storage/filesystem/object.go:404

• encodedObjectSizeFromUnpacked opens f but only closes the objfile Reader; objfile.Reader.Close() does not close the underlying file, so f is leaked on both success and error paths. Add a defer to close f (or otherwise ensure it is closed) alongside closing r.

func (s *ObjectStorage) encodedObjectSizeFromUnpacked(h plumbing.Hash) (size int64, err error) {
	f, err := s.dir.Object(h)
	if err != nil {
		if os.IsNotExist(err) {
			return 0, plumbing.ErrObjectNotFound
		}

		return 0, err
	}

	r, err := objfile.NewReader(f, s.options.ObjectFormat)
	if err != nil {
		return 0, err
	}
	defer ioutil.CheckClose(r, &err)

storage/filesystem/dotgit/reader.go:47

• If objfile.NewReader or Header() fails, the opened file f is not closed (and r.Close() does not close the underlying file). Ensure f.Close() is called on all error paths, not only in the success case wrapped by NewReadCloserWithCloser.

	r, err := objfile.NewReader(f, e.dir.options.ObjectFormat)
	if err != nil {
		return nil, err
	}

	t, size, err := r.Header()
	if err != nil {
		_ = r.Close()
		return nil, err
	}

plumbing/transport/http/dumb.go:266

• ioutil.CheckClose is being called without defer, which closes rd (and later w) immediately before they are used. These should be deferred (or replaced with explicit close-at-end logic) so Header()/copying can read/write successfully and still capture close errors via err.

	rd, err := objfile.NewReader(res.Body, objectFormatFromHash(objHash))
	if err != nil {
		return err
	}
	ioutil.CheckClose(rd, &err)