CVS commit: pkgsrc/devel/libgit2

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Sun Jul 19 08:32:23 UTC 2026

Modified Files:
        pkgsrc/devel/libgit2: Makefile distinfo

Log Message:
libgit2: updated to 1.9.6

v1.9.6

This release includes a few small but important bugfixes.

* load_known_hosts: do not fail if homedir is invalid
  by @JonasVautherin in https://github.com/libgit2/libgit2/pull/7056
* Fix segfault on Android when no HOME set by @501st-alpha1 in
  https://github.com/libgit2/libgit2/pull/7309
* cmake: bring back hidden visibility for the static build by
  @carlosmn in https://github.com/libgit2/libgit2/pull/7288

v1.9.5

This is a security release with multiple changes.

* Fix for blame error handling on hunk creation failures

  `hunk_from_entry` can return `NULL` on error; handle that and
  return an error.

* Fix for potential PCRE memory access: 1-byte heap-buffer-overflow
  WRITE in bundled PCRE 8.45 reachable via revspec

  `git_revparse_single` accepts revspecs of the form `:/<pattern>`
  (the "grep by commit message" shorthand) and forwards `<pattern>`
  directly to libgit2's regex backend. When libgit2 is using its builtin
  regular expression engine, this causes a heap buffer overflow.

* Fix for CVE-2026-53586: give auth callback current host

  libgit2's builtin HTTP transport follows offsite redirects for the
  initial smart HTTP request by default. If the redirected server then
  returns 401 Unauthorized, libgit2 asks the application credential
  callback for credentials using the original remote URL, not the
  redirected URL. The returned credential is then attached to the next
  request to the redirected host as an Authorization header.

* Fix for CVE-2026-53587: libgit2 version 1.9.4 and below is vulnerable
  to a heap out-of-bounds read in `set_data` in
  `src/libgit2/transports/smart_pkt.c`.

  When given capabilities, we check for the object-format capability; we
  need to ensure that the current packet buffer is large enough before
  actually doing the check.

* Fix for CVE-2026-53585: Unbounded Memory Allocation via Delta
  Object Result-Size Header

  Potential denial of service because `git_delta_apply` reads the
  claimed result size (`res_sz`) from the delta object header — data
  entirely controlled by the sender — and immediately allocates a
  buffer of that size.

* Fix for CVE-2026-53584: submodule: check paths for escaping

  A crafted repository with a submodule whose path contains traversal
  components (e.g. "../") can cause the library to create directories
  outside the repository's working tree.

* Fix for CVE-2026-53583: inverted IP SubjectAltName comparison in
  OpenSSL backend.

  An inverted comparison in the OpenSSL TLS backend causes IP
  SubjectAltName (SAN) verification to accept certificates with
  mismatched IP addresses and reject certificates with correct IP
  addresses. This allows a network attacker with a valid CA-signed
  certificate containing any IP SAN to perform MITM attacks against
  libgit2 clients connecting to IP-literal HTTPS URLs.


To generate a diff of this commit:
cvs rdiff -u -r1.101 -r1.102 pkgsrc/devel/libgit2/Makefile
cvs rdiff -u -r1.47 -r1.48 pkgsrc/devel/libgit2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/libgit2/Makefile
diff -u pkgsrc/devel/libgit2/Makefile:1.101 pkgsrc/devel/libgit2/Makefile:1.102
--- pkgsrc/devel/libgit2/Makefile:1.101 Fri May 22 15:51:01 2026
+++ pkgsrc/devel/libgit2/Makefile       Sun Jul 19 08:32:23 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.101 2026/05/22 15:51:01 adam Exp $
+# $NetBSD: Makefile,v 1.102 2026/07/19 08:32:23 adam Exp $
 
-DISTNAME=      libgit2-1.9.4
+DISTNAME=      libgit2-1.9.6
 CATEGORIES=    devel
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libgit2/}
 GITHUB_TAG=    v${PKGVERSION_NOREV}

Index: pkgsrc/devel/libgit2/distinfo
diff -u pkgsrc/devel/libgit2/distinfo:1.47 pkgsrc/devel/libgit2/distinfo:1.48
--- pkgsrc/devel/libgit2/distinfo:1.47  Fri May 22 15:51:01 2026
+++ pkgsrc/devel/libgit2/distinfo       Sun Jul 19 08:32:23 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.47 2026/05/22 15:51:01 adam Exp $
+$NetBSD: distinfo,v 1.48 2026/07/19 08:32:23 adam Exp $
 
-BLAKE2s (libgit2-1.9.4.tar.gz) = 0433708831686bae3f7dcac6cd0315bcf40e6d9e508b5492a80ecd0f8db4fbda
-SHA512 (libgit2-1.9.4.tar.gz) = 85036ade3aca33c5283605ae9de21a7948ec5952bc8cd468aa024ca873851a56ab0ebe62f95c0da109df9163875e9687a377d3df69728d434cc258b3f845ef0c
-Size (libgit2-1.9.4.tar.gz) = 7674814 bytes
+BLAKE2s (libgit2-1.9.6.tar.gz) = c1ed7416c15ce90fcf7026518ba784aa147f3d05dce26b6179c0525809a77f2f
+SHA512 (libgit2-1.9.6.tar.gz) = 33a4bede42b602d968fd3d2d7e2863e7f64cd23ca147cb2327843afa9a6aa6008c2a8de876ea15813ddcbd247ae8ab23e6528c624554d706ededc0ca20878446
+Size (libgit2-1.9.6.tar.gz) = 7769080 bytes