• Add PackIndex.object_sha_at_position to look up an object by its position in the sorted index, and use it when loading a .bitmap instead of re-scanning the index for every entry, which made loading quadratic in the pack size, unlike git. (Kartik Kenchi)
• Fix applying patches without content changes, such as mode changes and added or deleted empty files. They have no ---/+++ lines and failed with "Patch has no file path". (Jelmer Vernooij)
• Fix applying binary patches produced by git diff --binary. Their paths are now taken from the diff --git line, literal data is inflated, base85 line lengths are decoded correctly and binary deletions remove the file. (Jelmer Vernooij)
• Support delta binary patches, binary changes combined with a rename or copy and reverse application of binary patches in apply_patches. (Jelmer Vernooij)
• Unquote C-style quoted file names (as git emits for names with special or non-ASCII characters) when parsing patches. (Jelmer Vernooij)
• SECURITY: Validate index paths in sparse checkout, mixed reset, lfs_pull and lfs_migrate, so that a malicious repository can no longer write files outside the work tree via .. entries or symlinks. (Jelmer Vernooij, reported by Choudhry Shehryar)
• SECURITY: Don't write through symlinks in apply_patches. A tracked symlink such as trap -> .git/hooks/pre-commit was followed when writing, so porcelain.am/apply_patch could install a hook. Symlinks are now patched as links, like git does, and a patch whose mode doesn't match the type in the work tree or that adds a file over an existing path is refused. (Jelmer Vernooij, reported by @manus-pi)
• Apply a mode change in build_file_from_blob when the content is unchanged. (Jelmer Vernooij)
• Fix parsing of a rename or copy without content changes followed by another patch, which swallowed the next patch. (Jelmer Vernooij)
• Honour \ No newline at end of file markers when applying patches, which previously made patches to files without a trailing newline fail. (Jelmer Vernooij)
• Ignore a multi-pack-index entry whose pack has been removed when answering whether an object is present. After a prune the stale index made sha in repo.object_store disagree with repo.object_store[sha]. (Kartik Kenchi)
• Don't follow a symlink when reading .gitignore or .gitattributes from the work tree. A tree could point either name at a file outside the repository and have its contents drive dulwich. (Kartik Kenchi)
• Honour GIT_OPTIONAL_LOCKS=0 in dulwich status, skipping the index stat-cache refresh that would otherwise lock the index. (Jelmer Vernooij, #1861)
• Preserve original URL in remote origin configuration when cloning, matching C git behavior. (Suprovo Ghosh, #2428)
• Report conflicts in criss-cross merges where the merge bases disagree on a file. The recursive merge silently kept one base's blob as the virtual base, so the final three-way merge published the other side's content without recording a conflict. (Jelmer Vernooij, #2419)
• Record merge conflicts in the index with stages 1/2/3 and write MERGE_HEAD/MERGE_MSG when porcelain.merge leaves conflicts, so the working tree matches git's state and git commit can finish the merge. (Jelmer Vernooij)
• Preserve index entries that differ only by case when loading the index, resetting mixed, or restoring a stashed index tree under core.ignorecase. (Jelmer Vernooij, #2434)
• Fix a crash in dulwich log <path> on merge commits where the path is unchanged relative to one parent. tree_changes_for_merge reports None for such parents, which the walker and the --name-status and --name-only output wrongly assumed to be a TreeChange. (Jelmer Vernooij, #2412)
• dulwich log <path> now applies git's default history simplification. Pass --full-history for the old behavior. Walker and get_walker gain a simplify_history flag. (Jelmer Vernooij, #2414)
• Carry the repository's object format through the index and the work tree. add and commit on a SHA-256 repository wrote SHA-1 identities into the index, trees and refs, leaving a repository neither dulwich nor git could read back. (Jelmer Vernooij, #2416)
• Honour the eol gitattribute. Line ending conversion is now resolved per path from the text/crlf and eol attributes, falling back to core.autocrlf and core.eol only where the attributes are silent, so eol=crlf and eol=lf take precedence over the configuration as they do in git. (Jelmer Vernooij, #2403)
• Write carriage returns in configuration values literally rather than as a \r escape. (Jelmer Vernooij)
• Strip leading blank lines in stripspace in a single pass. The previous pop(0) loop made an all-blank input O(n^2); it is now linear like git. (Kartik Kenchi)