fix: bump to libgit2 1.9.6

Cargo.toml

@@ -21,7 +21,7 @@ url = { version = "2.5.4", optional = true }
 bitflags = "2.1.0"
 libc = "0.2"
 log = "0.4.8"
-libgit2-sys = { path = "libgit2-sys", version = "0.18.5" }
+libgit2-sys = { path = "libgit2-sys", version = "0.18.7" }
 
 [target."cfg(all(unix, not(target_os = \"macos\")))".dependencies]
 openssl-sys = { version = "0.9.45", optional = true }

README.md

@@ -27,7 +27,7 @@ stable release as well.
 
 ## Version of libgit2
 
-Currently this library requires libgit2 1.9.0 (or newer patch versions). The
+Currently this library requires libgit2 1.9.6 (or newer patch versions). The
 source for libgit2 is included in the libgit2-sys crate so there's no need to
 pre-install the libgit2 library, the libgit2-sys crate will figure that and/or
 build that for you. On the other hand, if an appropriate version of `libgit2`

libgit2-sys/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.18.7+1.9.6 - 2026-07-22
+[0.18.6...0.18.7](https://github.com/rust-lang/git2-rs/compare/libgit2-sys-0.18.6+1.9.5...libgit2-sys-0.18.7+1.9.6)
+
+### Changed
+
+- Updated to libgit2 [1.9.6](https://github.com/libgit2/libgit2/releases/tag/v1.9.6).
+  This fixes SSH known-host loading with an invalid home directory,
+  an Android crash when `HOME` is unset,
+  and hidden symbol visibility for static builds.
+
+## 0.18.6+1.9.5 - 2026-07-22
+[0.18.5...0.18.6](https://github.com/rust-lang/git2-rs/compare/libgit2-sys-0.18.5+1.9.4...libgit2-sys-0.18.6+1.9.5)
+
+### Added
+
+- Added bindings for `GIT_OPT_ADD_SSL_X509_CERT`.
+- Added bindings for `GIT_OPT_GET_PACK_MAX_OBJECT_SIZE` and `GIT_OPT_SET_PACK_MAX_OBJECT_SIZE`.
+
+### Changed
+
+- Updated to libgit2 [1.9.5](https://github.com/libgit2/libgit2/releases/tag/v1.9.5).
+  This fixes
+  [CVE-2026-53583](https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp),
+  [CVE-2026-53584](https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm),
+  [CVE-2026-53585](https://github.com/libgit2/libgit2/security/advisories/GHSA-27m5-gxxh-x79j),
+  [CVE-2026-53586](https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x),
+  [CVE-2026-53587](https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm),
+  and [GHSA-wfx7-g85r-q6vw](https://github.com/libgit2/libgit2/security/advisories/GHSA-wfx7-g85r-q6vw).
+- Updated the vendored build to use libgit2's bundled PCRE2 regex backend.
+
 ## 0.18.5+1.9.4 - 2026-05-23
 [0.18.4...0.18.5](https://github.com/rust-lang/git2-rs/compare/libgit2-sys-0.18.4+1.9.3...libgit2-sys-0.18.5+1.9.4)
 

libgit2-sys/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "libgit2-sys"
-version = "0.18.5+1.9.4"
+version = "0.18.7+1.9.6"
 authors = ["Josh Triplett <josh@joshtriplett.org>", "Alex Crichton <alex@alexcrichton.com>"]
 links = "git2"
 build = "build.rs"

libgit2-sys/build.rs

@@ -9,7 +9,7 @@ fn try_system_libgit2(
     experimental_sha256: bool,
 ) -> Result<pkg_config::Library, Box<dyn std::error::Error>> {
     let mut cfg = pkg_config::Config::new();
-    let range_version = "1.9.4".."1.10.0";
+    let range_version = "1.9.6".."1.10.0";
 
     let lib = if experimental_sha256 {
         // Determine whether experimental SHA256 object support is enabled.
@@ -163,33 +163,36 @@ The build is now aborting. To disable, unset the variable or use `LIBGIT2_NO_VEN
     cfg.include("libgit2/deps/xdiff");
     add_c_files(&mut cfg, "libgit2/deps/xdiff");
 
-    // Use the included PCRE regex backend.
-    //
-    // Ideally these defines would be specific to the pcre files (or placed in
-    // a config.h), but since libgit2 already has a config.h used for other
-    // reasons, just define on the command-line for everything. Perhaps there
-    // is some way with cc to have different instructions per-file?
+    // Use the included PCRE2 regex backend.
+    // Keep these settings aligned with libgit2's bundled PCRE2 configuration.
     cfg.define("GIT_REGEX_BUILTIN", "1")
-        .include("libgit2/deps/pcre")
-        .define("HAVE_STDINT_H", Some("1"))
-        .define("HAVE_MEMMOVE", Some("1"))
-        .define("NO_RECURSE", Some("1"))
-        .define("NEWLINE", Some("10"))
-        .define("POSIX_MALLOC_THRESHOLD", Some("10"))
+        .include("libgit2/deps/pcre2")
+        .define("PCRE2_STATIC", None)
+        .define("PCRE2_EXPORT", Some(""))
+        .define("PCRE2_EXP_DECL", Some(""))
+        .define("PCRE2_EXP_DEFN", Some(""))
+        .define("PCRE2_CODE_UNIT_WIDTH", Some("8"))
+        .define("SUPPORT_PCRE2_8", Some("1"))
+        .define("SUPPORT_UNICODE", Some("1"))
         .define("LINK_SIZE", Some("2"))
-        .define("PARENS_NEST_LIMIT", Some("250"))
+        .define("HEAP_LIMIT", Some("20000000"))
         .define("MATCH_LIMIT", Some("10000000"))
-        .define("MATCH_LIMIT_RECURSION", Some("MATCH_LIMIT"))
-        .define("MAX_NAME_SIZE", Some("32"))
+        .define("MATCH_LIMIT_DEPTH", Some("MATCH_LIMIT"))
+        .define("MAX_VARLOOKBEHIND", Some("255"))
+        .define("NEWLINE_DEFAULT", Some("2"))
+        .define("PARENS_NEST_LIMIT", Some("250"))
+        .define("MAX_NAME_SIZE", Some("128"))
         .define("MAX_NAME_COUNT", Some("10000"));
-    // "no symbols" warning on pcre_string_utils.c is because it is only used
-    // when when COMPILE_PCRE8 is not defined, which is the default.
-    add_c_files(&mut cfg, "libgit2/deps/pcre");
+    add_pcre2_files(&mut cfg);
 
     cfg.file("libgit2/src/util/allocators/failalloc.c");
     cfg.file("libgit2/src/util/allocators/stdalloc.c");
 
     if windows {
+        if target.contains("msvc") {
+            cfg.define("_CRT_SECURE_NO_DEPRECATE", None);
+            cfg.define("_CRT_SECURE_NO_WARNINGS", None);
+        }
         add_c_files(&mut cfg, "libgit2/src/util/win32");
         cfg.define("STRSAFE_NO_DEPRECATE", None);
         cfg.define("WIN32", None);
@@ -360,3 +363,43 @@ fn add_c_files(build: &mut cc::Build, path: impl AsRef<Path>) {
         }
     }
 }
+
+fn add_pcre2_files(build: &mut cc::Build) {
+    // Keep this list in sync with libgit2's PCRE2_SOURCES:
+    // https://github.com/libgit2/libgit2/blob/f7a4071c766ceea3915415e22134cbe3e581c420/deps/pcre2/CMakeLists.txt#L65-L96
+    let root = Path::new("libgit2/deps/pcre2");
+    for file in &[
+        "pcre2_auto_possess.c",
+        "pcre2_chartables.c",
+        "pcre2_chkdint.c",
+        "pcre2_compile.c",
+        "pcre2_compile_cgroup.c",
+        "pcre2_compile_class.c",
+        "pcre2_config.c",
+        "pcre2_context.c",
+        "pcre2_convert.c",
+        "pcre2_dfa_match.c",
+        "pcre2_error.c",
+        "pcre2_extuni.c",
+        "pcre2_find_bracket.c",
+        "pcre2_maketables.c",
+        "pcre2_match.c",
+        "pcre2_match_data.c",
+        "pcre2_match_next.c",
+        "pcre2_newline.c",
+        "pcre2_ord2utf.c",
+        "pcre2_pattern_info.c",
+        "pcre2_script_run.c",
+        "pcre2_serialize.c",
+        "pcre2_string_utils.c",
+        "pcre2_study.c",
+        "pcre2_substitute.c",
+        "pcre2_substring.c",
+        "pcre2_tables.c",
+        "pcre2_ucd.c",
+        "pcre2_valid_utf.c",
+        "pcre2_xclass.c",
+    ] {
+        build.file(root.join(file));
+    }
+}

libgit2-sys/lib.rs

@@ -2203,6 +2203,9 @@ git_enum! {
         GIT_OPT_GET_SERVER_TIMEOUT,
         GIT_OPT_SET_USER_AGENT_PRODUCT,
         GIT_OPT_GET_USER_AGENT_PRODUCT,
+        GIT_OPT_ADD_SSL_X509_CERT,
+        GIT_OPT_GET_PACK_MAX_OBJECT_SIZE,
+        GIT_OPT_SET_PACK_MAX_OBJECT_SIZE,
     }
 }