CVS commit: pkgsrc/devel/py-dulwich

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/devel/py-dulwich
From: "Adam Ciarcinski" <adam%netbsd.org@localhost>
Date: Tue, 7 Jul 2026 14:24:31 +0000

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Jul  7 14:24:31 UTC 2026

Modified Files:
        pkgsrc/devel/py-dulwich: Makefile cargo-depends.mk distinfo

Log Message:
py-dulwich: updated to 1.2.10

1.2.10  2026-07-07

 * Fix regression in 1.2.9 where loose objects whose content inflates to
   more than 8192 bytes failed to parse with ``zlib.error: object header
   exceeds maximum size``. (Jelmer Vernooĳ)

1.2.9   2026-07-06

 * Bound the running length when decoding EWAH bitmaps, so a corrupt or
   malformed ``.bitmap`` index raises ``ValueError`` instead of hanging in
   an unbounded loop that exhausts memory. (Jelmer Vernooĳ)

 * web: Reject smart HTTP ``git-upload-pack`` / ``git-receive-pack`` POSTs
   whose ``Content-Type`` is not the exact ``application/x-<service>-request``
   value, matching ``git http-backend``. Real git clients (and dulwich's own
   client) already send this header, so there is no interop cost; the check
   is defense in depth against cross-origin POSTs for deployments that wrap
   ``dulwich.web`` in a cookie-based auth layer.

 * SECURITY: On Windows, reject checkout paths whose leading component
   is a DOS drive-letter prefix like `C:`. `os.path.join(root, "C:...")`
   discards `root` and writes to the absolute drive path, so a tree entry
   named `C:` could otherwise write arbitrary files outside the work tree.
   (reported by Luke Baton, Jelmer Vernooĳ)

 * SECURITY: Bound zlib decompression of pack entries and loose objects
   against decompression-bomb DoS. ``read_zlib_chunks`` now caps the
   inflated size at the declared ``decomp_len``, and loose-object parsing
   (``ShaFile.from_file``/``from_path``) accepts a ``max_size`` argument
   defaulting to Git's ``core.bigFileThreshold`` (512 MiB). The disk
   object store reads ``core.bigFileThreshold`` from config and enforces
   it on ``_get_loose_object``.
   (reported by Luke Bento, Jelmer Vernooĳ)

 * SECURITY: Reject ``OFS_DELTA`` pack entries whose ``delta_base_offset``
   is zero. Such an entry references itself, so ``Pack.resolve_object``
   would loop forever growing its delta stack until the process ran out
   of memory. ``unpack_object`` now raises ``ApplyDeltaError`` at parse
   time, matching git's ``delta offset == 0 is invalid`` guard.
   (reported by Luke Banto, Jelmer Vernooĳ)

 * dulwich.web: Warn at startup that running ``python3 -m dulwich.web``
   is not meant to provide a production web server. It does not
   support authentication, for example.   (Jelmer Vernooĳ)

 * SECURITY: Bound ``Transfer-Encoding: chunked`` request bodies in
   ``dulwich.web``. ``_chunk_iter`` now strips chunk extensions, rejects
   negative sizes, and enforces per-chunk and per-request size limits;
   ``LimitedInputFilter`` also caps requests that omit ``Content-Length``.
   (Jelmer Vernooĳ)


To generate a diff of this commit:
cvs rdiff -u -r1.84 -r1.85 pkgsrc/devel/py-dulwich/Makefile
cvs rdiff -u -r1.18 -r1.19 pkgsrc/devel/py-dulwich/cargo-depends.mk
cvs rdiff -u -r1.79 -r1.80 pkgsrc/devel/py-dulwich/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/py-dulwich/Makefile
diff -u pkgsrc/devel/py-dulwich/Makefile:1.84 pkgsrc/devel/py-dulwich/Makefile:1.85
--- pkgsrc/devel/py-dulwich/Makefile:1.84       Mon Jul  6 07:56:46 2026
+++ pkgsrc/devel/py-dulwich/Makefile    Tue Jul  7 14:24:31 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.84 2026/07/06 07:56:46 adam Exp $
+# $NetBSD: Makefile,v 1.85 2026/07/07 14:24:31 adam Exp $
 
-DISTNAME=      dulwich-1.2.8
+DISTNAME=      dulwich-1.2.10
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    devel python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=d/dulwich/}

Index: pkgsrc/devel/py-dulwich/cargo-depends.mk
diff -u pkgsrc/devel/py-dulwich/cargo-depends.mk:1.18 pkgsrc/devel/py-dulwich/cargo-depends.mk:1.19
--- pkgsrc/devel/py-dulwich/cargo-depends.mk:1.18       Mon Jul  6 07:56:46 2026
+++ pkgsrc/devel/py-dulwich/cargo-depends.mk    Tue Jul  7 14:24:31 2026
@@ -1,8 +1,8 @@
-# $NetBSD: cargo-depends.mk,v 1.18 2026/07/06 07:56:46 adam Exp $
+# $NetBSD: cargo-depends.mk,v 1.19 2026/07/07 14:24:31 adam Exp $
 
-CARGO_CRATE_DEPENDS+=  bstr-1.12.1
+CARGO_CRATE_DEPENDS+=  bstr-1.12.3
 CARGO_CRATE_DEPENDS+=  heck-0.5.0
-CARGO_CRATE_DEPENDS+=  libc-0.2.185
+CARGO_CRATE_DEPENDS+=  libc-0.2.186
 CARGO_CRATE_DEPENDS+=  memchr-2.8.2
 CARGO_CRATE_DEPENDS+=  once_cell-1.21.4
 CARGO_CRATE_DEPENDS+=  portable-atomic-1.13.1
@@ -12,11 +12,10 @@ CARGO_CRATE_DEPENDS+=       pyo3-build-config-
 CARGO_CRATE_DEPENDS+=  pyo3-ffi-0.29.0
 CARGO_CRATE_DEPENDS+=  pyo3-macros-0.29.0
 CARGO_CRATE_DEPENDS+=  pyo3-macros-backend-0.29.0
-CARGO_CRATE_DEPENDS+=  quote-1.0.45
-CARGO_CRATE_DEPENDS+=  serde-1.0.228
+CARGO_CRATE_DEPENDS+=  quote-1.0.46
 CARGO_CRATE_DEPENDS+=  serde_core-1.0.228
 CARGO_CRATE_DEPENDS+=  serde_derive-1.0.228
 CARGO_CRATE_DEPENDS+=  similar-3.1.1
-CARGO_CRATE_DEPENDS+=  syn-2.0.117
+CARGO_CRATE_DEPENDS+=  syn-2.0.118
 CARGO_CRATE_DEPENDS+=  target-lexicon-0.13.5
 CARGO_CRATE_DEPENDS+=  unicode-ident-1.0.24

Index: pkgsrc/devel/py-dulwich/distinfo
diff -u pkgsrc/devel/py-dulwich/distinfo:1.79 pkgsrc/devel/py-dulwich/distinfo:1.80
--- pkgsrc/devel/py-dulwich/distinfo:1.79       Mon Jul  6 07:56:46 2026
+++ pkgsrc/devel/py-dulwich/distinfo    Tue Jul  7 14:24:31 2026
@@ -1,17 +1,17 @@
-$NetBSD: distinfo,v 1.79 2026/07/06 07:56:46 adam Exp $
+$NetBSD: distinfo,v 1.80 2026/07/07 14:24:31 adam Exp $
 
-BLAKE2s (bstr-1.12.1.crate) = bf738250e22e04ffa6d9ae59e16bec4997bc7307983bb39e1672cea8cba81d6f
-SHA512 (bstr-1.12.1.crate) = 63a1e62d43c4dce00f287421b1ec76accbbab7f0897c8df26227f533af325896c0c8921a873f4125381e7b89fbb69a4358a96698ec6ee61191955464ff1c84ac
-Size (bstr-1.12.1.crate) = 354916 bytes
-BLAKE2s (dulwich-1.2.8.tar.gz) = e225f0d6705417907b44d719313b0ba15efe6c801a0f0cb8c3c55d84cf115117
-SHA512 (dulwich-1.2.8.tar.gz) = a8da223bce5a2d07fca9f2e8eced5602efd1230cae9bd0f8d3b2e789ae6289d7c908615bcc5cd34072401ea71979938c2cce5c2e003bddb53ea24337a5868ed7
-Size (dulwich-1.2.8.tar.gz) = 1301174 bytes
+BLAKE2s (bstr-1.12.3.crate) = 147f1dc0e32ca9e25fc4eb8638b10a6a4683f890145057a982bf4ac718f30376
+SHA512 (bstr-1.12.3.crate) = 5093e7fc678c31684468d7b779a6f129db6b3d87fe7e05b86950ff1ee1afdf1bf6ae2586144667c8ee798de37f5fd089be0f7318401565484fbd7de07f7c0330
+Size (bstr-1.12.3.crate) = 355150 bytes
+BLAKE2s (dulwich-1.2.10.tar.gz) = 57f7e2eebc60b9a1c07573aa1d4d35b2b872bcdc07a33f98dbc1b53383bd196f
+SHA512 (dulwich-1.2.10.tar.gz) = cad8667471c2a97eb224c130a57cb6c6c2d8e5c77a290d4dcd3e0cb60d190e6932ffba848ee8945940b0a84c482aea87dd0c363bb7e83042e9e2364b169c3dc2
+Size (dulwich-1.2.10.tar.gz) = 1310282 bytes
 BLAKE2s (heck-0.5.0.crate) = 0bc71a5746c9d1e7c913d096fb68f1d422464744e18adc592540b291882f5660
 SHA512 (heck-0.5.0.crate) = f044fc9c3d22466629fd8f772ec0555350fd611c0cfadca51d99a3d2f10e155f77c1091916c8a95a6b9b499f366c2e99a5fbf45b010f988bfb9b2501bf9f6a76
 Size (heck-0.5.0.crate) = 11517 bytes
-BLAKE2s (libc-0.2.185.crate) = 4571ea59c09944dc900f3e23b2729201780fa042c594cf127bf8140222daf20b
-SHA512 (libc-0.2.185.crate) = c8dbcaaf2e5d8377a4d1003af4a7210fbfe4f9b1e8497f07d88a231a8d5c9f67014e650a5e18e913e7b4d6a1835c4cbc9c31ce0cd224ea28acbdbb39034a300e
-Size (libc-0.2.185.crate) = 821775 bytes
+BLAKE2s (libc-0.2.186.crate) = e4ae2a7c2182c3a4f54e39cfed3d574220b3a6d54af5a40aadfd814bb8a12c6a
+SHA512 (libc-0.2.186.crate) = 6a58e671ec6811dff9a0d7d4db8f37d38bcbca9efff20dad4706190e5cdb77b426567754bcf0ef0f2d0c31d6506401f724f3ca500b9bed57bb8605b1141ed690
+Size (libc-0.2.186.crate) = 821883 bytes
 BLAKE2s (memchr-2.8.2.crate) = bc2997ad38b5f25065eb90fab249f423f107ad01304fc317f1e042084b12bcac
 SHA512 (memchr-2.8.2.crate) = 011574c7b8519b19298e553d170c1defc5fd06698d4c00684715802de57b235562c8849ca7bc0ad2b77a05eb2f94af1f49289285803d4461460469248319a15e
 Size (memchr-2.8.2.crate) = 99069 bytes
@@ -39,12 +39,9 @@ Size (pyo3-macros-0.29.0.crate) = 8915 b
 BLAKE2s (pyo3-macros-backend-0.29.0.crate) = 6b63621bf64ba16ae267df41057b1ac4fcc3f47c5ac6ef4cc4f55ccd3c0d798e
 SHA512 (pyo3-macros-backend-0.29.0.crate) = 13a7af3958c09969637827d97ab9bbc664c407dda9e4283afaf495757798cf6f84932468bc092160fa75211ce0aafe6efc657f3a390234d77a67362cfb31fe0f
 Size (pyo3-macros-backend-0.29.0.crate) = 91943 bytes
-BLAKE2s (quote-1.0.45.crate) = 20533b49c424d16a57b48d77fd05ff08c31355221b3dd0d6fd917c60da7f748b
-SHA512 (quote-1.0.45.crate) = df96ede01ebd0ed642b758bf1d0862d0e116fc2b3343e14edb657ce5438ccabe743dec4a0a40de4dee98c134d169af9aba459faadf9c7a832b26377e755d49b0
-Size (quote-1.0.45.crate) = 31564 bytes
-BLAKE2s (serde-1.0.228.crate) = 6d35ddc61aef1dd8524d6730c719753730adcf3b2ecc0bb3f54af53f74384a99
-SHA512 (serde-1.0.228.crate) = 9b645d6214203533b303fc5e88ad4f7686c22df084878d18a0209a92304a340fcb62fdde88a7080cf7a7348d47b9b363885c4e1da90dba08cc99ff620f375e97
-Size (serde-1.0.228.crate) = 83652 bytes
+BLAKE2s (quote-1.0.46.crate) = c46b18b5cdbf25292ef1bc1b3a7fa18a92406588beb8dca1c12c7320e03ba60c
+SHA512 (quote-1.0.46.crate) = f51e65743b9f15b491d20bb6c3a0df921cfec29df8bafca36c9dde034b5117fe3f4eedcc258126c6cb1729be1ffde5fcf7e5b0fb0c3de4a618f46ab3cd803e77
+Size (quote-1.0.46.crate) = 31628 bytes
 BLAKE2s (serde_core-1.0.228.crate) = c3ea455d91e83c2bd00cc5627f0c256b89e4defeacb70b76aa1f21ed33aabbec
 SHA512 (serde_core-1.0.228.crate) = 43897e3a7ebdc85d81d1cb30cda8f0a11610f6f551529c8a21462c24fb83110652b462846aa3e1bed5fbf8b5d7927018845a524ee9e079e2c8acf2c687efd6c4
 Size (serde_core-1.0.228.crate) = 63111 bytes
@@ -54,9 +51,9 @@ Size (serde_derive-1.0.228.crate) = 5960
 BLAKE2s (similar-3.1.1.crate) = ae1f8646079c71f3b8c99a31c37c10ab39372a076b06e22e000639bda8877744
 SHA512 (similar-3.1.1.crate) = f197b2dbca2c9a09314042ddd6d413410f952f284cf12b8d86b7a6a2584ba61efb4a29e8d3bc954fdde79265711a97fe1a3e94ef82e8ade9379a5981c7bb793e
 Size (similar-3.1.1.crate) = 79833 bytes
-BLAKE2s (syn-2.0.117.crate) = 03f50444ef7a3b5f28a72c59696d1676df1b8f5c334b19648d2755927e8b2f43
-SHA512 (syn-2.0.117.crate) = 035c2e63542592b6a4058a2a82d4c2c1f5793f84fb1b04cbd393337a26fcf661a1f3bea439ce98a1fe943b1c4d36d2bda16df3bbc3fa6ca35e1548d530dc8416
-Size (syn-2.0.117.crate) = 306011 bytes
+BLAKE2s (syn-2.0.118.crate) = d87c4260b28e9ef68731e1bfde11fadc47cb88aff1cbf915eba7814fecdf429a
+SHA512 (syn-2.0.118.crate) = 24cbedce5f751fb5fab46ce27b9772fb59692e5520039a4d66a9f4d8d8b381d2af5c5be5eebd1e24cdba49fcb40a90b38f61477dd5dc96d8f272823f9a93b61d
+Size (syn-2.0.118.crate) = 305533 bytes
 BLAKE2s (target-lexicon-0.13.5.crate) = 68bf6c69ac036b1df41f1073b8a85e072da1e13c570340afe4f59722e4c95fd0
 SHA512 (target-lexicon-0.13.5.crate) = 956df27c01e1186c5356117ffd07810fc0b62fb919d5bfd215955ba85be00ef675212a3c0dc36679986be7b825442fec5c93c7643b7e1e19c04572e6463546fc
 Size (target-lexicon-0.13.5.crate) = 26928 bytes

Prev by Date: CVS commit: pkgsrc/doc
Next by Date: CVS commit: pkgsrc/doc
Previous by Thread: CVS commit: pkgsrc/doc
Next by Thread: CVS commit: pkgsrc/doc
Indexes:

Home | Main Index | Thread Index | Old Index