dependabot[bot] opened a new pull request, #1557: URL: https://github.com/apache/tooling-trusted-releases/pull/1557
Bumps [dulwich](https://github.com/dulwich/dulwich) from 1.2.12 to 1.2.13. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dulwich/dulwich/releases";>dulwich's releases</a>.</em></p> <blockquote> <h2>dulwich-1.2.13</h2> <ul> <li> <p>Make concurrent <code>Pack.get_raw</code> calls thread-safe by synchronizing <code>PackData</code>'s resolved-object offset cache. (Bojan Zivanovic)</p> </li> <li> <p>Speed up cached <code>PackData.get_object_at</code> lookups by acquiring the offset-cache lock directly instead of through a <code>with</code> statement. (Bojan Zivanovic)</p> </li> <li> <p>Bound fetch negotiation the way C Git's <code>MAX_IN_VAIN</code> does: give up after 256 unacknowledged "have" lines instead of draining the whole graph walker into stateless (HTTP) requests. (Bojan Zivanovic, <a href="https://redirect.github.com/dulwich/dulwich/issues/2343";>#2343</a>)</p> </li> <li> <p>Add <code>repo.sanitize_user_identity</code>, which builds an identity from a name and an email sanitized the way git's <code>fmt_ident</code> does, for callers who cannot reject invalid input via <code>check_user_identity</code>. (Bojan Zivanovic, <a href="https://redirect.github.com/dulwich/dulwich/issues/2342";>#2342</a>)</p> </li> <li> <p>Make concurrent <code>PackData</code> reads thread-safe by mmap-ing pack contents and indexing the mapping at explicit offsets instead of sharing the file position. New <code>unpack_object_at</code>, <code>read_pack_header_at</code>, <code>read_zlib_chunks_at</code>, <code>take_msb_bytes_at</code> and <code>compute_buffer_sha</code> read from a buffer; the existing read-callable variants remain for streams. (Bojan Zivanovic, Jelmer Vernooij)</p> </li> <li> <p>Deduplicate the commit walk in <code>find_shallow</code> and <code>get_depth</code> (<code>dulwich.object_store</code>). Both re-expanded a commit once per path that reached it, so a merge-heavy history walked in exponential time. (netliomax25-code)</p> </li> <li> <p>SECURITY: Don't follow symlinks when writing messages in <code>porcelain.format_patch</code>, <code>mbox.split_mbox</code> and <code>mbox.split_maildir</code>. A symlink pre-planted at an output filename was followed, writing the message outside the output directory. (Jelmer Vernooij; Reported by wzc)</p> </li> <li> <p>Only reject reserved Windows device names (<code>aux</code>, <code>nul</code>, <code>con</code>, ...) when actually running on Windows. C git confines this check to its Windows compat layer, so repositories carrying such paths could not be cloned elsewhere. (Jelmer Vernooij, <a href="https://redirect.github.com/dulwich/dulwich/issues/2351";>#2351</a>)</p> </li> <li> <p>Fix <code>ignore</code> and <code>attrs</code> matching for patterns ending in <code>**/</code>. The trailing slash was dropped when translating the pattern, so <code>foo/**/</code> also matched <code>foo/</code> itself and every file directly inside it. Git only ignores the directories below <code>foo</code>. (adarshsm)</p> </li> <li> <p>Catch <code>PackFileDisappeared</code> in the bitmap probe in <code>get_reachability_provider</code>, which only guarded <code>FileNotFoundError</code>. (Jelmer Vernooij, <a href="https://redirect.github.com/dulwich/dulwich/issues/2344";>#2344</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jelmer/dulwich/blob/main/NEWS";>dulwich's changelog</a>.</em></p> <blockquote> <p>1.2.13 2026-08-24</p> <ul> <li> <p>Make concurrent <code>Pack.get_raw</code> calls thread-safe by synchronizing <code>PackData</code>'s resolved-object offset cache. (Bojan Zivanovic)</p> </li> <li> <p>Speed up cached <code>PackData.get_object_at</code> lookups by acquiring the offset-cache lock directly instead of through a <code>with</code> statement. (Bojan Zivanovic)</p> </li> <li> <p>Bound fetch negotiation the way C Git's <code>MAX_IN_VAIN</code> does: give up after 256 unacknowledged "have" lines instead of draining the whole graph walker into stateless (HTTP) requests. (Bojan Zivanovic, <a href="https://redirect.github.com/dulwich/dulwich/issues/2343";>#2343</a>)</p> </li> <li> <p>Add <code>repo.sanitize_user_identity</code>, which builds an identity from a name and an email sanitized the way git's <code>fmt_ident</code> does, for callers who cannot reject invalid input via <code>check_user_identity</code>. (Bojan Zivanovic, <a href="https://redirect.github.com/dulwich/dulwich/issues/2342";>#2342</a>)</p> </li> <li> <p>Make concurrent <code>PackData</code> reads thread-safe by mmap-ing pack contents and indexing the mapping at explicit offsets instead of sharing the file position. New <code>unpack_object_at</code>, <code>read_pack_header_at</code>, <code>read_zlib_chunks_at</code>, <code>take_msb_bytes_at</code> and <code>compute_buffer_sha</code> read from a buffer; the existing read-callable variants remain for streams. (Bojan Zivanovic, Jelmer Vernooij)</p> </li> <li> <p>Deduplicate the commit walk in <code>find_shallow</code> and <code>get_depth</code> (<code>dulwich.object_store</code>). Both re-expanded a commit once per path that reached it, so a merge-heavy history walked in exponential time. (netliomax25-code)</p> </li> <li> <p>SECURITY: Don't follow symlinks when writing messages in <code>porcelain.format_patch</code>, <code>mbox.split_mbox</code> and <code>mbox.split_maildir</code>. A symlink pre-planted at an output filename was followed, writing the message outside the output directory. (Jelmer Vernooij; Reported by wzc)</p> </li> <li> <p>Only reject reserved Windows device names (<code>aux</code>, <code>nul</code>, <code>con</code>, ...) when actually running on Windows. C git confines this check to its Windows compat layer, so repositories carrying such paths could not be cloned elsewhere. (Jelmer Vernooij, <a href="https://redirect.github.com/dulwich/dulwich/issues/2351";>#2351</a>)</p> </li> <li> <p>Fix <code>ignore</code> and <code>attrs</code> matching for patterns ending in <code>**/</code>. The trailing slash was dropped when translating the pattern, so <code>foo/**/</code> also matched <code>foo/</code> itself and every file directly inside it. Git only ignores the directories below <code>foo</code>. (adarshsm)</p> </li> <li> <p>Catch <code>PackFileDisappeared</code> in the bitmap probe in <code>get_reachability_provider</code>, which only guarded <code>FileNotFoundError</code>. (Jelmer Vernooij, <a href="https://redirect.github.com/dulwich/dulwich/issues/2344";>#2344</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jelmer/dulwich/commit/2d47e39d441c3192776029e4570bb02201524bcf";><code>2d47e39</code></a> Release 1.2.13</li> <li><a href="https://github.com/jelmer/dulwich/commit/dc216711ba595262deeece7924acb7d375be4787";><code>dc21671</code></a> Keep the directory constraint on patterns ending in "**/" (<a href="https://redirect.github.com/dulwich/dulwich/issues/2348";>#2348</a>)</li> <li><a href="https://github.com/jelmer/dulwich/commit/5fba6e66306b07974be9150adbd27c83b604f7e8";><code>5fba6e6</code></a> test: check-attr compat coverage for trailing <code>**/</code></li> <li><a href="https://github.com/jelmer/dulwich/commit/430fd46607c70bae098b231641a706aef4c945aa";><code>430fd46</code></a> test: unit tests for trailing <code>**/</code></li> <li><a href="https://github.com/jelmer/dulwich/commit/e3175151196947188767cde8b93ea80fa55b1e4b";><code>e317515</code></a> Add compat tests for patterns ending in "**/"</li> <li><a href="https://github.com/jelmer/dulwich/commit/2f530ab956c7bfadf384c451fd17a9f93f8626bf";><code>2f530ab</code></a> Keep the directory constraint on patterns ending in "**/"</li> <li><a href="https://github.com/jelmer/dulwich/commit/343ead4af84cbbcd806e14ca74803595964f5226";><code>343ead4</code></a> Speed up cached PackData.get_object_at lookups (<a href="https://redirect.github.com/dulwich/dulwich/issues/2368";>#2368</a>)</li> <li><a href="https://github.com/jelmer/dulwich/commit/f53cd4dc3a62692e90ccc355422fff1722c67c4e";><code>f53cd4d</code></a> Speed up cached PackData.get_object_at lookups</li> <li><a href="https://github.com/jelmer/dulwich/commit/8afc2ef78ab8f2de4e236c0e97c86b619f52bac8";><code>8afc2ef</code></a> Make Pack.get_raw thread-safe (<a href="https://redirect.github.com/dulwich/dulwich/issues/2366";>#2366</a>)</li> <li><a href="https://github.com/jelmer/dulwich/commit/3d270b191f117225d8907701730bc1b6c856e1da";><code>3d270b1</code></a> Make Pack.get_raw thread-safe</li> <li>Additional commits viewable in <a href="https://github.com/dulwich/dulwich/compare/dulwich-1.2.12...dulwich-1.2.13";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
