What's Changed

• plumbing: transport/ssh, Shell-quote path and args by @hiddeco in #2067
• git: submodule, canonical remote for relative URLs by @hiddeco in #2071
• storage: filesystem, Use repository object format for writing loose objects by @pjbgf in #2073
• git: submodule, error on remote without URLs by @hiddeco in #2076
• plumbing: objfile, Pass object format into Reader by @pjbgf in #2077
• git: submodule, Add relative URL regression tests by @hiddeco in #2072
• plumbing: format/idxfile, Validate offset64 indices by @hiddeco in #2083
• storage: filesystem, Search alternates in HashesWithPrefix by @andrew in #2087
• *: Reject malformed variable-length integers by @hiddeco in #2090
• Add worktreeFilesystem wrapper for worktree by @pjbgf in #2081
• tests: fix three recurring CI flakes by @hiddeco in #2093
• plumbing: format/packfile, Test patchDeltaWriter cap by @hiddeco in #2086
• plumbing: format/packfile, Tighten delta validation by @hiddeco in #2089
• git: worktree path hardening by @hiddeco in #2097
• build: Update module github.com/go-git/go-git-fixtures/v6 to v6.0.0-20260502205956-66bffbe5a6ff (main) by @go-git-renovate[bot] in #2102
• build: Update golang (main) by @go-git-renovate[bot] in #2099
• config: validate submodule names by @hiddeco in #2079
• build: Update go-git (main) by @go-git-renovate[bot] in #2103
• worktree: skip ignored directories during Reset walk by @Soph in #2075
• plumbing: format/pktline, validate reader/writer inputs by @pjbgf in #2104
• build: Update module github.com/go-git/go-git-fixtures/v6 to v6.0.0-alpha.1 (main) by @go-git-renovate[bot] in #2110
• plumbing: object, tree entry validation by @hiddeco in #2105
• git: Stop validating symlink target paths by @pjbgf in #2114
• git: Allow MkdirAll on worktree-root paths by @hiddeco in #2115
• git: add repository and remote archive support by @aymanbagabas in #2013
• Fix file handle leaks by calling Repository.Close() and adding transactional.Storage.Close() by @AriehSchneier in #1999
• plumbing: fuzz on-disk format decoders by @hiddeco in #2120
• plumbing: format decoder input bounds and contracts by @hiddeco in #2119
• plumbing: fuzz packp and capability decoders by @hiddeco in #2121
• storage: dotgit, fix hasIncomingObjects race by @hiddeco in #2131
• plumbing: format/packfile, use ReadAt in FSObject.Reader() for concurrency safety. by @cedric-appdirect in #1998
• plumbing: format/packfile, harden malformed pack handling by @pjbgf in #2113

New Contributors

• @andrew made their first contribution in #2087

Full Changelog: v6.0.0-alpha.3...v6.0.0-alpha.4

What's Changed

• v5: plumbing: transport/ssh, Shell-quote path by @hiddeco in #2068
• v5: git: submodule, Fix relative URL resolution by @hiddeco in #2070
• v5: git: submodule, canonical remote for relative URLs by @hiddeco in #2074
• v5: git: submodule, error on remote without URLs by @hiddeco in #2078
• v5: plumbing: format/idxfile, Validate offset64 indices by @hiddeco in #2084
• v5: *: Reject malformed variable-length integers by @hiddeco in #2092
• v5: plumbing: format/packfile, Tighten delta validation by @hiddeco in #2091
• v5: Add worktreeFilesystem wrapper for worktree and hardening by @hiddeco in #2100
• v5: config: validate submodule names by @hiddeco in #2082
• build: Update module github.com/go-git/go-git/v5 to v5.19.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #2111
• v5: git: Allow MkdirAll on worktree-root paths by @hiddeco in #2117
• v5: git: Stop validating symlink target paths by @pjbgf in #2116
• v5: plumbing: format decoder input bounds and contracts by @hiddeco in #2125
• plumbing: format/packfile, cap delta chain depth in parser by @pjbgf in #2137

Full Changelog: v5.19.0...v5.19.1

What's Changed

• plumbing: transport, add git-upload-archive support by @aymanbagabas in #1986
• utils: sync, Make zlib compression pluggable via x/plugin by @stiak in #2012
• build: establish DCO sign-off requirement for all contributions by @pjbgf in #1914
• docs: update CONTRIBUTING.md, README.md and add HISTORY.md by @pjbgf in #1946
• storage: filesystem, close packfile iterators after use by @aymanbagabas in #2027
• Add .github/copilot-instructions.md with PR review guidelines by @Copilot in #2040
• docs: update comment to reflect support for the last 2 stable Go versions by @alexandear in #2041
• *: clone, resolve relative local URLs against CWD in CloneOptions.Validate by @AriehSchneier in #1891
• SHA256: Support submodules in SHA256 repositories by @pjbgf in #1979
• plumbing: ssh, fix concurrent test failures due to cert key generation by @aymanbagabas in #2043
• storage: filesystem, dedupe object iteration by @pjbgf in #2042
• build: Update module github.com/go-git/go-git-fixtures/v6 to v6.0.0-20260422085740-0c07409f52ec (main) by @go-git-renovate[bot] in #2045
• Implement Git-compatible wildmatch for gitignore patterns by @AriehSchneier in #1940
• git: worktree, fix treeContainsDirs test to build a new tree for each… by @aymanbagabas in #2047
• _examples: remove deprecated usage of io/ioutil by @alexandear in #2046
• plumbing: transport/upload_pack multi round bugs by @manland in #2016
• plumbing: filemode, fix typo in comment by @shawntoffel in #2003
• build: Update module github.com/go-git/go-billy/v6 to v6.0.0-20260424211911-732291493fb8 (main) by @go-git-renovate[bot] in #2051
• plumbing: packp, refactor AdvRefs and capability packages by @aymanbagabas in #1987
• worktree: skip ignored directories during Status walk by @Soph in #2048
• build: Update module github.com/pjbgf/sha1cd to v0.6.0 (main) by @go-git-renovate[bot] in #2059
• internal: servers, add git server implementation by @aymanbagabas in #2014
• Remove use of ChrootOS by @pjbgf in #2061
• plumbing: transport, Align flush size with upstream git by @pjbgf in #2000
• internal: git, add server timeout test small tolerance by @aymanbagabas in #2064
• Align object encoding with upstream by @pjbgf in #2066

New Contributors

• @Copilot made their first contribution in #2040
• @shawntoffel made their first contribution in #2003

Full Changelog: v6.0.0-alpha.2...v6.0.0-alpha.3

What's Changed

• build: Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #2010
• v5: Bump sha1cd and go-billy by @pjbgf in #2060
• v5: Align object encoding with upstream by @pjbgf in #2065

Full Changelog: v5.18.0...v5.19.0

🚀 Release Summary

⚠️ v6 Alpha Release

This is an alpha release of go-git v6.

We encourage users to test this version in real-world scenarios and help us validate the new transport layer and features.

👉 Please report any issues, bugs, or unexpected behavior via GitHub issues.

This release brings major improvements across transport, performance, and Git feature support, along with significant internal modernization.

🚀 Highlights

• Major refactor of the plumbing/transport API with a new design, improving extensibility and aligning behaviour more closely with upstream Git.
• Performance improvements in remote operations, including faster send-pack.
• Significant improvements to HTTP transport robustness and protocol correctness.
• File transport: added support for gitfile and improved repository detection logic.

🐛 Bug Fixes

• repository: fix DeleteBranch failing when using full ref names (#1951)
• worktree: fix Add silently failing for absolute paths (#1949)
• transport/http: fix multi-round pack negotiation (#1992)
• transport/http: harden redirect handling to match canonical Git (#1997)
• transport/http: fix data race in dumb HTTP test server (#1960)
• transport: avoid emitting duplicate NAK after empty ACKs (#1989)
• updreq: support multiple shallow records in upload request decoding (#1952)
• file transport: fix Windows file handle leak (#1976)
• worktree tests: fix Windows file handle leaks (#1996)
• transport tests: correct receive-pack usage (#1988)

✨ Enhancements

• remote: faster send-pack implementation (#1947)
• object: improved object walk painting (#1973)
• repository: add gitfile support and improve loader detection (#1994)
• config: introduce ConfigLoader plugins aligned with upstream Git (#1924)

🔧 Refactoring

• plumbing/transport: replace transport API with new design (#1972)
• plumbing/transport: follow-up API refactoring and cleanup (#1983)

📚 Documentation

• docs: updates and introduction of AI Policy (#1913)

📋 Full Changelog

What's Changed

• git: repository, fix DeleteBranch failing with full ref name by @tmchow in #1951
• build: Update golang (main) by @go-git-renovate[bot] in #1931
• git: worktree, fix Add silently failing for absolute paths by @tmchow in #1949
• build: Update github.com/go-git/go-git-fixtures/v5 digest to eda62fa (main) by @go-git-renovate[bot] in #1834
• fix(updreq): support multiple shallow records in upload request decoding by @yuzhuo in #1952
• plumbing: transport/http, Fix data race in dumb HTTP test server by preventing sendfile optimization. by @MotanOfficial in #1960
• build: Update go-git (main) by @go-git-renovate[bot] in #1969
• Update docs and introduce AI Policy by @pjbgf in #1913
• Faster send pack for remote by @stiak in #1947
• plumbing: transport, replace transport API with new design by @aymanbagabas in #1972
• plumbing/transport API Refactoring by @pjbgf in #1983
• plumbing: transport, correct the test to use the correct receive-pack… by @aymanbagabas in #1988
• Object walk painting by @stiak in #1973
• build: Update golang (main) by @go-git-renovate[bot] in #1975
• Fix Windows file handle leak in file transport by @AriehSchneier in #1976
• plumbing/transport: don't emit a second NAK after encoding empty ACKs by @Soph in #1989
• Fix file handle leaks in worktree tests on Windows by @AriehSchneier in #1996
• Add gitfile support and fix loader repository detection by @AriehSchneier in #1994
• plumbing: transport/http, fix multi-round pack negotiation by @stiak in #1992
• Implement ConfigLoader plugins that aligns with upstream behaviour by @pjbgf in #1924
• plumbing: transport/http, harden redirect handling to match canonical git by @aymanbagabas in #1997

New Contributors

• @tmchow made their first contribution in #1951
• @MotanOfficial made their first contribution in #1960
• @stiak made their first contribution in #1947

Full Changelog: v6.0.0-alpha.1...v6.0.0-alpha.2

What's Changed

• plumbing: transport/http, Add support for followRedirects policy by @pjbgf in #2004

Full Changelog: v5.17.2...v5.18.0

🚀 Release Summary

⚠️ v6 Alpha Release

This is the first alpha release of go-git v6.

We encourage users to test this version in real-world scenarios and help us validate the new transport layer and features.

👉 Please report any issues, bugs, or unexpected behavior via GitHub issues.

This release brings major improvements across transport, performance, and Git feature support, along with significant internal modernization.

👤 What Changed for Users

🌐 Better Git Compatibility

• Improved support for modern Git protocol features:
  • multi-ack, filters (partial clone), sideband
  • better HTTP and SSH transport handling
• More reliable push/fetch behavior, especially for:
  • shallow clones
  • large repositories
  • edge-case server interactions

🆕 Support for Git Features

• Cherry-pick support
• Reflog support
• git reset --keep equivalent
• Autocrlf support
• Improved linked worktree support (git worktree)
• Support for **relative submodule URLs

🔐 SHA-256 Repository Support

• Open, initialize, and clone SHA-256 repositories

⚙️ Config & Feature Parity

• Support for Git features:
  • core.hooksPath
  • index.skipHash
  • worktreeConfig

⚡ Performance Improvements

• Faster operations on large repositories:
  • improved status calculation
  • optimized packfile handling
  • reduced memory usage

🧹 Stability & Reliability

• Fixed many issues around:
  • push/fetch correctness
  • worktree operations
  • filesystem handling
  • Windows compatibility
• Fewer crashes and race conditions

🛠️ What Changed Internally

🚧 Major: Transport Overhaul

• Complete redesign of the transport layer
• New APIs and cleaner abstractions
• Expanded protocol support (v1/v2, HTTP, SSH, Git)
• File transport no longer relies on the git binary being present
• Foundation for future improvements

🔄 Protocol & Transport Refactor

• Improved negotiation, capability handling, and error reporting
• Added server-side capabilities and middleware support
• Better handling of edge cases (EOF, flushing, sideband)

🧠 Performance & Scalability Work

• New index strategies (LazyIndex, stat-based cache)
• Large repo optimizations (PackScanner, delta processing)
• Reduced allocations and improved memory usage

🧪 Testing & Quality Improvements

• Migration from gocheck → testify
• Expanded transport and integration test coverage
• Many flaky/race tests fixed

🔍 Linting & Code Quality

• Enabled extensive linting (staticcheck, govet, revive, etc.)
• Improved code consistency and maintainability

📦 Build & Dependency Maintenance

• Large number of dependency updates (security + maintenance)
• CI/CD improvements and automation (Renovate, Scorecard)
• Updated Go versions and support policy

📋 Full Changelog

What's Changed

• build: bump github.com/go-git/go-git/v5 from 5.11.0 to 5.12.0 in /cli/go-git by @dependabot[bot] in #1065
• build: bump golang.org/x/net from 0.22.0 to 0.23.0 by @dependabot[bot] in #1068
• build: bump golang.org/x/net from 0.23.0 to 0.24.0 by @dependabot[bot] in #1071
• Properly support skipping of non-mandatory extensions by @codablock in #1066
• git: Refine some codes in test and non-test. by @onee-only in #1077
• plumbing: protocol/packp, client-side filter capability support by @edigaryev in #1000
• build: bump golang.org/x/net from 0.22.0 to 0.23.0 in /cli/go-git by @dependabot[bot] in #1078
• plumbing: fix sideband demux on flush by @aymanbagabas in #1084
• storage: dotgit, head reference usually comes first by @aymanbagabas in #1085
• build: bump golang.org/x/text from 0.14.0 to 0.15.0 by @dependabot[bot] in #1091
• build: bump golang.org/x/crypto from 0.22.0 to 0.23.0 by @dependabot[bot] in #1094
• build: bump golang.org/x/net from 0.24.0 to 0.25.0 by @dependabot[bot] in #1093
• git: Added an example for Repository.Branches by @johnmatthiggins in #1088
• git: worktree_commit, Modify checking empty commit. Fixes #723 by @onee-only in #1050
• plumbing: transport/http, Wrap http errors to return reason. Fixes #1097 by @ggambetti in #1100
• build: bump golang.org/x/sys from 0.20.0 to 0.21.0 by @dependabot[bot] in #1106
• build: bump golang.org/x/text from 0.15.0 to 0.16.0 by @dependabot[bot] in #1107
• Bumps Go versions and go-billy by @pjbgf in #1056
• _examples: Fixed a dead link COMPATIBILITY.md by @gecko655 in #1109
• Refactor pktline by @aymanbagabas in #1082
• build: bump github.com/jessevdk/go-flags from 1.5.0 to 1.6.1 in /cli/go-git by @dependabot[bot] in #1115
• build: bump github.com/elazarl/goproxy from v0.0.0-20230808193330-2592e75ae04a to v0.0.0-20240618083138-03be62527ccb by @hbelmiro in #1124
• build: bump golang.org/x/net from 0.25.0 to 0.26.0 by @dependabot[bot] in #1104
• Add option approximating git clean -x flag. by @msuozzo in #995
• Revert "Add option approximating git clean -x flag." by @pjbgf in #1129
• Fix reference updated concurrently error for the filesystem storer by @Javier-varez in #1116
• build: bump golang.org/x/net from 0.26.0 to 0.27.0 by @dependabot[bot] in #1134
• utils: merkletrie, Align error message with upstream by @pjbgf in #1142
• plumbing: transport/file, Change paths to absolute by @pjbgf in #1141
• plumbing: gitignore, Fix loading of ignored .gitignore files. by @Achilleshiel in #1114
• build: bump github.com/skeema/knownhosts from 1.2.2 to 1.3.0 by @dependabot[bot] in #1147
• plumbing: transport/ssh, Add support for SSH @cert-authority. by @Javier-varez in #1157
• build: run example tests during CI workflow by @crazybolillo in #1030
• storage: filesystem, Fix object cache not working due to uninitialised objects being put into cache by @SatelliteMind in #1138
• git: Fix fetching missing commits by @AriehSchneier in #1032
• plumbing: format/packfile, remove duplicate checks in findMatch() by @edigaryev in #1152
• git: worktree, Fix file reported as Untracked while it is committed by @rodrigocam in #1023
• build: bump golang.org/x/sys from 0.22.0 to 0.23.0 by @dependabot[bot] in #1160
• plumbing: filemode, Remove check for setting size of .git/index file by @nicholasSUSE in #1159
• build: bump golang.org/x/net from 0.27.0 to 0.28.0 by @dependabot[bot] in #1163
• Fix some lint warning and increase stalebot to 180 days by @pjbgf in #1128
• adjust path extracted from file: url on Windows by @tomqwpl in #416
• build: bump golang.org/x/sys from 0.23.0 to 0.24.0 by @dependabot[bot] in #1164
• [v6-exp] Consolidate in-flight changes by @pjbgf in #1166
• plumbing: allow discovery of non bare repos in fsLoader by @jakobmoellerdev in #1173
• [v6-exp] Expand trace support for SSH and Performance by @pjbgf in #1172
• v6: Consume push URLs when they are provided by @mcepl in #1192
• [v6-exp] git: options, Fix typo of SubmoduleRecursivity. Fixes #197 by @onee-only in #1205
• [v6-exp] git: worktree, Fix sparse reset. by @onee-only in #1208
• [v6-exp] plumbing: Improve PACK trace by redacting binary data by @pjbgf in #1214
• server: uploadpack, implement multi_ack capability by @manland in #1204
• [v6-exp] plumbing: packfile, Refactor Parser and Scanner logic by @pjbgf in #1228
• [v6-exp] Forward port changes from master by @pjbgf in #1252
• [v6-exp] New performance focused clone example + forward ports by @pjbgf in #1255
• [v6-exp] Build improvements + forward ports by @pjbgf in #1258
• pktline : Accept uppercase hexa in pktline length by @BeChris in #1259
• git: worktree_commit, sanitize author and commiter name and email before creating the commit object. Fixes #680 by @BeChris in #1263
• plumbing: object, limit logs by trailing hash by @d-fal in #1227
• plumbing: filemode, gocheck t...

What's Changed

• build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1941
• dotgit: skip writing pack files that already exist on disk by @pjbgf in #1944

⚠️ This release fixes a bug (#1942) that blocked some users from upgrading to v5.17.1. Thanks @pskrbasu for reporting it. 🙇

Full Changelog: v5.17.1...v5.17.2

What's Changed

• build: Update module github.com/cloudflare/circl to v1.6.3 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1930
• [v5] plumbing: format/index, Improve v4 entry name validation by @pjbgf in #1935
• [v5] plumbing: format/idxfile, Fix version and fanout checks by @pjbgf in #1937

Full Changelog: v5.17.0...v5.17.1

What's Changed

• build: Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1839
• git: worktree, optimize infiles function for very large repos by @k-anshul in #1853
• git: Add strict checks for supported extensions by @pjbgf in #1861
• backport, git: Improve Status() speed with new index.ModTime check by @cedric-appdirect in #1862
• storage: filesystem, Avoid overwriting loose obj files by @pjbgf in #1864

Full Changelog: v5.16.5...v5.17.0