git: upgrading to 2.56.1 SUCCEEDED
Hello,
this email is a notification from the Auto Upgrade Helper
that the automatic attempt to upgrade the recipe(s) *git* to *2.56.1* has Succeeded.
Next steps:
- apply the patch: git am 0001-git-upgrade-2.56.0-2.56.1.patch
- check the changes to upstream patches and summarize them in the commit message,
- compile an image that contains the package
- perform some basic sanity tests
- amend the patch and sign it off: git commit -s --reset-author --amend
- send it to the appropriate mailing list
Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted.
Please review the attached files for further information and build/update failures.
Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler
Regards,
The Upgrade Helper
-- >8 --
From b1b46a997354c4fe860d358de88d4a44f1ddce21 Mon Sep 17 00:00:00 2001
From: Upgrade Helper <[email protected]>
Date: Wed, 11 Nov 2026 05:13:55 +0000
Subject: [PATCH] git: upgrade 2.56.0 -> 2.56.1
Git v2.50.2 Release Notes
=========================
This addresses the security issues CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437.
This release also backports fixes necessary to let the CI builds pass successfully.
Fixes since v2.50.1
-------------------
Recursive clones are susceptible to Remote Code Execution: an attacker-controlled repository can be crafted in a way that exploits a bug in Git whereby Git can be fooled into overwriting a gitfile (used for submodules) with a symbolic link that then points to a directory with malicious config or hooks. The config or hooks may have attacker-specified code.
See <https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr>
for details.
It is possible for a server to advertise an unborn HEAD that contains path-traversal characters (e.g., refs/heads/../../../TARGET). With the files ref backend that can lead to ref-updating actions to write to unwanted files.
See <https://gitlab.com/gitlab-org/git/-/work_items/809> for details.
When Git strips the GPG signatures from a commit message, it only accounts for two signatures. A commit message containing more than two signatures therefore causes a stack memory corruption.
This can be triggered when using git merge with a tag which contains more than two signatures. As such, this makes way for a DoS attack which can potentially also affect forges when such a tag is pushed to a remote and a merge action is initiated.
See <https://gitlab.com/gitlab-org/git/-/work_items/810> for details.
Git rejects patches larger than ~1 GiB, because its patch application code does not work well with large files. That check, however, only considered the size of the patch as it appears in the input, which for binary patches is much smaller than the size of the file the patch describes, as binary patches are compressed and encoded. A binary patch that inflates to a very large size therefore slipped past the check and crashed Git with an out-of-bounds read.
See <https://gitlab.com/gitlab-org/git/-/work_items/811> for details.
When merging, Git computes the size of the buffer holding the merge result in a way that can overflow for very large merges, which can be triggered by a large number of conflicts combined with a large conflict-marker-size. The resulting buffer can then be too small, and Git writes past its end (and, before and after that, before its start), corrupting the heap.
See <https://gitlab.com/gitlab-org/git/-/work_items/814> for details.
In response to CVE-2019-1348, fast-import disallows the export-marks feature by default. The features rewrite-submodules-to and rewrite-submodules-from as well as the option export-pack-edges that were introduced in the meantime also allow reading from arbitrary paths, and are therefore now also disallowed by default.
See <https://gitlab.com/gitlab-org/git/-/work_items/812> for details.
Git v2.51.3 Release Notes
=========================
This release merges up the fix that appears in v2.50.2 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for that version for details.
Git v2.52.1 Release Notes
=========================
This release merges up the fix that appears in v2.50.2 and v2.51.3 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.
Git v2.53.1 Release Notes
=========================
This release merges up the fix that appears in v2.50.2, v2.51.3 and v2.52.1 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.
Git v2.54.1 Release Notes
=========================
This release merges up the fix that appears in v2.50.2, v2.51.3, v2.52.1 and v2.53.1 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.
Also contains minor documentation updates and code clean-ups.
Git v2.55.1 Release Notes
=========================
This release merges up the fix that appears in v2.50.2, v2.51.3, v2.52.1, v2.53.1 and v2.54.1 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.
Git v2.56.1 Release Notes
=========================
This release merges up the fix that appears in v2.50.2, v2.51.3, v2.52.1, v2.53.1, v2.54.1 and v2.55.1 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.
---
meta/recipes-devtools/git/git/fixsort.patch | 2 +-
meta/recipes-devtools/git/{git_2.56.0.bb => git_2.56.1.bb} | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-devtools/git/{git_2.56.0.bb => git_2.56.1.bb} (98%)meta/recipes-devtools/git/git/fixsort.patch +1 -1
@@ -1,4 +1,4 @@ -From dbc552db68ca945a24d3cd15f39c6f9982cc317c Mon Sep 17 00:00:00 2001 +From d6a4fa6fa4529f37856913b598d4b3760d64e7a3 Mon Sep 17 00:00:00 2001 From: Richard Purdie <[email protected]> Date: Wed, 17 Feb 2021 17:57:13 +0000 Subject: [PATCH] generate-configlist.sh: Fix determinism issue
meta/recipes-devtools/git/git_2.56.1.bb renamed from meta/recipes-devtools/git/git_2.56.0.bb +1 -1
@@ -175,7 +175,7 @@ EXTRA_OECONF += "ac_cv_snprintf_returns_bogus=no \ " EXTRA_OEMAKE += "NO_GETTEXT=1" -SRC_URI[tarball.sha256sum] = "826817fd3671b8565586d6d49f688298de8354ab11db829c02720e5c74b9b39f" +SRC_URI[tarball.sha256sum] = "fd0c0495427dc9ac445fdced8e36bb5eb6f233a14da5db3c6dfd8dcfa7f85761" CVE_STATUS[CVE-2024-32002] = "fixed-version: fixed since v2.46.0" CVE_STATUS[CVE-2024-50349] = "fixed-version: fixed since v2.49.0"
Signature · 1 line
2.47.1
From b1b46a997354c4fe860d358de88d4a44f1ddce21 Mon Sep 17 00:00:00 2001
From: Upgrade Helper <[email protected]>
Date: Wed, 11 Nov 2026 05:13:55 +0000
Subject: [PATCH] git: upgrade 2.56.0 -> 2.56.1
Git v2.50.2 Release Notes
=========================
This addresses the security issues CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437.
This release also backports fixes necessary to let the CI builds pass successfully.
Fixes since v2.50.1
-------------------
Recursive clones are susceptible to Remote Code Execution: an attacker-controlled repository can be crafted in a way that exploits a bug in Git whereby Git can be fooled into overwriting a gitfile (used for submodules) with a symbolic link that then points to a directory with malicious config or hooks. The config or hooks may have attacker-specified code.
See <https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr>
for details.
It is possible for a server to advertise an unborn HEAD that contains path-traversal characters (e.g., refs/heads/../../../TARGET). With the files ref backend that can lead to ref-updating actions to write to unwanted files.
See <https://gitlab.com/gitlab-org/git/-/work_items/809> for details.
When Git strips the GPG signatures from a commit message, it only accounts for two signatures. A commit message containing more than two signatures therefore causes a stack memory corruption.
This can be triggered when using git merge with a tag which contains more than two signatures. As such, this makes way for a DoS attack which can potentially also affect forges when such a tag is pushed to a remote and a merge action is initiated.
See <https://gitlab.com/gitlab-org/git/-/work_items/810> for details.
Git rejects patches larger than ~1 GiB, because its patch application code does not work well with large files. That check, however, only considered the size of the patch as it appears in the input, which for binary patches is much smaller than the size of the file the patch describes, as binary patches are compressed and encoded. A binary patch that inflates to a very large size therefore slipped past the check and crashed Git with an out-of-bounds read.
See <https://gitlab.com/gitlab-org/git/-/work_items/811> for details.
When merging, Git computes the size of the buffer holding the merge result in a way that can overflow for very large merges, which can be triggered by a large number of conflicts combined with a large conflict-marker-size. The resulting buffer can then be too small, and Git writes past its end (and, before and after that, before its start), corrupting the heap.
See <https://gitlab.com/gitlab-org/git/-/work_items/814> for details.
In response to CVE-2019-1348, fast-import disallows the export-marks feature by default. The features rewrite-submodules-to and rewrite-submodules-from as well as the option export-pack-edges that were introduced in the meantime also allow reading from arbitrary paths, and are therefore now also disallowed by default.
See <https://gitlab.com/gitlab-org/git/-/work_items/812> for details.
Git v2.51.3 Release Notes
=========================
This release merges up the fix that appears in v2.50.2 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for that version for details.
Git v2.52.1 Release Notes
=========================
This release merges up the fix that appears in v2.50.2 and v2.51.3 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.
Git v2.53.1 Release Notes
=========================
This release merges up the fix that appears in v2.50.2, v2.51.3 and v2.52.1 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.
Git v2.54.1 Release Notes
=========================
This release merges up the fix that appears in v2.50.2, v2.51.3, v2.52.1 and v2.53.1 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.
Also contains minor documentation updates and code clean-ups.
Git v2.55.1 Release Notes
=========================
This release merges up the fix that appears in v2.50.2, v2.51.3, v2.52.1, v2.53.1 and v2.54.1 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.
Git v2.56.1 Release Notes
=========================
This release merges up the fix that appears in v2.50.2, v2.51.3, v2.52.1, v2.53.1, v2.54.1 and v2.55.1 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.
---
meta/recipes-devtools/git/git/fixsort.patch | 2 +-
meta/recipes-devtools/git/{git_2.56.0.bb => git_2.56.1.bb} | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-devtools/git/{git_2.56.0.bb => git_2.56.1.bb} (98%)meta/recipes-devtools/git/git/fixsort.patch +1 -1
@@ -1,4 +1,4 @@ -From dbc552db68ca945a24d3cd15f39c6f9982cc317c Mon Sep 17 00:00:00 2001 +From d6a4fa6fa4529f37856913b598d4b3760d64e7a3 Mon Sep 17 00:00:00 2001 From: Richard Purdie <[email protected]> Date: Wed, 17 Feb 2021 17:57:13 +0000 Subject: [PATCH] generate-configlist.sh: Fix determinism issue
meta/recipes-devtools/git/git_2.56.1.bb renamed from meta/recipes-devtools/git/git_2.56.0.bb +1 -1
@@ -175,7 +175,7 @@ EXTRA_OECONF += "ac_cv_snprintf_returns_bogus=no \ " EXTRA_OEMAKE += "NO_GETTEXT=1" -SRC_URI[tarball.sha256sum] = "826817fd3671b8565586d6d49f688298de8354ab11db829c02720e5c74b9b39f" +SRC_URI[tarball.sha256sum] = "fd0c0495427dc9ac445fdced8e36bb5eb6f233a14da5db3c6dfd8dcfa7f85761" CVE_STATUS[CVE-2024-32002] = "fixed-version: fixed since v2.46.0" CVE_STATUS[CVE-2024-50349] = "fixed-version: fixed since v2.49.0"
Signature · 1 line
2.47.1
Git v2.50.2 Release Notes
=========================
This addresses the security issues CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437.
This release also backports fixes necessary to let the CI builds pass successfully.
Fixes since v2.50.1
-------------------
Recursive clones are susceptible to Remote Code Execution: an attacker-controlled repository can be crafted in a way that exploits a bug in Git whereby Git can be fooled into overwriting a gitfile (used for submodules) with a symbolic link that then points to a directory with malicious config or hooks. The config or hooks may have attacker-specified code.
See <https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr>
for details.
It is possible for a server to advertise an unborn HEAD that contains path-traversal characters (e.g., refs/heads/../../../TARGET). With the files ref backend that can lead to ref-updating actions to write to unwanted files.
See <https://gitlab.com/gitlab-org/git/-/work_items/809> for details.
When Git strips the GPG signatures from a commit message, it only accounts for two signatures. A commit message containing more than two signatures therefore causes a stack memory corruption.
This can be triggered when using git merge with a tag which contains more than two signatures. As such, this makes way for a DoS attack which can potentially also affect forges when such a tag is pushed to a remote and a merge action is initiated.
See <https://gitlab.com/gitlab-org/git/-/work_items/810> for details.
Git rejects patches larger than ~1 GiB, because its patch application code does not work well with large files. That check, however, only considered the size of the patch as it appears in the input, which for binary patches is much smaller than the size of the file the patch describes, as binary patches are compressed and encoded. A binary patch that inflates to a very large size therefore slipped past the check and crashed Git with an out-of-bounds read.
See <https://gitlab.com/gitlab-org/git/-/work_items/811> for details.
When merging, Git computes the size of the buffer holding the merge result in a way that can overflow for very large merges, which can be triggered by a large number of conflicts combined with a large conflict-marker-size. The resulting buffer can then be too small, and Git writes past its end (and, before and after that, before its start), corrupting the heap.
See <https://gitlab.com/gitlab-org/git/-/work_items/814> for details.
In response to CVE-2019-1348, fast-import disallows the export-marks feature by default. The features rewrite-submodules-to and rewrite-submodules-from as well as the option export-pack-edges that were introduced in the meantime also allow reading from arbitrary paths, and are therefore now also disallowed by default.
See <https://gitlab.com/gitlab-org/git/-/work_items/812> for details.
Git v2.51.3 Release Notes
=========================
This release merges up the fix that appears in v2.50.2 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for that version for details.
Git v2.52.1 Release Notes
=========================
This release merges up the fix that appears in v2.50.2 and v2.51.3 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.
Git v2.53.1 Release Notes
=========================
This release merges up the fix that appears in v2.50.2, v2.51.3 and v2.52.1 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.
Git v2.54.1 Release Notes
=========================
This release merges up the fix that appears in v2.50.2, v2.51.3, v2.52.1 and v2.53.1 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.
Also contains minor documentation updates and code clean-ups.
Git v2.55.1 Release Notes
=========================
This release merges up the fix that appears in v2.50.2, v2.51.3, v2.52.1, v2.53.1 and v2.54.1 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.
Git v2.56.1 Release Notes
=========================
This release merges up the fix that appears in v2.50.2, v2.51.3, v2.52.1, v2.53.1, v2.54.1 and v2.55.1 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.
packages/x86-64-v3-poky-linux/git/git-bash-completion: PV changed from "2.56.0" to "2.56.1"
packages/x86-64-v3-poky-linux/git/git-bash-completion: PKGV changed from 2.56.0 [default] to 2.56.1 [default]
packages/x86-64-v3-poky-linux/git/git-dbg: PV changed from "2.56.0" to "2.56.1"
packages/x86-64-v3-poky-linux/git/git-dbg: PKGV changed from 2.56.0 [default] to 2.56.1 [default]
packages/x86-64-v3-poky-linux/git/git-dbg: PKGSIZE changed from 114344408 to 114500368 (+0%)
packages/x86-64-v3-poky-linux/git/git-dev: PV changed from "2.56.0" to "2.56.1"
packages/x86-64-v3-poky-linux/git/git-dev: PKGV changed from 2.56.0 [default] to 2.56.1 [default]
packages/x86-64-v3-poky-linux/git/git-doc: PV changed from "2.56.0" to "2.56.1"
packages/x86-64-v3-poky-linux/git/git-doc: PKGV changed from 2.56.0 [default] to 2.56.1 [default]
packages/x86-64-v3-poky-linux/git/git-locale: PV changed from "2.56.0" to "2.56.1"
packages/x86-64-v3-poky-linux/git/git-locale: PKGV changed from 2.56.0 [default] to 2.56.1 [default]
packages/x86-64-v3-poky-linux/git/git-perltools: PV changed from "2.56.0" to "2.56.1"
packages/x86-64-v3-poky-linux/git/git-perltools: PKGV changed from 2.56.0 [default] to 2.56.1 [default]
packages/x86-64-v3-poky-linux/git/git-src: PV changed from "2.56.0" to "2.56.1"
packages/x86-64-v3-poky-linux/git/git-src: PKGV changed from 2.56.0 [default] to 2.56.1 [default]
packages/x86-64-v3-poky-linux/git/git-src: FILELIST: directory renamed /usr/src/debug/git/2.56.0/compat/fsmonitor -> /usr/src/debug/git/2.56.1/compat/fsmonitor, directory renamed /usr/src/debug/git/2.56.0/ewah -> /usr/src/debug/git/2.56.1/ewah, directory renamed /usr/src/debug/git/2.56.0/refs -> /usr/src/debug/git/2.56.1/refs, directory renamed /usr/src/debug/git/2.56.0/odb -> /usr/src/debug/git/2.56.1/odb, directory renamed /usr/src/debug/git/2.56.0/xdiff -> /usr/src/debug/git/2.56.1/xdiff, directory renamed /usr/src/debug/git/2.56.0/sha256/block -> /usr/src/debug/git/2.56.1/sha256/block, directory renamed /usr/src/debug/git/2.56.0 -> /usr/src/debug/git/2.56.1, directory renamed /usr/src/debug/git/2.56.0/compiler-tricks -> /usr/src/debug/git/2.56.1/compiler-tricks, directory renamed /usr/src/debug/git/2.56.0/reftable -> /usr/src/debug/git/2.56.1/reftable, directory renamed /usr/src/debug/git/2.56.0/sha1dc -> /usr/src/debug/git/2.56.1/sha1dc, directory renamed /usr/src/debug/git/2.56
.0/compat/simple-ipc -> /usr/src/debug/git/2.56.1/compat/simple-ipc, directory renamed /usr/src/debug/git/2.56.0/trace2 -> /usr/src/debug/git/2.56.1/trace2, directory renamed /usr/src/debug/git/2.56.0/compat -> /usr/src/debug/git/2.56.1/compat, directory renamed /usr/src/debug/git/2.56.0/compat/linux -> /usr/src/debug/git/2.56.1/compat/linux, directory renamed /usr/src/debug/git/2.56.0/negotiator -> /usr/src/debug/git/2.56.1/negotiator, directory renamed /usr/src/debug/git/2.56.0/builtin -> /usr/src/debug/git/2.56.1/builtin
packages/x86-64-v3-poky-linux/git/git-src: PKGSIZE changed from 10863211 to 10865867 (+0%)
packages/x86-64-v3-poky-linux/git/git-staticdev: PV changed from "2.56.0" to "2.56.1"
packages/x86-64-v3-poky-linux/git/git-staticdev: PKGV changed from 2.56.0 [default] to 2.56.1 [default]
packages/x86-64-v3-poky-linux/git/git-tk: PV changed from "2.56.0" to "2.56.1"
packages/x86-64-v3-poky-linux/git/git-tk: PKGV changed from 2.56.0 [default] to 2.56.1 [default]
packages/x86-64-v3-poky-linux/git/git: PV changed from "2.56.0" to "2.56.1"
packages/x86-64-v3-poky-linux/git/git: PKGV changed from 2.56.0 [default] to 2.56.1 [default]
packages/x86-64-v3-poky-linux/git/git: PKGSIZE changed from 27750132 to 27774708 (+0%)
packages/x86-64-v3-poky-linux/git/gitweb: PV changed from "2.56.0" to "2.56.1"
packages/x86-64-v3-poky-linux/git/gitweb: PKGV changed from 2.56.0 [default] to 2.56.1 [default]
packages/x86-64-v3-poky-linux/git: PV changed from "2.56.0" to "2.56.1"
packages/x86-64-v3-poky-linux/git: PKGV changed from 2.56.0 [default] to 2.56.1 [default]
packages/x86-64-v3-poky-linux/git: SRC_URI changed from "https://cdn.kernel.org/pub/software/scm/git/git-2.56.0.tar.gz;name=tarball file://fixsort.patch" to "https://cdn.kernel.org/pub/software/scm/git/git-2.56.1.tar.gz;name=tarball file://fixsort.patch"