From 482270aac487d2d7ba7777d813a4cff265818380 Mon Sep 17 00:00:00 2001 From: Weihang Lo Date: Mon, 20 Jul 2026 23:30:56 -0400 Subject: [PATCH 1/6] fix(sys): bind X509 certificate option libgit2 added GIT_OPT_ADD_SSL_X509_CERT in ad04bf2566ff0477abff8c32662853c2ecc582a7 and moved it to the end of git_libgit2_opt_t in 67900a0fcb6be70914eef14587279c2aa43a39a0 libgit2-sys 0.18 omitted the option. Add it before binding newer options whose values follow it. --- libgit2-sys/lib.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/libgit2-sys/lib.rs b/libgit2-sys/lib.rs index 8aec3f2e45..5fb11e56d6 100644 --- a/libgit2-sys/lib.rs +++ b/libgit2-sys/lib.rs @@ -2203,6 +2203,7 @@ git_enum! { GIT_OPT_GET_SERVER_TIMEOUT, GIT_OPT_SET_USER_AGENT_PRODUCT, GIT_OPT_GET_USER_AGENT_PRODUCT, + GIT_OPT_ADD_SSL_X509_CERT, } } From c7cc1c34020f6b706d18ba9cd4377324532162f1 Mon Sep 17 00:00:00 2001 From: Weihang Lo Date: Tue, 21 Jul 2026 07:27:46 -0400 Subject: [PATCH 2/6] fix(sys): update libgit2 to 1.9.5 libgit2 replaced its bundled PCRE1 copy with PCRE2 in 3a9102dae9aef333791bf03ba1a00d2cc78ecfc2. --- Cargo.lock | 2 +- Cargo.toml | 2 +- README.md | 2 +- libgit2-sys/Cargo.toml | 2 +- libgit2-sys/build.rs | 81 ++++++++++++++++++++++++++++++++---------- libgit2-sys/libgit2 | 2 +- 6 files changed, 67 insertions(+), 24 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index cf86548edc..63189b99c9 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -479,7 +479,7 @@ checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776" [[package]] name = "libgit2-sys" -version = "0.18.5+1.9.4" +version = "0.18.6+1.9.5" dependencies = [ "cc", "libc", diff --git a/Cargo.toml b/Cargo.toml index d92caf60b1..70dbf4e246 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -21,7 +21,7 @@ url = { version = "2.5.4", optional = true } bitflags = "2.1.0" libc = "0.2" log = "0.4.8" -libgit2-sys = { path = "libgit2-sys", version = "0.18.5" } +libgit2-sys = { path = "libgit2-sys", version = "0.18.6" } [target."cfg(all(unix, not(target_os = \"macos\")))".dependencies] openssl-sys = { version = "0.9.45", optional = true } diff --git a/README.md b/README.md index 317d134055..0fceaea583 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,7 @@ stable release as well. ## Version of libgit2 -Currently this library requires libgit2 1.9.0 (or newer patch versions). The +Currently this library requires libgit2 1.9.5 (or newer patch versions). The source for libgit2 is included in the libgit2-sys crate so there's no need to pre-install the libgit2 library, the libgit2-sys crate will figure that and/or build that for you. On the other hand, if an appropriate version of `libgit2` diff --git a/libgit2-sys/Cargo.toml b/libgit2-sys/Cargo.toml index 68215aa666..1893da1a7f 100644 --- a/libgit2-sys/Cargo.toml +++ b/libgit2-sys/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "libgit2-sys" -version = "0.18.5+1.9.4" +version = "0.18.6+1.9.5" authors = ["Josh Triplett ", "Alex Crichton "] links = "git2" build = "build.rs" diff --git a/libgit2-sys/build.rs b/libgit2-sys/build.rs index 06b17e5fad..55fe5f7ebd 100644 --- a/libgit2-sys/build.rs +++ b/libgit2-sys/build.rs @@ -9,7 +9,7 @@ fn try_system_libgit2( experimental_sha256: bool, ) -> Result> { let mut cfg = pkg_config::Config::new(); - let range_version = "1.9.4".."1.10.0"; + let range_version = "1.9.5".."1.10.0"; let lib = if experimental_sha256 { // Determine whether experimental SHA256 object support is enabled. @@ -163,33 +163,36 @@ The build is now aborting. To disable, unset the variable or use `LIBGIT2_NO_VEN cfg.include("libgit2/deps/xdiff"); add_c_files(&mut cfg, "libgit2/deps/xdiff"); - // Use the included PCRE regex backend. - // - // Ideally these defines would be specific to the pcre files (or placed in - // a config.h), but since libgit2 already has a config.h used for other - // reasons, just define on the command-line for everything. Perhaps there - // is some way with cc to have different instructions per-file? + // Use the included PCRE2 regex backend. + // Keep these settings aligned with libgit2's bundled PCRE2 configuration. cfg.define("GIT_REGEX_BUILTIN", "1") - .include("libgit2/deps/pcre") - .define("HAVE_STDINT_H", Some("1")) - .define("HAVE_MEMMOVE", Some("1")) - .define("NO_RECURSE", Some("1")) - .define("NEWLINE", Some("10")) - .define("POSIX_MALLOC_THRESHOLD", Some("10")) + .include("libgit2/deps/pcre2") + .define("PCRE2_STATIC", None) + .define("PCRE2_EXPORT", Some("")) + .define("PCRE2_EXP_DECL", Some("")) + .define("PCRE2_EXP_DEFN", Some("")) + .define("PCRE2_CODE_UNIT_WIDTH", Some("8")) + .define("SUPPORT_PCRE2_8", Some("1")) + .define("SUPPORT_UNICODE", Some("1")) .define("LINK_SIZE", Some("2")) - .define("PARENS_NEST_LIMIT", Some("250")) + .define("HEAP_LIMIT", Some("20000000")) .define("MATCH_LIMIT", Some("10000000")) - .define("MATCH_LIMIT_RECURSION", Some("MATCH_LIMIT")) - .define("MAX_NAME_SIZE", Some("32")) + .define("MATCH_LIMIT_DEPTH", Some("MATCH_LIMIT")) + .define("MAX_VARLOOKBEHIND", Some("255")) + .define("NEWLINE_DEFAULT", Some("2")) + .define("PARENS_NEST_LIMIT", Some("250")) + .define("MAX_NAME_SIZE", Some("128")) .define("MAX_NAME_COUNT", Some("10000")); - // "no symbols" warning on pcre_string_utils.c is because it is only used - // when when COMPILE_PCRE8 is not defined, which is the default. - add_c_files(&mut cfg, "libgit2/deps/pcre"); + add_pcre2_files(&mut cfg); cfg.file("libgit2/src/util/allocators/failalloc.c"); cfg.file("libgit2/src/util/allocators/stdalloc.c"); if windows { + if target.contains("msvc") { + cfg.define("_CRT_SECURE_NO_DEPRECATE", None); + cfg.define("_CRT_SECURE_NO_WARNINGS", None); + } add_c_files(&mut cfg, "libgit2/src/util/win32"); cfg.define("STRSAFE_NO_DEPRECATE", None); cfg.define("WIN32", None); @@ -360,3 +363,43 @@ fn add_c_files(build: &mut cc::Build, path: impl AsRef) { } } } + +fn add_pcre2_files(build: &mut cc::Build) { + // Keep this list in sync with libgit2's PCRE2_SOURCES: + // https://github.com/libgit2/libgit2/blob/f7a4071c766ceea3915415e22134cbe3e581c420/deps/pcre2/CMakeLists.txt#L65-L96 + let root = Path::new("libgit2/deps/pcre2"); + for file in &[ + "pcre2_auto_possess.c", + "pcre2_chartables.c", + "pcre2_chkdint.c", + "pcre2_compile.c", + "pcre2_compile_cgroup.c", + "pcre2_compile_class.c", + "pcre2_config.c", + "pcre2_context.c", + "pcre2_convert.c", + "pcre2_dfa_match.c", + "pcre2_error.c", + "pcre2_extuni.c", + "pcre2_find_bracket.c", + "pcre2_maketables.c", + "pcre2_match.c", + "pcre2_match_data.c", + "pcre2_match_next.c", + "pcre2_newline.c", + "pcre2_ord2utf.c", + "pcre2_pattern_info.c", + "pcre2_script_run.c", + "pcre2_serialize.c", + "pcre2_string_utils.c", + "pcre2_study.c", + "pcre2_substitute.c", + "pcre2_substring.c", + "pcre2_tables.c", + "pcre2_ucd.c", + "pcre2_valid_utf.c", + "pcre2_xclass.c", + ] { + build.file(root.join(file)); + } +} diff --git a/libgit2-sys/libgit2 b/libgit2-sys/libgit2 index f7164261c9..f7a4071c76 160000 --- a/libgit2-sys/libgit2 +++ b/libgit2-sys/libgit2 @@ -1 +1 @@ -Subproject commit f7164261c9bc0a7e0ebf767c584e5192810a8b24 +Subproject commit f7a4071c766ceea3915415e22134cbe3e581c420 From 0d7a569cb18e5b426007ee48a1e014ef13021ca2 Mon Sep 17 00:00:00 2001 From: Weihang Lo Date: Tue, 21 Jul 2026 07:28:20 -0400 Subject: [PATCH 3/6] feat(sys): bind pack object size options libgit2 added `GIT_OPT_{GET,SET}_PACK_MAX_OBJECT_SIZE` in 0cdfdd5fa8f8514c82413025e1e0808866cf7c30 --- libgit2-sys/lib.rs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libgit2-sys/lib.rs b/libgit2-sys/lib.rs index 5fb11e56d6..b397144d3f 100644 --- a/libgit2-sys/lib.rs +++ b/libgit2-sys/lib.rs @@ -2204,6 +2204,8 @@ git_enum! { GIT_OPT_SET_USER_AGENT_PRODUCT, GIT_OPT_GET_USER_AGENT_PRODUCT, GIT_OPT_ADD_SSL_X509_CERT, + GIT_OPT_GET_PACK_MAX_OBJECT_SIZE, + GIT_OPT_SET_PACK_MAX_OBJECT_SIZE, } } From a5836fd112e856ca099f1c1790b158e0cca267e0 Mon Sep 17 00:00:00 2001 From: Weihang Lo Date: Tue, 21 Jul 2026 07:28:36 -0400 Subject: [PATCH 4/6] docs(sys): add 0.18.6 changelog --- libgit2-sys/CHANGELOG.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/libgit2-sys/CHANGELOG.md b/libgit2-sys/CHANGELOG.md index 9a82f1b799..179953fff9 100644 --- a/libgit2-sys/CHANGELOG.md +++ b/libgit2-sys/CHANGELOG.md @@ -1,5 +1,25 @@ # Changelog +## 0.18.6+1.9.5 - 2026-07-22 +[0.18.5...0.18.6](https://github.com/rust-lang/git2-rs/compare/libgit2-sys-0.18.5+1.9.4...libgit2-sys-0.18.6+1.9.5) + +### Added + +- Added bindings for `GIT_OPT_ADD_SSL_X509_CERT`. +- Added bindings for `GIT_OPT_GET_PACK_MAX_OBJECT_SIZE` and `GIT_OPT_SET_PACK_MAX_OBJECT_SIZE`. + +### Changed + +- Updated to libgit2 [1.9.5](https://github.com/libgit2/libgit2/releases/tag/v1.9.5). + This fixes + [CVE-2026-53583](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp), + [CVE-2026-53584](https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm), + [CVE-2026-53585](https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j), + [CVE-2026-53586](https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x), + [CVE-2026-53587](https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm), + and [GHSA-wfx7-g85r-q6vw](https://github.com/libgit2/libgit2/security/advisories/GHSA-wfx7-g85r-q6vw). +- Updated the vendored build to use libgit2's bundled PCRE2 regex backend. + ## 0.18.5+1.9.4 - 2026-05-23 [0.18.4...0.18.5](https://github.com/rust-lang/git2-rs/compare/libgit2-sys-0.18.4+1.9.3...libgit2-sys-0.18.5+1.9.4) From 645628965d059d37f565b00dc16ef1b704d7a717 Mon Sep 17 00:00:00 2001 From: Weihang Lo Date: Tue, 21 Jul 2026 07:29:22 -0400 Subject: [PATCH 5/6] fix(sys): update libgit2 to 1.9.6 --- Cargo.lock | 2 +- Cargo.toml | 2 +- README.md | 2 +- libgit2-sys/Cargo.toml | 2 +- libgit2-sys/build.rs | 2 +- libgit2-sys/libgit2 | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 63189b99c9..4bc081af8b 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -479,7 +479,7 @@ checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776" [[package]] name = "libgit2-sys" -version = "0.18.6+1.9.5" +version = "0.18.7+1.9.6" dependencies = [ "cc", "libc", diff --git a/Cargo.toml b/Cargo.toml index 70dbf4e246..5e1ea71217 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -21,7 +21,7 @@ url = { version = "2.5.4", optional = true } bitflags = "2.1.0" libc = "0.2" log = "0.4.8" -libgit2-sys = { path = "libgit2-sys", version = "0.18.6" } +libgit2-sys = { path = "libgit2-sys", version = "0.18.7" } [target."cfg(all(unix, not(target_os = \"macos\")))".dependencies] openssl-sys = { version = "0.9.45", optional = true } diff --git a/README.md b/README.md index 0fceaea583..d25e9dbb2d 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,7 @@ stable release as well. ## Version of libgit2 -Currently this library requires libgit2 1.9.5 (or newer patch versions). The +Currently this library requires libgit2 1.9.6 (or newer patch versions). The source for libgit2 is included in the libgit2-sys crate so there's no need to pre-install the libgit2 library, the libgit2-sys crate will figure that and/or build that for you. On the other hand, if an appropriate version of `libgit2` diff --git a/libgit2-sys/Cargo.toml b/libgit2-sys/Cargo.toml index 1893da1a7f..586c4a0b7b 100644 --- a/libgit2-sys/Cargo.toml +++ b/libgit2-sys/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "libgit2-sys" -version = "0.18.6+1.9.5" +version = "0.18.7+1.9.6" authors = ["Josh Triplett ", "Alex Crichton "] links = "git2" build = "build.rs" diff --git a/libgit2-sys/build.rs b/libgit2-sys/build.rs index 55fe5f7ebd..60fb26f430 100644 --- a/libgit2-sys/build.rs +++ b/libgit2-sys/build.rs @@ -9,7 +9,7 @@ fn try_system_libgit2( experimental_sha256: bool, ) -> Result> { let mut cfg = pkg_config::Config::new(); - let range_version = "1.9.5".."1.10.0"; + let range_version = "1.9.6".."1.10.0"; let lib = if experimental_sha256 { // Determine whether experimental SHA256 object support is enabled. diff --git a/libgit2-sys/libgit2 b/libgit2-sys/libgit2 index f7a4071c76..26055f5af7 160000 --- a/libgit2-sys/libgit2 +++ b/libgit2-sys/libgit2 @@ -1 +1 @@ -Subproject commit f7a4071c766ceea3915415e22134cbe3e581c420 +Subproject commit 26055f5af74ab1cf636d272e8a34315496d3f06f From 2fb35918ee826746456d5a1ea3017504f0b733cf Mon Sep 17 00:00:00 2001 From: Weihang Lo Date: Tue, 21 Jul 2026 08:02:57 -0400 Subject: [PATCH 6/6] docs(sys): add 0.18.7 changelog --- libgit2-sys/CHANGELOG.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/libgit2-sys/CHANGELOG.md b/libgit2-sys/CHANGELOG.md index 179953fff9..0841cc61ec 100644 --- a/libgit2-sys/CHANGELOG.md +++ b/libgit2-sys/CHANGELOG.md @@ -1,5 +1,15 @@ # Changelog +## 0.18.7+1.9.6 - 2026-07-22 +[0.18.6...0.18.7](https://github.com/rust-lang/git2-rs/compare/libgit2-sys-0.18.6+1.9.5...libgit2-sys-0.18.7+1.9.6) + +### Changed + +- Updated to libgit2 [1.9.6](https://github.com/libgit2/libgit2/releases/tag/v1.9.6). + This fixes SSH known-host loading with an invalid home directory, + an Android crash when `HOME` is unset, + and hidden symbol visibility for static builds. + ## 0.18.6+1.9.5 - 2026-07-22 [0.18.5...0.18.6](https://github.com/rust-lang/git2-rs/compare/libgit2-sys-0.18.5+1.9.4...libgit2-sys-0.18.6+1.9.5)