[ANNOUNCE] Git 2.56.1 and friends

[Junio C Hamano <gitster@pobox.com>]

A maintenance release Git 2.56.1 and others for older maintenance
tracks down to maint-2.43 are now available at the usual places.

This is a set of coordinated security fix releases.  Please update
at your earliest convenience.

The tarballs are found at:

    https://www.kernel.org/pub/software/scm/git/

The following public repositories all have a copy of the v2.50.2,
v2.51.3, v2.52.1, v2.53.1, v2.54.1, v2.55.1, and v2.56.1 tags:

  url = https://git.kernel.org/pub/scm/git/git
  url = https://kernel.googlesource.com/pub/scm/git/git
  url = git://repo.or.cz/alt-git.git
  url = https://github.com/gitster/git


Credit for organizing the set of these releases goes to Johannes
Schindelin.  Credit for finding the vulnerabilities goes to Luke
Martin and pwn2addr.  Credit for fixing them goes to Toon Claes,
Karthik Nayak, and Kaartic Sivaraam.  The xdiff hardening is based
on a patch by Jeff King, with help from Toon Claes and Christian
Couder.

------------------------------------------------------------
Git v2.56.1 Release Notes
=========================

This release merges up the fix that appears in v2.50.2, v2.51.3,
v2.52.1, v2.53.1, v2.54.1 and v2.55.1 to address CVE-2026-111760,
CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469
and CVE-2026-105437; see the release notes for these versions for
details.


------------------------------------------------------------
Git v2.50.2 Release Notes
=========================

This addresses the security issues CVE-2026-111760, CVE-2026-113408,
CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437.

This release also backports fixes necessary to let the CI builds pass
successfully.

Fixes since v2.50.1
-------------------

 * CVE-2026-111760:

   Recursive clones are susceptible to Remote Code Execution: an
   attacker-controlled repository can be crafted in a way that exploits
   a bug in Git whereby Git can be fooled into overwriting a gitfile
   (used for submodules) with a symbolic link that then points to a
   directory with malicious config or hooks. The config or hooks may
   have attacker-specified code.

   See <https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr>
   for details.

 * CVE-2026-113408:

   It is possible for a server to advertise an unborn HEAD that contains
   path-traversal characters (e.g., `refs/heads/../../../TARGET`). With
   the files ref backend that can lead to ref-updating actions to write
   to unwanted files.

   See <https://gitlab.com/gitlab-org/git/-/work_items/809> for details.

 * CVE-2026-114467:

   When Git strips the GPG signatures from a commit message, it only
   accounts for two signatures. A commit message containing more than
   two signatures therefore causes a stack memory corruption.

   This can be triggered when using `git merge` with a tag which
   contains more than two signatures. As such, this makes way for a DoS
   attack which can potentially also affect forges when such a tag is
   pushed to a remote and a merge action is initiated.

   See <https://gitlab.com/gitlab-org/git/-/work_items/810> for details.

 * CVE-2026-114469:

   Git rejects patches larger than ~1 GiB, because its patch application
   code does not work well with large files. That check, however, only
   considered the size of the patch as it appears in the input, which for
   binary patches is much smaller than the size of the file the patch
   describes, as binary patches are compressed and encoded. A binary
   patch that inflates to a very large size therefore slipped past the
   check and crashed Git with an out-of-bounds read.

   See <https://gitlab.com/gitlab-org/git/-/work_items/811> for details.

 * CVE-2026-105437:

   When merging, Git computes the size of the buffer holding the merge
   result in a way that can overflow for very large merges, which can be
   triggered by a large number of conflicts combined with a large
   `conflict-marker-size`. The resulting buffer can then be too small,
   and Git writes past its end (and, before and after that, before its
   start), corrupting the heap.

   See <https://gitlab.com/gitlab-org/git/-/work_items/814> for details.

 * CVE-2026-114466:

   In response to CVE-2019-1348, `fast-import` disallows the
   `export-marks` feature by default. The features
   `rewrite-submodules-to` and `rewrite-submodules-from` as well as the
   option `export-pack-edges` that were introduced in the meantime also
   allow reading from arbitrary paths, and are therefore now also
   disallowed by default.

   See <https://gitlab.com/gitlab-org/git/-/work_items/812> for details.

 * Defense-in-depth: read-cache: reject cache entries with over-long
   names.

 * Various fix-ups on HTTP tests.

 * Test update.

 * HTTP Header redaction code has been adjusted for a newer version of
   cURL library that shows its traces differently from earlier
   versions.

 * The `imap-send` command was adjusted to work with OpenSSL 4.0.

 * Replace macos-13 used at GitHub CI with macos-14, and macos-14 with
   macos-15.

 * Work around a bug in the iconv library shipped with macOS 14 and 15
   that fails to correctly handle stateful ISO/IEC 2022 encoded strings.

 * ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1).

 * ci(dockerized): raise the PID limit for private repositories.

 * ci: bump debian-11 job to debian-12.

 * ci: skip CVS and P4 tests in leaks job, too.

 * mingw: drop the -D_USE_32BIT_TIME_T option, stop using nedmalloc, and
   only use -Wl,--large-address-aware for 32-bit builds.

 * Update GitHub Actions jobs to avoid warnings against using deprecated
   version of Node.js.

----------------------------------------------------------------

Changes since v2.56.0 are as follows:

Beat Bolli (3):
      imap-send: use the OpenSSL API to access the subject alternative names
      imap-send: use the OpenSSL API to access the subject common name
      imap-send: move common code into function host_matches()

Colin Stagner (1):
      ci: ubuntu: use GNU coreutils for dirname

Collin Funk (4):
      global: constify some pointers that are not written to
      gpg-interface: remove an unnecessary NULL initialization
      bloom: remove a misleading const qualifier
      dir: avoid -Wdiscarded-qualifiers in remove_path()

Elijah Newren (1):
      read-cache: reject cache entries with over-long names

Jeff King (30):
      revision: make handle_dotdot() interface less confusing
      convert: add const to fix strchr() warnings
      http: add const to fix strchr() warnings
      transport-helper: drop const to fix strchr() warnings
      pager: explicitly cast away strchr() constness
      run-command: explicitly cast away constness when assigning to void
      pseudo-merge: fix disk reads from find_pseudo_merge()
      rev-parse: simplify dotdot parsing
      skip_prefix(): check const match between in and out params
      revision: avoid writing to const string for parent marks
      pkt-line: make packet_reader.line non-const
      rev-parse: avoid writing to const string for parent marks
      range-diff: drop const to fix strstr() warnings
      config: store allocated string in non-const pointer
      http: drop const to fix strstr() warning
      ref-filter: factor out refname component counting
      refs/files-backend: drop const to fix strchr() warning
      ref-filter: simplify lstrip_ref_components() memory handling
      git-compat-util: fix CONST_OUTPARAM typo and indentation
      ref-filter: simplify rstrip_ref_components() memory handling
      ref-filter: avoid strrchr() in rstrip_ref_components()
      ref-filter: clarify lstrip/rstrip component counting
      find_last_dir_sep(): convert inline function to macro
      ci: bump debian-11 job to debian-12
      test-lib: allow lazy prerequisite snippets as here-docs
      t5551: handle trailing slashes in expected cookies output
      t5563: add missing end-of-line in HTTP header
      revert: initialize const value
      curl: add support for curl_global_trace() components
      http: handle curl stripping creds from effective url

Johannes Schindelin (19):
      ci(dockerized): raise the PID limit for private repositories
      ci: work around Debian 12's HTTP/2 authentication failures
      ci(vs-build): adapt to Visual Studio 2026 default on windows-latest
      mingw: drop the -D_USE_32BIT_TIME_T option
      mingw: stop using nedmalloc
      mingw: only use -Wl,--large-address-aware for 32-bit builds
      t5564: use a short path for the SOCKS proxy socket
      checkout: use size_t and st_add() for cache entry length in update_some()
      read-cache: use size_t and st_add() for cache entry size in read_one_entry_opt()
      cmake: stop trying to build the reftable and xdiff libraries
      t1600-index: add expensive tests for over-long tree paths
      ci(vs-build) make the VS-built git.exe adjust MSYSTEM/PATH
      Git 2.50.2
      Git 2.51.3
      Git 2.52.1
      Git 2.53.1
      Git 2.54.1
      Git 2.55.1
      Git 2.56.1

Junio C Hamano (2):
      GitHub CI: macos-13 images are no more
      ci: skip CVS and P4 tests in leaks job, too

Kaartic Sivaraam (3):
      git-compat-util: add st_add5() helper to detect size_t overflow
      xdiff: use size_t for merge buffer size computations
      xdiff: check for overflow when computing merge buffer size

Karthik Nayak (8):
      base85: cleanup unused debug code
      base85: introduce a new `chunk_and_encode85()` function
      test-tool: add command to encode-chunk base85
      apply: reject binary patches greater than MAX_APPLY_SIZE
      apply: add tests mismatch in binary patch size
      commit: rewrite `remove_signature()` to work with multiple signatures
      fast-import: add safeguard around rewrite-submodules features
      fast-import: add safeguard around 'export-pack-edges'

Patrick Steinhardt (15):
      build: tolerate use of _Generic from glibc 2.43 with Clang
      ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)
      t7528: work around ETOOMANY in OpenSSH 10.1 and newer
      meson: simplify iconv-emits-BOM check
      meson: detect broken iconv that requires ICONV_RESTART_RESET
      gitlab-ci: update to macOS 15 images
      README: add GitLab CI badge to make it more discoverable
      t0021: skip EXPENSIVE test that is broken without SIZE_T_IS_64BIT
      t4141: fix inefficient use of dd(1)
      t5608: reduce maximum disk usage
      t7508: skip EXPENSIVE test that is broken without SIZE_T_IS_64BIT
      t7900: clean up large EXPENSIVE repository
      t: use `test_bool_env` to parse GIT_TEST_LONG
      gitlab-ci: disable RAM disk on macOS jobs
      gitlab-ci: enable "GIT_TEST_LONG"

Paul Tarjan (1):
      t7800: fix racy "difftool --dir-diff syncs worktree" test

René Scharfe (2):
      macOS: make Homebrew use configurable
      macOS: use iconv from Homebrew if needed and present

Tamir Duberstein (2):
      t4205: compare huge output without diff
      ci: use twice the CPU count on both providers

Toon Claes (6):
      meson: ignore subprojects/.wraplock
      meson: only detect ICONV_OMITS_BOM if possible
      meson: use is_cross_build() where possible
      connect: validate unborn HEAD symref-target in protocol v2
      connect: validate born ref symref-target in protocol v2
      connect: validate ref names in protocol v2 ls-refs response

Torsten Bögershausen (2):
      utf8.c: prepare workaround for iconv under macOS 14/15
      utf8.c: enable workaround for iconv under macOS 14/15