pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: pkgsrc/devel/py-dulwich
Module Name: pkgsrc
Committed By: adam
Date: Mon Aug 31 10:56:29 UTC 2026
Modified Files:
pkgsrc/devel/py-dulwich: Makefile PLIST cargo-depends.mk distinfo
Log Message:
py-dulwich: updated to 1.2.14
1.2.14 2026-08-28
* Collapse consecutive `**` segments in wildmatch translation, matching
git's behavior and avoiding catastrophic regex backtracking on patterns
like `a/**/**/**/z` from untrusted repositories. (netliomax25-code)
1.2.13 2026-08-24
* Make concurrent ``Pack.get_raw`` calls thread-safe by synchronizing
``PackData``'s resolved-object offset cache.
(Bojan Zivanovic)
* Speed up cached `PackData.get_object_at` lookups by acquiring the
offset-cache lock directly instead of through a `with` statement.
(Bojan Zivanovic)
* Bound fetch negotiation the way C Git's ``MAX_IN_VAIN`` does: give up
after 256 unacknowledged "have" lines instead of draining the whole
graph walker into stateless (HTTP) requests.
* Add ``repo.sanitize_user_identity``, which builds an identity from a
name and an email sanitized the way git's ``fmt_ident`` does, for
callers who cannot reject invalid input via ``check_user_identity``.
* Make concurrent ``PackData`` reads thread-safe by mmap-ing pack contents
and indexing the mapping at explicit offsets instead of sharing the file
position. New ``unpack_object_at``, ``read_pack_header_at``,
``read_zlib_chunks_at``, ``take_msb_bytes_at`` and ``compute_buffer_sha``
read from a buffer; the existing read-callable variants remain for streams.
(Bojan Zivanovic, Jelmer Vernooij)
* Deduplicate the commit walk in ``find_shallow`` and ``get_depth``
(``dulwich.object_store``). Both re-expanded a commit once per path that
reached it, so a merge-heavy history walked in exponential time.
(netliomax25-code)
* SECURITY: Don't follow symlinks when writing messages in
``porcelain.format_patch``, ``mbox.split_mbox`` and ``mbox.split_maildir``.
A symlink pre-planted at an output filename was followed, writing the
message outside the output
directory. (Jelmer Vernooij; Reported by wzc)
* Only reject reserved Windows device names (``aux``, ``nul``, ``con``, ...)
when actually running on Windows. C git confines this check to its Windows
compat layer, so repositories carrying such paths could not be cloned
elsewhere.
* Fix ``ignore`` and ``attrs`` matching for patterns ending in ``**/``. The
trailing slash was dropped when translating the pattern, so ``foo/**/`` also
matched ``foo/`` itself and every file directly inside it. Git only ignores
the directories below ``foo``. (adarshsm)
* Catch ``PackFileDisappeared`` in the bitmap probe in
``get_reachability_provider``, which only guarded ``FileNotFoundError``.
* SECURITY: Widen modes for ``core.sharedRepository`` as git does rather than
chmodding to a precomputed one, which left ``.git/hooks`` and ``.git/refs``
world-writable for ``all``.
* ``parse_shared_repository`` now returns a ``SharedPerm``, and
``DiskObjectStore``, ``Index`` and ``GitFile`` take a ``shared_perm``
argument in place of ``file_mode``/``dir_mode``. (Jelmer Vernooij)
* Fix commit-graph extra edge indexing: the stored value is a position in a
list of 4-byte entries, not a byte offset, so every octopus merge after
the first got a wrong parent list. (netliomax25-code)
* Refresh the mtime of an existing loose object in
``DiskObjectStore.add_object()``, so that a concurrent ``git gc`` cannot
prune an object that was just reported as present.
* HARDEN: Validate shallow object ids received from the remote.
(netliomax25-code)
* SECURITY: Refuse patch targets addressing the ``.git`` control directory.
``apply_patches`` (via ``porcelain.am``/``apply_patch``) previously wrote and
ran ``.git/hooks/pre-commit``. (Jelmer Vernooij, reported by @bhaswanthc)
* Extend the ``verify_leading_dirs`` symlink guard to
``update_working_tree`` (used by ``pull``, ``merge`` and ``checkout``).
The 1.2.12 fix only covered ``build_index_from_tree``, so a tree pairing a
symlink ``x`` with a descendant ``x/config`` could still write through the
link and overwrite ``.git/config`` on pull.
(Jelmer Vernooij, reported by Hugh Lewis)
* Translate ``.gitignore``/``.gitattributes`` bracket expressions with Git's
``wildmatch()`` semantics: ``[^...]`` negation, POSIX classes, backslash
escapes and malformed-class handling. ``ignore`` and ``attrs`` now share
one translator, the new public ``dulwich.wildmatch``.
* Always single-quote the repository path in the SSH command, matching git's
``sq_quote()``. ``shlex.quote`` left paths without shell metacharacters
bare, which broke cloning from servers that parse the command themselves
rather than handing it to a shell, such as Bitbucket Server.
To generate a diff of this commit:
cvs rdiff -u -r1.87 -r1.88 pkgsrc/devel/py-dulwich/Makefile
cvs rdiff -u -r1.42 -r1.43 pkgsrc/devel/py-dulwich/PLIST
cvs rdiff -u -r1.19 -r1.20 pkgsrc/devel/py-dulwich/cargo-depends.mk
cvs rdiff -u -r1.82 -r1.83 pkgsrc/devel/py-dulwich/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/devel/py-dulwich/Makefile
diff -u pkgsrc/devel/py-dulwich/Makefile:1.87 pkgsrc/devel/py-dulwich/Makefile:1.88
--- pkgsrc/devel/py-dulwich/Makefile:1.87 Sun Aug 9 05:54:35 2026
+++ pkgsrc/devel/py-dulwich/Makefile Mon Aug 31 10:56:29 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.87 2026/08/09 05:54:35 adam Exp $
+# $NetBSD: Makefile,v 1.88 2026/08/31 10:56:29 adam Exp $
-DISTNAME= dulwich-1.2.12
+DISTNAME= dulwich-1.2.14
PKGNAME= ${PYPKGPREFIX}-${DISTNAME}
CATEGORIES= devel python
MASTER_SITES= ${MASTER_SITE_PYPI:=d/dulwich/}
Index: pkgsrc/devel/py-dulwich/PLIST
diff -u pkgsrc/devel/py-dulwich/PLIST:1.42 pkgsrc/devel/py-dulwich/PLIST:1.43
--- pkgsrc/devel/py-dulwich/PLIST:1.42 Thu Jul 2 11:26:44 2026
+++ pkgsrc/devel/py-dulwich/PLIST Mon Aug 31 10:56:29 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.42 2026/07/02 11:26:44 adam Exp $
+@comment $NetBSD: PLIST,v 1.43 2026/08/31 10:56:29 adam Exp $
bin/dul-receive-pack-${PYVERSSUFFIX}
bin/dul-upload-pack-${PYVERSSUFFIX}
bin/dulwich-${PYVERSSUFFIX}
@@ -261,6 +261,9 @@ ${PYSITELIB}/dulwich/web.pyo
${PYSITELIB}/dulwich/whitespace.py
${PYSITELIB}/dulwich/whitespace.pyc
${PYSITELIB}/dulwich/whitespace.pyo
+${PYSITELIB}/dulwich/wildmatch.py
+${PYSITELIB}/dulwich/wildmatch.pyc
+${PYSITELIB}/dulwich/wildmatch.pyo
${PYSITELIB}/dulwich/worktree.py
${PYSITELIB}/dulwich/worktree.pyc
${PYSITELIB}/dulwich/worktree.pyo
Index: pkgsrc/devel/py-dulwich/cargo-depends.mk
diff -u pkgsrc/devel/py-dulwich/cargo-depends.mk:1.19 pkgsrc/devel/py-dulwich/cargo-depends.mk:1.20
--- pkgsrc/devel/py-dulwich/cargo-depends.mk:1.19 Tue Jul 7 14:24:31 2026
+++ pkgsrc/devel/py-dulwich/cargo-depends.mk Mon Aug 31 10:56:29 2026
@@ -1,9 +1,9 @@
-# $NetBSD: cargo-depends.mk,v 1.19 2026/07/07 14:24:31 adam Exp $
+# $NetBSD: cargo-depends.mk,v 1.20 2026/08/31 10:56:29 adam Exp $
CARGO_CRATE_DEPENDS+= bstr-1.12.3
CARGO_CRATE_DEPENDS+= heck-0.5.0
CARGO_CRATE_DEPENDS+= libc-0.2.186
-CARGO_CRATE_DEPENDS+= memchr-2.8.2
+CARGO_CRATE_DEPENDS+= memchr-2.8.3
CARGO_CRATE_DEPENDS+= once_cell-1.21.4
CARGO_CRATE_DEPENDS+= portable-atomic-1.13.1
CARGO_CRATE_DEPENDS+= proc-macro2-1.0.106
Index: pkgsrc/devel/py-dulwich/distinfo
diff -u pkgsrc/devel/py-dulwich/distinfo:1.82 pkgsrc/devel/py-dulwich/distinfo:1.83
--- pkgsrc/devel/py-dulwich/distinfo:1.82 Sun Aug 9 05:54:35 2026
+++ pkgsrc/devel/py-dulwich/distinfo Mon Aug 31 10:56:29 2026
@@ -1,20 +1,20 @@
-$NetBSD: distinfo,v 1.82 2026/08/09 05:54:35 adam Exp $
+$NetBSD: distinfo,v 1.83 2026/08/31 10:56:29 adam Exp $
BLAKE2s (bstr-1.12.3.crate) = 147f1dc0e32ca9e25fc4eb8638b10a6a4683f890145057a982bf4ac718f30376
SHA512 (bstr-1.12.3.crate) = 5093e7fc678c31684468d7b779a6f129db6b3d87fe7e05b86950ff1ee1afdf1bf6ae2586144667c8ee798de37f5fd089be0f7318401565484fbd7de07f7c0330
Size (bstr-1.12.3.crate) = 355150 bytes
-BLAKE2s (dulwich-1.2.12.tar.gz) = 0de5252186120a56f858b8548f643ce9ecb74b9f998b3835818605ca6b0aa3e7
-SHA512 (dulwich-1.2.12.tar.gz) = 650d9fd53e702ec1f029cf0a9c7e3d0b6e9b392353e431676d6dd633311f8d665800ebf183bc7a0a2501c27d53d91a5f1e7948b63a959d784e7d4a21eeb33854
-Size (dulwich-1.2.12.tar.gz) = 1323805 bytes
+BLAKE2s (dulwich-1.2.14.tar.gz) = ed9936c85df4f748632982e578e5d9fd2f5c7068f4e338d1f40f8fd60bf7fb55
+SHA512 (dulwich-1.2.14.tar.gz) = 8bea61b50759879872b7960bbb2bcd9d94570079e97ce2f0ab9ba7f5bd1dfa63eceae2253d461f1e7c6093d70cdb5295b7f4d9204330c2724a577873304de972
+Size (dulwich-1.2.14.tar.gz) = 1361695 bytes
BLAKE2s (heck-0.5.0.crate) = 0bc71a5746c9d1e7c913d096fb68f1d422464744e18adc592540b291882f5660
SHA512 (heck-0.5.0.crate) = f044fc9c3d22466629fd8f772ec0555350fd611c0cfadca51d99a3d2f10e155f77c1091916c8a95a6b9b499f366c2e99a5fbf45b010f988bfb9b2501bf9f6a76
Size (heck-0.5.0.crate) = 11517 bytes
BLAKE2s (libc-0.2.186.crate) = e4ae2a7c2182c3a4f54e39cfed3d574220b3a6d54af5a40aadfd814bb8a12c6a
SHA512 (libc-0.2.186.crate) = 6a58e671ec6811dff9a0d7d4db8f37d38bcbca9efff20dad4706190e5cdb77b426567754bcf0ef0f2d0c31d6506401f724f3ca500b9bed57bb8605b1141ed690
Size (libc-0.2.186.crate) = 821883 bytes
-BLAKE2s (memchr-2.8.2.crate) = bc2997ad38b5f25065eb90fab249f423f107ad01304fc317f1e042084b12bcac
-SHA512 (memchr-2.8.2.crate) = 011574c7b8519b19298e553d170c1defc5fd06698d4c00684715802de57b235562c8849ca7bc0ad2b77a05eb2f94af1f49289285803d4461460469248319a15e
-Size (memchr-2.8.2.crate) = 99069 bytes
+BLAKE2s (memchr-2.8.3.crate) = f18d09ec2f1d3e7ec6d9764389518b51cd9bdec5d3cb677a2d38b6f58a452c31
+SHA512 (memchr-2.8.3.crate) = 2965717bb9e0451c8fcb3d81f509898918491a7b72a894bec5a0d48619cf24db4378e28c6f71f22dbb0f47f1e96662cd86adb0cf1ffad81a7efc2a973fbcd62f
+Size (memchr-2.8.3.crate) = 99165 bytes
BLAKE2s (once_cell-1.21.4.crate) = 5945879c1e46e46585a2692e5f3ac0beaa15f111aa45611e0419b50abb21fb4e
SHA512 (once_cell-1.21.4.crate) = af67669b0107f44268ba74c355200cb2ed1aab235a6989a8bc54323eb2c9a45677010f8672e7790edadd4c981e939436e0c3a099d33c06dce9c14fd5ede86155
Size (once_cell-1.21.4.crate) = 35010 bytes
Home |
Main Index |
Thread Index |
Old Index