An open index of dependabot pull requests across open source projects.

github.com/go-git/go-git/v5

Ecosystem:
go
Package URL:
pkg:golang/github.com/go-git/go-git/v5
Total PRs:
2,693 Dependabot PRs
Latest PR:
2 days ago
Unique Repositories:
1,112 repositories
Unique Repos (30 days):
87 repositories
Security Advisories
go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git
GHSA-389r-gv7p-r3rp CVE-2026-45022 HIGH published 14 days ago • updated 5 days ago
### Impact `go-git` may parse malformed Git objects in a way that differs from upstream Git. When `commit` or `tag` objects contain ambiguous or ma...
go-git: Improper single-quote escaping in go-git SSH transport
GHSA-m7cr-m3pv-hgrp CVE-2026-45570 LOW published 6 days ago • updated 5 days ago
### Impact `go-git`'s SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single qu...
go-git: Credential leak via cross-host redirect in smart HTTP transport
GHSA-3xc5-wrhm-f963 CVE-2026-41506 MODERATE published about 1 month ago • updated 5 days ago
### Impact `go-git` may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. If a remote re...
go-git: Maliciously crafted idx file can cause asymmetric memory consumption
GHSA-jhf3-xxhw-2wpp CVE-2026-34165 MODERATE published about 2 months ago • updated 5 days ago
### Impact A vulnerability has been identified in which a maliciously crafted `.idx` file can cause asymmetric memory consumption, potentially exh...
go-git improperly verifies data integrity values for .idx and .pack files
GHSA-37cx-329c-33x3 CVE-2026-25934 MODERATE published 3 months ago • updated 5 days ago
### Impact A vulnerability was discovered in `go-git` whereby data integrity values for `.pack` and `.idx` files were not properly verified. This...
Recent PRs
Package Details
Name: github.com/go-git/go-git/v5
Ecosystem: go
PURL Type: golang
Package URL: pkg:golang/github.com/go-git/go-git/v5
JSON API: View JSON
Security Advisories

11

Active advisories
CRITICAL 2
HIGH 3
MODERATE 4
LOW 2
View All golang Advisories
Package Information
Description:

A highly extensible git implementation in pure Go. go-git aims to reach the completeness of libgit2 or jgit, nowadays covers the majority of the plumbing read operations and some of the main write operations, but lacks the main porcelain operations such as merges. It is highly extensible, we have been following the open/close principle in its design to facilitate extensions, mainly focusing the efforts on the persistence of the objects.

Repository: https://github.com/go-git/go-git
Homepage: https://github.com/go-git/go-git
Latest Release: v5.16.1
12 months ago
Dependent Repos: 13,417
Dependent Packages: 8,164
Ranking: Top 0.0657% by dependent repos Top 0.0353% by dependent pkgs
PR Status
Open 1,190 (44.2%)
Merged 308 (11.4%)
Closed 950 (35.3%)
PR Types
Minor 1,382 (51.3%)
Patch 1,066 (39.6%)