UNCLASSIFIED - NO CUI

Skip to content

Update dependency libgit2/libgit2 to v1.4.3

renovate requested to merge renovate/libgit2-libgit2-1.x into development

This MR contains the following updates:

Package Type Update Change
libgit2/libgit2 ironbank-github minor v1.3.0 -> v1.4.3

Release Notes

libgit2/libgit2

v1.4.3

Compare Source

🔒 This is a security release to provide compatibility with git's changes to address CVE 2022-24765.

libgit2 is not directly affected by this vulnerability, because libgit2 does not directly invoke any executable. But we are providing these changes as a security release for any users that use libgit2 for repository discovery and then also use git on that repository. In this release, we will now validate that the user opening the repository is the same user that owns the on-disk repository. This is to match git's behavior.

In addition, we are providing several correctness fixes where invalid input can lead to a crash. These may prevent possible denial of service attacks. At this time there are not known exploits to these issues.

Full list of changes:

All users of the v1.4 release line are recommended to upgrade.

Full Changelog: https://github.com/libgit2/libgit2/compare/v1.4.2...v1.4.3

v1.4.2

Compare Source

🐞 This is a bugfix release with the following changes:

All users of the v1.4 release line are recommended to upgrade.

v1.4.1

Compare Source

🐞 This is a bugfix release with the following changes:

All users of the v1.4 release line are recommended to upgrade.

Full Changelog: https://github.com/libgit2/libgit2/compare/v1.4.0...v1.4.1

v1.4.0

Compare Source

This is release v1.4.0, "Fisematenten". This release includes several new features and bugfixes, improves compatibility with git, and begins preparation for SHA256 support in a future release.

What's Changed

New features
Deprecated APIs
  • git_index_checksum is deprecated; this information is now internal to the library and there is no replacement
  • git_indexer_hash is deprecated; callers should use git_indexer_name to retrieve the filename
  • git_packbuilder_hash is deprecated; callers should use git_packbuilder_name to retrieve the filename
ABI changes
  • git_fetch_options now includes the follow_redirects value
  • git_push_options now includes the follow_redirects value
  • git_status_options now includes the rename_threshold value
  • git_transport contains several changed function pointer signatures
Bug fixes
Code cleanups
CI improvements
Documentation improvements
Other changes

New Contributors

Full Changelog: https://github.com/libgit2/libgit2/compare/v1.3.0...v1.4.0

v1.3.1

Compare Source

🔒 This is a security release to provide compatibility with git's changes to address CVE 2022-24765.

libgit2 is not directly affected by this vulnerability, because libgit2 does not directly invoke any executable. But we are providing these changes as a security release for any users that use libgit2 for repository discovery and then also use git on that repository. In this release, we will now validate that the user opening the repository is the same user that owns the on-disk repository. This is to match git's behavior.

In addition, we are providing several correctness fixes where invalid input can lead to a crash. These may prevent possible denial of service attacks. At this time there are not known exploits to these issues.

Full list of changes:

All users of the v1.3 release line are recommended to upgrade.

Configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, click this checkbox.

This MR has been generated by Renovate Bot.

Merge request reports

UNCLASSIFIED - NO CUI