Skip to content

Update dependency dulwich to v1#65

Open
mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/dulwich-1.x
Open

Update dependency dulwich to v1#65
mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/dulwich-1.x

Conversation

@mend-for-github-com
Copy link
Copy Markdown

@mend-for-github-com mend-for-github-com Bot commented Jun 4, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
dulwich major ==0.20.23 → ==1.2.5

By merging this PR, the issue #63 will be automatically resolved and closed:

Severity CVSS Score Vulnerability
High High 8.8 CVE-2026-42305

Release Notes

dulwich/dulwich (dulwich)

v1.2.5: dulwich 1.2.5

Compare Source

This is a security release. All users are encouraged to upgrade.

Security fixes

  • GHSA-gfhv-vqv2-4544 -- Validate submodule paths in porcelain.submodule_update (and thus porcelain.clone(recurse_submodules=True)). A crafted upstream repository could carry a submodule whose path was .git/hooks (or any other path inside .git or above the work tree), causing the submodule's tree contents to be written there with their executable bits intact. The dulwich analogue of git's CVE-2024-32002 / CVE-2024-32004. (Reported by tonghuaroot)

  • CVE-2026-42305 -- Harden tree path validation against entry names that are harmless on POSIX but dangerous when checked out on Windows. validate_path_element_ntfs now also rejects Windows path separators, the alternate data stream marker :, NTFS 8.3 short-name aliases of .git, and reserved Windows device names. core.protectNTFS now defaults to true on every platform, and both core.protectNTFS and core.protectHFS are now read under their correct option names. (Reported by Christopher Toth)

  • CVE-2026-42563 -- Shell-quote values substituted into ProcessMergeDriver commands. A malicious branch could inject shell commands when a merge driver referencing %P was configured. (Reported by Ravishanker Kusuma (hayageek))

  • CVE-2026-47712 -- Sanitize commit subjects used in porcelain.format_patch filenames so a malicious subject (e.g. x/../../x) cannot direct the generated patch outside outdir. (Reported by Christopher Toth)

  • receive.maxInputSize -- Honour receive.maxInputSize in ReceivePackHandler. Previously a remote unauthenticated client could send a tiny crafted pack that declared a huge dest_size and trigger hundreds of MB of allocation over git-receive-pack. (Reported by Liyi, Ziyue, Strick, Maurice and Chenchen @​ University of Sydney)

v1.2.4

Compare Source

Tolerate ref names with empty path components (e.g. `refs/tags//v1.0`) for now, emitting a `DeprecationWarning` rather than raising a `RefFormatError`. Such names are constructed by older Poetry releases (fixed in Poetry 2.4.0) and were silently accepted before Dulwich 1.2.3. `local_branch_name`, `local_tag_name` and `local_replace_name` likewise warn about, and strip, a leading slash instead of raising `ValueError`. Both will become errors again in a future release. (Jelmer Vernooij, #​2192)

v1.2.3

Compare Source

v1.2.2

Compare Source

v1.2.1

Compare Source

Changes since 1.2.0

  • Derive the LFS endpoint as the remote's on-disk LFS store
    (<remote>/.git/lfs for worktrees, <remote>/lfs for bare repos)
    when remote.origin.url points at a local filesystem path or
    file:// URL, matching git-lfs behaviour. Previously the built-in
    smudge filter constructed an HTTP-style <remote>.git/info/lfs path
    that did not exist on disk, leaving LFS-tracked files as pointers
    when cloning from a local repo.

  • Deduplicate objects when writing a multi-pack-index. Objects present
    in multiple packs (e.g. after git gc creates a cruft pack) would
    otherwise produce an OIDL chunk with repeated SHAs, causing
    git multi-pack-index verify to fail with "oid lookup out of order".
    (#​2152)

  • Extend ignorecase and precomposeunicode support to index lookups.
    (#​1807)

v1.2.0: 1.2.0

Compare Source

Notable changes since 1.1.0

New features
  • Add am command and porcelain.am() for applying mailbox-style email patches (git am), with state persistence for --continue, --skip, --abort, and --quit recovery (#​1692).
  • Add apply command and porcelain.apply_patch() for applying unified diffs, including rename/copy detection, binary patches with Git's base85 encoding, and --3way merge fallback (#​1784).
  • Expand log command options: --oneline, --abbrev-commit, --author, --committer, --grep, --since/--after, --until/--before, -n/--max-count, --no-merges, --merges, --stat, -p/--patch, --name-only, and --follow (#​1779).
  • Add support for push options (-o/--push-option) in push, enabling AGit flow and other server-side push option workflows.
  • Add missing push options: --all, --tags, --delete, --dry-run, --prune, --set-upstream, --follow-tags, and --mirror (#​1844).
  • Add support for atomic push operations (--atomic): either all ref updates succeed or none are applied (#​1781).
  • Add support for extensions.relativeworktrees repository extension, allowing worktrees to use relative paths (#​2112).
Configuration support
  • gc.pruneExpire — grace period before unreachable objects are pruned (#​1859).
  • core.precomposeunicode — normalize NFD Unicode paths from macOS filesystems to NFC (#​1804).
  • core.gitProxy — proxy command for git:// protocol connections (#​1850).
  • core.maxStat — limit stat operations when checking for unstaged changes (#​1853).
  • core.packedGitLimit — cap memory used for mmapped pack files, closing LRU packs when exceeded (#​1848).
  • core.deltaBaseCacheLimit — cap memory used for caching delta base objects; defaults to 96 MiB (#​1849).
  • http.userAgent — customize the User-Agent header (global and URL-specific); default is git/dulwich/{version}.
Fixes
  • Fix GPG signature verification to raise BadSignature for all GPG errors, not just BadSignatures; also detect when GPG returns no signatures.
  • Fix client incorrectly sending unborn argument in Git protocol v2 ls-refs requests to servers that don't advertise ls-refs=unborn, preventing clones from older servers like Gerrit 3.12.2 (#​2104).
  • Improve error message in read_info_refs() to show the actual line content when parsing fails (#​2103).
  • Preserve quoted trailing whitespace in config values (#​2145, Christopher Toth).
  • Fix .gitignore parent re-include handling so a later !dir/ re-include allows a subsequent file-level negation to take effect (#​2141, N0zoM1z0).
  • Fix host key verification in contrib/paramiko_vendor.py by loading known hosts and rejecting unknown SSH host keys by default (#​2123, quart27219).
Packaging
  • No longer ship contrib/ as part of the distribution. The contrib/ directory has always been documented as unsupported and is now excluded from the installed package (#​2122).

v1.1.0: 1.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: jelmer/dulwich@dulwich-1.0.0...dulwich-1.1.0

v1.0.0: 1.0.0

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.25.2...dulwich-1.0.0

v0.25.2: dulwich-0.25.1

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.25.1...dulwich-0.25.2

v0.25.1

Compare Source

Full Changelog: jelmer/dulwich@dulwich-0.25.0...dulwich-0.25.1

v0.25.0: v0.25.0

Compare Source

What's Changed

New Contributors

Full Changelog: jelmer/dulwich@dulwich-0.24.10...dulwich-0.25.0

v0.24.10: 0.24.10

Compare Source

Full Changelog: jelmer/dulwich@dulwich-0.24.9...dulwich-0.24.10

v0.24.9

Compare Source

  • Fix passing key_filename and ssh_command parameters to SSHGitClient by @​skshetry

  • Relax check to support subclasses of Urllib3HttpGitClient. Fixes
    regression from 0.24.2 where subclasses of Urllib3HttpGitClient would
    not receive the config object. by @​skshetry

  • Fix test_concurrent_ref_operations_compatibility test flakiness by @​jelmer

  • Fix warnings in test suite by @​jelmer

Full Changelog: jelmer/dulwich@dulwich-0.24.8...dulwich-0.24.9

v0.24.8

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.24.7...dulwich-0.24.8

v0.24.7: 0.24.7

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.24.6...dulwich-0.24.7

v0.24.6: 0.24.6

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.24.5...dulwich-0.24.6

v0.24.5: 0.24.5

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.24.4...dulwich-0.24.5

v0.24.4: 0.24.4

Compare Source

What's Changed

New Contributors

Full Changelog: jelmer/dulwich@dulwich-0.24.2...dulwich-0.24.4

v0.24.3: 0.24.3

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.24.2...dulwich-0.24.3

v0.24.2: 0.24.2

Compare Source

What's Changed

New Contributors

Full Changelog: jelmer/dulwich@dulwich-0.24.1...dulwich-0.24.2

v0.24.1

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.24.0...dulwich-0.24.1

v0.24.0: 0.24.0

Compare Source

What's Changed

@mend-for-github-com mend-for-github-com Bot added the security fix Security fix generated by Mend label Jun 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

security fix Security fix generated by Mend

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants