# Merge pull request #11 from entireio/soph/bump-go-git-v6-alpha2

`23db7f3`→[main](/content/gh/entireio/git-sync/commits/main/index.html)·

Soph·2mo ago·18 files·+140 added/-166 removed

Upgrade go-git to v6.0.0-alpha.2 (CVE-2026-41506)

## Changes

18

- M.golangci.yaml+1/-1
- cmd/git-sync
    - Mmain_test.go+4/-15
- Mgo.mod+4/-5
- Mgo.sum+14/-16
- internal
    - auth
        - Mauth.go+13/-5
        - Mauth_test.go+19/-23
        - Mentiredb.go+3/-4
    - gitproto
        - Mfetch.go+10/-2
        - Mfetch_test.go+13/-13
        - Mpush_test.go+3/-3
        - Mrefs.go+1/-1
        - Msmarthttp.go+37/-34
        - Msmarthttp_test.go+6/-9
    - strategy/bootstrap
        - Mbootstrap_test.go+2/-2
    - syncer
        - Mauth_test.go+3/-3
        - Mintegration_test.go+3/-26
        - Msyncer.go+1/-1
- pkg/gitsync
    - Mclient_test.go+3/-3

```

96 unmodified lines

```

```

nolintlint:  
      require-explanation: true  
      require-specific: true
```

M.golangci.yaml+1/-1

```

22 unmodified lines

```

```

413 unmodified lines

```

```

```

```

```

```

```

```

```

```

```

```

```

```

```

```

```

"github.com/go-git/go-git/v6/storage.Storer"  
- "github.com/go-git/go-git/v6/plumbing/storer.EncodedObjectIter"  
- "github.com/go-git/go-billy/v6.Filesystem"  
- "github.com/go-git/go-git/v6/plumbing/transport.AuthMethod"  
- "entire.io/git-sync/internal/auth.Method"

nolintlint:  
      require-explanation: true
      require-specific: true

```

Mcmd/git-sync/main_test.go+4/-15

```

3 unmodified lines

```

```

```

github.com/go-git/go-billy/v6 v6.0.0-20260410103409-85b6241850b5

github.com/go-git/go-git/v6 v6.0.0-alpha.1

github.com/go-git/go-git/v6 v6.0.0-alpha.2

github.com/stretchr/testify v1.11.1

github.com/zalando/go-keyring v0.2.8  
)

```

Mgo.mod+4/-5

```

github.com/go-git/gcfg/v2 v2.0.2/go.mod  
}"github.com/go-git/go-billy/v6 v6.0.0-20260410103409-85b6241850b5"  
"github.com/go-git/go-git-fixtures/v5 v5.1.2-0.20260122163445-0622d7459a67"  
\n[additional lines omitted for brevity]

gopath/module/go-pkg/gitsync.git

** Caution: **  
The above snippets and blocks follow the main changes to the original file.