Skip to content
@ethomson ethomson
v1.4.3
465bbf8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: 4AEE18F83AFDEB23
Learn about vigilant mode.
Compare
Choose a tag to compare

libgit2 v1.4.3

Latest
Latest

🔒 This is a security release to provide compatibility with git's changes to address CVE 2022-24765.

libgit2 is not directly affected by this vulnerability, because libgit2 does not directly invoke any executable. But we are providing these changes as a security release for any users that use libgit2 for repository discovery and then also use git on that repository. In this release, we will now validate that the user opening the repository is the same user that owns the on-disk repository. This is to match git's behavior.

In addition, we are providing several correctness fixes where invalid input can lead to a crash. These may prevent possible denial of service attacks. At this time there are not known exploits to these issues.

Full list of changes:

  • Validate repository directory ownership (v1.4) by @ethomson in #6267
  • midx: Fix an undefined behavior (left-shift signed overflow) by @lhchavez in #6260
  • fetch: support OID refspec without dst by @ethomson in #6251
  • Fix crash when regenerating a patch with unquoted spaces in filename by @jorio in #6244

All users of the v1.4 release line are recommended to upgrade.

Full Changelog: v1.4.2...v1.4.3

Contributors

ethomson, lhchavez, and jorio

Assets

2
@ethomson ethomson
v1.3.1
1f5e7f9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: 4AEE18F83AFDEB23
Learn about vigilant mode.
Compare
Choose a tag to compare

libgit2 v1.3.1

🔒 This is a security release to provide compatibility with git's changes to address CVE 2022-24765.

libgit2 is not directly affected by this vulnerability, because libgit2 does not directly invoke any executable. But we are providing these changes as a security release for any users that use libgit2 for repository discovery and then also use git on that repository. In this release, we will now validate that the user opening the repository is the same user that owns the on-disk repository. This is to match git's behavior.

In addition, we are providing several correctness fixes where invalid input can lead to a crash. These may prevent possible denial of service attacks. At this time there are not known exploits to these issues.

Full list of changes:

  • Validate repository directory ownership (v1.3) by @ethomson in #6268

All users of the v1.3 release line are recommended to upgrade.

Contributors

ethomson

Assets

2
@ethomson ethomson
v1.4.2
182d0d1
Compare
Choose a tag to compare

libgit2 v1.4.2

🐞 This is a bugfix release with the following changes:

  • remote: do store the update_tips callback error value by @carlosmn in #6226
  • win32: find_system_dirs does not return GIT_ENOTFOUND by @ethomson in #6228

All users of the v1.4 release line are recommended to upgrade.

Contributors

carlosmn and ethomson

Assets

2
@ethomson ethomson
v1.4.1
fdd15bc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: 4AEE18F83AFDEB23
Learn about vigilant mode.
Compare
Choose a tag to compare

libgit2 v1.4.1

🐞 This is a bugfix release with the following changes:

All users of the v1.4 release line are recommended to upgrade.

Full Changelog: v1.4.0...v1.4.1

Contributors

ethomson, mgorny, and apnadkarni

Assets

2
@ethomson ethomson
v1.4.0
1d5b9bd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: 4AEE18F83AFDEB23
Learn about vigilant mode.
Compare
Choose a tag to compare

libgit2 v1.4.0

This is release v1.4.0, "Fisematenten". This release includes several new features and bugfixes, improves compatibility with git, and begins preparation for SHA256 support in a future release.

What's Changed

New features

  • diff: update rename limit to 1000 to match git's behavior by @ethomson in #6092
  • odb: support checking for object existence without refresh by @joshtriplett in #6107
  • object: provide a low-level mechanism to validate whether a raw object is valid (git_object_rawcontent_is_valid) by @ethomson in #6128
  • blob: provide a function to identify binary content by @ethomson in #6142
  • status: add rename_threshold to git_status_options. by @arroz in #6158
  • remote: support http.followRedirects (false and initial) and follow initial redirects by default by @ethomson in #6175
  • remote: support scp style paths with ports ([git@github.com:22]:libgit2/libgit2) by @ethomson in #6167
  • win32: update git for windows configuration file location compatibility by @csware in #6151 and @ethomson in #6180
  • refs: speed up packed reference lookups when packed refs are sorted by @ccstolley in #6138
  • merge: support zdiff3 conflict styles by @ethomson in #6195
  • remote: support fetching by object id (using "+oid:ref" refspec syntax) by @ethomson in #6203
  • merge: callers can specify virtual-base building behavior and to optionally accept conflict markers as a resolution by @boretrk in #6204

Deprecated APIs

  • git_index_checksum is deprecated; this information is now internal to the library and there is no replacement
  • git_indexer_hash is deprecated; callers should use git_indexer_name to retrieve the filename
  • git_packbuilder_hash is deprecated; callers should use git_packbuilder_name to retrieve the filename

ABI changes

  • git_fetch_options now includes the follow_redirects value
  • git_push_options now includes the follow_redirects value
  • git_status_options now includes the rename_threshold value
  • git_transport contains several changed function pointer signatures

Bug fixes

Code cleanups

CI improvements

Documentation improvements

Other changes

  • libgit2_clar is now libgit2_tests by @mkhl in #6100
  • Remove PSGit from Language Bindings section of README by @cestrand in #6150
  • COPYING: remove regex copyright, add PCRE copyright by @ethomson in #6187
  • meta: add a release configuration file by @ethomson in #6211

New Contributors

Full Changelog: v1.3.0...v1.4.0

Contributors

ethomson, joshtriplett, and 16 other contributors

Assets

2
0 Join discussion
@ethomson ethomson
v1.3.0
b7bad55
Compare
Choose a tag to compare

libgit2 v1.3.0

This is release v1.3.0, "Zugunruhe". This release includes several bugfixes, but only minor new features that will be helpful for users to have an orderly transition to the v2.0 lineage.

New Features

Deprecated APIs

  • git_oidarray_free is deprecated; callers should use git_oidarray_dispose

Bug fixes

  • #6028: Check if threadstate->error_t.message is not git_buf__initbuf before freeing. by @arroz in #6029
  • remote: Mark git_remote_name_is_valid as GIT_EXTERN by @lhchavez in #6032
  • Fix config parsing for multiline with multiple quoted comment chars by @basile-henry in #6043
  • indexer: Avoid one mmap(2)/munmap(2) pair per git_indexer_append call by @lhchavez in #6039
  • merge: Check file mode when resolving renames by @ccstolley in #6060
  • Allow proxy options when connecting with a detached remote. by @lrm29 in #6058
  • win32: allow empty environment variables by @ethomson in #6063
  • Fixes for deprecated APIs by @ethomson in #6066
  • filter: use a git_oid in filter options, not a pointer by @ethomson in #6067
  • diff: update GIT_DIFF_IGNORE_BLANK_LINES by @ethomson in #6068
  • Attribute lookups are always on relative paths by @ethomson in #6073
  • Handle long paths when querying attributes by @ethomson in #6075

Code cleanups

CI Improvements

Documentation changes

New Contributors

Full Changelog: v1.2.0...v1.3.0

Contributors

ethomson, arroz, and 11 other contributors

Assets

2
@ethomson ethomson
v1.2.0
4fd32be
Compare
Choose a tag to compare

libgit2 v1.2.0

This is release v1.2.0, "Absacker". This release includes many new features: in particular, support for commit graphs, multi-pack indexes, and core.longpaths support.

This is meant to be the final minor release in the v1 lineage. v2.0 will be the next major release and will remove deprecated APIs and may include breaking changes.

New features

Bug fixes

Deprecated APIs

  • revspec: rename git_revparse_mode_t to git_revspec_t by @ethomson in #5786
  • tree: deprecate git_treebuilder_write_with_buffer by @ethomson in #5815
  • Deprecate is_valid_name functions; replace with name_is_valid functions by @ethomson in #5659
  • filter: stop taking git_buf as user input by @ethomson in #5859
  • remote: introduce remote_ready_cb, deprecate resolve_url callback by @ethomson in #6012
  • Introduce create_commit_cb, deprecate signing_cb by @ethomson in #6016
  • filter: filter drivers stop taking git_buf as user input by @ethomson in #6011
  • buf: deprecate public git_buf writing functions by @ethomson in #6017

Documentation improvements

Development improvements

  • WIP: .devcontainer: settings for a codespace workflow by @ethomson in #5508

CI Improvements

Dependency updates

Full Changelog: v1.1.0...v1.2.0

Contributors

0xdky, A-Ovchinnikov-mx, and 37 other contributors

Assets

2
9 Join discussion
@ethomson ethomson
v1.1.1
8a0dc67
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: 4AEE18F83AFDEB23
Learn about vigilant mode.
Compare
Choose a tag to compare

libgit2 v1.1.1

🐞 This is a bugfix release with the following changes:

  • Fixes a bug where decompressing packfiles could fail in rare instances.

  • Ensure worktree paths are validated in more cases.

  • Builds without thread-safety (THREADSAFE=OFF) are supported again.

  • Builds without mmap (NO_MMAP) are supported again.

  • mbedTLS is supported in non-default locations.

  • Malformed branch names or missing branches on remotes are ignored.

  • Use compiler intrinsics to detect arithmetic overflows in more cases.

  • The configuration cache functions properly on systems with strict alignment.

  • A missing options initializer function (git_blob_filter_options_init) was added for git_blob_filter_options.

  • Several documentation fixes.

🎉 Thanks to all the contributors who have helped with libgit2 v1.1.1:

Assets

2
5 Join discussion
@ethomson ethomson
v1.1.0
7f4fa17
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: 4AEE18F83AFDEB23
Learn about vigilant mode.
Compare
Choose a tag to compare

libgit2 v1.1.0

This is release v1.1, "Fernweh".

Changes or improvements

  • Our bundled PCRE dependency has been updated to 8.44.

  • The refs/remotes/origin/HEAD file will be created at clone time to
    point to the origin's default branch.

  • libgit2 now uses the __atomic_ intrinsics instead of __sync_
    intrinsics on supported gcc and clang versions.

  • The init.defaultBranch setting is now respected and master is
    no longer the hardcoded as the default branch name.

  • Patch files that do not contain an index line can now be parsed.

  • Configuration files with multi-line values can now contain quotes
    split across multiple lines.

  • Windows clients now attempt to use TLS1.3 when available.

  • Servers that request an upgrade to a newer HTTP version are
    silently ignored instead of erroneously failing.

  • Users can pass NULL to the options argument to
    git_describe_commit.

  • Clones and fetches of very large packfiles now succeeds on 32-bit
    platforms.

  • Custom reference database backends can now handle the repository's
    HEAD correctly.

  • Repositories with a large number of packfiles no longer exhaust the
    number of file descriptors.

  • The test framework now supports TAP output when the -t flag is
    specified.

  • The test framework can now specify an exact match to a test
    function using a trailing $.

  • All checkout types support GIT_CHECKOUT_DISABLE_PATHSPEC_MATCH.

  • git_blame now can ignore whitespace changes using the option
    GIT_BLAME_IGNORE_WHITESPACE.

  • Several new examples have been created, including an examples for
    commit, add and push.

  • Mode changes during rename are now supported in patch application.

  • git_checkout_head now correctly removes untracked files in a
    subdirectory when the FORCE | REMOVE_UNTRACKED options are specified.

Assets

4
@ethomson ethomson
v1.0.1
0ced296
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: 4AEE18F83AFDEB23
Learn about vigilant mode.
Compare
Choose a tag to compare

libgit2 v1.0.1

This is a bugfix release with the following changes:

  • Calculating information about renamed files during merges is more
    efficient because dissimilarity about files is now being cached and
    no longer needs to be recomputed.

  • The git_worktree_prune_init_options has been correctly restored for
    backward compatibility. In v1.0 it was incorrectly deprecated with a
    typo.

  • The optional ntlmclient dependency now supports NetBSD.

  • A bug where attempting to stash on a bare repository may have failed
    has been fixed.

  • Configuration files that are unreadable due to permissions are now
    silently ignored, and treated as if they do not exist. This matches
    git's behavior; previously this case would have been an error.

  • v4 index files are now correctly written; previously we would read
    them correctly but would not write the prefix-compression accurately,
    causing corruption.

  • A bug where the smart HTTP transport could not read large data packets
    has been fixed. Previously, fetching from servers like Gerrit, that
    sent large data packets, would error.

Assets

4