UNCLASSIFIED - NO CUI

Skip to content

Update dependency libgit2/libgit2 to v1.8.1 - autoclosed

POPs-renovate-tools_03Dec2024 requested to merge renovate/all into development

This MR contains the following updates:

Package Type Update Change
libgit2/libgit2 ironbank-github minor v1.5.0 -> v1.8.1

Release Notes

libgit2/libgit2 (libgit2/libgit2)

v1.8.1: libgit2 v1.8.1

Compare Source

This release primarily includes straightforward bugfixes, as well as new functionality to have more control over the HTTP User-Agent header. However, there is an API change from v1.8 that was required for cross-platform compatibility.

In v1.8, libgit2 introduced the report_unchanged member in the git_fetch_options structure. We mistakenly introduced this as a bitfield, which is not suitable for our public API. To correct this mistake, we have removed the report_unchanged member. To support the report unchanged tips option, users can set the update_fetchhead member to include the GIT_REMOTE_UPDATE_REPORT_UNCHANGED value.

The libgit2 projects regrets the API change, but this was required to support cross-platform compatibility.

What's Changed

New features
Bug fixes
Build and CI improvements
Documentation improvements
Dependency updates

New Contributors

Full Changelog: https://github.com/libgit2/libgit2/compare/v1.8.0...v1.8.1

v1.8.0: libgit2 v1.8.0

Compare Source

v1.8

This is release v1.8.0, "Das Fliegende Klassenzimmer". This release includes optional, experimental support for invoking OpenSSH to fetch and push, an easier mechanism to perform the default behavior of git commit, and has many improvements for worktrees. This release also includes many other new features and bugfixes.

Major changes

Breaking changes

  • Adding WORKTREE configuration level (ABI breaking change) To support worktree configurations at the appropriate level (higher priority than local configuration, but lower priority than app-specific configuration), the GIT_CONFIG_LEVEL_WORKTREE level was introduced at priority 6. GIT_CONFIG_LEVEL_APP now begins at priority 7.

  • Changes to git_config_entry (ABI breaking change) The git_config_entry structure now contains information about the backend_type and origin_path. The unused payload value has been removed.

  • git_push_options includes remote push options (ABI breaking change) The git_push_options structure now contains a value for remote push options.

Other changes

New features
Bug fixes
Build and CI improvements
Documentation improvements
Platform compatibility fixes
Git compatibility fixes
Dependency updates

New Contributors

Full Changelog: https://github.com/libgit2/libgit2/compare/v1.7.0...v1.8.0

v1.7.2: libgit2 v1.7.2

Compare Source

🔒 This is a security release with multiple changes.

  • A bug in git_revparse_single is fixed that could have caused the function to enter an infinite loop given well-crafted inputs, potentially causing a Denial of Service attack in the calling application. This fixes CVE-2024-24575, which was discovered by researchers at Amazon AWS.

  • A bug in git_index_add is fixed that could have caused the function to corrupt its heap and possibly lead to arbitrary code execution. This fixes CVE-2024-24577, which was discovered by researchers at Amazon AWS.

  • A bug in the smart transport negotiation could have caused an out-of-bounds read when a remote server did not advertise capabilities.

The libgit2 project thanks the researchers and outreach team at AWS Security for finding the git_index_add and git_revparse_single bugs, and providing details and reproduction steps during their responsible disclosure.

All users of the v1.7 release line are recommended to upgrade.

v1.7.1: libgit2 v1.7.1

Compare Source

v1.7.1

What's Changed

Bug fixes
Compatibility improvements

New Contributors

Full Changelog: https://github.com/libgit2/libgit2/compare/v1.7.0...v1.7.1

v1.7.0: libgit2 v1.7.0

Compare Source

This is release v1.7.0, "Kleine Raupe Nimmersatt". This release adds shallow clone support, completes the experimental SHA256 support, adds Schannel support for Windows, and includes many other newj features and bugfixes.

Major changes

Breaking changes

  • Simplify custom pluggable allocator (System API / ABI breaking change) The git_allocator structure (configurable by the GIT_OPT_SET_ALLOCATOR option) now only contains gmalloc, grealloc and gfree members. This simplifies both the work needed by an implementer and allows more flexibility and correctness in libgit2 itself, especially during out-of-memory situations and errors during bootstrapping.

Other changes

New features
Performance improvements
Bug fixes
Build and CI improvements
Documentation improvements
Dependency upgrades

New Contributors

Full Changelog: https://github.com/libgit2/libgit2/compare/v1.6.3...v1.7.0

v1.6.5: libgit2 v1.6.5

Compare Source

🔒 This is a security release with multiple changes.

  • A bug in git_revparse_single is fixed that could have caused the function to enter an infinite loop given well-crafted inputs, potentially causing a Denial of Service attack in the calling application. This fixes CVE-2024-24575, which was discovered by researchers at Amazon AWS.

  • A bug in git_index_add is fixed that could have caused the function to corrupt its heap and possibly lead to arbitrary code execution. This fixes CVE-2024-24577, which was discovered by researchers at Amazon AWS.

  • A bug in the smart transport negotiation could have caused an out-of-bounds read when a remote server did not advertise capabilities.

The libgit2 project thanks the researchers and outreach team at AWS Security for finding the git_index_add and git_revparse_single bugs, and providing details and reproduction steps during their responsible disclosure.

All users of the v1.6 release line are recommended to upgrade.

v1.6.4: libgit2 v1.6.4

Compare Source

What's Changed

Bug fixes

Full Changelog: https://github.com/libgit2/libgit2/compare/v1.6.3...v1.6.4

v1.6.3: libgit2 v1.6.3

Compare Source

What's Changed

Bug fixes
Build and CI improvements

New Contributors

Full Changelog: https://github.com/libgit2/libgit2/compare/v1.6.2...v1.6.3

v1.6.2: libgit2 v1.6.2

Compare Source

What's Changed

Bug fixes

Full Changelog: https://github.com/libgit2/libgit2/compare/v1.6.1...v1.6.2

v1.6.1: libgit2 v1.6.1

Compare Source

This is release v1.6.1, "Hubbeliges Krokodil". This release adds experimental SHA256 support and includes many new features and bugfixes. This release replaces libgit2 v1.6.0, which did not correctly update its version number(s).

What's Changed

New features
Bug fixes
Security fixes
Code cleanups
Build and CI improvements
Documentation improvements

New Contributors

v1.5.2: libgit2 v1.5.2

Compare Source

This is a bugfix release to improve the SSH key handling functionality that was introduced in v1.5.1.

  • libgit2 can now read the known_hosts file on Windows.
  • libgit2 will now examine all keys for a particular host in the known_hosts file for matches, to support remote hosts with multiple key types.

All users of the v1.5 release line are recommended to upgrade.

v1.5.1: libgit2 v1.5.1

Compare Source

libgit2, when compiled using the optional, included libssh2 backend, fails to verify SSH keys by default.

Description

When using an SSH remote with the optional, included libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the certificate_check field of libgit2's git_remote_callbacks structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack.

Beginning in libgit2 v1.4.5 and v1.5.1, libgit2 will now perform host key checking by default. Users can still override the default behavior using the certificate_check function.

The libgit2 security team would like to thank the Julia and Rust security teams for responsibly disclosing this vulnerability and assisting with fixing the vulnerability.

Users are encouraged to upgrade to v1.4.5 or v1.5.1.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Merge request reports

UNCLASSIFIED - NO CUI