CVS commit: pkgsrc/devel/git-lfs

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Fri Oct 23 08:26:49 UTC 2026

Modified Files:
        pkgsrc/devel/git-lfs: Makefile distinfo go-modules.mk

Log Message:
git-lfs: updated to 3.8.1

3.8.1 (22 October 2026)

This release introduces security fixes for four vulnerabilities that
have been assigned the identifiers CVE-2026-69260, CVE-2026-69261,
CVE-2026-105802, and CVE-2026-105803.  These vulnerabilities apply
to all of the operating systems supported by Git LFS.

* CVE-2026-69260:

  When Git LFS sends a remote command via SSH, it does not properly
  format the argument it derives from the remote SSH URL.  Servers
  which pass remote commands to a shell without sanitizing their
  arguments may be induced to execute malicious programs.

  Git LFS has resolved this problem by fully quoting the arguments
  of the remote commands it sends via SSH.

* CVE-2026-69261:

  After receiving an HTTP redirection, Git LFS may forward Cookie
  headers to a host other than the one for which they were intended.
  If credentials or other secrets are stored in HTTP cookies, they
  may be leaked to a potentially malicious host.

  Git LFS has resolved this issue by only sending Cookie headers
  to the hosts for which they were intended.

* CVE-2026-105802:

  When operating in a malicious repository which contains a submodule,
  Git LFS may execute an arbitrary program after incorrectly parsing
  line feed (LF) characters in the submodule's URL.

  Git LFS has resolved this issue by always using an unambiguous
  format to read and parse Git configuration options.

* CVE-2026-105803:

  When operating in a malicious repository, Git LFS may execute an
  arbitrary program as a custom transfer adapter after incorrectly
  filtering the options defined in an `.lfsconfig` file.

  Git LFS has resolved this issue by restricting the configuration
  of custom object transfer commands to local sources.

As well as the changes listed above, Git LFS has resolved a problem
with its encoding of the HTTPS URL it checks when a remote SSH host
either does not support Git LFS commands or does not return an
HTTP URL in response to an authentication request.


To generate a diff of this commit:
cvs rdiff -u -r1.107 -r1.108 pkgsrc/devel/git-lfs/Makefile
cvs rdiff -u -r1.22 -r1.23 pkgsrc/devel/git-lfs/distinfo
cvs rdiff -u -r1.9 -r1.10 pkgsrc/devel/git-lfs/go-modules.mk

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/git-lfs/Makefile
diff -u pkgsrc/devel/git-lfs/Makefile:1.107 pkgsrc/devel/git-lfs/Makefile:1.108
--- pkgsrc/devel/git-lfs/Makefile:1.107 Tue Oct 20 20:27:59 2026
+++ pkgsrc/devel/git-lfs/Makefile       Fri Oct 23 08:26:49 2026
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.107 2026/10/20 20:27:59 bsiegert Exp $
+# $NetBSD: Makefile,v 1.108 2026/10/23 08:26:49 adam Exp $
 
-DISTNAME=      git-lfs-3.8.0
-PKGREVISION=   2
+DISTNAME=      git-lfs-3.8.1
 CATEGORIES=    devel
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=git-lfs/}
 GITHUB_TAG=    v${PKGVERSION_NOREV}

Index: pkgsrc/devel/git-lfs/distinfo
diff -u pkgsrc/devel/git-lfs/distinfo:1.22 pkgsrc/devel/git-lfs/distinfo:1.23
--- pkgsrc/devel/git-lfs/distinfo:1.22  Tue Sep 22 11:29:58 2026
+++ pkgsrc/devel/git-lfs/distinfo       Fri Oct 23 08:26:49 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.22 2026/09/22 11:29:58 adam Exp $
+$NetBSD: distinfo,v 1.23 2026/10/23 08:26:49 adam Exp $
 
-BLAKE2s (git-lfs-3.8.0.tar.gz) = 904849ffef37913c7f6a50169584700d582ec13a1abfccc479913680389c8bfc
-SHA512 (git-lfs-3.8.0.tar.gz) = e3c9e6ac0094e3fd150112b55c3d80bdfbf89c0b73a331c69b909ce8f59a21505876055a5222d1c9bd947d5af4cba924065423e503faf25166f205b1ed12586f
-Size (git-lfs-3.8.0.tar.gz) = 747367 bytes
+BLAKE2s (git-lfs-3.8.1.tar.gz) = 50a1e7f2dce26034cf6498294fd426b36b224b717419447dc9c76453c5243a7a
+SHA512 (git-lfs-3.8.1.tar.gz) = ecc912965397e1bc8e65eed99083536298fb99b818fd6788d265f83ea9978cf5531f617c7b10f298511476e96a0d99cc551606ab09e52ba6be5b2724eacb416d
+Size (git-lfs-3.8.1.tar.gz) = 761517 bytes
 BLAKE2s (github.com_alexbrainman_sspi_@v_v0.0.0-20210105120005-909beea2cc74.mod) = c21a1ebaba97d3b288d48b37ba7e87cb0872c5eaa04d535accae5c379fc492ff
 SHA512 (github.com_alexbrainman_sspi_@v_v0.0.0-20210105120005-909beea2cc74.mod) = 
aee6f208fe93284b91980e086ddb31e4550149072fbadb81a7084ad30d39bcbeda0e497aebfb231599ea22a52c67cdf4319a8b538e6594ec2bb2892c9ce77570
 Size (github.com_alexbrainman_sspi_@v_v0.0.0-20210105120005-909beea2cc74.mod) = 45 bytes
@@ -63,6 +63,12 @@ Size (github.com_golang_groupcache_@v_v0
 BLAKE2s (github.com_golang_groupcache_@v_v0.0.0-20241129210726-2c02b8208cf8.zip) = 016b80b4851057e2b9f7fe50f5f13b2ac7280e493d9e9e31602d2fffc077639d
 SHA512 (github.com_golang_groupcache_@v_v0.0.0-20241129210726-2c02b8208cf8.zip) = 
52430a23b092ab60386fa24d00a04c66978efa1beb94c28a72a9240435bc1da3fcfb594566cb135db8c2ceae1a6d8339507451cf39a4efb727c4000e3dd3c0f3
 Size (github.com_golang_groupcache_@v_v0.0.0-20241129210726-2c02b8208cf8.zip) = 40748 bytes
+BLAKE2s (github.com_google_shlex_@v_v0.0.0-20191202100458-e7afc7fbc510.mod) = cd2155833aea8a3d072dc083d22ae0b3fcb4f86fad731dd5589b321d31d5a7fa
+SHA512 (github.com_google_shlex_@v_v0.0.0-20191202100458-e7afc7fbc510.mod) = 
33a53fe7874517289a9eb9d87b62060ab4827159300acb6f933018b30fc56e3356ec3d33ee64e452137cc6c892a0c6eddeb7e6bd383be8972407c6e7568f94fa
+Size (github.com_google_shlex_@v_v0.0.0-20191202100458-e7afc7fbc510.mod) = 40 bytes
+BLAKE2s (github.com_google_shlex_@v_v0.0.0-20191202100458-e7afc7fbc510.zip) = 3e5a6a0d4f82d4e992d9b960b1f015fd1b39b4b9ba66d0fe8e1d8600a4ab4adf
+SHA512 (github.com_google_shlex_@v_v0.0.0-20191202100458-e7afc7fbc510.zip) = 
74bf278d42859148df97c1fdefcbe962ebc583e3c567157b4e17721fd4cef5db7d24c9a76fb32a3d827e6bce6ba761181d9a2d1eca804b59f3cb792a30198906
+Size (github.com_google_shlex_@v_v0.0.0-20191202100458-e7afc7fbc510.zip) = 8977 bytes
 BLAKE2s (github.com_gorilla_securecookie_@v_v1.1.1.mod) = b82e5635de027d073a770ef9143377e397ac81769554bd3d65ddea635061058c
 SHA512 (github.com_gorilla_securecookie_@v_v1.1.1.mod) = f5596bc3919bf32ebdb9851ba6b8e5931eb88583e5129c277f6d5de4b339433ca8a180c40b1bfb44420c35cc8a01f53e4bf1cf6f0aef6f3b790590234bbebf61
 Size (github.com_gorilla_securecookie_@v_v1.1.1.mod) = 39 bytes

Index: pkgsrc/devel/git-lfs/go-modules.mk
diff -u pkgsrc/devel/git-lfs/go-modules.mk:1.9 pkgsrc/devel/git-lfs/go-modules.mk:1.10
--- pkgsrc/devel/git-lfs/go-modules.mk:1.9      Tue Sep 22 11:29:58 2026
+++ pkgsrc/devel/git-lfs/go-modules.mk  Fri Oct 23 08:26:49 2026
@@ -1,4 +1,4 @@
-# $NetBSD: go-modules.mk,v 1.9 2026/09/22 11:29:58 adam Exp $
+# $NetBSD: go-modules.mk,v 1.10 2026/10/23 08:26:49 adam Exp $
 
 GO_MODULE_FILES+=      github.com/alexbrainman/sspi/@v/v0.0.0-20210105120005-909beea2cc74.mod
 GO_MODULE_FILES+=      github.com/alexbrainman/sspi/@v/v0.0.0-20210105120005-909beea2cc74.zip
@@ -20,6 +20,8 @@ GO_MODULE_FILES+=     github.com/git-lfs/wil
 GO_MODULE_FILES+=      github.com/git-lfs/wildmatch/v2/@v/v2.0.1.zip
 GO_MODULE_FILES+=      github.com/golang/groupcache/@v/v0.0.0-20241129210726-2c02b8208cf8.mod
 GO_MODULE_FILES+=      github.com/golang/groupcache/@v/v0.0.0-20241129210726-2c02b8208cf8.zip
+GO_MODULE_FILES+=      github.com/google/shlex/@v/v0.0.0-20191202100458-e7afc7fbc510.mod
+GO_MODULE_FILES+=      github.com/google/shlex/@v/v0.0.0-20191202100458-e7afc7fbc510.zip
 GO_MODULE_FILES+=      github.com/gorilla/securecookie/@v/v1.1.1.mod
 GO_MODULE_FILES+=      github.com/gorilla/sessions/@v/v1.2.1.mod
 GO_MODULE_FILES+=      github.com/hashicorp/go-uuid/@v/v1.0.2.mod