[v5] git: Add strict checks for supported extensions by pjbgf · Pull Request #1861 · go-git/go-git

pjbgf · 2026-02-23T09:22:57Z

The upstream Git enforces fail-safe heuristics to ensure that older git versions will avoid handling repositories using extensions they are unaware of.

The logic is largely based on the value of core.repositoryformatversion. As per official Git docs:

This version specifies the rules for operating on the on-disk repository data.
An implementation of git which does not understand a particular version
advertised by an on-disk repository MUST NOT operate on that repository;
doing so risks not only producing wrong results, but actually losing data.

Now go-git will ensure that:

The git.Open logic will verify and enforces the extension support rules.
go-git will keep track of built-in extensions that it supports.

This is a breaking change and it will force go-git to not be able to open repositories that it in fact doesn't really support. Conversaly, the error messages will be more useful (e.g. unknown extension: X vs object not found).

Upstream refs:

Back-port of #1850.

The upstream Git enforces fail-safe heuristics to ensure that older git versions will avoid handling repositories using extensions they are unaware of. The logic is largely based on the value of core.repositoryformatversion. As per official Git docs: > This version specifies the rules for operating on the on-disk repository data. > An implementation of git which does not understand a particular version > advertised by an on-disk repository MUST NOT operate on that repository; > doing so risks not only producing wrong results, but actually losing data. Now go-git will ensure that: - The git.Open logic will verify and enforces the extension support rules. - go-git will keep track of built-in extensions that it supports. This is a breaking change and it will force go-git to not be able to open repositories that it in fact doesn't really support. Conversaly, the error messages will be more useful (e.g. unknown extension vs object not found). Upstream refs: - https://git-scm.com/docs/git-config#Documentation/git-config.txt-extensions - https://git-scm.com/docs/gitrepository-layout#_git_repository_format_versions Signed-off-by: Paulo Gomes <[email protected]>

Copilot

Pull request overview

This PR backports strict Git extension validation from #1850 to go-git v5. It enforces Git's fail-safe heuristics for repository format versions, ensuring go-git refuses to open repositories using unsupported extensions or format versions.

Changes:

Added extension validation logic in verifyExtensions() function that checks repository format version compatibility
Integrated extension checks into the Open() function to reject unsupported repositories early
Added comprehensive test coverage for various extension and format version scenarios

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
repository_extensions.go	New file implementing core extension validation logic with error definitions, supported extension maps, and the verifyExtensions function
repository.go	Integrates extension validation into the Open function by calling verifyExtensions after loading config
repository_extensions_test.go	New test file with table-driven tests covering various extension and format version scenarios

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

repository_extensions_test.go

repository_extensions.go

The test workflow for v5 diverged from main slightly, including its job name, which caused it to not be in-sync with the latest repository rulesets. Signed-off-by: Paulo Gomes <[email protected]>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.16.5` -> `v5.17.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-git%2fgo-git%2fv5/v5.17.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-git%2fgo-git%2fv5/v5.16.5/v5.17.0?slim=true) | --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.17.0`](https://github.com/go-git/go-git/releases/tag/v5.17.0) [Compare Source](go-git/go-git@v5.16.5...v5.17.0) #### What's Changed - build: Update module github.com/go-git/go-git/v5 to v5.16.5 \[SECURITY] (releases/v5.x) by [@go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#1839](go-git/go-git#1839) - git: worktree, optimize infiles function for very large repos by [@k-anshul](https://github.com/k-anshul) in [#1853](go-git/go-git#1853) - git: Add strict checks for supported extensions by [@pjbgf](https://github.com/pjbgf) in [#1861](go-git/go-git#1861) - backport, git: Improve Status() speed with new index.ModTime check by [@cedric-appdirect](https://github.com/cedric-appdirect) in [#1862](go-git/go-git#1862) - storage: filesystem, Avoid overwriting loose obj files by [@pjbgf](https://github.com/pjbgf) in [#1864](go-git/go-git#1864) **Full Changelog**: <go-git/go-git@v5.16.5...v5.17.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1410 Reviewed-by: Mathieu Fenniak <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]>

This PR contains the following updates: | Package | Type | Update | Change | OpenSSF | |---|---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | require | minor | `v5.16.5` → `v5.17.0` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/go-git/go-git/badge)](https://securityscorecards.dev/viewer/?uri=github.com/go-git/go-git) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.17.0`](https://github.com/go-git/go-git/releases/tag/v5.17.0) [Compare Source](go-git/go-git@v5.16.5...v5.17.0) #### What's Changed - build: Update module github.com/go-git/go-git/v5 to v5.16.5 \[SECURITY] (releases/v5.x) by [@go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#1839](go-git/go-git#1839) - git: worktree, optimize infiles function for very large repos by [@k-anshul](https://github.com/k-anshul) in [#1853](go-git/go-git#1853) - git: Add strict checks for supported extensions by [@pjbgf](https://github.com/pjbgf) in [#1861](go-git/go-git#1861) - backport, git: Improve Status() speed with new index.ModTime check by [@cedric-appdirect](https://github.com/cedric-appdirect) in [#1862](go-git/go-git#1862) - storage: filesystem, Avoid overwriting loose obj files by [@pjbgf](https://github.com/pjbgf) in [#1864](go-git/go-git#1864) **Full Changelog**: <go-git/go-git@v5.16.5...v5.17.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday ( * 0-4,22-23 * * 1-5 ), Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://altlinux.space/stapler/stplr/pulls/333 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]>

v5.17.0 includes strict extension checks (go-git/go-git#1861) but it causes problems for `worktreeconfig` because it wasn't added to the supported extension list until go-git/go-git#1877. Until it's released, we need to keep the version back. Signed-off-by: Charith Ellawala <[email protected]>

v5.17.0 includes strict extension checks (go-git/go-git#1861) but it causes problems for `worktreeconfig` because it wasn't added to the supported extension list until go-git/go-git#1877. Until it's released, we need to keep the version back. Signed-off-by: Charith Ellawala <[email protected]> Signed-off-by: Charith Ellawala <[email protected]>

v5.17.0 includes strict extension checks (go-git/go-git#1861) but it causes problems for `worktreeconfig` because it wasn't added to the supported extension list until go-git/go-git#1877. Until it's released, we need to keep the version back. Signed-off-by: Charith Ellawala <[email protected]>

pjbgf marked this pull request as ready for review February 24, 2026 12:08

Copilot AI review requested due to automatic review settings February 24, 2026 12:08

Copilot started reviewing on behalf of pjbgf February 24, 2026 12:09 View session

Copilot AI reviewed Feb 24, 2026

View reviewed changes

repository_extensions_test.go Show resolved Hide resolved

repository_extensions.go Show resolved Hide resolved

repository_extensions.go Show resolved Hide resolved

repository_extensions.go Show resolved Hide resolved

repository_extensions.go Show resolved Hide resolved

build: Align test workflow with main

40785f0

The test workflow for v5 diverged from main slightly, including its job name, which caused it to not be in-sync with the latest repository rulesets. Signed-off-by: Paulo Gomes <[email protected]>

pjbgf merged commit c7b5960 into go-git:releases/v5.x Feb 24, 2026
12 checks passed

pjbgf deleted the backport-checks branch February 24, 2026 12:35

charithe mentioned this pull request Mar 9, 2026

Downgrade go-git to v5.16.5 cerbos/cerbos#3022

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[v5] git: Add strict checks for supported extensions#1861

[v5] git: Add strict checks for supported extensions#1861
pjbgf merged 2 commits intogo-git:releases/v5.xfrom
pjbgf:backport-checks

pjbgf commented Feb 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

pjbgf commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pjbgf commented Feb 23, 2026 •

edited

Loading