Upgrade go-git to v6.0.0-alpha.2

Closes the credential-leak advisory tracked as CVE-2026-41506
(GHSA-3xc5-wrhm-f963 / Dependabot alert #1). Our smart-HTTP path
already used Go's stdlib http.Client directly, which strips the
Authorization header on cross-host redirects since 1.8 — but
upgrading clears the alert and pulls in the upstream
http.followRedirects controls.

Alpha.2 is a major rewrite of plumbing/transport. Translation:

- *transport.Endpoint (struct) → *url.URL throughout. Field
  accesses (.Scheme, .Host, .Path, .User, .Hostname()) are
  unchanged.
- transport.NewEndpoint → transport.ParseURL.
- transport.AuthMethod (interface) is gone. Defined our own
  auth.Method and gitproto.AuthMethod with a single
  Authorizer(*http.Request) error method, satisfied by
  *transporthttp.BasicAuth and *transporthttp.TokenAuth (whose
  SetAuth methods were renamed to Authorizer).
- transport.Service (typed) → string constants. Function
  parameters take string.
- transporthttp.NewTransport(*TransportOptions) →
  NewTransport(Options) (value, not pointer).
- transport.AdvertiseReferences → transport.AdvertiseRefs.
- transport.UploadPackOptions → transport.UploadPackRequest;
  transport.ReceivePackOptions → transport.ReceivePackRequest.
- transport.Register / transport.Get were removed. The TestMain
  shims in syncer/integration_test.go and cmd/git-sync/main_test.go
  registered a custom HTTP transport for go-git's transport
  registry, but our code never goes through that registry — it
  hits the network through gitproto's own http.Client. Dropped
  both shims as dead code.

Also dropped the now-unused Conn.Transport field; nothing in
git-sync read it.

Updated .golangci.yaml ireturn allowlist to permit the new
auth.Method interface where the previous transport.AuthMethod
allowance lived.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: b0d39f2320f3

Author: Soph

.golangci.yaml

@@ -97,7 +97,7 @@ linters:
         - github.com/go-git/go-git/v6/storage.Storer
         - github.com/go-git/go-git/v6/plumbing/storer.EncodedObjectIter
         - github.com/go-git/go-billy/v6.Filesystem
-        - github.com/go-git/go-git/v6/plumbing/transport.AuthMethod
+        - github.com/entirehq/git-sync/internal/auth.Method
     nolintlint:
       require-explanation: true
       require-specific: true

cmd/git-sync/main_test.go

@@ -23,7 +23,6 @@ import (
 	"github.com/go-git/go-git/v6/plumbing/protocol/packp"
 	"github.com/go-git/go-git/v6/plumbing/protocol/packp/capability"
 	"github.com/go-git/go-git/v6/plumbing/transport"
-	transporthttp "github.com/go-git/go-git/v6/plumbing/transport/http"
 	"github.com/go-git/go-git/v6/storage/memory"
 )
 
@@ -443,14 +442,14 @@ func (s *smartHTTPRepoServer) handle(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *smartHTTPRepoServer) handleInfoRefs(w http.ResponseWriter, r *http.Request) {
-	service := transport.Service(r.URL.Query().Get("service"))
+	service := r.URL.Query().Get("service")
 	if service != transport.UploadPackService && service != transport.ReceivePackService {
 		http.Error(w, "missing service", http.StatusBadRequest)
 		return
 	}
 
 	var buf bytes.Buffer
-	if err := transport.AdvertiseReferences(r.Context(), s.repo.Storer, &buf, service, false); err != nil {
+	if err := transport.AdvertiseRefs(r.Context(), s.repo.Storer, &buf, service, false); err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
@@ -506,7 +505,7 @@ func (s *smartHTTPRepoServer) handleUploadPack(w http.ResponseWriter, r *http.Re
 	var buf bytes.Buffer
 	wc := nopWriteCloser{&buf}
 
-	err := transport.UploadPack(r.Context(), s.repo.Storer, r.Body, wc, &transport.UploadPackOptions{
+	err := transport.UploadPack(r.Context(), s.repo.Storer, r.Body, wc, &transport.UploadPackRequest{
 		StatelessRPC: true,
 	})
 	if err != nil {
@@ -528,7 +527,7 @@ func (s *smartHTTPRepoServer) handleReceivePack(w http.ResponseWriter, r *http.R
 	var buf bytes.Buffer
 	wc := nopWriteCloser{&buf}
 
-	err := transport.ReceivePack(r.Context(), s.repo.Storer, r.Body, wc, &transport.ReceivePackOptions{
+	err := transport.ReceivePack(r.Context(), s.repo.Storer, r.Body, wc, &transport.ReceivePackRequest{
 		StatelessRPC: true,
 	})
 
@@ -548,12 +547,3 @@ type nopWriteCloser struct{ io.Writer }
 
 func (nopWriteCloser) Close() error { return nil }
 
-func TestMain(m *testing.M) {
-	customHTTP := transporthttp.NewTransport(&transporthttp.TransportOptions{
-		Client: &http.Client{},
-	})
-	transport.Register("http", customHTTP)
-	transport.Register("https", customHTTP)
-
-	os.Exit(m.Run())
-}

go.mod

@@ -4,7 +4,7 @@ go 1.25.2
 
 require (
 	github.com/go-git/go-billy/v6 v6.0.0-20260410103409-85b6241850b5
-	github.com/go-git/go-git/v6 v6.0.0-alpha.1
+	github.com/go-git/go-git/v6 v6.0.0-alpha.2
 	github.com/stretchr/testify v1.11.1
 	github.com/zalando/go-keyring v0.2.8
 )
@@ -19,15 +19,14 @@ require (
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/go-git/gcfg/v2 v2.0.2 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
-	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/kevinburke/ssh_config v1.6.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/pjbgf/sha1cd v0.5.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
-	golang.org/x/crypto v0.48.0 // indirect
-	golang.org/x/net v0.51.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.43.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -23,14 +23,12 @@ github.com/go-git/gcfg/v2 v2.0.2 h1:MY5SIIfTGGEMhdA7d7JePuVVxtKL7Hp+ApGDJAJ7dpo=
 github.com/go-git/gcfg/v2 v2.0.2/go.mod h1:/lv2NsxvhepuMrldsFilrgct6pxzpGdSRC13ydTLSLs=
 github.com/go-git/go-billy/v6 v6.0.0-20260410103409-85b6241850b5 h1:r5Y4Hn9QwQj+u6vN0Ib1MipHkanYaG8Zj0kxsnv8Bu4=
 github.com/go-git/go-billy/v6 v6.0.0-20260410103409-85b6241850b5/go.mod h1:CdBVp7CXl9l3sOyNEog46cP1Pvx/hjCe9AD0mtaIUYU=
-github.com/go-git/go-git-fixtures/v5 v5.1.2-0.20260122163445-0622d7459a67 h1:3hutPZF+/FBjR/9MdsLJ7e1mlt9pwHgwxMW7CrbmWII=
-github.com/go-git/go-git-fixtures/v5 v5.1.2-0.20260122163445-0622d7459a67/go.mod h1:xKt0pNHST9tYHvbiLxSY27CQWFwgIxBJuDrOE0JvbZw=
-github.com/go-git/go-git/v6 v6.0.0-alpha.1 h1:tGohX5luKeO50DZD0/Zqd5dYjJzKtub91S4I+1qFVIs=
-github.com/go-git/go-git/v6 v6.0.0-alpha.1/go.mod h1:qtzfNHlFsnq6vCw54aT4KvFWPK5bsOpTVtFC2sysdB8=
+github.com/go-git/go-git-fixtures/v6 v6.0.0-20260405195209-b16dd39735e0 h1:XoTsdvaghuVfIr7HpNTmFDLu2nz3I2iGqyn6Uk6MkJc=
+github.com/go-git/go-git-fixtures/v6 v6.0.0-20260405195209-b16dd39735e0/go.mod h1:1Lr7/vYEYyl6Ir9Ku0tKrCIRreM5zovv0Jdx2MPSM4s=
+github.com/go-git/go-git/v6 v6.0.0-alpha.2 h1:T3loNtDuAixNzXtlQxZhnYiYpaQ3CA4vn9RssAniEeI=
+github.com/go-git/go-git/v6 v6.0.0-alpha.2/go.mod h1:oCD3i19CTz7gBpeb11ZZqL91WzqbMq9avn5KpUYy/Ak=
 github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
 github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
 github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
@@ -54,18 +52,18 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPccHs=
 github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0=
-golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
-golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
-golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
-golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
 golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
-golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

internal/auth/auth.go

@@ -3,15 +3,23 @@ package auth
 import (
 	"context"
 	"fmt"
+	"net/http"
+	"net/url"
 	"os/exec"
 	"strings"
 
-	"github.com/go-git/go-git/v6/plumbing/transport"
 	transporthttp "github.com/go-git/go-git/v6/plumbing/transport/http"
 )
 
 const defaultGitUsername = "git"
 
+// Method authorizes outbound HTTP requests for a remote. It is satisfied
+// by *transporthttp.BasicAuth and *transporthttp.TokenAuth, whose Authorizer
+// methods replaced the Method interface that go-git removed in v6 alpha.2.
+type Method interface {
+	Authorizer(req *http.Request) error
+}
+
 // Endpoint holds the authentication-related fields for a remote.
 type Endpoint struct {
 	Username      string
@@ -22,7 +30,7 @@ type Endpoint struct {
 
 // Resolve resolves the auth method for the given endpoint configuration.
 // Order: explicit flags → Entire DB token → git credential helper → anonymous.
-func Resolve(raw Endpoint, ep *transport.Endpoint) (transport.AuthMethod, error) {
+func Resolve(raw Endpoint, ep *url.URL) (Method, error) {
 	if auth := explicitAuth(raw); auth != nil {
 		return auth, nil
 	}
@@ -43,7 +51,7 @@ func Resolve(raw Endpoint, ep *transport.Endpoint) (transport.AuthMethod, error)
 	return nil, nil //nolint:nilnil // nil signals no auth method found at this stage
 }
 
-func explicitAuth(raw Endpoint) transport.AuthMethod {
+func explicitAuth(raw Endpoint) Method {
 	if raw.BearerToken != "" {
 		return &transporthttp.TokenAuth{Token: raw.BearerToken}
 	}
@@ -64,7 +72,7 @@ var GitCredentialFillCommand = func(ctx context.Context, input string) ([]byte,
 	return cmd.Output()
 }
 
-func lookupGitCredential(ep *transport.Endpoint) (string, string, bool) {
+func lookupGitCredential(ep *url.URL) (string, string, bool) {
 	input := credentialFillInput(ep)
 	if input == "" {
 		return "", "", false
@@ -89,7 +97,7 @@ func lookupGitCredential(ep *transport.Endpoint) (string, string, bool) {
 	return username, password, true
 }
 
-func credentialFillInput(ep *transport.Endpoint) string {
+func credentialFillInput(ep *url.URL) string {
 	if ep == nil || ep.Hostname() == "" {
 		return ""
 	}

internal/auth/auth_test.go

@@ -120,13 +120,11 @@ func TestTokenExpiredOrExpiring(t *testing.T) {
 }
 
 func TestCredentialFillInput(t *testing.T) {
-	ep := &transport.Endpoint{
-		URL: url.URL{
-			Scheme: "https",
-			Host:   "github.com",
-			Path:   "/owner/repo.git",
-			User:   url.User("myuser"),
-		},
+	ep := &url.URL{
+		Scheme: "https",
+		Host:   "github.com",
+		Path:   "/owner/repo.git",
+		User:   url.User("myuser"),
 	}
 
 	got := credentialFillInput(ep)
@@ -144,20 +142,18 @@ func TestCredentialFillInputNilEndpoint(t *testing.T) {
 }
 
 func TestCredentialFillInputEmptyHost(t *testing.T) {
-	ep := &transport.Endpoint{URL: url.URL{Scheme: "https"}}
+	ep := &url.URL{Scheme: "https"}
 	got := credentialFillInput(ep)
 	if got != "" {
 		t.Errorf("expected empty string for empty host, got %q", got)
 	}
 }
 
 func TestCredentialFillInputNoUser(t *testing.T) {
-	ep := &transport.Endpoint{
-		URL: url.URL{
-			Scheme: "https",
-			Host:   "example.com",
-			Path:   "/repo.git",
-		},
+	ep := &url.URL{
+		Scheme: "https",
+		Host:   "example.com",
+		Path:   "/repo.git",
 	}
 	got := credentialFillInput(ep)
 	want := "protocol=https\nhost=example.com\npath=repo.git\n\n"
@@ -227,17 +223,17 @@ func TestParseCredentialOutput(t *testing.T) {
 }
 
 func TestResolve(t *testing.T) {
-	ep, err := transport.NewEndpoint("https://example.com/repo.git")
+	ep, err := transport.ParseURL("https://example.com/repo.git")
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	sshEP := &transport.Endpoint{URL: url.URL{Scheme: "ssh", Host: "example.com", Path: "/repo.git"}}
+	sshEP := &url.URL{Scheme: "ssh", Host: "example.com", Path: "/repo.git"}
 
 	tests := []struct {
 		name     string
 		raw      Endpoint
-		ep       *transport.Endpoint
+		ep       *url.URL
 		mockCred func(ctx context.Context, input string) ([]byte, error)
 		wantType string // "token", "basic", "nil"
 		wantUser string
@@ -414,17 +410,17 @@ func TestExplicitAuth(t *testing.T) {
 func TestEndpointBaseURL(t *testing.T) {
 	tests := []struct {
 		name string
-		ep   *transport.Endpoint
+		ep   *url.URL
 		want string
 	}{
 		{
 			name: "https host",
-			ep:   &transport.Endpoint{URL: url.URL{Scheme: "https", Host: "example.com"}},
+			ep:   &url.URL{Scheme: "https", Host: "example.com"},
 			want: "https://example.com",
 		},
 		{
 			name: "http host with port",
-			ep:   &transport.Endpoint{URL: url.URL{Scheme: "http", Host: "example.com:8080"}},
+			ep:   &url.URL{Scheme: "http", Host: "example.com:8080"},
 			want: "http://example.com:8080",
 		},
 		{
@@ -447,17 +443,17 @@ func TestEndpointBaseURL(t *testing.T) {
 func TestEndpointCredentialHost(t *testing.T) {
 	tests := []struct {
 		name string
-		ep   *transport.Endpoint
+		ep   *url.URL
 		want string
 	}{
 		{
 			name: "host without port",
-			ep:   &transport.Endpoint{URL: url.URL{Host: "example.com"}},
+			ep:   &url.URL{Host: "example.com"},
 			want: "example.com",
 		},
 		{
 			name: "host with port",
-			ep:   &transport.Endpoint{URL: url.URL{Host: "example.com:8080"}},
+			ep:   &url.URL{Host: "example.com:8080"},
 			want: "example.com:8080",
 		},
 		{

internal/auth/entiredb.go

@@ -14,7 +14,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/go-git/go-git/v6/plumbing/transport"
 	"github.com/zalando/go-keyring"
 )
 
@@ -39,7 +38,7 @@ type oauthTokenResponse struct {
 // Returns (username, password, true, nil) on success, ("", "", false, nil) when
 // no credential is configured, or ("", "", false, err) when a credential exists
 // but refresh failed (issue #7).
-func LookupEntireDBCredential(raw Endpoint, ep *transport.Endpoint) (string, string, bool, error) {
+func LookupEntireDBCredential(raw Endpoint, ep *url.URL) (string, string, bool, error) {
 	if ep == nil || ep.Host == "" {
 		return "", "", false, nil
 	}
@@ -58,7 +57,7 @@ func LookupEntireDBCredential(raw Endpoint, ep *transport.Endpoint) (string, str
 	return username, token, true, nil
 }
 
-func endpointBaseURL(ep *transport.Endpoint) string {
+func endpointBaseURL(ep *url.URL) string {
 	if ep == nil || ep.Hostname() == "" {
 		return ""
 	}
@@ -70,7 +69,7 @@ func endpointBaseURL(ep *transport.Endpoint) string {
 	return scheme + "://" + host
 }
 
-func endpointCredentialHost(ep *transport.Endpoint) string {
+func endpointCredentialHost(ep *url.URL) string {
 	if ep == nil {
 		return ""
 	}