chore(deps): update module github.com/go-git/go-git/v5 to v5.16.5 [security] by NumaryBot · Pull Request #1259 · formancehq/ledger

NumaryBot · 2026-02-10T03:01:30Z

This PR contains the following updates:

Package	Type	Update	Change
github.com/go-git/go-git/v5	indirect	patch	`v5.16.0` -> `v5.16.5`

GitHub Vulnerability Alerts

CVE-2026-25934

Impact

A vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found.

For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly.

Note that the lack of verification of the packfile checksum has no impact on the trust relationship between the client and server, which is enforced based on the protocol being used (e.g. TLS in the case of https:// or known hosts for ssh://). In other words, the packfile checksum verification does not provide any security benefits when connecting to a malicious or compromised Git server.

Patches

Users should upgrade to v5.16.5, or the latest v6 pseudo-version, in order to mitigate this vulnerability.

Workarounds

In case updating to a fixed version of go-git is not possible, users can run git fsck from the git cli to check for data corruption on a given repository.

Credit

Thanks @N0zoM1z0 for finding and reporting this issue privately to the go-git project.

go-git improperly verifies data integrity values for .idx and .pack files

CVE-2026-25934 / GHSA-37cx-329c-33x3 / GO-2026-4473

More information

Details

Impact

A vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found.

For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly.

Note that the lack of verification of the packfile checksum has no impact on the trust relationship between the client and server, which is enforced based on the protocol being used (e.g. TLS in the case of https:// or known hosts for ssh://). In other words, the packfile checksum verification does not provide any security benefits when connecting to a malicious or compromised Git server.

Patches

Users should upgrade to v5.16.5, or the latest v6 pseudo-version, in order to mitigate this vulnerability.

Workarounds

In case updating to a fixed version of go-git is not possible, users can run git fsck from the git cli to check for data corruption on a given repository.

Credit

Thanks @N0zoM1z0 for finding and reporting this issue privately to the go-git project.

Severity

CVSS Score: 4.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

CVE-2026-25934 / GHSA-37cx-329c-33x3 / GO-2026-4473

More information

Details

Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

utils: merkletrie, Fix diff on sparse-checkout index. Fixes #1406 to releases/v5.x by @kane8n in https://github.com/go-git/go-git/pull/1561

New Contributors

@kane8n made their first contribution in https://github.com/go-git/go-git/pull/1561

Full Changelog: go-git/go-git@v5.16.0...v5.16.1

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

coderabbitai · 2026-02-10T03:01:41Z

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

deployments/pulumi/go.mod is excluded by !**/*.mod
deployments/pulumi/go.sum is excluded by !**/*.sum, !**/*.sum

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch renovate/go-gitlite.zycloud.tk-go-git-go-git-v5-vulnerability

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov · 2026-02-10T03:06:38Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.18%. Comparing base (be673c1) to head (b679feb).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1259   +/-   ##
=======================================
  Coverage   81.18%   81.18%           
=======================================
  Files         205      205           
  Lines       10926    10926           
=======================================
  Hits         8870     8870           
  Misses       1524     1524           
  Partials      532      532

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…curity]

NumaryBot requested a review from a team as a code owner February 10, 2026 03:01

NumaryBot added the security label Feb 10, 2026

NumaryBot enabled auto-merge February 10, 2026 03:01

NumaryBot force-pushed the renovate/go-gitlite.zycloud.tk-go-git-go-git-v5-vulnerability branch from 5e10fbd to 0e4f48b Compare February 12, 2026 03:02

NumaryBot force-pushed the renovate/go-gitlite.zycloud.tk-go-git-go-git-v5-vulnerability branch from 0e4f48b to 71f4f20 Compare February 20, 2026 02:58

chore(deps): update module github.com/go-git/go-git/v5 to v5.16.5 [se…

b679feb

…curity]

NumaryBot force-pushed the renovate/go-gitlite.zycloud.tk-go-git-go-git-v5-vulnerability branch from 71f4f20 to b679feb Compare February 22, 2026 03:01

gfyrag approved these changes Feb 23, 2026

View reviewed changes

NumaryBot added this pull request to the merge queue Feb 23, 2026

Merged via the queue into main with commit 5189c39 Feb 23, 2026
9 checks passed

NumaryBot deleted the renovate/go-gitlite.zycloud.tk-go-git-go-git-v5-vulnerability branch February 23, 2026 08:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update module github.com/go-git/go-git/v5 to v5.16.5 [security]#1259

chore(deps): update module github.com/go-git/go-git/v5 to v5.16.5 [security]#1259
NumaryBot merged 1 commit intomainfrom
renovate/go-gitlite.zycloud.tk-go-git-go-git-v5-vulnerability

NumaryBot commented Feb 10, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Feb 10, 2026 •

edited

Loading

Review skipped

Uh oh!

codecov bot commented Feb 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

NumaryBot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

CVE-2026-25934

Impact

Patches

Workarounds

Credit

go-git improperly verifies data integrity values for .idx and .pack files

Details

Impact

Patches

Workarounds

Credit

Severity

References

Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

Details

Severity

References

Release Notes

v5.16.5

What's Changed

v5.16.4

What's Changed

v5.16.3

What's Changed

v5.16.2

What's Changed

v5.16.1

What's Changed

New Contributors

Configuration

Uh oh!

coderabbitai bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

codecov bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

NumaryBot commented Feb 10, 2026 •

edited

Loading

`v5.16.5`

`v5.16.4`

`v5.16.3`

`v5.16.2`

`v5.16.1`

coderabbitai bot commented Feb 10, 2026 •

edited

Loading

codecov bot commented Feb 10, 2026 •

edited

Loading