devel/libgit2: update to 1.9.7 Changes: https://github.com/libgit2/libgit2/releases265edfbeec
Libgit2 -- multiple vulnerabilitiesentered 2024-02-08
Portable, pure C implementation of the Git core
pkg audit for the packaged version 1.9.7.| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-5917 | 8.6 | 2026-08-11 | libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows rem… |
| CVE-2026-53587 | 7.5 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application… |
| CVE-2026-53586 | 6.5 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application… |
| CVE-2026-53583 | 6.5 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application… |
| CVE-2026-53585 | 5.3 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application… |
| CVE-2026-53584 | 4.3 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application… |
no CVE referenced
| PR | Summary | Status | Changed |
|---|---|---|---|
| 288120 | maintainer-feedback? devel/libgit2 1.9.1 build fails when openssl35 MD4=off | New | 2025-07-21 |
devel/libgit2: update to 1.9.7 Changes: https://github.com/libgit2/libgit2/releases265edfbeec
devel/libgit2: update to 1.9.6 Changes: https://github.com/libgit2/libgit2/releasesf7f81df0f5
devel/libgit2: update to 1.9.4 Changes: https://github.com/libgit2/libgit2/releases0c785e823a
devel/libgit2: update to 1.9.3 Changes: https://github.com/libgit2/libgit2/releasesfb728b9d70
www/llhttp: Update to 9.4.1 - Bump PORTREVISION of dependent ports for shlib change Changes: https://github.com/nodejs/llhttp/releasesc1efdbb496
devel/libgit2: corrected WWW to point to reachable github7c45d6dcf9
devel/libgit2: update to 1.9.2 Changes: https://github.com/libgit2/libgit2/releases/tag/v1.9.2efdb49d98b
devel/libgit2: update to 1.9.1 * Update WWW * Switch to llhttp instead of http-parser (deprecated upstream) * Adjust Python dependency, only needed for unit tests * Disable online tests Changes: https://github.com/libgit2/libgit2/releases/tag/v1.9.1 PR: 287356a0dca9cfc1
devel/libgit2: update to 1.9.0 Changes: https://github.com/libgit2/libgit2/releases/tag/v1.9.0 PR: 2860620281122d15
devel/libgit2: Fix handling for SSH option Needs to be specified as USE_SSH=libssh2. Also remove the THREADSAFE option, this is no longer relevant. PR: 2830068508c0c849
devel/libgit2: update to 1.8.4 Changes: https://github.com/libgit2/libgit2/releases/tag/v1.8.4aad53845a9
devel/libgit2: update to 1.8.3 Changes: https://github.com/libgit2/libgit2/releases/tag/v1.8.3ca4a4b3dfc
devel/libgit2: udpate to 1.8.2 Changes: https://github.com/libgit2/libgit2/releases/tag/v1.8.2 PR: 282262e67e0c6cbd
devel/libgit2: Update to 1.8.1 ChangeLog: https://github.com/libgit2/libgit2/releases/tag/v1.8.1 https://github.com/libgit2/libgit2/releases/tag/v1.8.0 PR: 280685 Approved by: mfechner0141544318
devel/libgit2: Ensure LOCALBASE/include is in the include path
Add USES=localbase.
[ 1% 9/188] cc -isystem /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/include -isystem /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/src/util -isystem /wrkdirs/usr/ports/devel/libgit2/work/.build/src/util -D_GNU_SOURCE -O2 -pipe -fno-strict-aliasing -Wall -Wextra -fvisibility=hidden -fPIC -Wdocumentation -Wno-documentation-deprecated-sync -Wno-missing-field-initializers -Wmissing-declarations -Wstrict-aliasing -Wstrict-prototypes -Wdeclaration-after-statement -Wshift-count-overflow -Wunused-const-variable -Wunused-function -Wint-conversion -Wc11-extensions -Wformat -Wformat-security -O2 -pipe -fno-strict-aliasing -DNDEBUG -Wno-sign-compare -MD -MT deps/xdiff/CMakeFiles/xdiff.dir/xpatience.c.o -MF deps/xdiff/CMakeFiles/xdiff.dir/xpatience.c.o.d -o deps/xdiff/CMakeFiles/xdiff.dir/xpatience.c.o -c /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/deps/xdiff/xpatience.c
FAILED: deps/xdiff/CMakeFiles/xdiff.dir/xpatience.c.o
cc -isystem /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/include -isystem /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/src/util -isystem /wrkdirs/usr/ports/devel/libgit2/work/.build/src/util -D_GNU_SOURCE -O2 -pipe -fno-strict-aliasing -Wall -Wextra -fvisibility=hidden -fPIC -Wdocumentation -Wno-documentation-deprecated-sync -Wno-missing-field-initializers -Wmissing-declarations -Wstrict-aliasing -Wstrict-prototypes -Wdeclaration-after-statement -Wshift-count-overflow -Wunused-const-variable -Wunused-function -Wint-conversion -Wc11-extensions -Wformat -Wformat-security -O2 -pipe -fno-strict-aliasing -DNDEBUG -Wno-sign-compare -MD -MT deps/xdiff/CMakeFiles/xdiff.dir/xpatience.c.o -MF deps/xdiff/CMakeFiles/xdiff.dir/xpatience.c.o.d -o deps/xdiff/CMakeFiles/xdiff.dir/xpatience.c.o -c /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/deps/xdiff/ xpatience.c
In file included from /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/deps/xdiff/xpatience.c:22:
In file included from /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/deps/xdiff/xinclude.h:26:
In file included from /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/deps/xdiff/git-xdiff.h:17:
/wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/src/util/regexp.h:19:11: fatal error: 'pcre2.h' file not found
# include <pcre2.h>
^~~~~~~~~
1 error generated.5a69132231devel/libgit2: security update to 1.7.2 Changelog: https://github.com/libgit2/libgit2/releases/tag/v1.7.2 MFH: 2024Q1 Security: 43768ff3-c683-11ee-97d0-001b217b3468dee2d48f01
devel/libgit2: update to 1.7.1 Including direct dependencies. Changelog: https://github.com/libgit2/libgit2/releases2c68245ea1
devel/libgit2: fix build problem with openssl3 and libressl Make cmake aware of the selected ssl lib PR: 27360944751f5f02
devel/libgit2: fix build with clang 16 Update the patch from: https://cgit.freebsd.org/ports/commit/devel/libgit2?id=a62f1b5796b641bb502b33f7f073238a49dc4d0c so it can by applied to libgit 1.6.x24de08d4d0
devel/libgit2: update to 1.6.4 Required for gitlab-ce 16.3. Bump of pending ports will be done in another commit. Changelog: https://github.com/libgit2/libgit2/tagsf11ed41604
devel/libgit2: fix build with clang 16
Clang 16 has a new error about incompatible function types, which shows
up when building devel/libgit2:
/wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.5.2/src/util/util.c:731:28: error: incompatible function pointer types passing 'int (void *, const void *, const void *)' to parameter of type 'int (*)(const void *, const void *, void *)' [-Wincompatible-function-pointer-types]
qsort_s(els, nel, elsize, git__qsort_r_glue_cmp, &glue);
^~~~~~~~~~~~~~~~~~~~~
/usr/include/stdlib.h:397:11: note: passing argument to parameter here
int (*)(const void *, const void *, void *), void *);
^
Clang is indeed right, as the version of qsort_s(3) in FreeBSD 13 and
later has the 'void *payload' parameter last:
errno_t qsort_s(void *, rsize_t, rsize_t,
int (*)(const void *, const void *, void *), void *);
This could be fixed by putting the arguments in the right place for
qsort_s(3), but it turns out the rabbit hole goes a bit deeper: on
14-CURRENT, libgit2's CMake configuration is not able to detect
qsort_r(3), which is actually why it chooses qsort_s():
-- Checking prototype qsort_r for GIT_QSORT_R_BSD
-- Checking prototype qsort_r for GIT_QSORT_R_BSD - False
-- Checking prototype qsort_r for GIT_QSORT_R_GNU
-- Checking prototype qsort_r for GIT_QSORT_R_GNU - False
-- Looking for qsort_s
-- Looking for qsort_s - found
The problem with the GIT_QSORT_R_BSD detection is due to the check in
libgit2's src/CMakeLists.txt, where it does:
check_prototype_definition(qsort_r
"void qsort_r(void *base, size_t nmemb, size_t size, void
*thunk, int (*compar)(void *, const void *, const void *))"
"" "stdlib.h" GIT_QSORT_R_BSD)
and CMake attempts to define a function with a similar prototype in its
test program, which then fails to compile, at least on 14-CURRENT:
/wrkdirs/share/dim/ports/devel/libgit2/work/.build/CMakeFiles/CMakeScratch/TryCompile-tILE28/CheckPrototypeDefinition.c:14:6:
error: expected identifier or '('
void qsort_r(void *base, size_t nmemb, size_t size, void *thunk, int
(*compar)(void *, const void *, const void *)) {
^
/usr/include/stdlib.h:357:5: note: expanded from macro 'qsort_r'
__generic(arg5, int (*)(void *, const void *, const void *),
\\
^
/usr/include/sys/cdefs.h:323:2: note: expanded from macro '__generic'
_Generic(expr, t: yes, default: no)
^
This is because in https://cgit.freebsd.org/src/commit/?id=af3c78886fd8d
Ed Schouten changed the prototype of qsort_r(3) to match POSIX, using a
C11 _Generic macro. When CMake tries to compile its own custom
definition of qsort_r, that fails with the above compile error, because
the macro gets expanded in place of the function declaration.
So the summarized situation is:
* On 12.x and 13.x, qsort_r(3) is a plain function, and uses the old
comparison function type: 'int (*compar)(void *thunk, const void
*elem1, const void *elem2)'.
Therefore, CMake detects GIT_QSORT_R_BSD, and libgit2's
src/util/util.c uses the correct comparison function type.
* On 14.x, qsort_r(3) is a macro, and uses the POSIX comparison function
type: 'int (*compar)(const void *elem1, const void *elem2, void *thunk)'.
Therefore, CMake fails to detect GIT_QSORT_R_BSD, and detects
GIT_QSORT_S instead, and libgit2's src/util/util.c uses an incorrect
comparison function type.
I submitted https://github.com/libgit2/libgit2/pull/6555 and
https://github.com/libgit2/libgit2/pull/6558 upstream to remedy the
situation and correctly detect all qsort variants, and these were merged
with a few minor changes.
This is an adjusted version of the upstream commits that applies on top
of libgit-1.5.2.
PR: 271234
Approved by: mfechner (maintainer)
MFH: 2023Q2a62f1b5796devel/libgit2: update to 1.5.2
Changelog:
This is a bugfix release to improve the SSH key handling functionality that was introduced in v1.5.1.
libgit2 can now read the known_hosts file on Windows.
libgit2 will now examine all keys for a particular host in the known_hosts file for matches, to support remote hosts with multiple key types.
All users of the v1.5 release line are recommended to upgrade.
https://github.com/libgit2/libgit2/blob/v1.5.2/docs/changelog.md1195af7f23devel/libgit2: update to 1.5.1 Changelog: https://github.com/libgit2/libgit2/releases/tag/v1.5.186cac20392
devel/libgit2: only build test suite when we request it and adjust tests There's still one failure that seems to be occurring if you're running as root [1] and I'm unable to work out where and/or if upstream ever fixed this test. References: https://github.com/archlinux/svntogit-packages/blob/packages/libgit2/trunk/PKGBUILD 1: https://github.com/libgit2/libgit2/issues/6307 PR: 268572bc220a9f11
devel/libgit2: Add python as a build dep to fix NINJA_DEFAULT=samurai Normally, python is brought in from ninja. When NINJA_DEFAULT=samurai, that dependency is missing. -- Could NOT find PythonInterp (missing: PYTHON_EXECUTABLE) CMake Error at tests/libgit2/CMakeLists.txt:7 (message): Could not find a python interpreter, which is needed to build the tests. Make sure python is available, or pass -DBUILD_TESTS=OFF to skip building the tests Note that python is only used to build tests, so no PORTREVISION bump is needed here.677e3e510f
devel/libgit2: update to 1.5.0 Changelog: https://github.com/libgit2/libgit2/releases/tag/v1.5.0e245ebd059
devel/libgit2: Fix build with libressl 3.5 Approved by: mfechner (maintainer), tcberner (mentor) Differential Revision: https://reviews.freebsd.org/D37057bcbefcd525
Remove WWW entries moved into port Makefiles Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)fb16dfecae
Add WWW entries to port Makefiles It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)b7f05445c0
devel/libgit2: security update to 1.3.2
Changelog:
https://github.com/libgit2/libgit2/releases/tag/v1.3.2
This is a security release with multiple changes.
This provides compatibility with git's changes to address CVE 2022-29187. As a follow up to CVE 2022-24765, now not only is the working directory of a non-bare repository examined for its ownership, but the .git directory and the .git file (if present) are also examined for their ownership.
A fix for compatibility with git's (new) behavior for CVE 2022-24765 allows users on POSIX systems to access a git repository that is owned by them when they are running in sudo.
A fix for further compatibility with git's (existing) behavior for CVE 2022-24765 allows users on Windows to access a git repository that is owned by the Administrator when running with escalated privileges (using runas Administrator).
The bundled zlib is updated to v1.2.12, as prior versions had memory corruption bugs. It is not known that there is a security vulnerability in libgit2 based on these bugs, but we are updating to be cautious.
MFH: 2022Q3de1569c878devel/libgit2: update to 1.3.1 Validate repository directory ownership (v1.3) by @ethomson in #6268 Changelog: https://github.com/libgit2/libgit2/releases/tag/v1.3.1851b2ce2dc
devel/libgit2: fix linking with libressl Patch upstream: https://github.com/libgit2/libgit2/pull/6157 PR: 260216 Reported by: lysfjord.daniel@smokepit.net7679b30c46
devel/libgit2: Update to 1.3.0 Use DISTVERSION and USE_GIT to follow Porter's Handbook more closely Use PCRE2 by default instead of PCRE(1) Use http-parser library from ports rather than bundled version as per recommendation in Porter's Handbook Import patch to remove incompatible tests Reference: https://github.com/archlinux/svntogit-packages/blob/packages/libgit2/trunk/libgit2-1.2.0-remove_http-parse_incompatible_tests.patch (see commit history) PR: 2584845c8d1c24f8
devel/libgit2: Add CPE information Approved by: portmgr (blanket)cf0bd6f389
devel/libgit2: Update to 1.1.1 Changelog: https://github.com/libgit2/libgit2/releases/tag/v1.1.144c43aa93c
One more small cleanup, forgotten yesterday. Reported by: lwhsucf118ccf87
Remove # $FreeBSD$ from Makefiles.305f148f48
Fixed build problem if base SSL is used. PR: 252098d2b6fcea36
Removed svn keywords again. They went in by accident while merging older commits. Reported by: jbeich1b802f473e
Update libgit2 to 1.1.0. This update is also required for www/gitlab-ce 13.10 upgrade. Changelog: https://github.com/libgit2/libgit2/releases/tag/v1.1.0 PR: 252098e7d94d42f8
devel/libgit2: Update to 1.0.1 Changes: https://github.com/libgit2/libgit2/releases/tag/v1.0.1 Changes: https://github.com/libgit2/pygit2/blob/v1.2.1/CHANGELOG.rst#121-2020-05-01 Approved by: mfechner (maintainer) Differential Revision: https://reviews.freebsd.org/D253417435fdd300
devel/libgit2: Update to 1.0.0 Changes: https://github.com/libgit2/libgit2/releases/tag/v1.0.0 ABI: https://abi-laboratory.pro/tracker/timeline/libgit2 Approved by: mfechner (maintainer) Differential Revision: https://reviews.freebsd.org/D24471eefc22ffc3
devel/libgit2: Update to 0.99.0 - Switch to the release tarballs libgit2 now publishes - Drop CURL option since it is no longer used - Use system libpcre instead of the bundled one - Hook up tests - Bump consumers for ABI changes Changes: https://github.com/libgit2/libgit2/releases/tag/v0.99.0 ABI: https://abi-laboratory.pro/tracker/timeline/libgit2/3ca7fb22b4
devel/libgit2 security upgrade to 0.28.4. Changelog: https://github.com/libgit2/libgit2/releases/tag/v0.28.4 MFH: 2019Q4252655da23
devel/libgit2: security upgrade to 0.28.3. PR: 239932 Submitted by: tobik Approved by: mfechner MFH: 2019Q3 Security: d51b52cf-c199-11e9-b13f-001b217b3468ef5dee39ac
Make portlint happy. Updated version bump node (reported by tijl).d2347a8d2d
Added a small note to bump revision using small script I just added.30ffc09b45
Upgrade to version 0.28.1. Changelog: https://github.com/libgit2/libgit2/releases57041ff097
Upgrade devel/libgit2 to 0.27.8 and required ports. Reported by: PORTSCOUT, swills7410048bb7
Upgrade to 0.27.7. Approved by: mentors (implicit)a388b70346