CVS commit: pkgsrc/devel/py-dulwich

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/devel/py-dulwich
From: "Adam Ciarcinski" <adam%netbsd.org@localhost>
Date: Mon, 6 Jul 2026 07:56:46 +0000

Module Name:    pkgsrc
Committed By:   adam
Date:           Mon Jul  6 07:56:46 UTC 2026

Modified Files:
        pkgsrc/devel/py-dulwich: Makefile cargo-depends.mk distinfo

Log Message:
py-dulwich: updated to 1.2.8

1.2.8   2026-07-05

* Enumerate the objects to push before the HTTP ``git-receive-pack``
  request body starts streaming. ``generate_pack_data`` previously ran
  lazily inside the body generator, after the header pkt-lines were
  already on the wire, so on large repositories the request stalled
  mid-body while objects were counted and servers such as GitHub aborted
  the push with a timeout / "broken pipe".

* Support ``http.postBuffer``.

* SECURITY: Canonicalize file modes to ``0o644``/``0o755`` before ``chmod``
  on checkout and patch apply, matching git. An untrusted tree entry or
  patch ``new file mode`` could otherwise set setuid/setgid/sticky or
  world-writable bits on a materialized file. (netliomax25-code)

* SECURITY(GHSA-8w8g-wq8h-fq33): Write files through ``build_file_from_blob``
  in path-restricted ``porcelain.checkout(paths=...)`` instead of a raw
  ``os.open``. The old path followed a symlink left at the target, so a
  crafted repository could write attacker content outside the work tree
  (e.g. into ``.git/hooks``) on ``checkout``. (reported by zx (Jace) and
  Houlton McGuinn, Jelmer Vernooĳ)

* SECURITY(GHSA-5fqc-mrg8-w798): Build the temporary index for
  ``filter-branch --index-filter`` in memory instead of materializing tree
  entries into CWD. Persisted entries between commits let a symlink from
  an ancestor commit redirect a descendant's writes outside the work tree.
  (reported by zx (Jace), Jelmer Vernooĳ)

* SECURITY: Refuse to write a stash entry through an intermediate symlink
  on ``stash.pop``. The old ``os.path.exists`` check followed symlinks, so
  a crafted stash whose parent path was a symlink already present in the
  worktree (e.g. ``link`` -> ``.git/hooks``) let the subsequent write land
  outside the work tree. (reported by zx (Jace), Jelmer Vernooĳ)

* SECURITY: Refuse path-restricted ``porcelain.checkout``, ``restore`` and
  ``reset_file`` writes whose leading directory is an existing symlink, so
  a crafted repository can no longer land ``sub`` as a link to
  ``.git/hooks`` and have a write to ``sub/anything`` traverse it.
  (reported by zx (Jace), Jelmer Vernooĳ)

* SECURITY: Reject non-hex pkt-line length prefixes in the protocol parser.
  ``int(sizestr, 16)`` accepted a leading ``-``, whose negative length made
  the following ``read(size - 4)`` slurp the rest of the stream and caused
  ``PktLineParser`` to loop without consuming its buffer.

* SECURITY: Escape the repository path passed to the remote in the SSH
  client, so a path containing a single quote can no longer close the
  quoting and have the remainder interpreted by the remote shell.

* SECURITY: Reject an option-like host in ``TCPGitClient`` before invoking
  the ``core.gitProxy`` command, matching the ``SubprocessSSHVendor`` guard,
  so a URL like ``git://-oProxyCommand=...`` can no longer be interpreted
  as a flag by the proxy program.

* SECURITY: Validate object ids in the object store and refs container. An
  id containing path separators would previously be joined into a filename
  by ``DiskObjectStore._get_shafile_path`` (escaping the objects
  directory) or stored as a ref value.

* SECURITY: Validate the object id in LFS server request handlers before
  it reaches the store. The store maps ``oid`` onto
  ``objects/<oid[:2]>/<oid[2:4]>/<oid>``, so a request path containing
  ``..`` could otherwise escape the LFS directory.

* SECURITY: Don't expand config ``include``/``includeIf`` directives when
  parsing bundle lists served by an untrusted bundle-uri host, matching
  the handling of ``.gitmodules``.

* SECURITY: Read the signing key from gpg's ``--status-fd`` (``VALIDSIG``)
  in ``GPGCliSignatureVendor.verify`` instead of the human-readable
  ``using RSA key ...`` text on stderr, which could be spoofed by embedding
  a matching line in the signed payload.

* SECURITY: Raise ``UntrustedSignature`` from ``verify_commit`` and
  ``verify_tag`` when ``keyids`` is set and the object carries no
  signature, instead of silently accepting it.

* SECURITY: Fix quadratic backtracking in ``_find_scissors_line``. The
  perforation regex had two unbounded ``-+`` groups separated only by
  optional subpatterns, so a long dash-only line ran in O(n^2); every line
  of a mailbox is fed through ``mailinfo``/``git am --scissors``, so a
  crafted patch could stall the parser.

* SECURITY: Collapse consecutive ``*`` wildcards to at most ``**`` in
  ``.gitattributes``, ``.gitignore`` and config glob translation, so a
  pattern with a long run of stars can no longer produce adjacent
  unbounded regex quantifiers that backtrack catastrophically (ReDoS).

* SECURITY: Fix quadratic buffering in ``web.ChunkReader.read``. The
  buffered-byte total was recomputed from scratch on each iteration, so a
  large chunked request body ran in O(n^2).

* SECURITY: Skip invalid tree paths (containing ``..``, ``.git``, etc.) in
  ``diff_working_tree_to_tree`` instead of joining them onto the work
  tree, matching git. A working-tree diff against an untrusted commit
  could otherwise read a file outside the work tree and disclose its
  contents in the diff output.

* SECURITY: Fix quadratic header accumulation in ``ShaFile._parse_message``
  so parsing an object with many header lines no longer runs in O(n^2).

* Replace a symlink left at the target path with a fresh regular file in
  ``build_file_from_blob`` instead of writing through it, matching git on
  checkout.

* Raise ``GitProtocolError`` carrying the server's message when the
  fetch/send-pack tail loop sees a fatal side-band channel (``\x03``),
  instead of crashing with ``AssertionError: Invalid sideband channel 3``
  and swallowing the server's error text. (Jelmer Vernooĳ)

* Use ``ThreadingHTTPServer`` and advertise HTTP/1.1 in ``lfs_server`` so
  urllib3's keep-alive pool doesn't race a torn-down connection into
  ``RemoteDisconnected``. (Jelmer Vernooĳ)

* Deprecate ``dulwich.objects.filename_to_hex``, which is unused.
  (Jelmer Vernooĳ)

* Support pyo3 0.29. (Jelmer Vernooĳ)


To generate a diff of this commit:
cvs rdiff -u -r1.83 -r1.84 pkgsrc/devel/py-dulwich/Makefile
cvs rdiff -u -r1.17 -r1.18 pkgsrc/devel/py-dulwich/cargo-depends.mk
cvs rdiff -u -r1.78 -r1.79 pkgsrc/devel/py-dulwich/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/py-dulwich/Makefile
diff -u pkgsrc/devel/py-dulwich/Makefile:1.83 pkgsrc/devel/py-dulwich/Makefile:1.84
--- pkgsrc/devel/py-dulwich/Makefile:1.83       Thu Jul  2 11:26:44 2026
+++ pkgsrc/devel/py-dulwich/Makefile    Mon Jul  6 07:56:46 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.83 2026/07/02 11:26:44 adam Exp $
+# $NetBSD: Makefile,v 1.84 2026/07/06 07:56:46 adam Exp $
 
-DISTNAME=      dulwich-1.2.7
+DISTNAME=      dulwich-1.2.8
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    devel python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=d/dulwich/}

Index: pkgsrc/devel/py-dulwich/cargo-depends.mk
diff -u pkgsrc/devel/py-dulwich/cargo-depends.mk:1.17 pkgsrc/devel/py-dulwich/cargo-depends.mk:1.18
--- pkgsrc/devel/py-dulwich/cargo-depends.mk:1.17       Thu Jul  2 11:26:44 2026
+++ pkgsrc/devel/py-dulwich/cargo-depends.mk    Mon Jul  6 07:56:46 2026
@@ -1,17 +1,17 @@
-# $NetBSD: cargo-depends.mk,v 1.17 2026/07/02 11:26:44 adam Exp $
+# $NetBSD: cargo-depends.mk,v 1.18 2026/07/06 07:56:46 adam Exp $
 
 CARGO_CRATE_DEPENDS+=  bstr-1.12.1
 CARGO_CRATE_DEPENDS+=  heck-0.5.0
 CARGO_CRATE_DEPENDS+=  libc-0.2.185
-CARGO_CRATE_DEPENDS+=  memchr-2.8.1
+CARGO_CRATE_DEPENDS+=  memchr-2.8.2
 CARGO_CRATE_DEPENDS+=  once_cell-1.21.4
 CARGO_CRATE_DEPENDS+=  portable-atomic-1.13.1
 CARGO_CRATE_DEPENDS+=  proc-macro2-1.0.106
-CARGO_CRATE_DEPENDS+=  pyo3-0.28.3
-CARGO_CRATE_DEPENDS+=  pyo3-build-config-0.28.3
-CARGO_CRATE_DEPENDS+=  pyo3-ffi-0.28.3
-CARGO_CRATE_DEPENDS+=  pyo3-macros-0.28.3
-CARGO_CRATE_DEPENDS+=  pyo3-macros-backend-0.28.3
+CARGO_CRATE_DEPENDS+=  pyo3-0.29.0
+CARGO_CRATE_DEPENDS+=  pyo3-build-config-0.29.0
+CARGO_CRATE_DEPENDS+=  pyo3-ffi-0.29.0
+CARGO_CRATE_DEPENDS+=  pyo3-macros-0.29.0
+CARGO_CRATE_DEPENDS+=  pyo3-macros-backend-0.29.0
 CARGO_CRATE_DEPENDS+=  quote-1.0.45
 CARGO_CRATE_DEPENDS+=  serde-1.0.228
 CARGO_CRATE_DEPENDS+=  serde_core-1.0.228

Index: pkgsrc/devel/py-dulwich/distinfo
diff -u pkgsrc/devel/py-dulwich/distinfo:1.78 pkgsrc/devel/py-dulwich/distinfo:1.79
--- pkgsrc/devel/py-dulwich/distinfo:1.78       Thu Jul  2 11:26:44 2026
+++ pkgsrc/devel/py-dulwich/distinfo    Mon Jul  6 07:56:46 2026
@@ -1,20 +1,20 @@
-$NetBSD: distinfo,v 1.78 2026/07/02 11:26:44 adam Exp $
+$NetBSD: distinfo,v 1.79 2026/07/06 07:56:46 adam Exp $
 
 BLAKE2s (bstr-1.12.1.crate) = bf738250e22e04ffa6d9ae59e16bec4997bc7307983bb39e1672cea8cba81d6f
 SHA512 (bstr-1.12.1.crate) = 63a1e62d43c4dce00f287421b1ec76accbbab7f0897c8df26227f533af325896c0c8921a873f4125381e7b89fbb69a4358a96698ec6ee61191955464ff1c84ac
 Size (bstr-1.12.1.crate) = 354916 bytes
-BLAKE2s (dulwich-1.2.7.tar.gz) = 21160a6730accf751ed886a5d6356db7bb83930b03896380187de25b176a2174
-SHA512 (dulwich-1.2.7.tar.gz) = 57ebe0e682b7e01a2ee452f8378be6228ebfa8d35549c7f1d7d2c24263972649def0bf5c57e911ba859f61d7d26df9b6053c7b2222e858076f9a9272d8fed660
-Size (dulwich-1.2.7.tar.gz) = 1284735 bytes
+BLAKE2s (dulwich-1.2.8.tar.gz) = e225f0d6705417907b44d719313b0ba15efe6c801a0f0cb8c3c55d84cf115117
+SHA512 (dulwich-1.2.8.tar.gz) = a8da223bce5a2d07fca9f2e8eced5602efd1230cae9bd0f8d3b2e789ae6289d7c908615bcc5cd34072401ea71979938c2cce5c2e003bddb53ea24337a5868ed7
+Size (dulwich-1.2.8.tar.gz) = 1301174 bytes
 BLAKE2s (heck-0.5.0.crate) = 0bc71a5746c9d1e7c913d096fb68f1d422464744e18adc592540b291882f5660
 SHA512 (heck-0.5.0.crate) = f044fc9c3d22466629fd8f772ec0555350fd611c0cfadca51d99a3d2f10e155f77c1091916c8a95a6b9b499f366c2e99a5fbf45b010f988bfb9b2501bf9f6a76
 Size (heck-0.5.0.crate) = 11517 bytes
 BLAKE2s (libc-0.2.185.crate) = 4571ea59c09944dc900f3e23b2729201780fa042c594cf127bf8140222daf20b
 SHA512 (libc-0.2.185.crate) = c8dbcaaf2e5d8377a4d1003af4a7210fbfe4f9b1e8497f07d88a231a8d5c9f67014e650a5e18e913e7b4d6a1835c4cbc9c31ce0cd224ea28acbdbb39034a300e
 Size (libc-0.2.185.crate) = 821775 bytes
-BLAKE2s (memchr-2.8.1.crate) = 1b8983eacf166f8ccb7312f81cff61cdefcfe0519857b66dce35b73328aba70b
-SHA512 (memchr-2.8.1.crate) = a11ff12e2e2fda7ee6e45dcc39bba289d0c2605e996263782d7039c3922781a51fdbe6e0b0455a0075e126b9ff2369a5935d9162e6d5903110120c12886322e1
-Size (memchr-2.8.1.crate) = 98743 bytes
+BLAKE2s (memchr-2.8.2.crate) = bc2997ad38b5f25065eb90fab249f423f107ad01304fc317f1e042084b12bcac
+SHA512 (memchr-2.8.2.crate) = 011574c7b8519b19298e553d170c1defc5fd06698d4c00684715802de57b235562c8849ca7bc0ad2b77a05eb2f94af1f49289285803d4461460469248319a15e
+Size (memchr-2.8.2.crate) = 99069 bytes
 BLAKE2s (once_cell-1.21.4.crate) = 5945879c1e46e46585a2692e5f3ac0beaa15f111aa45611e0419b50abb21fb4e
 SHA512 (once_cell-1.21.4.crate) = af67669b0107f44268ba74c355200cb2ed1aab235a6989a8bc54323eb2c9a45677010f8672e7790edadd4c981e939436e0c3a099d33c06dce9c14fd5ede86155
 Size (once_cell-1.21.4.crate) = 35010 bytes
@@ -24,21 +24,21 @@ Size (portable-atomic-1.13.1.crate) = 19
 BLAKE2s (proc-macro2-1.0.106.crate) = d914a8fc313c5a898a0a9381a19dfbdfe9b94efba3f431759ea2c7ce43cd5362
 SHA512 (proc-macro2-1.0.106.crate) = b726e2c92af434bfa88cd4f53c3fe6db647503567675fb439890dee3d15f5111137e3242b28d164114ce081c10acf3fd11950753ddb349190c87ee04e7d97744
 Size (proc-macro2-1.0.106.crate) = 59765 bytes
-BLAKE2s (pyo3-0.28.3.crate) = 3c6aaac1c9811198ec6da1c9fc48d2f6838f322132ada3667eacb8ed65c418f3
-SHA512 (pyo3-0.28.3.crate) = f955957eec4b95cc9337d331bba3bba52b4754b301cf86cd974601e64eb20c2424023b19be89a224661fe2e185de646cd3d0d00705b6b5cbd139856c9443a247
-Size (pyo3-0.28.3.crate) = 1204476 bytes
-BLAKE2s (pyo3-build-config-0.28.3.crate) = fbf0abd806eefd9d8e61c5c0074bed592f2cdfbf3a82db8e1d78996c13adc5ad
-SHA512 (pyo3-build-config-0.28.3.crate) = 78f85696901b16540d42187d10e888bd929b9f23415faeb73f9798abda1af3506a308145dd4113b070521271c72624d7930fb4b19bad25aa1afd3082030c9126
-Size (pyo3-build-config-0.28.3.crate) = 35961 bytes
-BLAKE2s (pyo3-ffi-0.28.3.crate) = e6ec195e9898889c1bd58068700c10823bb34dc8292bbf0c1ebb473563fc7aae
-SHA512 (pyo3-ffi-0.28.3.crate) = ec49b5cc67d19f46c9daea76b37b4988af0f63b9ed67c71190f015a0aa9691d4a8ffd4128413de430928428e1e8e26d44c3103f561e6b71b7e8c4597ab602d9f
-Size (pyo3-ffi-0.28.3.crate) = 80881 bytes
-BLAKE2s (pyo3-macros-0.28.3.crate) = 91c533aadcfafb9c1aac727e81e88fb1daf48ee50292f10de2fa67623d3d909d
-SHA512 (pyo3-macros-0.28.3.crate) = 57d178bd9b53dd98916e60c89bc26c34f9949829dc17bf7d6cc15b704bba7c874d85d6bd3c827d401268660a79230a6e32711048da939ec4e22342f3e08046d1
-Size (pyo3-macros-0.28.3.crate) = 8963 bytes
-BLAKE2s (pyo3-macros-backend-0.28.3.crate) = 4566cb08ea39578f852a847f909c3aa2b5fd0b9e65cf862a8a418e6982a8cdd0
-SHA512 (pyo3-macros-backend-0.28.3.crate) = 45ce31ed64ee4fd0249736d480c9840a756bc45934d6803ae11e0680057ecf4cc74c71b47ccf9241fc3ab5c1e0b9c758426f08bd523d1ace92fc308302ea3c84
-Size (pyo3-macros-backend-0.28.3.crate) = 88063 bytes
+BLAKE2s (pyo3-0.29.0.crate) = f25cfefac48e0d488a15bcace947cbedfae7afe57f1f7a142a5bc80ba8ed1609
+SHA512 (pyo3-0.29.0.crate) = e6822400de53ebcef4a14c899dc065abae621a126483873139f5eb850877c94f4bccee3a183d4e2a69eadcd3c3b82b0a6f3e1053d926b103be572329607f2f67
+Size (pyo3-0.29.0.crate) = 1241253 bytes
+BLAKE2s (pyo3-build-config-0.29.0.crate) = e0e97f7d0ac4e5042975ecefea1e7c59b0f5703b9432798585b20246f1a21ea6
+SHA512 (pyo3-build-config-0.29.0.crate) = df77e8d7d5fe173749437ff6b90fa1703083377d515ab8a85dc77d9cac9c3fc331ede4b040f7e3694311ddb5adff577cf90c181a27c196ab93a4569e918fdea8
+Size (pyo3-build-config-0.29.0.crate) = 39616 bytes
+BLAKE2s (pyo3-ffi-0.29.0.crate) = 3af279f26061a985347a80550d7bee3255c334ae2a8ffcc7f67c1418b571e72f
+SHA512 (pyo3-ffi-0.29.0.crate) = baaf01d13ddc09316ba16b22e9ca15a67e5bda5b861ed7961c3393fd4692fc1c96952f81465d1dcb6531b9083f96c5630981b3d7802cb1ac2af67aafaffbec76
+Size (pyo3-ffi-0.29.0.crate) = 88184 bytes
+BLAKE2s (pyo3-macros-0.29.0.crate) = bfbee9072175b5300ed98357459423798f130a3333bd796de32009a725d9ba4b
+SHA512 (pyo3-macros-0.29.0.crate) = fb6633ac76229d2e0ad88d51136a9318f03823b27c700a62cfbc957b4c834985e2f4c0cdaf5ea5e9993ec9e8ce3d63cd6b3fb823f2a042e65186adbed78da7c2
+Size (pyo3-macros-0.29.0.crate) = 8915 bytes
+BLAKE2s (pyo3-macros-backend-0.29.0.crate) = 6b63621bf64ba16ae267df41057b1ac4fcc3f47c5ac6ef4cc4f55ccd3c0d798e
+SHA512 (pyo3-macros-backend-0.29.0.crate) = 13a7af3958c09969637827d97ab9bbc664c407dda9e4283afaf495757798cf6f84932468bc092160fa75211ce0aafe6efc657f3a390234d77a67362cfb31fe0f
+Size (pyo3-macros-backend-0.29.0.crate) = 91943 bytes
 BLAKE2s (quote-1.0.45.crate) = 20533b49c424d16a57b48d77fd05ff08c31355221b3dd0d6fd917c60da7f748b
 SHA512 (quote-1.0.45.crate) = df96ede01ebd0ed642b758bf1d0862d0e116fc2b3343e14edb657ce5438ccabe743dec4a0a40de4dee98c134d169af9aba459faadf9c7a832b26377e755d49b0
 Size (quote-1.0.45.crate) = 31564 bytes

Prev by Date: CVS commit: pkgsrc/devel/cargo-nextest
Next by Date: CVS commit: pkgsrc/doc
Previous by Thread: CVS commit: pkgsrc/devel/cargo-nextest
Next by Thread: CVS commit: pkgsrc/doc
Indexes:

Home | Main Index | Thread Index | Old Index