Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY]

[pulumi-renovate]

This PR contains the following updates:

Package	Type	Update	Change
github.com/go-git/go-git/v5	indirect	minor	v5.16.5 -> v5.17.1

---

go-git: Maliciously crafted idx file can cause asymmetric memory consumption

CVE-2026-34165 / GHSA-jhf3-xxhw-2wpp

More information

Details

Impact

A vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a Denial of Service (DoS) condition.

Exploitation requires write access to the local repository's .git directory, it order to create or alter existing .idx files.

Patches

Users should upgrade to v5.17.1, or the latest v6 pseudo-version, in order to mitigate this vulnerability.

Credit

The go-git maintainers thank @​kq5y for finding and reporting this issue privately to the go-git project.

Severity

• CVSS Score: 5.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

References

• https://github.com/go-git/go-git/security/advisories/GHSA-jhf3-xxhw-2wpp
• https://nvd.nist.gov/vuln/detail/CVE-2026-34165
• https://github.com/go-git/go-git
• https://github.com/go-git/go-git/releases/tag/v5.17.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

go-git missing validation decoding Index v4 files leads to panic

CVE-2026-33762 / GHSA-gm2x-2g9h-ccm8

More information

Details

Impact

go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing.

This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue.

An attacker able to supply a crafted .git/index file can cause applications using go-git to panic while reading the index. If the application does not recover from panics, this results in process termination, leading to a denial-of-service (DoS) condition.

Exploitation requires the ability to modify or inject a Git index file within the local repository in disk. This typically implies write access to the .git directory.

Patches

Users should upgrade to v5.17.1, or the latest v6 pseudo-version, in order to mitigate this vulnerability.

Credit

go-git maintainers thank @​kq5y for finding and reporting this issue privately to the go-git project.

Severity

• CVSS Score: 2.8 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

References

• https://github.com/go-git/go-git/security/advisories/GHSA-gm2x-2g9h-ccm8
• https://nvd.nist.gov/vuln/detail/CVE-2026-33762
• https://github.com/go-git/go-git
• https://github.com/go-git/go-git/releases/tag/v5.17.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

go-git/go-git (github.com/go-git/go-git/v5)

v5.17.1

Compare Source

What's Changed

• build: Update module github.com/cloudflare/circl to v1.6.3 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] inhttps://github.com/go-git/go-git/pull/19300
• [v5] plumbing: format/index, Improve v4 entry name validation by @​pjbgf in https://github.com/go-git/go-git/pull/1935
• [v5] plumbing: format/idxfile, Fix version and fanout checks by @​pjbgf in https://github.com/go-git/go-git/pull/1937

Full Changelog: go-git/go-git@v5.17.0...v5.17.1

v5.17.0

Compare Source

What's Changed

• build: Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] inhttps://github.com/go-git/go-git/pull/18399
• git: worktree, optimize infiles function for very large repos by @​k-anshul in https://github.com/go-git/go-git/pull/1853
• git: Add strict checks for supported extensions by @​pjbgf in https://github.com/go-git/go-git/pull/1861
• backport, git: Improve Status() speed with new index.ModTime check by @​cedric-appdirect in https://github.com/go-git/go-git/pull/1862
• storage: filesystem, Avoid overwriting loose obj files by @​pjbgf in https://github.com/go-git/go-git/pull/1864

Full Changelog: go-git/go-git@v5.16.5...v5.17.0

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 Automerge: Disabled because a matching PR was automerged previously.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[pulumi-renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: ovhcloud-go-kubernetes/go.sum

Command failed: go get -d -t ./...
go: -d flag is deprecated. -d=true is a no-op
go: errors parsing go.mod:
go.mod:6:2: require github.com/ovh/pulumi-ovh/sdk: version "v2.1.1" invalid: should be v0 or v1, not v2