From 5d9547e3833843e9e89d2a1bd49cb42e8f216a11 Mon Sep 17 00:00:00 2001 From: Weihang Lo Date: Fri, 21 Aug 2026 15:23:11 -0400 Subject: [PATCH 1/2] fix(sys): update libgit2 to 1.9.7 --- Cargo.lock | 2 +- Cargo.toml | 2 +- README.md | 2 +- libgit2-sys/Cargo.toml | 2 +- libgit2-sys/build.rs | 2 +- libgit2-sys/libgit2 | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 8071a59930..91bb3e47d3 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -479,7 +479,7 @@ checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776" [[package]] name = "libgit2-sys" -version = "0.18.7+1.9.6" +version = "0.18.8+1.9.7" dependencies = [ "cc", "libc", diff --git a/Cargo.toml b/Cargo.toml index b7b0d069c9..ea3a69b470 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -20,7 +20,7 @@ url = { version = "2.5.4", optional = true } bitflags = "2.1.0" libc = "0.2" log = "0.4.8" -libgit2-sys = { path = "libgit2-sys", version = "0.18.7" } +libgit2-sys = { path = "libgit2-sys", version = "0.18.8" } [target."cfg(all(unix, not(target_os = \"macos\")))".dependencies] openssl-sys = { version = "0.9.45", optional = true } diff --git a/README.md b/README.md index d25e9dbb2d..78b2060f20 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,7 @@ stable release as well. ## Version of libgit2 -Currently this library requires libgit2 1.9.6 (or newer patch versions). The +Currently this library requires libgit2 1.9.7 (or newer patch versions). The source for libgit2 is included in the libgit2-sys crate so there's no need to pre-install the libgit2 library, the libgit2-sys crate will figure that and/or build that for you. On the other hand, if an appropriate version of `libgit2` diff --git a/libgit2-sys/Cargo.toml b/libgit2-sys/Cargo.toml index 67b8b49c81..8db52d62b4 100644 --- a/libgit2-sys/Cargo.toml +++ b/libgit2-sys/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "libgit2-sys" -version = "0.18.7+1.9.6" +version = "0.18.8+1.9.7" authors = ["Josh Triplett ", "Alex Crichton "] links = "git2" build = "build.rs" diff --git a/libgit2-sys/build.rs b/libgit2-sys/build.rs index 6ecd018233..fd4bf6516e 100644 --- a/libgit2-sys/build.rs +++ b/libgit2-sys/build.rs @@ -9,7 +9,7 @@ fn try_system_libgit2( experimental_sha256: bool, ) -> Result> { let mut cfg = pkg_config::Config::new(); - let range_version = "1.9.6".."1.10.0"; + let range_version = "1.9.7".."1.10.0"; let lib = if experimental_sha256 { // Determine whether experimental SHA256 object support is enabled. diff --git a/libgit2-sys/libgit2 b/libgit2-sys/libgit2 index 26055f5af7..49e408b320 160000 --- a/libgit2-sys/libgit2 +++ b/libgit2-sys/libgit2 @@ -1 +1 @@ -Subproject commit 26055f5af74ab1cf636d272e8a34315496d3f06f +Subproject commit 49e408b3208bc3093757a1c2db938d3590f3f412 From dbf3fe4f554894cc529ca31cee3232ea0baf652d Mon Sep 17 00:00:00 2001 From: Weihang Lo Date: Fri, 21 Aug 2026 15:23:36 -0400 Subject: [PATCH 2/2] docs(sys): add 0.18.8 changelog --- libgit2-sys/CHANGELOG.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/libgit2-sys/CHANGELOG.md b/libgit2-sys/CHANGELOG.md index 0841cc61ec..f0532e879f 100644 --- a/libgit2-sys/CHANGELOG.md +++ b/libgit2-sys/CHANGELOG.md @@ -1,5 +1,16 @@ # Changelog +## 0.18.8+1.9.7 - 2026-08-21 +[0.18.7...0.18.8](https://github.com/rust-lang/git2-rs/compare/libgit2-sys-0.18.7+1.9.6...libgit2-sys-0.18.8+1.9.7) + +### Changed + +- Updated to libgit2 [1.9.7](https://github.com/libgit2/libgit2/releases/tag/v1.9.7). + This fixes + [CVE-2026-5917](https://github.com/libgit2/libgit2/security/advisories/GHSA-xqj4-2j5v-rr75), + a potential command injection on the remote host + via unescaped repository paths in the libssh2 SSH transport. + ## 0.18.7+1.9.6 - 2026-07-22 [0.18.6...0.18.7](https://github.com/rust-lang/git2-rs/compare/libgit2-sys-0.18.6+1.9.5...libgit2-sys-0.18.7+1.9.6)