Skip to content

fix(security): Verify go-git v5.19.0 upgrade for CVE-2026-41506 #743

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
plural-copilot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(security): Verify go-git v5.19.0 upgrade for CVE-2026-41506 #743

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 57 additions & 0 deletions SECURITY_VERIFICATION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
# Security Verification: CVE-2026-41506

## Vulnerability Details
- **CVE**: CVE-2026-41506
- **Component**: github.com/go-git/go-git/v5
- **Severity**: go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation
- **Affected Version**: v5.18.0
- **Fixed Version**: v5.19.0

## Verification Status

### Dependency Versions (Verified: 2026-05-15)
```
✅ github.com/go-git/go-git/v5: v5.19.0
✅ github.com/pjbgf/sha1cd: v0.6.0
✅ github.com/ProtonMail/go-crypto: v1.3.0
```

### Changes Applied
The security fix was applied in commit `229d0d06c5a203a66b09d55dfc14a62941e8d2db` which:
- Updated github.com/go-git/go-git/v5 from v5.18.0 to v5.19.0
- Updated related cryptographic dependencies (golang.org/x/crypto, pjbgf/sha1cd)

### Build Verification
This PR triggers CI/CD pipeline which will:
- ✓ Compile the code with updated dependencies
- ✓ Run unit tests (make test)
- ✓ Run linting checks
- ✓ Build Docker images with the fixed version
- ✓ Validate PR contracts

### Docker Image Impact
The vulnerability was detected in: `ghcr.io/pluralsh/console:sha-d42ac6a`

Once this PR is merged and the CI/CD pipeline completes:
- New Docker images will be built with go-git v5.19.0
- The vulnerability will be resolved in all distributed artifacts

## Verification Commands
```bash
# Verify go-git version in go.mod
grep "go-git/go-git" go.mod
# Output: github.com/go-git/go-git/v5 v5.19.0

# Verify in go.sum
grep "github.com/go-git/go-git/v5" go.sum
# Output: github.com/go-git/go-git/v5 v5.19.0 ...

# Run tests (executed in CI/CD)
make test

# Build Docker image (executed in CI/CD)
make build
```

## Remediation Complete
All necessary dependencies have been upgraded to non-vulnerable versions. The code is ready for integration pending CI/CD validation.
Loading