chore(deps): update dependency dulwich to v1.2.13

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
dulwich	==1.2.12 → ==1.2.13

---

Release Notes

dulwich/dulwich (dulwich)

v1.2.13

Compare Source

• Make concurrent Pack.get_raw calls thread-safe by synchronizing
  PackData's resolved-object offset cache.
  (Bojan Zivanovic)

• Speed up cached PackData.get_object_at lookups by acquiring the
  offset-cache lock directly instead of through a with statement.
  (Bojan Zivanovic)

• Bound fetch negotiation the way C Git's MAX_IN_VAIN does: give up
  after 256 unacknowledged "have" lines instead of draining the whole
  graph walker into stateless (HTTP) requests. (Bojan Zivanovic, #​2343)

• Add repo.sanitize_user_identity, which builds an identity from a
  name and an email sanitized the way git's fmt_ident does, for
  callers who cannot reject invalid input via check_user_identity.
  (Bojan Zivanovic, #​2342)

• Make concurrent PackData reads thread-safe by mmap-ing pack contents
  and indexing the mapping at explicit offsets instead of sharing the file
  position. New unpack_object_at, read_pack_header_at,
  read_zlib_chunks_at, take_msb_bytes_at and compute_buffer_sha
  read from a buffer; the existing read-callable variants remain for streams.
  (Bojan Zivanovic, Jelmer Vernooij)

• Deduplicate the commit walk in find_shallow and get_depth
  (dulwich.object_store). Both re-expanded a commit once per path that
  reached it, so a merge-heavy history walked in exponential time.
  (netliomax25-code)

• SECURITY: Don't follow symlinks when writing messages in
  porcelain.format_patch, mbox.split_mbox and mbox.split_maildir.
  A symlink pre-planted at an output filename was followed, writing the
  message outside the output
  directory. (Jelmer Vernooij; Reported by wzc)

• Only reject reserved Windows device names (aux, nul, con, ...)
  when actually running on Windows. C git confines this check to its Windows
  compat layer, so repositories carrying such paths could not be cloned
  elsewhere. (Jelmer Vernooij, #​2351)

• Fix ignore and attrs matching for patterns ending in **/. The
  trailing slash was dropped when translating the pattern, so foo/**/ also
  matched foo/ itself and every file directly inside it. Git only ignores
  the directories below foo. (adarshsm)

• Catch PackFileDisappeared in the bitmap probe in
  get_reachability_provider, which only guarded FileNotFoundError.
  (Jelmer Vernooij, #​2344)

• SECURITY: Widen modes for core.sharedRepository as git does rather than
  chmodding to a precomputed one, which left .git/hooks and .git/refs
  world-writable for all. (netliomax25-code, Jelmer Vernooij, #​2323)

• parse_shared_repository now returns a SharedPerm, and
  DiskObjectStore, Index and GitFile take a shared_perm
  argument in place of file_mode/dir_mode. (Jelmer Vernooij)

• Fix commit-graph extra edge indexing: the stored value is a position in a
  list of 4-byte entries, not a byte offset, so every octopus merge after
  the first got a wrong parent list. (netliomax25-code)

• Refresh the mtime of an existing loose object in
  DiskObjectStore.add_object(), so that a concurrent git gc cannot
  prune an object that was just reported as present.
  (Bojan Zivanovic, #​2340)

• HARDEN: Validate shallow object ids received from the remote.
  (netliomax25-code)

• SECURITY: Refuse patch targets addressing the .git control directory.
  apply_patches (via porcelain.am/apply_patch) previously wrote and
  ran .git/hooks/pre-commit. (Jelmer Vernooij, reported by @​bhaswanthc)

• Extend the verify_leading_dirs symlink guard to
  update_working_tree (used by pull, merge and checkout).
  The 1.2.12 fix only covered build_index_from_tree, so a tree pairing a
  symlink x with a descendant x/config could still write through the
  link and overwrite .git/config on pull.
  (Jelmer Vernooij, reported by Hugh Lewis)

• Translate .gitignore/.gitattributes bracket expressions with Git's
  wildmatch() semantics: [^...] negation, POSIX classes, backslash
  escapes and malformed-class handling. ignore and attrs now share
  one translator, the new public dulwich.wildmatch.
  (Vincent Gao, #​2326)

• Always single-quote the repository path in the SSH command, matching git's
  sq_quote(). shlex.quote left paths without shell metacharacters
  bare, which broke cloning from servers that parse the command themselves
  rather than handing it to a shell, such as Bitbucket Server.
  (Jelmer Vernooij, #​2319)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Super-linter summary

Language	Validation result
BIOME_LINT	Pass ✅
EDITORCONFIG	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter