Update Rust crate git2 to 0.20 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
git2	dependencies	minor	0.16 → 0.20

---

git2 has potential undefined behavior when dereferencing Buf struct

GHSA-j39j-6gw9-jw6h

More information

Details

If the Buf struct is dereferenced immediately after calling new() or default() on the Buf struct, a null pointer is passed to the unsafe function slice::from_raw_parts. According to the safety section documentation of the function, data must be non-null and aligned even for zero-length slices or slices of ZSTs. Thus, passing a null pointer will lead to undefined behavior.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://github.com/rust-lang/git2-rs/issues/1211
• https://github.com/rust-lang/git2-rs/pull/1213
• https://github.com/rust-lang/git2-rs/commit/9e160f15bd056f82143109bb330573381e5de719
• https://rustsec.org/advisories/RUSTSEC-2026-0008.html
• https://github.com/advisories/GHSA-j39j-6gw9-jw6h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

rust-lang/git2-rs (git2)

v0.20.4

Compare Source

0.20.4...main

Added

• Added experimental SHA256 repository support behind the new unstable-sha256 Cargo feature,
  along with *_ext API variants that accept an ObjectFormat.
  #​1206
• Added opts::set_cache_max_size() and opts::get_cached_memory().
  #​1188
• Added Repository::object_format() and a new ObjectFormat enum.
  #​1204
• Added Repository::set_config().
  #​1208
• Added merge_file() along with MergeFileInput.
  #​1210
• Added Repository::refdb_compress() for packing loose refs.
  #​1221
• Added public Refdb type, along with Repository::refdb() and Repository::set_refdb(). Repository::refdb_compress() now delegates to Refdb::compress().
  #​1228
• Added Revspec::into_objects().
  #​1230
• Added BlameHunk::final_committer(), BlameHunk::orig_committer(), BlameHunk::summary(), and BlameHunk::summary_bytes().
  #​1231
• Implemented Clone for Reference.
  #​1233
• Added Repository::author_from_env() and Repository::committer_from_env().
  #​1237
• Added impl From<Utf8Error> for Error.
  #​1239

Changed

• ❗ The ssh, https, and cred Cargo features are no longer enabled by default.
  Previously default = ["ssh", "https"]; now default = [].
  Enable them explicitly if you rely on credential helpers or transport support.
  #​1168
• ❗ CredentialHelper and the url dependency are now gated behind the new cred Cargo feature.
  Enabling ssh or https transitively enables cred.
  #​1168
• ❗ Updated to the 2021 edition.
  #​1173
• ❗ Many string accessors that previously returned Option<&str>
  now return Result<&str, Error> or Result<Option<&str>, Error>,
  so callers can distinguish a missing value from a non-UTF-8 one.
  #​1241
• ❗ BlameHunk::final_signature, BlameHunk::final_committer, BlameHunk::orig_signature, and BlameHunk::orig_committer
  now return Option to avoid segfaults when signature information is missing.
  #​1254
• Bumped requirement to libgit2-sys 0.18.4, which updates libgit2 to 1.9.3.
  #​1242

Fixed

• Fixed MergeOptions::skip_reuc() to use the correct GIT_MERGE_SKIP_REUC flag.
  #​1194
• Repository::submodules() now returns an Error when the underlying git_submodule_lookup() call to libgit2 fails, rather than panicking with a failed assertion.
  #​1220
• Reference::is_valid_name() now propagates errors from CString conversion instead of panicking.
  #​1229
• Fixed Remote::list() to return an empty list instead of erroring
  when the remote advertises no refs.
  #​1250
• ReferenceNames now returns an Err for non-UTF-8 branch names instead of panicking.
  #​1239

Documentation

• Added note regarding potentially confusing behavior of git_checkout_head.
  #​1149
• Added comments describing the IndexAddOption flags.
  #​1163
• Updated README note about the ssh feature.
  #​1187
• Improved function docs for Repository::tag_foreach().
  #​1190
• Fixed doc comment typo in StatusOptions.
  #​1199
• Fixed missing period in module documentation.
  #​1219
• Small wording fix in Signature::from_raw_const() docs.
  #​1222
• Replaced discussion of missing gist in README.
  #​1223
• Documented the bitflag methods for checking flags.
  #​1224
• Clarified CheckoutBuilder::update_index() documentation.
  #​1232
• Added more missing documentation.
  #​1235
• Fixed typo in Repository::stash_save_ext() docs.
  #​1245
• Added example showing retrieval of the latest commit for a file.
  #​1243
• Replaced comma with period in CheckoutBuilder::refresh() docs.
  #​1252

Internals

• Dropped civet/conduit from dev-dependencies.
  #​1170
• Updated dependencies.
  #​1171
• Fixed lockfile verification in CI.
  #​1177
• Updated CI and documentation to cover feature combinations.
  #​1182
• Listed all examples that may need HTTP and SSH.
  #​1196
• Allowed publishing from any ref in the publish workflow.
  #​1198
• Bumped time from 0.3.41 to 0.3.47.
  #​1215
• Added end-to-end test for branch name on initialization.
  #​1244
• Added end-to-end test for stash count.
  #​1246
• Added end-to-end tests demonstrating use of Repository::statuses().
  #​1251
• Internal refactors preparing for experimental SHA256 OID support.
  #​1201
  #​1205

v0.20.3

Compare Source

0.20.3...0.20.4

Fixed

• Fix undefined behavior when dereferencing empty Buf.
  #​1213

v0.20.2

Compare Source

0.20.2...0.20.3

Changed

• Bumped requirement to libgit2-sys 0.18.3, which updates libgit2 from 1.9.0 to 1.9.2.
  #​1197

v0.20.1

Compare Source

0.20.1...0.20.2

Added

• Added Status::WT_UNREADABLE.
  #​1151

Fixed

• Added missing codes for GIT_EDIRECTORY, GIT_EMERGECONFLICT, GIT_EUNCHANGED, GIT_ENOTSUPPORTED, and GIT_EREADONLY to Error::raw_code.
  #​1153
• Fixed missing initialization in Indexer::new.
  #​1160

v0.20.0

Compare Source

0.20.0...0.20.1

Added

• Added Repository::branch_upstream_merge()
  #​1131
• Added Index::conflict_get()
  #​1134
• Added Index::conflict_remove()
  #​1133
• Added opts::set_cache_object_limit()
  #​1118
• Added Repo::merge_file_from_index() and associated MergeFileOptions and MergeFileResult.
  #​1062

Changed

• The url dependency minimum raised to 2.5.4
  #​1128
• Changed the tracing callback to abort the process if the callback panics instead of randomly detecting the panic in some other function.
  #​1121
• Credential helper config (loaded with CredentialHelper::config) now checks for helpers that start with something that looks like an absolute path, rather than checking for a / or \ anywhere in the helper string (which resolves an issue if the helper had arguments with / or \).
  #​1137

Fixed

• Fixed panic in Remote::url_bytes if the url is empty.
  #​1120
• Fixed incorrect lifetimes on Patch::delta, Patch::hunk, and Patch::line_in_hunk. The return values must not outlive the Patch.
  #​1141
• Bumped requirement to libgit2-sys 0.18.1, which fixes linking of advapi32 on Windows.
  #​1143

v0.19.0

Compare Source

0.19.0...0.20.0

Added

• Debug is now implemented for transport::Service
  #​1074
• Added Repository::commondir
  #​1079
• Added Repository::merge_base_octopus
  #​1088
• Restored impls for PartialOrd, Ord, and Hash for bitflags types that were inadvertently removed in a prior release.
  #​1096
• Added CheckoutBuilder::disable_pathspec_match
  #​1107
• Added PackBuilder::write
  #​1110

Changed

• ❗ Updated to libgit2 1.9.0
  #​1111
• ❗ Removed the ssh_key_from_memory Cargo feature, it was unused.
  #​1087
• ❗ Errors from Tree::walk are now correctly reported to the caller.
  #​1098
• ❗ The trace_set callback now takes a &[u8] instead of a &str.
  #​1071
• ❗ Error::last_error now returns Error instead of Option<Error>.
  #​1072

Fixed

• Fixed OdbReader::read return value.
  #​1061
• When a credential helper executes a shell command, don't pop open a console window on Windows.
  #​1075

v0.18.3

Compare Source

0.20.2...0.20.3

Changed

• Bumped requirement to libgit2-sys 0.18.3, which updates libgit2 from 1.9.0 to 1.9.2.
  #​1197

v0.18.2

Compare Source

0.18.2...0.18.3

Added

• Added opts:: functions to get / set libgit2 mwindow options
  #​1035

Changed

• Updated examples to use clap instead of structopt
  #​1007

v0.18.1

Compare Source

0.20.0...0.20.1

Added

• Added Repository::branch_upstream_merge()
  #​1131
• Added Index::conflict_get()
  #​1134
• Added Index::conflict_remove()
  #​1133
• Added opts::set_cache_object_limit()
  #​1118
• Added Repo::merge_file_from_index() and associated MergeFileOptions and MergeFileResult.
  #​1062

Changed

• The url dependency minimum raised to 2.5.4
  #​1128
• Changed the tracing callback to abort the process if the callback panics instead of randomly detecting the panic in some other function.
  #​1121
• Credential helper config (loaded with CredentialHelper::config) now checks for helpers that start with something that looks like an absolute path, rather than checking for a / or \ anywhere in the helper string (which resolves an issue if the helper had arguments with / or \).
  #​1137

Fixed

• Fixed panic in Remote::url_bytes if the url is empty.
  #​1120
• Fixed incorrect lifetimes on Patch::delta, Patch::hunk, and Patch::line_in_hunk. The return values must not outlive the Patch.
  #​1141
• Bumped requirement to libgit2-sys 0.18.1, which fixes linking of advapi32 on Windows.
  #​1143

v0.18.0

Compare Source

0.18.0...0.18.1

Added

• Added FetchOptions::depth to set the depth of a fetch or clone, adding support for shallow clones.
  #​979

Fixed

• Fixed an internal data type (TreeWalkCbData) to not assume it is a transparent type while casting.
  #​989
• Fixed so that DiffPatchidOptions and StashSaveOptions are publicly exported allowing the corresponding APIs to actually be used.
  #​988

v0.17.2

Compare Source

0.17.2...0.18.0

Added

• Added Blame::blame_buffer for getting blame data for a file that has been modified in memory.
  #​981

Changed

• Updated to libgit2 1.7.0.
  #​968
• Updated to libgit2 1.7.1.
  #​982
• Switched from bitflags 1.x to 2.1. This brings some small changes to types generated by bitflags.
  #​973
• Changed Revwalk::with_hide_callback to take a mutable reference to its callback to enforce type safety.
  #​970
• Implemented FusedIterator for many iterators that can support it.
  #​955

Fixed

• Fixed builds with cargo's -Zminimal-versions.
  #​960

v0.17.1

Compare Source

0.17.1...0.17.2

Added

• Added support for stashing with options (which can support partial stashing).
  #​930

v0.17.0

Compare Source

0.17.0...0.17.1

Changed

• Updated to libgit2 1.6.4.
  #​948

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.