golang-github-go-git-go-git-v6 - Debian Package Tracker

general

source: golang-github-go-git-go-git-v6 (main)
version: 6.0.0~alpha.4-1
maintainer: Daniel Baumann (DMD)
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

testing: 6~git20260305.2083cf94-3
unstable: 6.0.0~alpha.4-1

versioned links

6~git20260305.2083cf94-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.0.0~alpha.4-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

golang-github-go-git-go-git-v6-dev

action needed

Marked for autoremoval on 15 August due to golang-github-go-git-go-billy-v6: #1141292, #1141290 high

Version 6~git20260305.2083cf94-3 of golang-github-go-git-go-git-v6 is marked for autoremoval from testing on Sat 15 Aug 2026. It is affected by #1141292. The removal of golang-github-go-git-go-git-v6 will also cause the removal of (transitive) reverse dependency: git-pages. It depends (transitively) on golang-github-go-git-go-billy-v6, affected by #1141290. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-07-09 Last update: 2026-07-14 22:30

4 security issues in forky high

There are 4 open security issues in forky.

4 important issues:

CVE-2026-41506: go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.
CVE-2026-45022: go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from how Git itself would interpret or reject the same object. Additionally, go-git’s commit signing and verification logic operates over commit data reconstructed from go-git’s parsed representation rather than the original raw object bytes. As a result, go-git may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository. This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed. This vulnerability is fixed in 5.19.0 and 6.0.0-alpha.3.
CVE-2026-45570: go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.
CVE-2026-45571: go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.

Created: 2026-06-02 Last update: 2026-06-02 20:00

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2026-06-07 Last update: 2026-07-14 23:02

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 3b20de62b232edb4470078a4b613cc9ad46ce83a
Author: Daniel Baumann <daniel@debian.org>
Date:   Thu Jun 25 07:17:39 2026 +0200

    Setting go compatibility in rules.
    
    Signed-off-by: Daniel Baumann <daniel@debian.org>

commit 9cf508b3b3c2b0d83812c83d05af6966fa09ce14
Author: Daniel Baumann <daniel@debian.org>
Date:   Wed Jun 10 17:22:50 2026 +0200

    Using references in copyright to refer to full license texts.
    
    Signed-off-by: Daniel Baumann <daniel@debian.org>

Created: 2026-06-11 Last update: 2026-07-14 21:01

testing migrations

excuses:
- Migration status for golang-github-go-git-go-git-v6 (6~git20260305.2083cf94-3 to 6.0.0~alpha.4-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Autopkgtest for git-pages/0.5.0-1: amd64: Regression ♻ (reference ♻), arm64: Regression ♻ (reference ♻), ppc64el: Regression ♻ (reference ♻), riscv64: Regression ♻ (reference ♻), s390x: Regression ♻ (reference ♻)
- ∙ ∙ Autopkgtest for golang-github-go-git-go-git-v6/6.0.0~alpha.4-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- Additional info (not blocking):
- ∙ ∙ Updating golang-github-go-git-go-git-v6 will fix bugs in testing: #1141292
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/g/golang-github-go-git-go-git-v6.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ 43 days old (needed 5 days)
- Not considered

news

[rss feed]

[2026-06-02] Accepted golang-github-go-git-go-git-v6 6.0.0~alpha.4-1 (source) into unstable (Daniel Baumann)
[2026-05-31] Accepted golang-github-go-git-go-git-v6 6.0.0~alpha4-2 (source) into unstable (Daniel Baumann)
[2026-05-31] Accepted golang-github-go-git-go-git-v6 6.0.0~alpha4-1 (source) into unstable (Daniel Baumann)
[2026-04-02] golang-github-go-git-go-git-v6 6~git20260305.2083cf94-3 MIGRATED to testing (Debian testing watch)
[2026-03-14] Accepted golang-github-go-git-go-git-v6 6~git20260305.2083cf94-3 (source) into unstable (Daniel Baumann)
[2026-03-14] Accepted golang-github-go-git-go-git-v6 6~git20260305.2083cf94-2 (source) into unstable (Daniel Baumann)
[2026-03-11] Accepted golang-github-go-git-go-git-v6 6~git20260305.2083cf94-1 (source all) into unstable (Debian FTP Masters) (signed by: Daniel Baumann)

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 6.0.0~alpha.4-1