# git 2.55.0

Git Source Code Mirror - This is a publish-only repository but pull requests can be turned into patches to the mailing list via GitGitGadget (https://gitgitgadget.github.io/). Please follow Documentation/SubmittingPatches procedure for any of your improvements.

Snapshot of gominimal/pkgs commit `2c24dbe892e1b47a5b54020abe4645b499d943e8` (pushed 2026-09-12T22:42:24.000Z).

## Install

```sh
min add git
```

## Direct advisories

None at this commit.

## Transitive advisories

32 advisories inherited through runtime dependencies:

- CVE-2026-13608 (HIGH) via curl
- CVE-2026-18924 (CRITICAL) via curl
- CVE-2026-19931 (CRITICAL) via curl
- CVE-2026-80229 (HIGH) via curl
- CVE-2026-80230 (HIGH) via curl
- CVE-2026-80231 (HIGH) via curl
- CVE-2026-80255 (HIGH) via curl
- CVE-2026-82208 (HIGH) via curl
- CVE-2026-82209 (HIGH) via curl
- CVE-2026-66046 (HIGH) via expat
- CVE-2026-76956 (MEDIUM) via expat
- CVE-2026-76957 (MEDIUM) via expat
- CVE-2026-14456 (HIGH) via openssl
- CVE-2026-14457 (HIGH) via openssl
- CVE-2026-18798 (HIGH) via openssl
- CVE-2026-54874 (HIGH) via openssl
- CVE-2026-54876 (HIGH) via openssl
- CVE-2026-63072 (HIGH) via openssl
- CVE-2026-63073 (CRITICAL) via openssl
- CVE-2026-63074 (MEDIUM) via openssl
- CVE-2026-63075 (HIGH) via openssl
- CVE-2026-63076 (HIGH) via openssl
- CVE-2026-75803 (CRITICAL) via openssl
- CVE-2026-86145 (HIGH) via pcre2
- GHSA-2p8c-ff85-vh9x (LOW) via pcre2
- GHSA-9qww-pwc4-77qq (LOW) via pcre2
- GHSA-fmgr-6ggq-9859 (MEDIUM) via pcre2
- GHSA-q7rw-r7qq-2hx6 (LOW) via pcre2
- GHSA-q8g2-wprr-34m9 (MEDIUM) via pcre2
- OSV-2026-343 (HIGH) via pcre2
- CVE-2026-5435 (HIGH) via expat → glibc
- CVE-2026-6238 (MEDIUM) via expat → glibc

## Dependencies

- Build (6): base, gettext, make, python, rust, toolchain
- Runtime (5): curl, expat, openssl, pcre2, zlib

## Scorecard

| Category | Score | Band |
| --- | --- | --- |
| supply-chain | 50 | mid |
| advisories | 10 | low |
| quality | 30 | low |
| maintenance | 100 | perfect |
| licence | 90 | good |

## Links

- Package page (HTML): https://minimal.dev/pkgs/git
- JSON API (floats latest): https://minimal.dev/api/pkgs/git.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/git/sbom.json