Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-dulwich for openSUSE:Factory checked in at 2026-08-22 21:35:03 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-dulwich (Old) and /work/SRC/openSUSE:Factory/.python-dulwich.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-dulwich" Sat Aug 22 21:35:03 2026 rev:75 rq:1372931 version:1.2.12 Changes: -------- --- /work/SRC/openSUSE:Factory/python-dulwich/python-dulwich.changes 2026-07-09 22:22:55.369388619 +0200 +++ /work/SRC/openSUSE:Factory/.python-dulwich.new.1258/python-dulwich.changes 2026-08-22 21:37:12.018486475 +0200 @@ -1,0 +2,60 @@ +Fri Aug 21 20:11:04 UTC 2026 - Dirk Müller <[email protected]> + +- update to 1.2.12: + * Fix ``Bundle.store_objects()`` silently dropping every + OFS_DELTA/REF_DELTA object in the bundle's pack instead of + resolving it, leaving the target object store missing most + objects with no error raised. Delta resolution + now goes through ``PackInflater``, matching how packs are + ingested elsewhere in the object store code. + * SECURITY: Refuse to write a checkout entry whose leading path + resolves through a symlink. ``build_index_from_tree`` (used by + ``reset_index`` and thus by ``clone``/``checkout``) + materialized a tree in sorted order without checking leading + components, so a tree pairing a symlink ``link`` with a + descendant ``link/foo`` wrote ``foo`` through the link to an + arbitrary absolute path. The same ``verify_leading_dirs`` + guard already used by porcelain and stash is now applied here. + * Let porcelain functions that consult the environment take an + ``env`` argument overriding ``os.environ``. As a side effect + ``tag_create`` now honours ``GIT_COMMITTER_NAME``/ + ``GIT_COMMITTER_EMAIL`` for the tagger line and + ``merge``/``revert`` honour ``GIT_AUTHOR_NAME``/``GIT_AUTHOR_EMAIL``, + * Honour the ``core.worktree`` configuration option, so the + working tree can live somewhere other than the parent of + the control directory. Relative paths are resolved against the + control directory, and ``core.bare`` and ``core.worktree`` + are now rejected as incompatible. + * Clear ``core.bare`` when setting up a submodule's working + tree. ``submodule_update`` cloned the submodule bare and then + ``core.worktree`` on it, leaving a configuration git + considers invalid. + * Read ``GIT_PROTOCOL`` in porcelain rather than only in the + command line interface, so ``clone`` and ``pull`` honour it + when called as a library. + * Add a ``remote`` argument to ``porcelain.archive()``, so an + archive can be retrieved from a remote repository without + dropping down to ``dulwich.client``. (Jelmer Vernooij) + * Read ``GIT_SSH_COMMAND``/``GIT_SSH`` in porcelain rather than + only in the command line interface, so ``clone``, ``fetch``, + ``ls_remote``, ``pull`` and ``push`` honour them again when + called as a library. + * Recurse into subtrees when merging trees, so non-overlapping + changes on different sides of a shared directory merge cleanly + instead of being reported as a directory-level conflict. + * HARDEN: Verify that a ``.bitmap`` index matches the pack it + is loaded for. + * HARDEN: Parse commit-message trailers in linear time. + ``parse_trailers`` + * SECURITY: Apply ``core.protectHFS`` and ``core.protectNTFS`` + together when selecting the checkout path-element validator. + ``get_path_element_validator`` + * HARDEN: Canonicalize the file mode of regular files written + into a ``git archive`` tarball. ``tar_stream`` copied the tree- + supplied mode verbatim, so a crafted tree entry + * HARDEN: Collapse embedded whitespace in reflog messages when + writing a reflog line. ``format_reflog_line`` wrote the message + verbatim, and ``do_commit`` logs ``commit: <full message>``, + so any commit whose message + +------------------------------------------------------------------- Old: ---- dulwich-1.2.10.tar.gz New: ---- dulwich-1.2.12.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-dulwich.spec ++++++ --- /var/tmp/diff_new_pack.fN934D/_old 2026-08-22 21:37:12.762513071 +0200 +++ /var/tmp/diff_new_pack.fN934D/_new 2026-08-22 21:37:12.763513107 +0200 @@ -25,7 +25,7 @@ %{?sle15_python_module_pythons} %define oldpython python Name: python-dulwich -Version: 1.2.10 +Version: 1.2.12 Release: 0 Summary: Pure-Python Git Library License: Apache-2.0 OR GPL-2.0-or-later ++++++ dulwich-1.2.10.tar.gz -> dulwich-1.2.12.tar.gz ++++++ ++++ 3757 lines of diff (skipped)
