Skip to content

Update dependency dulwich to v1 - #65

Open
mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/dulwich-1.x
Open

Update dependency dulwich to v1#65
mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/dulwich-1.x

Conversation

@mend-for-github-com

@mend-for-github-com mend-for-github-com Bot commented Jun 4, 2026

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
dulwich major ==0.20.23==1.2.0

By merging this PR, the issue #63 will be automatically resolved and closed:

Severity CVSS Score Vulnerability
Medium Medium 5.3 CVE-2026-38974

Release Notes

dulwich/dulwich (dulwich)

v1.2.0: 1.2.0

Compare Source

Notable changes since 1.1.0

New features
  • Add am command and porcelain.am() for applying mailbox-style email patches (git am), with state persistence for --continue, --skip, --abort, and --quit recovery (#​1692).
  • Add apply command and porcelain.apply_patch() for applying unified diffs, including rename/copy detection, binary patches with Git's base85 encoding, and --3way merge fallback (#​1784).
  • Expand log command options: --oneline, --abbrev-commit, --author, --committer, --grep, --since/--after, --until/--before, -n/--max-count, --no-merges, --merges, --stat, -p/--patch, --name-only, and --follow (#​1779).
  • Add support for push options (-o/--push-option) in push, enabling AGit flow and other server-side push option workflows.
  • Add missing push options: --all, --tags, --delete, --dry-run, --prune, --set-upstream, --follow-tags, and --mirror (#​1844).
  • Add support for atomic push operations (--atomic): either all ref updates succeed or none are applied (#​1781).
  • Add support for extensions.relativeworktrees repository extension, allowing worktrees to use relative paths (#​2112).
Configuration support
  • gc.pruneExpire — grace period before unreachable objects are pruned (#​1859).
  • core.precomposeunicode — normalize NFD Unicode paths from macOS filesystems to NFC (#​1804).
  • core.gitProxy — proxy command for git:// protocol connections (#​1850).
  • core.maxStat — limit stat operations when checking for unstaged changes (#​1853).
  • core.packedGitLimit — cap memory used for mmapped pack files, closing LRU packs when exceeded (#​1848).
  • core.deltaBaseCacheLimit — cap memory used for caching delta base objects; defaults to 96 MiB (#​1849).
  • http.userAgent — customize the User-Agent header (global and URL-specific); default is git/dulwich/{version}.
Fixes
  • Fix GPG signature verification to raise BadSignature for all GPG errors, not just BadSignatures; also detect when GPG returns no signatures.
  • Fix client incorrectly sending unborn argument in Git protocol v2 ls-refs requests to servers that don't advertise ls-refs=unborn, preventing clones from older servers like Gerrit 3.12.2 (#​2104).
  • Improve error message in read_info_refs() to show the actual line content when parsing fails (#​2103).
  • Preserve quoted trailing whitespace in config values (#​2145, Christopher Toth).
  • Fix .gitignore parent re-include handling so a later !dir/ re-include allows a subsequent file-level negation to take effect (#​2141, N0zoM1z0).
  • Fix host key verification in contrib/paramiko_vendor.py by loading known hosts and rejecting unknown SSH host keys by default (#​2123, quart27219).
Packaging
  • No longer ship contrib/ as part of the distribution. The contrib/ directory has always been documented as unsupported and is now excluded from the installed package (#​2122).

v1.1.0: 1.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: jelmer/dulwich@dulwich-1.0.0...dulwich-1.1.0

v1.0.0: 1.0.0

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.25.2...dulwich-1.0.0

v0.25.2: dulwich-0.25.1

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.25.1...dulwich-0.25.2

v0.25.1

Compare Source

Full Changelog: jelmer/dulwich@dulwich-0.25.0...dulwich-0.25.1

v0.25.0: v0.25.0

Compare Source

What's Changed

New Contributors

Full Changelog: jelmer/dulwich@dulwich-0.24.10...dulwich-0.25.0

v0.24.10: 0.24.10

Compare Source

Full Changelog: jelmer/dulwich@dulwich-0.24.9...dulwich-0.24.10

v0.24.9

Compare Source

  • Fix passing key_filename and ssh_command parameters to SSHGitClient by @​skshetry

  • Relax check to support subclasses of Urllib3HttpGitClient. Fixes
    regression from 0.24.2 where subclasses of Urllib3HttpGitClient would
    not receive the config object. by @​skshetry

  • Fix test_concurrent_ref_operations_compatibility test flakiness by @​jelmer

  • Fix warnings in test suite by @​jelmer

Full Changelog: jelmer/dulwich@dulwich-0.24.8...dulwich-0.24.9

v0.24.8

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.24.7...dulwich-0.24.8

v0.24.7: 0.24.7

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.24.6...dulwich-0.24.7

v0.24.6: 0.24.6

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.24.5...dulwich-0.24.6

v0.24.5: 0.24.5

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.24.4...dulwich-0.24.5

v0.24.4: 0.24.4

Compare Source

What's Changed

New Contributors

Full Changelog: jelmer/dulwich@dulwich-0.24.2...dulwich-0.24.4

v0.24.3: 0.24.3

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.24.2...dulwich-0.24.3

v0.24.2: 0.24.2

Compare Source

What's Changed

New Contributors

Full Changelog: jelmer/dulwich@dulwich-0.24.1...dulwich-0.24.2

v0.24.1

Compare Source

What's Changed

Full Changelog: jelmer/dulwich@dulwich-0.24.0...dulwich-0.24.1

v0.24.0: 0.24.0

Compare Source

What's Changed

Note

PR body was truncated to here.

@mend-for-github-com mend-for-github-com Bot added the security fix Security fix generated by Mend label Jun 4, 2026
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/dulwich-1.x branch from 830039c to 0419776 Compare September 2, 2026 00:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security fix Security fix generated by Mend

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants