jelmer/dulwich dulwich-1.2.21

on GitHub

SECURITY: Refuse porcelain.submodule_update when the submodule path
or a parent directory is already a symlink. A victim's worktree could
otherwise redirect the clone (including the submodule .git file) into
the link target. Reported by AnkitSingh411. (Jelmer Vernooij)

SECURITY: Refuse to open a pack index whose fanout claims more objects
than the file could possibly hold. Loading previously succeeded and
lookups then returned empty names or raised struct errors deep in the
call stack. (Jelmer Vernooij)

HARDEN: Add a sha1dc extra: pip install dulwich[sha1dc] pulls
in the sha1dc package and dulwich picks it up for object ids, so
SHA-1 collisions are detected rather than silently accepted. Without it,
dulwich falls back to hashlib.sha1. (Jelmer Vernooij)

SECURITY: Strip terminal control bytes from sideband progress and fatal
messages received from a remote, so a hostile server can no longer inject
ANSI escape sequences into the user's terminal (matching git's fix for
CVE-2024-52005). (Jelmer Vernooij)

HARDEN: Cap tree traversal depth in iter_tree_contents at 1280 levels
(core.maxTreeDepth). A tree nested more deeply raises
MaxTreeDepthExceeded. (Jelmer Vernooij)

Free the object store passed to commit_tree without the cycle
collector. Its nested helper functions kept it in a reference cycle,
so pack files stayed open after use. (Zainab Mehmut)

Emit the \ No newline at end of file marker when the final line is
unchanged context. Patches ending with such a line were truncated and
git apply rejected them as corrupt. (Jelmer Vernooij, #2543)

Honour protocol.<name>.allow for submodule URLs; the file transport
is now refused for submodules by default. (Kartik Kenchi)

Yield checksum mismatches from porcelain.fsck instead of raising
them. Object store lookups now validate the SHA, so a corrupt loose
object aborted the iteration. (Jelmer Vernooij, #2552)