rc5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc5/manifests"},{"name":"v4.0.0-rc4","sha":"eb89d2dd9a36440d58aea224c055b364e49785f7","kind":"commit","published_at":"2016-11-14T17:27:31.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0-rc4","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0-rc4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0-rc4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc4/manifests"},{"name":"v4.0.0-rc3","sha":"f6ed7424cbf33c7013332d7e95b4262a4bc4a523","kind":"commit","published_at":"2016-11-07T09:52:45.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0-rc3","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0-rc3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0-rc3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc3/manifests"},{"name":"v4.0.0-rc2","sha":"743989abd8c1277dff78e56c2583a9f6dff796ff","kind":"commit","published_at":"2016-11-04T15:19:10.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0-rc2","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0-rc2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0-rc2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc2/manifests"},{"name":"v4.0.0-rc1","sha":"8cd772a53e8ecd2687b739eea110fa9b179f1e0f","kind":"commit","published_at":"2016-10-19T20:08:59.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v4.0.0-rc1","html_url":"https://github.com/go-git/go-git/releases/tag/v4.0.0-rc1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v4.0.0-rc1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v4.0.0-rc1/manifests"},{"name":"v3.2.0","sha":"02c228585e543413479ea36d3a2bbc80a070eb93","kind":"commit","published_at":"2016-09-23T11:39:00.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v3.2.0","html_url":"https://github.com/go-git/go-git/releases/tag/v3.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v3.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.2.0/manifests"},{"name":"v3.1.1","sha":"5413c7aeadb7cb18a6d51dae0bc313f2e129a337","kind":"commit","published_at":"2016-08-02T08:58:49.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v3.1.1","html_url":"https://github.com/go-git/go-git/releases/tag/v3.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v3.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.1.1/manifests"},{"name":"v3.1.0","sha":"5e73f01cb2e027a8f02801635b79d3a9bc866914","kind":"commit","published_at":"2016-07-04T15:09:22.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v3.1.0","html_url":"https://github.com/go-git/go-git/releases/tag/v3.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v3.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.1.0/manifests"},{"name":"v3.0.4","sha":"08f9e7015aad2ca768638b446fb8632f11601899","kind":"commit","published_at":"2016-05-19T11:28:17.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v3.0.4","html_url":"https://github.com/go-git/go-git/releases/tag/v3.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v3.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.0.4/manifests"},{"name":"v3.0.3","sha":"1cd347ec8970388f83745c9a530ea2bcd705c6d9","kind":"commit","published_at":"2016-05-08T10:06:18.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v3.0.3","html_url":"https://github.com/go-git/go-git/releases/tag/v3.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v3.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.0.3/manifests"},{"name":"v3.0.2","sha":"36d14454b32eca89ac43d2934c50f3a1ae2e1d20","kind":"commit","published_at":"2016-04-25T07:24:00.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v3.0.2","html_url":"https://github.com/go-git/go-git/releases/tag/v3.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v3.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.0.2/manifests"},{"name":"v3.0.1","sha":"b08327bfaf27171dddc5516c63e5646c40f0b004","kind":"commit","published_at":"2016-04-22T09:35:12.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v3.0.1","html_url":"https://github.com/go-git/go-git/releases/tag/v3.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v3.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.0.1/manifests"},{"name":"v3.0.0","sha":"07ca1ac7f3058ea6d3274a01973541fb84782f5e","kind":"commit","published_at":"2016-02-22T18:05:49.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v3.0.0","html_url":"https://github.com/go-git/go-git/releases/tag/v3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v3.0.0/manifests"},{"name":"v2.2.1","sha":"617a21ddaddeb4ea6b8cc4bbc86745c7f7288124","kind":"commit","published_at":"2016-02-22T17:45:35.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v2.2.1","html_url":"https://github.com/go-git/go-git/releases/tag/v2.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v2.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v2.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v2.2.1/manifests"},{"name":"v2.2.0","sha":"1931dfbf38508e790e9f129873bc073aacc6a50f","kind":"commit","published_at":"2016-02-16T16:37:29.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v2.2.0","html_url":"https://github.com/go-git/go-git/releases/tag/v2.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v2.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v2.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v2.2.0/manifests"},{"name":"v2.1.3","sha":"35ee4d749be21691b78a7465361ad47179fe2eff","kind":"commit","published_at":"2016-01-27T11:07:36.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v2.1.3","html_url":"https://github.com/go-git/go-git/releases/tag/v2.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v2.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v2.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v2.1.3/manifests"},{"name":"v2.1.2","sha":"37cc5cf842c3c0fb989bcf7525cc8f826d96b295","kind":"commit","published_at":"2016-01-11T11:09:15.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v2.1.2","html_url":"https://github.com/go-git/go-git/releases/tag/v2.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v2.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v2.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v2.1.2/manifests"},{"name":"v2.1.1","sha":"cebec78608e7913b8c843390237fd609069022ae","kind":"commit","published_at":"2016-01-08T16:01:36.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v2.1.1","html_url":"https://github.com/go-git/go-git/releases/tag/v2.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v2.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v2.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v2.1.1/manifests"},{"name":"v2.1.0","sha":"da5ab9de3e4c1bffa533108f46c5adc30929f7c2","kind":"commit","published_at":"2015-12-23T08:48:11.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v2.1.0","html_url":"https://github.com/go-git/go-git/releases/tag/v2.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v2.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v2.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v2.1.0/manifests"},{"name":"v2.0.0","sha":"f821e1340752dce95f73375dc9a13dcd58d58f82","kind":"commit","published_at":"2015-12-12T21:07:47.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v2.0.0","html_url":"https://github.com/go-git/go-git/releases/tag/v2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v2.0.0/manifests"},{"name":"v1.0.0","sha":"6f43e8933ba3c04072d5d104acc6118aac3e52ee","kind":"commit","published_at":"2015-10-22T11:11:33.000Z","download_url":"https://codeload.github.com/go-git/go-git/tar.gz/v1.0.0","html_url":"https://github.com/go-git/go-git/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/go-git/go-git@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/tags/v1.0.0/manifests"}]},"repo_metadata_updated_at":"2026-10-09T14:24:21.798Z","dependent_packages_count":8164,"downloads":null,"downloads_period":null,"dependent_repos_count":13417,"rankings":{"downloads":null,"dependent_repos_count":0.06567016769235239,"dependent_packages_count":0.03527307585371218,"stargazers_count":1.0053864061715434,"forks_count":1.1847702323497753,"docker_downloads_count":0.03081206920162505,"average":0.4643823902538017},"purl":"pkg:golang/github.com/go-git/go-git/v5","advisories":[{"uuid":"GSA_kwCzR0hTQS1xZ3E3LTdobTMtcTM5as4ABhvh","url":"https://github.com/advisories/GHSA-qgq7-7hm3-q39j","title":"go-git: Malicious reference names may modify files outside the reference storage","description":"### Impact\nA path traversal issue in `go-git` could allow malicious reference names to access files outside the repository's intended reference storage.\n\nLoose references are stored under `.git/\u003creference-name\u003e`. The reference name was previously used as a path without verifying that the resolved path remained within the reference storage. A name such as `refs/heads/../../config` could therefore resolve to unrelated repository metadata such as `.git/config` or `.git/HEAD`.\n\nA malicious Git server could advertise such a reference name. The name may also survive refspec mapping; for example, it could be mapped to `refs/remotes/origin/../../config` during a clone or fetch operation.\n\nThis vulnerability affects filesystem-backed repositories using the `storage/filesystem` package and its `dotgit` reference storage. Users relying exclusively on the in-memory storage implementation, `storage/memory`, are not affected, because reference names are not resolved as filesystem paths.\n\nExploitation requires an application using `go-git` with filesystem-backed storage to interact with a malicious Git server or otherwise process attacker-controlled reference names.\n\n### Patches\nThe issue has been addressed by validating reference names at the `dotgit` storage entry points and rejecting names whose resolved paths could escape the reference storage.\n\nUsers of filesystem-backed storage should upgrade to a patched version.\n\n### Workarounds\nApplications that exclusively use `storage/memory` are not affected and do not require a workaround for this vulnerability.\n\nFor applications using filesystem-backed storage, avoid cloning from or fetching from untrusted Git servers until an upgrade is possible.\n\nApplications that directly construct or process reference names may also validate them before passing them to filesystem-backed `go-git` storage. Application-level validation should only be considered a temporary mitigation and does not replace upgrading to a patched version.\n\n### References\n- Fixes:\n  - https://github.com/go-git/go-git/pull/2247\n  - https://github.com/go-git/go-git/pull/2254\n\n### Credits\n\nThanks to @Saku0512 for reporting this issue and @Sahana2524 for proposing the initial fix. 🙇","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-08-07T16:41:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","references":["https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j","https://github.com/go-git/go-git/pull/2247","https://github.com/go-git/go-git/pull/2254","https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7","https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36","https://github.com/go-git/go-git/releases/tag/v5.19.2","https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5","https://github.com/advisories/GHSA-qgq7-7hm3-q39j"],"source_kind":"github","identifiers":["GHSA-qgq7-7hm3-q39j","CVE-2026-71557"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-08-07T17:00:08.421Z","updated_at":"2026-10-08T07:46:27.506Z","epss_percentage":0.00413,"epss_percentile":0.33554,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xZ3E3LTdobTMtcTM5as4ABhvh","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xZ3E3LTdobTMtcTM5as4ABhvh","packages":[{"ecosystem":"go","package_name":"github.com/go-git/go-git/v6","versions":[{"first_patched_version":"6.0.0-alpha.5","vulnerable_version_range":"\u003c= 6.0.0-alpha.4"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv6"},{"ecosystem":"go","package_name":"github.com/go-git/go-git/v5","versions":[{"first_patched_version":"5.19.2","vulnerable_version_range":"\u003c= 5.19.1"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xZ3E3LTdobTMtcTM5as4ABhvh/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1oYzh2LXd3Yzktdmd4bc4ABhvg","url":"https://github.com/advisories/GHSA-hc8v-wwc9-vgxm","title":"go-git: Worktree operations may follow symlinks","description":"## Impact\n\nA symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended worktree path.\n\nThe `worktreeFilesystem` wrapper rejected dangerous path strings, including paths containing `.git`, parent-directory components, or control characters. However, it did not prevent filesystem operations from following symbolic links that were already present in the worktree.\n\nAs a result, a path that is safe when evaluated as a string could still resolve into the repository's Git metadata directory. For example, if `s` is a symbolic link to `.git`, writing to `s/config` would modify `.git/config`.\n\nA symbolic link at the final path component could also be followed. For example, if `s` points directly to `.git/config`, opening `s` for writing with truncation could overwrite the repository configuration.\n\nExploitation requires an attacker to be able to introduce or control a symbolic link in the worktree and cause the application to perform a write through that path.\n\nApplications using `storage/memory` for their Storer, or `go-billy/memfs` for their `Worktree`, are not affected by this vulnerability.\n\n## Patches\n\nThe issue has been addressed by making the worktree filesystem wrapper a symlink-safe boundary.\n\nWorktree operations now reject paths where an existing symbolic link in any path component could cause the operation to escape the intended worktree location, including symbolic links at the final component.\n\nUsers of filesystem-backed worktrees should upgrade to a patched version.\n\n### Credits\n\nThanks to @kodareef5 for reporting this issue and working with the go-git security team toward its resolution. :1st_place_medal: \nWe would also like to thank @HughLewis20, who independently reported the same issue while a fix was already in progress.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-08-07T16:38:15.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","references":["https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm","https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab","https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac","https://github.com/go-git/go-git/releases/tag/v5.19.2","https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5","https://github.com/advisories/GHSA-hc8v-wwc9-vgxm"],"source_kind":"github","identifiers":["GHSA-hc8v-wwc9-vgxm","CVE-2026-71556"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-08-07T17:00:08.421Z","updated_at":"2026-10-12T08:01:56.340Z","epss_percentage":0.00357,"epss_percentile":0.27509,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oYzh2LXd3Yzktdmd4bc4ABhvg","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1oYzh2LXd3Yzktdmd4bc4ABhvg","packages":[{"ecosystem":"go","package_name":"github.com/go-git/go-git/v6","versions":[{"first_patched_version":"6.0.0-alpha.5","vulnerable_version_range":"\u003c= 6.0.0-alpha.4"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv6"},{"ecosystem":"go","package_name":"github.com/go-git/go-git/v5","versions":[{"first_patched_version":"5.19.2","vulnerable_version_range":"\u003c= 5.19.1"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oYzh2LXd3Yzktdmd4bc4ABhvg/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13NXBwLTk5Y2gtcWoyOc4ABXwC","url":"https://github.com/advisories/GHSA-w5pp-99ch-qj29","title":"go-git: Malformed Git object data may cause panics or resource exhaustion","description":"### Impact\nSeveral denial-of-service issues were identified in `go-git` when parsing maliciously crafted Git repository data.\n\nAn attacker may craft a malicious `.pack`, `.idx` or loose objects that causes an application using an affected version of `go-git` to panic or consume excessive resources.\n\nThis can lead to denial of service in applications that use `go-git` to clone, fetch, open, or otherwise process untrusted repositories or Git object data.\n\nExploitation requires the ability to alter read-only files such as `.pack` or `.idx` from the local repository's `.git/objects/pack/` directory. Alternatively, the user would need to be interacting with a malicious remote server, which is not recommended and exposes users to a broader class of security risks beyond this issue.\n\n### Patches\nUsers should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to `v5` are likely to be affected, users are recommended to upgrade to a supported `go-git` version.\n\n### Credits\ngo-git thanks @kodareef5, @AyushParkara and @N0zoM1z0 for reporting this in four separate reports. 🙇","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-05-29T19:43:27.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","references":["https://github.com/go-git/go-git/security/advisories/GHSA-w5pp-99ch-qj29","https://github.com/advisories/GHSA-w5pp-99ch-qj29"],"source_kind":"github","identifiers":["GHSA-w5pp-99ch-qj29"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-29T20:00:08.879Z","updated_at":"2026-10-05T15:02:57.036Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13NXBwLTk5Y2gtcWoyOc4ABXwC","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13NXBwLTk5Y2gtcWoyOc4ABXwC","packages":[{"ecosystem":"go","package_name":"github.com/go-git/go-git/v6","versions":[{"first_patched_version":"6.0.0-alpha.4","vulnerable_version_range":"\u003c= 6.0.0-alpha.3"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv6"},{"ecosystem":"go","package_name":"github.com/go-git/go-git/v5","versions":[{"first_patched_version":"5.19.1","vulnerable_version_range":"\u003c= 5.19.0"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13NXBwLTk5Y2gtcWoyOc4ABXwC/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jcmhqLTU5Z2gtOHg5Ns4ABXGj","url":"https://github.com/advisories/GHSA-crhj-59gh-8x96","title":"go-git: Crafted repositories may modify main and submodule .git directories","description":"### Impact\nA path validation issue in `go-git` could allow crafted repository data to affect files outside the intended checkout target, including the repository's `.git` directory.\n\nThese validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. Some attack vectors were platform-specific: certain payloads affected only Windows users, others affected only macOS users, and some applied across all supported platforms.\n\nUsing non-descendant `go-billy` filesystem instances, or different filesystem types, for the `Storer` and `Worktree` may provide some isolation against `.git` directory manipulation. For example, users that store the `.git` directory through `memfs` while using `osfs` for the worktree are not affected by this vulnerability in the main repository, because repository metadata is not materialized inside the worktree filesystem.\n\nHowever, this isolation does not necessarily apply when the repository contains submodules, since submodule dotgit directories may still be represented or materialized within the worktree context.\n\nIt is important to note that exploitation requires a maliciously crafted repository payload. Users should always exercise caution when interacting with repositories or Git servers they do not trust.\n\n### Patches\nUsers should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to `v5` are likely to be affected, users are recommended to upgrade to a supported go-git version.\n\n### Credits\nThanks to @kodareef5, @AyushParkara and @N0zoM1z0 for reporting this to the go-git project in three separate reports. 🙇","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-05-19T15:38:39.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.4,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","references":["https://github.com/go-git/go-git/security/advisories/GHSA-crhj-59gh-8x96","https://nvd.nist.gov/vuln/detail/CVE-2026-45571","https://github.com/advisories/GHSA-crhj-59gh-8x96"],"source_kind":"github","identifiers":["GHSA-crhj-59gh-8x96","CVE-2026-45571"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-19T16:00:19.307Z","updated_at":"2026-10-07T16:03:05.381Z","epss_percentage":0.0033,"epss_percentile":0.2353,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jcmhqLTU5Z2gtOHg5Ns4ABXGj","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jcmhqLTU5Z2gtOHg5Ns4ABXGj","packages":[{"ecosystem":"go","package_name":"github.com/go-git/go-git","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 44.7.0"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git"},{"ecosystem":"go","package_name":"github.com/go-git/go-git/v6","versions":[{"first_patched_version":"6.0.0-alpha.4","vulnerable_version_range":"\u003c= 6.0.0-alpha.3"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv6"},{"ecosystem":"go","package_name":"github.com/go-git/go-git/v5","versions":[{"first_patched_version":"5.19.1","vulnerable_version_range":"\u003c= 5.19.0"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jcmhqLTU5Z2gtOHg5Ns4ABXGj/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tN2NyLW0zcHYtaGdycM4ABXFm","url":"https://github.com/advisories/GHSA-m7cr-m3pv-hgrp","title":"go-git: Improper single-quote escaping in go-git SSH transport","description":"### Impact\n\n`go-git`'s SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. This diverges from canonical Git, which shell-quotes the path through `sq_quote_buf` so that an embedded `'` becomes the `'\\''` close-escape-reopen sequence and the whole path round-trips as a single quoted argument.\n\nA repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. On SSH servers that evaluate the exec command through a shell (for example a user account whose login shell is `/bin/sh` or `/bin/bash`, or a `ForceCommand` wrapper that re-evaluates `$SSH_ORIGINAL_COMMAND`), those additional tokens execute in that account's command-execution context. SSH servers that tokenize the exec command without shell evaluation, including the canonical `git-shell` setup, are not affected.\n\nThe vulnerable behaviour is on the SSH server side, not in `go-git`: the same bytes can be produced by any SSH client. The change in `go-git` is defense-in-depth that restores parity with canonical Git's wire format and prevents `go-git` from being a vehicle for reaching shell-evaluating servers through attacker-influenced repository paths.\n\n### Patches\n\nUsers should upgrade to a patched version in order to mitigate this issue. The fix ports `sq_quote_buf` from canonical Git into `go-git`'s SSH transport so that the wire output is byte-identical to what `git` itself would send for the same input.\n\nVersions prior to `v5` are likely to be affected, users are recommended to upgrade to a supported go-git version.\n\n### Credit\n\nThanks to @N0zoM1z0 for reporting this to the `go-git` project. :bow:","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-05-19T15:21:01.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":2.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","references":["https://github.com/go-git/go-git/security/advisories/GHSA-m7cr-m3pv-hgrp","https://nvd.nist.gov/vuln/detail/CVE-2026-45570","https://github.com/advisories/GHSA-m7cr-m3pv-hgrp"],"source_kind":"github","identifiers":["GHSA-m7cr-m3pv-hgrp","CVE-2026-45570"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-19T16:00:19.307Z","updated_at":"2026-10-05T15:03:09.515Z","epss_percentage":0.00427,"epss_percentile":0.34508,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tN2NyLW0zcHYtaGdycM4ABXFm","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tN2NyLW0zcHYtaGdycM4ABXFm","packages":[{"ecosystem":"go","package_name":"github.com/go-git/go-git","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 4.7.0"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git"},{"ecosystem":"go","package_name":"github.com/go-git/go-git/v6","versions":[{"first_patched_version":"6.0.0-alpha.4","vulnerable_version_range":"\u003c= 6.0.0-alpha.3"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv6"},{"ecosystem":"go","package_name":"github.com/go-git/go-git/v5","versions":[{"first_patched_version":"5.19.1","vulnerable_version_range":"\u003c= 5.19.0"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tN2NyLW0zcHYtaGdycM4ABXFm/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zODlyLWd2N3AtcjNycM4ABWj6","url":"https://github.com/advisories/GHSA-389r-gv7p-r3rp","title":"go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git","description":"### Impact\n`go-git` may parse malformed Git objects in a way that differs from upstream Git. When `commit` or `tag` objects contain ambiguous or malformed headers, `go-git`’s decoded representation may expose values differently from how Git itself would interpret or reject the same object.\n\nAdditionally, `go-git`’s commit signing and verification logic operates over commit data reconstructed from `go-git`’s parsed representation rather than the original raw object bytes. As a result, `go-git` may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository.\n\nThis can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed.\n\n### Patches\nUsers should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported `go-git` version.\n\n### Credit\n\nThanks to @bugbunny-research (https://bugbunny.ai/) for reporting this to `sigstore/gitsign`, and to @wlynch, @patzielinski and @adityasaky for coordinating the disclosure with the `go-git` project. :bow: :1st_place_medal: \n\nThanks to @wayphinder for reporting this to the `go-git` project. :bow:","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-05-11T14:48:12.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.0,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","references":["https://github.com/go-git/go-git/security/advisories/GHSA-389r-gv7p-r3rp","https://nvd.nist.gov/vuln/detail/CVE-2026-45022","https://github.com/advisories/GHSA-389r-gv7p-r3rp"],"source_kind":"github","identifiers":["GHSA-389r-gv7p-r3rp","CVE-2026-45022"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-11T15:00:09.598Z","updated_at":"2026-10-14T10:04:32.696Z","epss_percentage":0.00159,"epss_percentile":0.04519,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zODlyLWd2N3AtcjNycM4ABWj6","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zODlyLWd2N3AtcjNycM4ABWj6","packages":[{"ecosystem":"go","package_name":"github.com/go-git/go-git/v5","versions":[{"first_patched_version":"5.19.0","vulnerable_version_range":"\u003c 5.19.0"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv5"},{"ecosystem":"go","package_name":"github.com/go-git/go-git/v6","versions":[{"first_patched_version":"6.0.0-alpha.3","vulnerable_version_range":"\u003e= 6.0.0-alpha.1, \u003c= 6.0.0-alpha.2"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv6"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zODlyLWd2N3AtcjNycM4ABWj6/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zeGM1LXdyaG0tZjk2M84ABVcg","url":"https://github.com/advisories/GHSA-3xc5-wrhm-f963","title":"go-git: Credential leak via cross-host redirect in smart HTTP transport","description":"### Impact\n`go-git` may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations.\n\nIf a remote repository responds to the initial `/info/refs` request with a redirect to a different host, go-git updates the session endpoint to the redirected location and reuses the original authentication for subsequent requests. This can result in the credentials (e.g. Authorization headers) being sent to an unintended host.\n\nAn attacker controlling or influencing the redirect target can capture these credentials and potentially reuse them to access the victim’s repositories or other resources, depending on the scope of the credential.\n\n**Clients using `go-git` exclusively with trusted remotes (for example, GitHub or GitLab), and over a secure HTTPS connection, are not affected by this issue.** The risk arises when interacting with untrusted or misconfigured Git servers, or when using unsecured HTTP connections, which is not recommended. Such configurations also expose clients to a broader class of security risks beyond this issue, including credential interception and tampering of repository data.\n\n### Patches\nUsers should upgrade to `v5.18.0`, or `v6.0.0-alpha.2`, in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported `go-git` version.\n\nThe patched versions add support for configuring [followRedirects](https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpfollowRedirects). In line with upstream behaviour, the default is now `initial`, while users can opt into `FollowRedirects` or `NoFollowRedirects` programmatically.\n\n### Credit\nThanks to the 3 separate reports from @celinke97, @N0zoM1z0 and @AyushParkara. Thanks for finding and reporting this issue privately to the `go-git` project. :bow:","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-04-17T22:31:35.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.7,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","references":["https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963","https://nvd.nist.gov/vuln/detail/CVE-2026-41506","https://github.com/go-git/go-git/releases/tag/v5.18.0","https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.2","https://github.com/advisories/GHSA-3xc5-wrhm-f963"],"source_kind":"github","identifiers":["GHSA-3xc5-wrhm-f963","CVE-2026-41506"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-17T23:00:08.611Z","updated_at":"2026-10-15T07:03:59.857Z","epss_percentage":0.00259,"epss_percentile":0.15773,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zeGM1LXdyaG0tZjk2M84ABVcg","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zeGM1LXdyaG0tZjk2M84ABVcg","packages":[{"ecosystem":"go","package_name":"github.com/go-git/go-git/v6","versions":[{"first_patched_version":"6.0.0-alpha.2","vulnerable_version_range":"\u003c= 6.0.0-alpha.1"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv6"},{"ecosystem":"go","package_name":"github.com/go-git/go-git/v5","versions":[{"first_patched_version":"5.18.0","vulnerable_version_range":"\u003c= 5.17.2"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zeGM1LXdyaG0tZjk2M84ABVcg/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qaGYzLXh4aHctMndwcM4ABUdU","url":"https://github.com/advisories/GHSA-jhf3-xxhw-2wpp","title":"go-git: Maliciously crafted idx file can cause asymmetric memory consumption","description":"### Impact\n\nA vulnerability has been identified in which a maliciously crafted `.idx` file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a Denial of Service (DoS) condition.\n\nExploitation requires write access to the local repository's `.git` directory, it order to create or alter existing `.idx` files. \n\n### Patches\n\nUsers should upgrade to `v5.17.1`, or the latest `v6` [pseudo-version](https://go.dev/ref/mod#pseudo-versions), in order to mitigate this vulnerability.\n\n### Credit\n\nThe go-git maintainers thank @kq5y for finding and reporting this issue privately to the `go-git` project.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-03-30T17:17:54.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.0,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","references":["https://github.com/go-git/go-git/security/advisories/GHSA-jhf3-xxhw-2wpp","https://github.com/go-git/go-git/releases/tag/v5.17.1","https://nvd.nist.gov/vuln/detail/CVE-2026-34165","https://github.com/advisories/GHSA-jhf3-xxhw-2wpp"],"source_kind":"github","identifiers":["GHSA-jhf3-xxhw-2wpp","CVE-2026-34165"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-30T18:00:09.657Z","updated_at":"2026-10-14T10:05:33.812Z","epss_percentage":0.00148,"epss_percentile":0.0353,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qaGYzLXh4aHctMndwcM4ABUdU","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qaGYzLXh4aHctMndwcM4ABUdU","packages":[{"ecosystem":"go","package_name":"github.com/go-git/go-git/v5","versions":[{"first_patched_version":"5.17.1","vulnerable_version_range":"\u003e= 5.0.0, \u003c= 5.17.0"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qaGYzLXh4aHctMndwcM4ABUdU/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nbTJ4LTJnOWgtY2NtOM4ABUdQ","url":"https://github.com/advisories/GHSA-gm2x-2g9h-ccm8","title":"go-git missing validation decoding Index v4 files leads to panic","description":"### Impact\n\n`go-git`’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing.\n\nThis issue only affects Git index format version 4. Earlier formats (`go-git` supports only `v2` and `v3`) are not vulnerable to this issue.\n\nAn attacker able to supply a crafted `.git/index` file can cause applications using go-git to panic while reading the index. If the application does not recover from panics, this results in process termination, leading to a denial-of-service (DoS) condition.\n\nExploitation requires the ability to modify or inject a Git index file within the local repository in disk. This typically implies write access to the `.git` directory.\n\n### Patches\n\nUsers should upgrade to `v5.17.1`, or the latest `v6` [pseudo-version](https://go.dev/ref/mod#pseudo-versions), in order to mitigate this vulnerability.\n\n### Credit\n\ngo-git maintainers thank @kq5y for finding and reporting this issue privately to the `go-git` project.","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-03-30T17:05:23.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":2.8,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","references":["https://github.com/go-git/go-git/security/advisories/GHSA-gm2x-2g9h-ccm8","https://nvd.nist.gov/vuln/detail/CVE-2026-33762","https://github.com/go-git/go-git/releases/tag/v5.17.1","https://github.com/advisories/GHSA-gm2x-2g9h-ccm8"],"source_kind":"github","identifiers":["GHSA-gm2x-2g9h-ccm8","CVE-2026-33762"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-30T18:00:09.657Z","updated_at":"2026-10-05T15:04:26.855Z","epss_percentage":0.00153,"epss_percentile":0.03724,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nbTJ4LTJnOWgtY2NtOM4ABUdQ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nbTJ4LTJnOWgtY2NtOM4ABUdQ","packages":[{"ecosystem":"go","package_name":"github.com/go-git/go-git/v5","versions":[{"first_patched_version":"5.17.1","vulnerable_version_range":"\u003c= 5.17.0"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nbTJ4LTJnOWgtY2NtOM4ABUdQ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zN2N4LTMyOWMtMzN4M84ABSH3","url":"https://github.com/advisories/GHSA-37cx-329c-33x3","title":"go-git improperly verifies data integrity values for .idx and .pack files","description":"### Impact \n\nA vulnerability was discovered in `go-git` whereby data integrity values for `.pack` and `.idx` files were not properly verified. This resulted in `go-git` potentially consuming corrupted files, which would likely result in unexpected errors such as `object not found`.\n\nFor context, clients fetch [`packfiles`](https://git-scm.com/docs/pack-protocol#_packfile_data) from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (`.idx`) are [generated](https://git-scm.com/docs/pack-format) locally by `go-git`, or the `git` cli, when new `.pack` files are received and processed. The integrity checks for both files were not being verified correctly.\n\nNote that the lack of verification of the packfile checksum has no impact on the trust relationship between the client and server, which is enforced based on the protocol being used (e.g. TLS in the case of `https://` or known hosts for `ssh://`). In other words, the packfile checksum verification does not provide any security benefits when connecting to a malicious or compromised Git server.\n\n### Patches\n\nUsers should upgrade to `v5.16.5`, or the latest `v6` [pseudo-version](https://go.dev/ref/mod#pseudo-versions), in order to mitigate this vulnerability.\n\n### Workarounds\n\nIn case updating to a fixed version of `go-git` is not possible, users can run [git fsck](https://git-scm.com/docs/git-fsck) from the `git` cli to check for data corruption on a given repository. \n\n### Credit\n\nThanks @N0zoM1z0 for finding and reporting this issue privately to the `go-git` project.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-02-10T00:28:53.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","references":["https://github.com/go-git/go-git/security/advisories/GHSA-37cx-329c-33x3","https://github.com/go-git/go-git/releases/tag/v5.16.5","https://nvd.nist.gov/vuln/detail/CVE-2026-25934","https://github.com/advisories/GHSA-37cx-329c-33x3"],"source_kind":"github","identifiers":["GHSA-37cx-329c-33x3","CVE-2026-25934"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-10T01:00:12.233Z","updated_at":"2026-10-14T10:06:35.690Z","epss_percentage":0.00176,"epss_percentile":0.06556,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zN2N4LTMyOWMtMzN4M84ABSH3","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zN2N4LTMyOWMtMzN4M84ABSH3","packages":[{"ecosystem":"go","package_name":"github.com/go-git/go-git/v5","versions":[{"first_patched_version":"5.16.5","vulnerable_version_range":"\u003c= 5.16.4"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zN2N4LTMyOWMtMzN4M84ABSH3/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yOXB4LW05NTktY3hmNM4ABC-l","url":"https://github.com/advisories/GHSA-r9px-m959-cxf4","title":"go-git clients vulnerable to DoS via maliciously crafted Git server replies","description":"### Impact\nA denial of service (DoS) vulnerability was discovered in go-git versions prior to `v5.13`. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in `go-git` clients. \n\nThis is a `go-git` implementation issue and does not affect the upstream `git` cli.\n\n### Patches\nUsers running versions of `go-git` from `v4` and above are recommended to upgrade to `v5.13` in order to mitigate this vulnerability.\n\n### Workarounds\nIn cases where a bump to the latest version of `go-git` is not possible, we recommend limiting its use to only trust-worthy Git servers.\n\n## Credit\nThanks to Ionut Lalu for responsibly disclosing this vulnerability to us.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-01-06T16:20:28.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/go-git/go-git/security/advisories/GHSA-r9px-m959-cxf4","https://nvd.nist.gov/vuln/detail/CVE-2025-21614","https://github.com/advisories/GHSA-r9px-m959-cxf4"],"source_kind":"github","identifiers":["GHSA-r9px-m959-cxf4","CVE-2025-21614"],"repository_url":"https://github.com/go-git/go-git","blast_radius":0.0,"created_at":"2025-01-06T17:08:37.545Z","updated_at":"2026-10-14T10:09:22.075Z","epss_percentage":0.00717,"epss_percentile":0.52587,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yOXB4LW05NTktY3hmNM4ABC-l","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yOXB4LW05NTktY3hmNM4ABC-l","packages":[{"ecosystem":"go","package_name":"github.com/go-git/go-git","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.13.1"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git"},{"ecosystem":"go","package_name":"github.com/go-git/go-git/v5","versions":[{"first_patched_version":"5.13.0","vulnerable_version_range":"\u003c 5.13.0"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv5"},{"ecosystem":"go","package_name":"gopkg.in/src-d/go-git.v4","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.13.1"}],"purl":"pkg:go/gopkg.in%2Fsrc-d%2Fgo-git.v4"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yOXB4LW05NTktY3hmNM4ABC-l/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12NzI1LTk1NDYtN3E3bc4ABC-k","url":"https://github.com/advisories/GHSA-v725-9546-7q7m","title":"go-git has an Argument Injection via the URL field","description":"### Impact\nAn argument injection vulnerability was discovered in `go-git` versions prior to `v5.13`. \n\nSuccessful exploitation of this vulnerability could allow an attacker to set arbitrary values to [git-upload-pack flags](https://git-scm.com/docs/git-upload-pack). This only happens when the `file` transport protocol is being used, as that is the only protocol that shells out to `git` binaries.\n\n### Affected versions\nUsers running versions of `go-git` from `v4` and above are recommended to upgrade to `v5.13` in order to mitigate this vulnerability.\n\n### Workarounds\nIn cases where a bump to the latest version of `go-git` is not possible, we recommend users to enforce restrict validation rules for values passed in the URL field.\n\n## Credit\nThanks to @vin01 for responsibly disclosing this vulnerability to us.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2025-01-06T16:16:30.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear","references":["https://github.com/go-git/go-git/security/advisories/GHSA-v725-9546-7q7m","https://nvd.nist.gov/vuln/detail/CVE-2025-21613","https://github.com/advisories/GHSA-v725-9546-7q7m"],"source_kind":"github","identifiers":["GHSA-v725-9546-7q7m","CVE-2025-21613"],"repository_url":"https://github.com/go-git/go-git","blast_radius":37.9744298619319,"created_at":"2025-01-06T17:08:38.164Z","updated_at":"2026-10-14T10:09:22.075Z","epss_percentage":0.01278,"epss_percentile":0.69249,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NzI1LTk1NDYtN3E3bc4ABC-k","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12NzI1LTk1NDYtN3E3bc4ABC-k","packages":[{"ecosystem":"go","package_name":"github.com/go-git/go-git/v5","versions":[{"first_patched_version":"5.13.0","vulnerable_version_range":"\u003c 5.13.0"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv5"},{"ecosystem":"go","package_name":"gopkg.in/src-d/go-git.v4","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.13.1"}],"purl":"pkg:go/gopkg.in%2Fsrc-d%2Fgo-git.v4"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NzI1LTk1NDYtN3E3bc4ABC-k/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS00NDlwLTNoODktcHc4OM4AA4Vg","url":"https://github.com/advisories/GHSA-449p-3h89-pw88","title":"Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients","description":"### Impact\nA path traversal vulnerability was discovered in go-git versions prior to `v5.11`. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.\n\nApplications are only affected if they are using the [ChrootOS](https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS), which is the default when using \"Plain\" versions of Open and Clone funcs (e.g. PlainClone). Applications using [BoundOS](https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS) or in-memory filesystems are not affected by this issue.\nThis is a `go-git` implementation issue and does not affect the upstream `git` cli.\n\n### Patches\nUsers running versions of `go-git` from `v4` and above are recommended to upgrade to `v5.11` in order to mitigate this vulnerability.\n\n### Workarounds\nIn cases where a bump to the latest version of `go-git` is not possible in a timely manner, we recommend limiting its use to only trust-worthy Git servers.\n\n## Credit\nThanks to Ionut Lalu for responsibly disclosing this vulnerability to us.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2024-01-10T15:37:05.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88","https://nvd.nist.gov/vuln/detail/CVE-2023-49569","https://github.com/advisories/GHSA-449p-3h89-pw88"],"source_kind":"github","identifiers":["GHSA-449p-3h89-pw88","CVE-2023-49569"],"repository_url":"https://github.com/go-git/go-git","blast_radius":0.0,"created_at":"2024-01-10T16:06:14.361Z","updated_at":"2026-10-15T07:11:25.313Z","epss_percentage":0.0151,"epss_percentile":0.73507,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00NDlwLTNoODktcHc4OM4AA4Vg","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS00NDlwLTNoODktcHc4OM4AA4Vg","packages":[{"ecosystem":"go","package_name":"gopkg.in/src-d/go-git.v4","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.13.1"}],"purl":"pkg:go/gopkg.in%2Fsrc-d%2Fgo-git.v4"},{"ecosystem":"go","package_name":"github.com/go-git/go-git/v5","versions":[{"first_patched_version":"5.11.0","vulnerable_version_range":"\u003e= 5.0.0, \u003c 5.11.0"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00NDlwLTNoODktcHc4OM4AA4Vg/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tdzk5LTljaGMteHc3cs4AA4Cr","url":"https://github.com/advisories/GHSA-mw99-9chc-xw7r","title":"Maliciously crafted Git server replies can cause DoS on go-git clients","description":"### Impact\nA denial of service (DoS) vulnerability was discovered in go-git versions prior to `v5.11`. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in `go-git` clients. \n\nApplications using only the in-memory filesystem supported by `go-git` are not affected by this vulnerability.\nThis is a `go-git` implementation issue and does not affect the upstream `git` cli.\n\n### Patches\nUsers running versions of `go-git` from `v4` and above are recommended to upgrade to `v5.11` in order to mitigate this vulnerability.\n\n### Workarounds\nIn cases where a bump to the latest version of `go-git` is not possible, we recommend limiting its use to only trust-worthy Git servers.\n\n## Credit\nThanks to Ionut Lalu for responsibly disclosing this vulnerability to us.\n\n### References\n- [GHSA-mw99-9chc-xw7r](https://github.com/go-git/go-git/security/advisories/GHSA-mw99-9chc-xw7r)\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2023-12-27T15:06:52.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/go-git/go-git/security/advisories/GHSA-mw99-9chc-xw7r","https://nvd.nist.gov/vuln/detail/CVE-2023-49568","https://github.com/advisories/GHSA-mw99-9chc-xw7r"],"source_kind":"github","identifiers":["GHSA-mw99-9chc-xw7r","CVE-2023-49568"],"repository_url":"https://github.com/go-git/go-git","blast_radius":0.0,"created_at":"2023-12-27T16:05:49.159Z","updated_at":"2026-10-07T16:08:05.203Z","epss_percentage":0.00698,"epss_percentile":0.51516,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tdzk5LTljaGMteHc3cs4AA4Cr","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tdzk5LTljaGMteHc3cs4AA4Cr","packages":[{"ecosystem":"go","package_name":"gopkg.in/src-d/go-git.v4","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 4.7.1, \u003c= 4.13.1"}],"purl":"pkg:go/gopkg.in%2Fsrc-d%2Fgo-git.v4"},{"ecosystem":"go","package_name":"github.com/go-git/go-git/v5","versions":[{"first_patched_version":"5.11.0","vulnerable_version_range":"\u003c 5.11.0"}],"purl":"pkg:go/github.com%2Fgo-git%2Fgo-git%2Fv5"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tdzk5LTljaGMteHc3cs4AA4Cr/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/go-git/go-git/v5","docker_dependents_count":2327,"docker_downloads_count":13799364729,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/go-git/go-git/v5","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/go-git/go-git/v5/dependencies","status":null,"funding_links":[],"critical":true,"issue_metadata":{"last_synced_at":"2026-10-09T06:31:15.552Z","issues_count":687,"pull_requests_count":1292,"avg_time_to_close_issue":55102278.85714286,"avg_time_to_close_pull_request":9075997.16683831,"issues_closed_count":461,"pull_requests_closed_count":971,"pull_request_authors_count":300,"issue_authors_count":522,"avg_comments_per_issue":2.8064046579330424,"avg_comments_per_pull_request":0.9496904024767802,"merged_pull_requests_count":643,"bot_issues_count":4,"bot_pull_requests_count":302,"past_year_issues_count":79,"past_year_pull_requests_count":362,"past_year_avg_time_to_close_issue":6875504.695652174,"past_year_avg_time_to_close_pull_request":2475775.146919431,"past_year_issues_closed_count":23,"past_year_pull_requests_closed_count":211,"past_year_pull_request_authors_count":120,"past_year_issue_authors_count":56,"past_year_avg_comments_per_issue":1.3924050632911391,"past_year_avg_comments_per_pull_request":0.6270718232044199,"past_year_bot_issues_count":1,"past_year_bot_pull_requests_count":37,"past_year_merged_pull_requests_count":145,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-git%2Fgo-git/issues","maintainers":[{"login":"pjbgf","count":143,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/pjbgf"},{"login":"aymanbagabas","count":91,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/aymanbagabas"},{"login":"hiddeco","count":52,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/hiddeco"}],"active_maintainers":[{"login":"hiddeco","count":46,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/hiddeco"},{"login":"pjbgf","count":39,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/pjbgf"},{"login":"aymanbagabas","count":38,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/aymanbagabas"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgo-git%2Fgo-git%2Fv5/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgo-git%2Fgo-git%2Fv5/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgo-git%2Fgo-git%2Fv5/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgo-git%2Fgo-git%2Fv5/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgo-git%2Fgo-git%2Fv5/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgo-git%2Fgo-git%2Fv5/codemeta","maintainers":[]}