v2

Feb 25, 2026 GO-2026-4909 +1 more

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Feb 9, 2026 GO-2026-4909 +1 more

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Nov 23, 2025 GO-2026-4473 +2 more

  GO-2026-4473: Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Sep 17, 2025 GO-2026-4473 +2 more

  GO-2026-4473: Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Jun 6, 2025 GO-2026-4473 +2 more

  GO-2026-4473: Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Jun 4, 2025 GO-2026-4473 +2 more

  GO-2026-4473: Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Apr 14, 2025 GO-2026-4473 +2 more

  GO-2026-4473: Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Apr 10, 2025 GO-2026-4473 +2 more

  GO-2026-4473: Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Feb 27, 2025 GO-2026-4473 +2 more

  GO-2026-4473: Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Jan 22, 2025 GO-2026-4473 +2 more

  GO-2026-4473: Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Jan 2, 2025 GO-2026-4473 +2 more

  GO-2026-4473: Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Dec 28, 2024 GO-2026-4473 +2 more

  GO-2026-4473: Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Mar 19, 2024 GO-2025-3367 +4 more

  GO-2025-3367: Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git

  GO-2025-3368: Argument Injection via the URL field in github.com/go-git/go-git

  GO-2026-4473: Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Dec 8, 2023 GO-2025-3367 +4 more

  GO-2025-3367: Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git

  GO-2025-3368: Argument Injection via the URL field in github.com/go-git/go-git

  GO-2026-4473: Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Nov 25, 2023 GO-2024-2456 +6 more

  GO-2024-2456: Path traversal and RCE in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4

  GO-2024-2466: Denial of service in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4

  GO-2025-3367: Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git

  GO-2025-3368: Argument Injection via the URL field in github.com/go-git/go-git

  GO-2026-4473: Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Oct 13, 2023 GO-2024-2456 +6 more

  GO-2024-2456: Path traversal and RCE in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4

  GO-2024-2466: Denial of service in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4

  GO-2025-3367: Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git

  GO-2025-3368: Argument Injection via the URL field in github.com/go-git/go-git

  GO-2026-4473: Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

  GO-2026-4909: Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git

  GO-2026-4910: Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Changes in this version

+ var ErrMalformedCommitGraphFile = errors.New("malformed commit graph file")

+ var ErrUnsupportedHash = errors.New("unsupported hash algorithm")

+ var ErrUnsupportedVersion = errors.New("unsupported version")

+ func OpenChainFile(r io.Reader) ([]string, error)

+ type ChunkType int

+ const BaseGraphsListChunk

+ const BloomFilterDataChunk

+ const BloomFilterIndexChunk

+ const CommitDataChunk

+ const ExtraEdgeListChunk

+ const GenerationDataChunk

+ const GenerationDataOverflowChunk

+ const OIDFanoutChunk

+ const OIDLookupChunk

+ const ZeroChunk

+ func ChunkTypeFromBytes(b []byte) (ChunkType, bool)

+ func (ct ChunkType) Signature() []byte

+ type CommitData struct

+ Generation uint64

+ GenerationV2 uint64

+ ParentHashes []plumbing.Hash

+ ParentIndexes []uint32

+ TreeHash plumbing.Hash

+ When time.Time

+ func (c *CommitData) GenerationV2Data() uint64

+ type Encoder struct

+ func NewEncoder(w io.Writer) *Encoder

+ func (e *Encoder) Encode(idx Index) error

+ type Index interface

+ GetCommitDataByIndex func(i uint32) (*CommitData, error)

+ GetHashByIndex func(i uint32) (plumbing.Hash, error)

+ GetIndexByHash func(h plumbing.Hash) (uint32, error)

+ HasGenerationV2 func() bool

+ Hashes func() []plumbing.Hash

+ MaximumNumberOfHashes func() uint32

+ func OpenChainIndex(fs billy.Filesystem) (Index, error)

+ func OpenChainOrFileIndex(fs billy.Filesystem) (Index, error)

+ func OpenFileIndex(reader ReaderAtCloser) (Index, error)

+ func OpenFileIndexWithParent(reader ReaderAtCloser, parent Index) (Index, error)

+ type MemoryIndex struct

+ func NewMemoryIndex() *MemoryIndex

+ func (mi *MemoryIndex) Add(hash plumbing.Hash, data *CommitData)

+ func (mi *MemoryIndex) Close() error

+ func (mi *MemoryIndex) GetCommitDataByIndex(i uint32) (*CommitData, error)

+ func (mi *MemoryIndex) GetHashByIndex(i uint32) (plumbing.Hash, error)

+ func (mi *MemoryIndex) GetIndexByHash(h plumbing.Hash) (uint32, error)

+ func (mi *MemoryIndex) HasGenerationV2() bool

+ func (mi *MemoryIndex) Hashes() []plumbing.Hash

+ func (mi *MemoryIndex) MaximumNumberOfHashes() uint32

+ type ReaderAtCloser interface