Merge pull request #1197 from ehuss/git2-0.20-br

Bump git2 to 0.20.3

Author: ehuss

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.20.3 - 2025-12-06
+[0.20.2...0.20.3](https://github.com/rust-lang/git2-rs/compare/git2-0.20.2...git2-0.20.3)
+
+### Changed
+
+- Bumped requirement to libgit2-sys 0.18.3, which updates libgit2 from 1.9.0 to 1.9.2.
+  [#1197](https://github.com/rust-lang/git2-rs/pull/1197)
+
 ## 0.20.2 - 2025-05-05
 [0.20.1...0.20.2](https://github.com/rust-lang/git2-rs/compare/git2-0.20.1...git2-0.20.2)
 

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "git2"
-version = "0.20.2"
+version = "0.20.3"
 authors = ["Josh Triplett <[email protected]>", "Alex Crichton <[email protected]>"]
 license = "MIT OR Apache-2.0"
 readme = "README.md"
@@ -20,7 +20,7 @@ url = "2.5.4"
 bitflags = "2.1.0"
 libc = "0.2"
 log = "0.4.8"
-libgit2-sys = { path = "libgit2-sys", version = "0.18.1" }
+libgit2-sys = { path = "libgit2-sys", version = "0.18.3" }
 
 [target."cfg(all(unix, not(target_os = \"macos\")))".dependencies]
 openssl-sys = { version = "0.9.45", optional = true }

Cargo.toml

@@ -6,7 +6,7 @@ libgit2 bindings for Rust.
 
 ```toml
 [dependencies]
-git2 = "0.20.2"
+git2 = "0.20.3"
 ```
 
 ## Rust version requirements

README.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.18.3+1.9.2 - 2025-12-06
+[0.18.2...0.18.3](https://github.com/rust-lang/git2-rs/compare/libgit2-sys-0.18.2+1.9.1...libgit2-sys-0.18.3+1.9.2)
+
+### Changed
+- Updated to libgit2 [1.9.2](https://github.com/libgit2/libgit2/releases/tag/v1.9.2)
+  [#1195](https://github.com/rust-lang/git2-rs/pull/1195)
+
+  Note that this release fixes two security issues. However, the Rust bindings do not provide direct support for the affected APIs. In particular:
+  - The `libgit2-sys` crate does not support building the vendored C library with the `GIT_SSH_EXEC` setting. This will only be an issue if you are binding to a system-provided library built with this setting.
+  - The `git2` crate does not support custom SSH credentials. However, the `libgit2-sys` crate does export the `git_cred_ssh_custom_new` C-binding. Any projects using the C bindings directly are affected.
+
+## 0.18.2+1.9.1 - 2025-06-21
+[0.18.1...0.18.2](https://github.com/rust-lang/git2-rs/compare/libgit2-sys-0.18.1+1.9.0...libgit2-sys-0.18.2+1.9.1)
+
+### Changed
+- Updated to libgit2 [1.9.1](https://github.com/libgit2/libgit2/releases/tag/v1.9.1)
+  [#1169](https://github.com/rust-lang/git2-rs/pull/1169)
+
 ## 0.18.1+1.9.0 - 2025-03-17
 [0.18.0...0.18.1](https://github.com/rust-lang/git2-rs/compare/libgit2-sys-0.18.0+1.9.0...libgit2-sys-0.18.1+1.9.0)
 

libgit2-sys/CHANGELOG.md

@@ -1,6 +1,6 @@
 [package]
 name = "libgit2-sys"
-version = "0.18.1+1.9.0"
+version = "0.18.3+1.9.2"
 authors = ["Josh Triplett <[email protected]>", "Alex Crichton <[email protected]>"]
 links = "git2"
 build = "build.rs"

libgit2-sys/Cargo.toml

@@ -7,7 +7,7 @@ use std::process::Command;
 /// Tries to use system libgit2 and emits necessary build script instructions.
 fn try_system_libgit2() -> Result<pkg_config::Library, pkg_config::Error> {
     let mut cfg = pkg_config::Config::new();
-    match cfg.range_version("1.9.0".."1.10.0").probe("libgit2") {
+    match cfg.range_version("1.9.2".."1.10.0").probe("libgit2") {
         Ok(lib) => {
             for include in &lib.include_paths {
                 println!("cargo:root={}", include.display());