CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

devel/libgit2 1.9.7

Portable, pure C implementation of the Git core

Maintainer
mfechner@FreeBSD.org
Packages
latest: 1.9.7
Upstream
up to date
Last update
to 1.9.7 · 265edfbeec
Quarterly
2026Q4: 1.9.7
WWW
https://libgit2.org
Links
cgit · VuXML

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 1.9.7.

Fixed (11)

Show 11 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-59178.62026-08-11libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows rem…
CVE-2026-535877.52026-08-20libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application…
CVE-2026-535866.52026-08-20libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application…
CVE-2026-535836.52026-08-20libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application…
CVE-2026-535855.32026-08-20libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application…
CVE-2026-535844.32026-08-20libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application…

Problem reports (1) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
288120maintainer-feedback? devel/libgit2 1.9.1 build fails when openssl35 MD4=offNew2025-07-21

Commits (98)

Matthias Fechner (mfechner) · 1.9.7 MFH 2026Q3 ✓
devel/libgit2: update to 1.9.7

Changes:	https://github.com/libgit2/libgit2/releases
265edfbeec
Matthias Fechner (mfechner) · 1.9.6 MFH 2026Q3 ✓
devel/libgit2: update to 1.9.6

Changes:	https://github.com/libgit2/libgit2/releases
f7f81df0f5
Matthias Fechner (mfechner) · 1.9.4
devel/libgit2: update to 1.9.4

Changes:	https://github.com/libgit2/libgit2/releases
0c785e823a
Matthias Fechner (mfechner) · 1.9.3
devel/libgit2: update to 1.9.3

Changes:	https://github.com/libgit2/libgit2/releases
fb728b9d70
Po-Chuan Hsieh (sunpoet) · 1.9.2_1
www/llhttp: Update to 9.4.1

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/nodejs/llhttp/releases
c1efdbb496
Matthias Fechner (mfechner) · 1.9.2
devel/libgit2: corrected WWW to point to reachable github
7c45d6dcf9
Matthias Fechner (mfechner) · 1.9.2
devel/libgit2: update to 1.9.2

Changes:	https://github.com/libgit2/libgit2/releases/tag/v1.9.2
efdb49d98b
Matthias Fechner (mfechner) · 1.9.1
devel/libgit2: update to 1.9.1

* Update WWW
* Switch to llhttp instead of http-parser (deprecated upstream)
* Adjust Python dependency, only needed for unit tests
* Disable online tests

Changes:	https://github.com/libgit2/libgit2/releases/tag/v1.9.1
PR:		287356
a0dca9cfc1
Matthias Fechner (mfechner) · 1.9.0
devel/libgit2: update to 1.9.0

Changes:	https://github.com/libgit2/libgit2/releases/tag/v1.9.0
PR:		286062
0281122d15
Matthias Fechner (mfechner) · 1.8.4_1
devel/libgit2: Fix handling for SSH option

Needs to be specified as USE_SSH=libssh2. Also remove the THREADSAFE
option, this is no longer relevant.

PR:		283006
8508c0c849
Matthias Fechner (mfechner) · 1.8.4
devel/libgit2: update to 1.8.4

Changes:	https://github.com/libgit2/libgit2/releases/tag/v1.8.4
aad53845a9
Matthias Fechner (mfechner) · 1.8.3
devel/libgit2: update to 1.8.3

Changes:	https://github.com/libgit2/libgit2/releases/tag/v1.8.3
ca4a4b3dfc
Matthias Fechner (mfechner) · 1.8.2
devel/libgit2: udpate to 1.8.2

Changes:	https://github.com/libgit2/libgit2/releases/tag/v1.8.2
PR:		282262
e67e0c6cbd
Nuno Teixeira (eduardo) · 1.8.1
devel/libgit2: Update to 1.8.1

ChangeLog:	https://github.com/libgit2/libgit2/releases/tag/v1.8.1
		https://github.com/libgit2/libgit2/releases/tag/v1.8.0
PR:		280685
Approved by:	mfechner
0141544318
Adam Weinberger (adamw) · 1.7.2
devel/libgit2: Ensure LOCALBASE/include is in the include path

Add USES=localbase.

[  1% 9/188] cc  -isystem /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/include -isystem /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/src/util -isystem /wrkdirs/usr/ports/devel/libgit2/work/.build/src/util -D_GNU_SOURCE -O2 -pipe  -fno-strict-aliasing -Wall -Wextra -fvisibility=hidden -fPIC -Wdocumentation -Wno-documentation-deprecated-sync -Wno-missing-field-initializers -Wmissing-declarations -Wstrict-aliasing -Wstrict-prototypes -Wdeclaration-after-statement -Wshift-count-overflow -Wunused-const-variable -Wunused-function -Wint-conversion -Wc11-extensions -Wformat -Wformat-security -O2 -pipe  -fno-strict-aliasing  -DNDEBUG -Wno-sign-compare -MD -MT deps/xdiff/CMakeFiles/xdiff.dir/xpatience.c.o -MF deps/xdiff/CMakeFiles/xdiff.dir/xpatience.c.o.d -o deps/xdiff/CMakeFiles/xdiff.dir/xpatience.c.o -c /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/deps/xdiff/xpatience.c
FAILED: deps/xdiff/CMakeFiles/xdiff.dir/xpatience.c.o
cc  -isystem /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/include -isystem /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/src/util -isystem /wrkdirs/usr/ports/devel/libgit2/work/.build/src/util -D_GNU_SOURCE -O2 -pipe  -fno-strict-aliasing -Wall -Wextra -fvisibility=hidden -fPIC -Wdocumentation -Wno-documentation-deprecated-sync -Wno-missing-field-initializers -Wmissing-declarations -Wstrict-aliasing -Wstrict-prototypes -Wdeclaration-after-statement -Wshift-count-overflow -Wunused-const-variable -Wunused-function -Wint-conversion -Wc11-extensions -Wformat -Wformat-security -O2 -pipe  -fno-strict-aliasing  -DNDEBUG -Wno-sign-compare -MD -MT deps/xdiff/CMakeFiles/xdiff.dir/xpatience.c.o -MF deps/xdiff/CMakeFiles/xdiff.dir/xpatience.c.o.d -o deps/xdiff/CMakeFiles/xdiff.dir/xpatience.c.o -c /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/deps/xdiff/ xpatience.c
In file included from /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/deps/xdiff/xpatience.c:22:
In file included from /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/deps/xdiff/xinclude.h:26:
In file included from /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/deps/xdiff/git-xdiff.h:17:
/wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.7.2/src/util/regexp.h:19:11: fatal error: 'pcre2.h' file not found
 # include <pcre2.h>
           ^~~~~~~~~
1 error generated.
5a69132231
Matthias Fechner (mfechner) · 1.7.2
devel/libgit2: security update to 1.7.2

Changelog:
https://github.com/libgit2/libgit2/releases/tag/v1.7.2

MFH:		2024Q1
Security:	43768ff3-c683-11ee-97d0-001b217b3468
dee2d48f01
Matthias Fechner (mfechner) · 1.7.1
devel/libgit2: update to 1.7.1

Including direct dependencies.
Changelog:
https://github.com/libgit2/libgit2/releases
2c68245ea1
Matthias Fechner (mfechner) · 1.6.4
devel/libgit2: fix build problem with openssl3 and libressl

Make cmake aware of the selected ssl lib
PR:		273609
44751f5f02
Matthias Fechner (mfechner) · 1.6.4
devel/libgit2: fix build with clang 16

Update the patch from:
https://cgit.freebsd.org/ports/commit/devel/libgit2?id=a62f1b5796b641bb502b33f7f073238a49dc4d0c

so it can by applied to libgit 1.6.x
24de08d4d0
Matthias Fechner (mfechner) · 1.6.4
devel/libgit2: update to 1.6.4

Required for gitlab-ce 16.3.
Bump of pending ports will be done in another commit.

Changelog:
https://github.com/libgit2/libgit2/tags
f11ed41604
Dimitry Andric (dim) · 1.5.2_1
devel/libgit2: fix build with clang 16

Clang 16 has a new error about incompatible function types, which shows
up when building devel/libgit2:

  /wrkdirs/usr/ports/devel/libgit2/work/libgit2-1.5.2/src/util/util.c:731:28: error: incompatible function pointer types passing 'int (void *, const void *, const void *)' to parameter of type 'int (*)(const void *, const void *, void *)' [-Wincompatible-function-pointer-types]
          qsort_s(els, nel, elsize, git__qsort_r_glue_cmp, &glue);
                                    ^~~~~~~~~~~~~~~~~~~~~
  /usr/include/stdlib.h:397:11: note: passing argument to parameter here
      int (*)(const void *, const void *, void *), void *);
            ^

Clang is indeed right, as the version of qsort_s(3) in FreeBSD 13 and
later has the 'void *payload' parameter last:

  errno_t  qsort_s(void *, rsize_t, rsize_t,
      int (*)(const void *, const void *, void *), void *);

This could be fixed by putting the arguments in the right place for
qsort_s(3), but it turns out the rabbit hole goes a bit deeper: on
14-CURRENT, libgit2's CMake configuration is not able to detect
qsort_r(3), which is actually why it chooses qsort_s():

  -- Checking prototype qsort_r for GIT_QSORT_R_BSD
  -- Checking prototype qsort_r for GIT_QSORT_R_BSD - False
  -- Checking prototype qsort_r for GIT_QSORT_R_GNU
  -- Checking prototype qsort_r for GIT_QSORT_R_GNU - False
  -- Looking for qsort_s
  -- Looking for qsort_s - found

The problem with the GIT_QSORT_R_BSD detection is due to the check in
libgit2's src/CMakeLists.txt, where it does:

  check_prototype_definition(qsort_r
          "void qsort_r(void *base, size_t nmemb, size_t size, void
          *thunk, int (*compar)(void *, const void *, const void *))"
          "" "stdlib.h" GIT_QSORT_R_BSD)

and CMake attempts to define a function with a similar prototype in its
test program, which then fails to compile, at least on 14-CURRENT:

  /wrkdirs/share/dim/ports/devel/libgit2/work/.build/CMakeFiles/CMakeScratch/TryCompile-tILE28/CheckPrototypeDefinition.c:14:6:
  error: expected identifier or '('
  void qsort_r(void *base, size_t nmemb, size_t size, void *thunk, int
  (*compar)(void *, const void *, const void *)) {
       ^
  /usr/include/stdlib.h:357:5: note: expanded from macro 'qsort_r'
      __generic(arg5, int (*)(void *, const void *, const void *),
       \\
      ^
  /usr/include/sys/cdefs.h:323:2: note: expanded from macro '__generic'
          _Generic(expr, t: yes, default: no)
          ^

This is because in https://cgit.freebsd.org/src/commit/?id=af3c78886fd8d
Ed Schouten changed the prototype of qsort_r(3) to match POSIX, using a
C11 _Generic macro. When CMake tries to compile its own custom
definition of qsort_r, that fails with the above compile error, because
the macro gets expanded in place of the function declaration.

So the summarized situation is:

* On 12.x and 13.x, qsort_r(3) is a plain function, and uses the old
  comparison function type: 'int (*compar)(void *thunk, const void
  *elem1, const void *elem2)'.
  Therefore, CMake detects GIT_QSORT_R_BSD, and libgit2's
  src/util/util.c uses the correct comparison function type.
* On 14.x, qsort_r(3) is a macro, and uses the POSIX comparison function
  type: 'int (*compar)(const void *elem1, const void *elem2, void *thunk)'.
  Therefore, CMake fails to detect GIT_QSORT_R_BSD, and detects
  GIT_QSORT_S instead, and libgit2's src/util/util.c uses an incorrect
  comparison function type.

I submitted https://github.com/libgit2/libgit2/pull/6555 and
https://github.com/libgit2/libgit2/pull/6558 upstream to remedy the
situation and correctly detect all qsort variants, and these were merged
with a few minor changes.

This is an adjusted version of the upstream commits that applies on top
of libgit-1.5.2.

PR:		271234
Approved by:	mfechner (maintainer)
MFH:		2023Q2
a62f1b5796
Matthias Fechner (mfechner) · 1.5.2
devel/libgit2: update to 1.5.2

Changelog:
This is a bugfix release to improve the SSH key handling functionality that was introduced in v1.5.1.

    libgit2 can now read the known_hosts file on Windows.
    libgit2 will now examine all keys for a particular host in the known_hosts file for matches, to support remote hosts with multiple key types.

All users of the v1.5 release line are recommended to upgrade.

https://github.com/libgit2/libgit2/blob/v1.5.2/docs/changelog.md
1195af7f23
Matthias Fechner (mfechner) · 1.5.1
devel/libgit2: update to 1.5.1

Changelog:
https://github.com/libgit2/libgit2/releases/tag/v1.5.1
86cac20392
Matthias Fechner (mfechner) · 1.5.0
devel/libgit2: only build test suite when we request it and adjust tests

There's still one failure that seems to be occurring if you're running as
root [1] and I'm unable to work out where and/or if upstream ever fixed this test.

References:
https://github.com/archlinux/svntogit-packages/blob/packages/libgit2/trunk/PKGBUILD
1: https://github.com/libgit2/libgit2/issues/6307

PR:		268572
bc220a9f11
Adam Weinberger (adamw) · 1.5.0
devel/libgit2: Add python as a build dep to fix NINJA_DEFAULT=samurai

Normally, python is brought in from ninja. When NINJA_DEFAULT=samurai,
that dependency is missing.

-- Could NOT find PythonInterp (missing: PYTHON_EXECUTABLE)
CMake Error at tests/libgit2/CMakeLists.txt:7 (message):
  Could not find a python interpreter, which is needed to build the tests.
  Make sure python is available, or pass -DBUILD_TESTS=OFF to skip building
  the tests

Note that python is only used to build tests, so no PORTREVISION bump is
needed here.
677e3e510f
Matthias Fechner (mfechner) · 1.5.0
devel/libgit2: update to 1.5.0

Changelog:
https://github.com/libgit2/libgit2/releases/tag/v1.5.0
e245ebd059
Felix Palmen (zirias) · 1.3.2
devel/libgit2: Fix build with libressl 3.5

Approved by:		mfechner (maintainer), tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D37057
bcbefcd525
Stefan Eßer (se) · 1.3.2
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 1.3.2
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Matthias Fechner (mfechner) · 1.3.2
devel/libgit2: security update to 1.3.2

Changelog:
https://github.com/libgit2/libgit2/releases/tag/v1.3.2

This is a security release with multiple changes.

    This provides compatibility with git's changes to address CVE 2022-29187. As a follow up to CVE 2022-24765, now not only is the working directory of a non-bare repository examined for its ownership, but the .git directory and the .git file (if present) are also examined for their ownership.

    A fix for compatibility with git's (new) behavior for CVE 2022-24765 allows users on POSIX systems to access a git repository that is owned by them when they are running in sudo.

    A fix for further compatibility with git's (existing) behavior for CVE 2022-24765 allows users on Windows to access a git repository that is owned by the Administrator when running with escalated privileges (using runas Administrator).

    The bundled zlib is updated to v1.2.12, as prior versions had memory corruption bugs. It is not known that there is a security vulnerability in libgit2 based on these bugs, but we are updating to be cautious.

MFH:		2022Q3
de1569c878
Matthias Fechner (mfechner) · 1.3.1
devel/libgit2: update to 1.3.1

Validate repository directory ownership (v1.3) by @ethomson in #6268

Changelog:
https://github.com/libgit2/libgit2/releases/tag/v1.3.1
851b2ce2dc
Matthias Fechner (mfechner) · 1.3.0
devel/libgit2: fix linking with libressl

Patch upstream:
https://github.com/libgit2/libgit2/pull/6157

PR:		260216
Reported by:	lysfjord.daniel@smokepit.net
7679b30c46
Matthias Fechner (mfechner) · 1.3.0
devel/libgit2: Update to 1.3.0

Use DISTVERSION and USE_GIT to follow Porter's Handbook more closely
Use PCRE2 by default instead of PCRE(1)
Use http-parser library from ports rather than bundled version as per recommendation in Porter's Handbook
Import patch to remove incompatible tests

Reference:
https://github.com/archlinux/svntogit-packages/blob/packages/libgit2/trunk/libgit2-1.2.0-remove_http-parse_incompatible_tests.patch (see commit history)

PR:		258484
5c8d1c24f8
Bernhard Froehlich (decke) · 1.1.1
devel/libgit2: Add CPE information

Approved by:	portmgr (blanket)
cf0bd6f389
Matthias Fechner (mfechner) · 1.1.1
devel/libgit2: Update to 1.1.1

Changelog:
https://github.com/libgit2/libgit2/releases/tag/v1.1.1
44c43aa93c
Mathieu Arnold (mat) · 1.1.0
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · 1.1.0
Remove # $FreeBSD$ from Makefiles.
305f148f48
Matthias Fechner (mfechner) · 1.1.0
Fixed build problem if base SSL is used. PR:		252098
d2b6fcea36
Matthias Fechner (mfechner) · 1.1.0
Removed svn keywords again. They went in by accident while merging older commits. Reported by:	jbeich
1b802f473e
Matthias Fechner (mfechner) · 1.1.0
Update libgit2 to 1.1.0. This update is also required for www/gitlab-ce 13.10 upgrade.

Changelog:
https://github.com/libgit2/libgit2/releases/tag/v1.1.0

PR:		252098
e7d94d42f8
Tobias Kortkamp (tobik) · 1.0.1
devel/libgit2: Update to 1.0.1

Changes:	https://github.com/libgit2/libgit2/releases/tag/v1.0.1
Changes:	https://github.com/libgit2/pygit2/blob/v1.2.1/CHANGELOG.rst#121-2020-05-01
Approved by:	mfechner (maintainer)
Differential Revision:	https://reviews.freebsd.org/D25341
7435fdd300
Tobias Kortkamp (tobik) · 1.0.0
devel/libgit2: Update to 1.0.0

Changes:	https://github.com/libgit2/libgit2/releases/tag/v1.0.0
ABI:		https://abi-laboratory.pro/tracker/timeline/libgit2
Approved by:	mfechner (maintainer)
Differential Revision:	https://reviews.freebsd.org/D24471
eefc22ffc3
Tobias Kortkamp (tobik) · 0.99.0
devel/libgit2: Update to 0.99.0

- Switch to the release tarballs libgit2 now publishes
- Drop CURL option since it is no longer used
- Use system libpcre instead of the bundled one
- Hook up tests
- Bump consumers for ABI changes

Changes:	https://github.com/libgit2/libgit2/releases/tag/v0.99.0
ABI:		https://abi-laboratory.pro/tracker/timeline/libgit2/
3ca7fb22b4
Matthias Fechner (mfechner) · 0.28.4
devel/libgit2 security upgrade to 0.28.4. Changelog: https://github.com/libgit2/libgit2/releases/tag/v0.28.4

MFH:		2019Q4
252655da23
Matthias Fechner (mfechner) · 0.28.3
devel/libgit2: security upgrade to 0.28.3.

PR:		239932
Submitted by:	tobik
Approved by:	mfechner
MFH:		2019Q3
Security:	d51b52cf-c199-11e9-b13f-001b217b3468
ef5dee39ac
Matthias Fechner (mfechner) · 0.28.1
Make portlint happy. Updated version bump node (reported by tijl).
d2347a8d2d
Matthias Fechner (mfechner) · 0.28.1
Added a small note to bump revision using small script I just added.
30ffc09b45
Matthias Fechner (mfechner) · 0.28.1
Upgrade to version 0.28.1. Changelog: https://github.com/libgit2/libgit2/releases
57041ff097
Matthias Fechner (mfechner) · 0.27.8
Upgrade devel/libgit2 to 0.27.8 and required ports.

Reported by:	PORTSCOUT, swills
7410048bb7
Matthias Fechner (mfechner) · 0.27.7
Upgrade to 0.27.7.

Approved by:	mentors (implicit)
a388b70346