CVS commit: pkgsrc/devel/py-dulwich

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/devel/py-dulwich
From: "Adam Ciarcinski" <adam%netbsd.org@localhost>
Date: Thu, 2 Jul 2026 11:26:44 +0000

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Jul  2 11:26:44 UTC 2026

Modified Files:
        pkgsrc/devel/py-dulwich: Makefile PLIST cargo-depends.mk distinfo

Log Message:
py-dulwich: updated to 1.2.7

1.2.7   2026-06-12

* Verify that an object retrieved by id actually hashes to the requested
  id, raising ``ChecksumMismatch`` otherwise. (Jelmer Vernooĳ,)

* Check out files whose names contain a colon or backslash. The NTFS path
  validator rejected any element containing ``:`` or ``\``, so such files
  were silently dropped on clone. It now rejects only the ``.git``/``git~1``
  alternate-data-stream spellings, like git. (Jelmer Vernooĳ,)

* Abort the checkout when a tree entry has an invalid path (e.g. a ``.git``
  alias) instead of silently skipping it.
  (Jelmer Vernooĳ,)

* Reject pack names containing path separators in the dumb HTTP transport,
  so a malicious server can no longer escape the temporary directory.
  (Jelmer Vernooĳ,)

* SECURITY: Don't expand config ``include`` directives when parsing
  ``.gitmodules``, so a crafted ``.gitmodules`` in a cloned repository can
  no longer make ``clone --recurse-submodules`` read arbitrary files.
  (netliomax25-code)

* SECURITY: Validate ref names before resolving them to a path, so a
  client-supplied name like ``../../secret`` can no longer read a file
  outside the ref store. This closes a traversal via git-upload-archive's
  ``argument`` and other lookup paths.
  (reported by netliomax25-code, Jelmer Vernooĳ,)

* Add ``porcelain.request_pull`` and a ``dulwich request-pull`` command
  that generate a summary of pending changes between repositories,
  suitable for emailing to a maintainer, like ``git request-pull``.
  (Jelmer Vernooĳ,)

* Add ``porcelain.range_diff`` and a ``dulwich range-diff`` command that
  compare two ranges of commits and show how a patch series evolved, like
  ``git range-diff``. Requires the ``munkres`` package, installable via the
  ``dulwich[range_diff]`` extra. (Jelmer Vernooĳ,)

* Fix ``apply_patch`` writing index entries with mode ``0``, which made
  native git abort with ``unsupported ce_mode: 0``. The file mode is now
  derived from the work-tree file. (Jelmer Vernooĳ,)

* Fix deepening of a local shallow fetch. Re-fetching with a larger
  ``depth`` moved the shallow boundary but did not transfer the
  newly-uncovered commits, because the parents provider still used the
  old boundary. (Jelmer Vernooĳ)

* Fix ``gc``/``repack`` on Windows raising ``PermissionError`` when
  removing read-only pack files (as written by git). The read-only
  attribute is now cleared before unlinking. (Jelmer Vernooĳ)

* Fix ``repack`` leaking a temporary pack file when the consolidated pack
  was identical to one already on disk. The orphaned file accumulated in
  the pack directory (``prune`` only removes ``tmp_pack_*``) and could
  collide with later pack writes on Windows. (Jelmer Vernooĳ)

* Fix ``repack`` on Windows raising ``PermissionError`` (``WinError 32``,
  file in use) when removing a pack whose index had been loaded.
  (Jelmer Vernooĳ)

* Discover packs named ``loose-<hash>.pack`` (as written by ``git
  maintenance run --task=loose-objects``), not just ``pack-<hash>.pack``.
  Objects living only in such a pack were previously invisible, and
  reading them through a multi-pack-index raised ``AssertionError:
  unexpected MIDX pack name``. (Jelmer Vernooĳ,)

* Dedup packs by content when completing a pack, so repacking a store whose
  objects already live in a pack with a non-``pack-`` name no longer writes
  a duplicate pack. Also remove the temporary pack file when an incoming
  pack is deduplicated, instead of leaking it into the pack directory.
  (Jelmer Vernooĳ)

* Serve packs with non-``pack-`` names (e.g. ``loose-<hash>``) and SHA-256
  packs over the dumb HTTP transport, which previously advertised them in
  ``objects/info/packs`` but returned 404 for the pack itself.
  (Jelmer Vernooĳ)


To generate a diff of this commit:
cvs rdiff -u -r1.82 -r1.83 pkgsrc/devel/py-dulwich/Makefile
cvs rdiff -u -r1.41 -r1.42 pkgsrc/devel/py-dulwich/PLIST
cvs rdiff -u -r1.16 -r1.17 pkgsrc/devel/py-dulwich/cargo-depends.mk
cvs rdiff -u -r1.77 -r1.78 pkgsrc/devel/py-dulwich/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/py-dulwich/Makefile
diff -u pkgsrc/devel/py-dulwich/Makefile:1.82 pkgsrc/devel/py-dulwich/Makefile:1.83
--- pkgsrc/devel/py-dulwich/Makefile:1.82       Mon Jun 22 09:56:51 2026
+++ pkgsrc/devel/py-dulwich/Makefile    Thu Jul  2 11:26:44 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.82 2026/06/22 09:56:51 adam Exp $
+# $NetBSD: Makefile,v 1.83 2026/07/02 11:26:44 adam Exp $
 
-DISTNAME=      dulwich-1.2.6
+DISTNAME=      dulwich-1.2.7
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    devel python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=d/dulwich/}

Index: pkgsrc/devel/py-dulwich/PLIST
diff -u pkgsrc/devel/py-dulwich/PLIST:1.41 pkgsrc/devel/py-dulwich/PLIST:1.42
--- pkgsrc/devel/py-dulwich/PLIST:1.41  Fri Apr 24 11:07:18 2026
+++ pkgsrc/devel/py-dulwich/PLIST       Thu Jul  2 11:26:44 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.41 2026/04/24 11:07:18 adam Exp $
+@comment $NetBSD: PLIST,v 1.42 2026/07/02 11:26:44 adam Exp $
 bin/dul-receive-pack-${PYVERSSUFFIX}
 bin/dul-upload-pack-${PYVERSSUFFIX}
 bin/dulwich-${PYVERSSUFFIX}
@@ -198,6 +198,9 @@ ${PYSITELIB}/dulwich/protocol.py
 ${PYSITELIB}/dulwich/protocol.pyc
 ${PYSITELIB}/dulwich/protocol.pyo
 ${PYSITELIB}/dulwich/py.typed
+${PYSITELIB}/dulwich/range_diff.py
+${PYSITELIB}/dulwich/range_diff.pyc
+${PYSITELIB}/dulwich/range_diff.pyo
 ${PYSITELIB}/dulwich/rebase.py
 ${PYSITELIB}/dulwich/rebase.pyc
 ${PYSITELIB}/dulwich/rebase.pyo

Index: pkgsrc/devel/py-dulwich/cargo-depends.mk
diff -u pkgsrc/devel/py-dulwich/cargo-depends.mk:1.16 pkgsrc/devel/py-dulwich/cargo-depends.mk:1.17
--- pkgsrc/devel/py-dulwich/cargo-depends.mk:1.16       Mon May 25 10:14:34 2026
+++ pkgsrc/devel/py-dulwich/cargo-depends.mk    Thu Jul  2 11:26:44 2026
@@ -1,9 +1,9 @@
-# $NetBSD: cargo-depends.mk,v 1.16 2026/05/25 10:14:34 adam Exp $
+# $NetBSD: cargo-depends.mk,v 1.17 2026/07/02 11:26:44 adam Exp $
 
 CARGO_CRATE_DEPENDS+=  bstr-1.12.1
 CARGO_CRATE_DEPENDS+=  heck-0.5.0
 CARGO_CRATE_DEPENDS+=  libc-0.2.185
-CARGO_CRATE_DEPENDS+=  memchr-2.8.0
+CARGO_CRATE_DEPENDS+=  memchr-2.8.1
 CARGO_CRATE_DEPENDS+=  once_cell-1.21.4
 CARGO_CRATE_DEPENDS+=  portable-atomic-1.13.1
 CARGO_CRATE_DEPENDS+=  proc-macro2-1.0.106
@@ -16,7 +16,7 @@ CARGO_CRATE_DEPENDS+= quote-1.0.45
 CARGO_CRATE_DEPENDS+=  serde-1.0.228
 CARGO_CRATE_DEPENDS+=  serde_core-1.0.228
 CARGO_CRATE_DEPENDS+=  serde_derive-1.0.228
-CARGO_CRATE_DEPENDS+=  similar-3.1.0
+CARGO_CRATE_DEPENDS+=  similar-3.1.1
 CARGO_CRATE_DEPENDS+=  syn-2.0.117
 CARGO_CRATE_DEPENDS+=  target-lexicon-0.13.5
 CARGO_CRATE_DEPENDS+=  unicode-ident-1.0.24

Index: pkgsrc/devel/py-dulwich/distinfo
diff -u pkgsrc/devel/py-dulwich/distinfo:1.77 pkgsrc/devel/py-dulwich/distinfo:1.78
--- pkgsrc/devel/py-dulwich/distinfo:1.77       Mon Jun 22 09:56:51 2026
+++ pkgsrc/devel/py-dulwich/distinfo    Thu Jul  2 11:26:44 2026
@@ -1,20 +1,20 @@
-$NetBSD: distinfo,v 1.77 2026/06/22 09:56:51 adam Exp $
+$NetBSD: distinfo,v 1.78 2026/07/02 11:26:44 adam Exp $
 
 BLAKE2s (bstr-1.12.1.crate) = bf738250e22e04ffa6d9ae59e16bec4997bc7307983bb39e1672cea8cba81d6f
 SHA512 (bstr-1.12.1.crate) = 63a1e62d43c4dce00f287421b1ec76accbbab7f0897c8df26227f533af325896c0c8921a873f4125381e7b89fbb69a4358a96698ec6ee61191955464ff1c84ac
 Size (bstr-1.12.1.crate) = 354916 bytes
-BLAKE2s (dulwich-1.2.6.tar.gz) = 30d41edf19c8c70191ffdfce505e21ccda278287ab70a7a8136c8ef726b83374
-SHA512 (dulwich-1.2.6.tar.gz) = 5be90b5fa1d806970e6fd3c5a70749e48c9639d614b199b25afd5f3725d8fe201b43cfd69a8f45840bf883df3f0e4f5db1bf54ebf3b6dab3caf1373e265eab7d
-Size (dulwich-1.2.6.tar.gz) = 1257895 bytes
+BLAKE2s (dulwich-1.2.7.tar.gz) = 21160a6730accf751ed886a5d6356db7bb83930b03896380187de25b176a2174
+SHA512 (dulwich-1.2.7.tar.gz) = 57ebe0e682b7e01a2ee452f8378be6228ebfa8d35549c7f1d7d2c24263972649def0bf5c57e911ba859f61d7d26df9b6053c7b2222e858076f9a9272d8fed660
+Size (dulwich-1.2.7.tar.gz) = 1284735 bytes
 BLAKE2s (heck-0.5.0.crate) = 0bc71a5746c9d1e7c913d096fb68f1d422464744e18adc592540b291882f5660
 SHA512 (heck-0.5.0.crate) = f044fc9c3d22466629fd8f772ec0555350fd611c0cfadca51d99a3d2f10e155f77c1091916c8a95a6b9b499f366c2e99a5fbf45b010f988bfb9b2501bf9f6a76
 Size (heck-0.5.0.crate) = 11517 bytes
 BLAKE2s (libc-0.2.185.crate) = 4571ea59c09944dc900f3e23b2729201780fa042c594cf127bf8140222daf20b
 SHA512 (libc-0.2.185.crate) = c8dbcaaf2e5d8377a4d1003af4a7210fbfe4f9b1e8497f07d88a231a8d5c9f67014e650a5e18e913e7b4d6a1835c4cbc9c31ce0cd224ea28acbdbb39034a300e
 Size (libc-0.2.185.crate) = 821775 bytes
-BLAKE2s (memchr-2.8.0.crate) = 9d6dade02bc948818801a90933500c8aecf86116a976d3c68dfc7e427b027efd
-SHA512 (memchr-2.8.0.crate) = 8089238153493a0ff6adf980efd1ea2ba10eeff9f33fff200268692662d24152a8c14a4dac37fbc6a55dca741701fd256174f10a9838ca66f038f08e090de12f
-Size (memchr-2.8.0.crate) = 97780 bytes
+BLAKE2s (memchr-2.8.1.crate) = 1b8983eacf166f8ccb7312f81cff61cdefcfe0519857b66dce35b73328aba70b
+SHA512 (memchr-2.8.1.crate) = a11ff12e2e2fda7ee6e45dcc39bba289d0c2605e996263782d7039c3922781a51fdbe6e0b0455a0075e126b9ff2369a5935d9162e6d5903110120c12886322e1
+Size (memchr-2.8.1.crate) = 98743 bytes
 BLAKE2s (once_cell-1.21.4.crate) = 5945879c1e46e46585a2692e5f3ac0beaa15f111aa45611e0419b50abb21fb4e
 SHA512 (once_cell-1.21.4.crate) = af67669b0107f44268ba74c355200cb2ed1aab235a6989a8bc54323eb2c9a45677010f8672e7790edadd4c981e939436e0c3a099d33c06dce9c14fd5ede86155
 Size (once_cell-1.21.4.crate) = 35010 bytes
@@ -51,9 +51,9 @@ Size (serde_core-1.0.228.crate) = 63111 
 BLAKE2s (serde_derive-1.0.228.crate) = 96ba1b9a1d86ef1d6189da828e4acb22c58e4c75bb851d67131f2b85dd11d75c
 SHA512 (serde_derive-1.0.228.crate) = 8bfdfeee10ee7ef0670972aa963ef63b13e8eb2c8a09b9e0b717f92551aa89b3dd2a0dcbae6ccf20a1caece07e6adb18f0db56fdac020e4e0281b0d24e376003
 Size (serde_derive-1.0.228.crate) = 59605 bytes
-BLAKE2s (similar-3.1.0.crate) = 57189ecd8f61a77b9eea602f0babd56c38b05c9f76ff56a87a72fbace058fb0e
-SHA512 (similar-3.1.0.crate) = 7c8d5f0a3ba376f1c4dd891772a0c87bed52027b8bcbaadfe30f0c79540e9058e68a706f6388dfc6a55f0970cdc8ef0b887eb924463d49a735e10b01bda0e727
-Size (similar-3.1.0.crate) = 78442 bytes
+BLAKE2s (similar-3.1.1.crate) = ae1f8646079c71f3b8c99a31c37c10ab39372a076b06e22e000639bda8877744
+SHA512 (similar-3.1.1.crate) = f197b2dbca2c9a09314042ddd6d413410f952f284cf12b8d86b7a6a2584ba61efb4a29e8d3bc954fdde79265711a97fe1a3e94ef82e8ade9379a5981c7bb793e
+Size (similar-3.1.1.crate) = 79833 bytes
 BLAKE2s (syn-2.0.117.crate) = 03f50444ef7a3b5f28a72c59696d1676df1b8f5c334b19648d2755927e8b2f43
 SHA512 (syn-2.0.117.crate) = 035c2e63542592b6a4058a2a82d4c2c1f5793f84fb1b04cbd393337a26fcf661a1f3bea439ce98a1fe943b1c4d36d2bda16df3bbc3fa6ca35e1548d530dc8416
 Size (syn-2.0.117.crate) = 306011 bytes

Prev by Date: CVS commit: pkgsrc/lang/py-ast-serialize
Next by Date: CVS commit: pkgsrc/www/py-django-photologue
Previous by Thread: CVS commit: pkgsrc/lang/py-ast-serialize
Next by Thread: CVS commit: pkgsrc/www/py-django-photologue
Indexes:

Home | Main Index | Thread Index | Old Index