Log message:
libgit2: updated to 1.9.7

v1.9.7

This is an security release with one change.

* Escape remote repository paths in libssh2

  In v1.9.2, we started escaping repository paths in the OpenSSH-based
  exec ssh transport. Bring the same escaping to the libssh2 transport
  to avoid any potential command injection.

Log message:
libgit2: updated to 1.9.6

v1.9.6

This release includes a few small but important bugfixes.

* load_known_hosts: do not fail if homedir is invalid
  by @JonasVautherin in https://github.com/libgit2/libgit2/pull/7056
* Fix segfault on Android when no HOME set by @501st-alpha1 in
  https://github.com/libgit2/libgit2/pull/7309
* cmake: bring back hidden visibility for the static build by
  @carlosmn in https://github.com/libgit2/libgit2/pull/7288

v1.9.5

This is a security release with multiple changes.

* Fix for blame error handling on hunk creation failures

  `hunk_from_entry` can return `NULL` on error; handle that and
  return an error.

* Fix for potential PCRE memory access: 1-byte heap-buffer-overflow
  WRITE in bundled PCRE 8.45 reachable via revspec

  `git_revparse_single` accepts revspecs of the form `:/<pattern>`
  (the "grep by commit message" shorthand) and forwards `<pattern>`
  directly to libgit2's regex backend. When libgit2 is using its builtin
  regular expression engine, this causes a heap buffer overflow.

* Fix for CVE-2026-53586: give auth callback current host

  libgit2's builtin HTTP transport follows offsite redirects for the
  initial smart HTTP request by default. If the redirected server then
  returns 401 Unauthorized, libgit2 asks the application credential
  callback for credentials using the original remote URL, not the
  redirected URL. The returned credential is then attached to the next
  request to the redirected host as an Authorization header.

* Fix for CVE-2026-53587: libgit2 version 1.9.4 and below is vulnerable
  to a heap out-of-bounds read in `set_data` in
  `src/libgit2/transports/smart_pkt.c`.

  When given capabilities, we check for the object-format capability; we
  need to ensure that the current packet buffer is large enough before
  actually doing the check.

* Fix for CVE-2026-53585: Unbounded Memory Allocation via Delta
  Object Result-Size Header

  Potential denial of service because `git_delta_apply` reads the
  claimed result size (`res_sz`) from the delta object header — data
  entirely controlled by the sender — and immediately allocates a
  buffer of that size.

* Fix for CVE-2026-53584: submodule: check paths for escaping

  A crafted repository with a submodule whose path contains traversal
  components (e.g. "../") can cause the library to create directories
  outside the repository's working tree.

* Fix for CVE-2026-53583: inverted IP SubjectAltName comparison in
  OpenSSL backend.

  An inverted comparison in the OpenSSL TLS backend causes IP
  SubjectAltName (SAN) verification to accept certificates with
  mismatched IP addresses and reject certificates with correct IP
  addresses. This allows a network attacker with a valid CA-signed
  certificate containing any IP SAN to perform MITM attacks against
  libgit2 clients connecting to IP-literal HTTPS URLs.

Log message:
libgit2: updated to 1.9.4

v1.9.4

This release includes a few small but important bugfixes.

* cmake: separate generated headers from translated headers
* Avoid uninitialized variable warnings in gcc
* fix: Recognize relative worktrees extension
* fix(sha256): thread-safety bug in builtin SHA-256

Log message:
*: Recursive revbump from security/nettle-4.0

Log message:
libgit2: updated to 1.9.3

v1.9.3

This release includes a number of bugfixes and compatibility
improvements, particularly around SHA256 support.

* cmake: fix linker error when using ninja build generator by
  @kcsaul in https://github.com/libgit2/libgit2/pull/7249
* Handle redirects with Content-Length: 0 correctly by
  @ethomson in https://github.com/libgit2/libgit2/pull/7246
* ci: use poxygit v0.8.1 in the tests by @ethomson in
  https://github.com/libgit2/libgit2/pull/7248
* Zero indexer stats in pack objects by @ethomson in
  https://github.com/libgit2/libgit2/pull/7243
* submodule: git_index_add_bypath does not move conflict entries
  to REUC by @lrm29 in https://github.com/libgit2/libgit2/pull/7003
* fix: prevent SSH timeout infinite loop and enable TCP keepalive
  by @ambv in https://github.com/libgit2/libgit2/pull/7165
* merge_files: avoid UB in xdiff by @ethomson in
  https://github.com/libgit2/libgit2/pull/7239
* git_merge_file_from_index: handle cases when a child (ours or
  theirs) is null by @eantoranz in
  https://github.com/libgit2/libgit2/pull/7092
* cmake: write git.h.tmp to current binary directory by @kcsaul in
  https://github.com/libgit2/libgit2/pull/7241
* fix(pack): ensure pack_backend__read returns null terminated buffer
  by @kanru in https://github.com/libgit2/libgit2/pull/7238
* Check object lengths against headers in read_loose by @howtonotwin
  in https://github.com/libgit2/libgit2/pull/7178
* cmake: don't recreate git2.h unnecessarily by @ethomson in
  https://github.com/libgit2/libgit2/pull/7234
* Memory Backend Corruption Fix by @kcsaul in
  https://github.com/libgit2/libgit2/pull/7232
* Fixed a heap-buffer-overflow in the smart_pkt.c:set_data function
  by @oliverchang in https://github.com/libgit2/libgit2/pull/7118
* fix(transport): get oid_type on local transport by @weihanglo in
  https://github.com/libgit2/libgit2/pull/7229
* `GIT_REMOTE_DOWNLOAD_TAGS_ALL`: remove stray "the" in docs by
  @DanielEScherzer in https://github.com/libgit2/libgit2/pull/7228
* fix(clone): propagate object format in local clone by @weihanglo in
  https://github.com/libgit2/libgit2/pull/7226
* repo: Fix possible null pointer dereference by @csware in
  https://github.com/libgit2/libgit2/pull/7225
* revparse: Allow `HEAD` abbreviation `@` by @KoviRobi in
  https://github.com/libgit2/libgit2/pull/7218
* camke: include libssh2 in `Requires.private` in the PC file
  by @carlosmn in https://github.com/libgit2/libgit2/pull/7215
* futils: fix undefined behavior in O_FSYNC fallback definition
  by @cehoffman in https://github.com/libgit2/libgit2/pull/7211
* pcre: actually fix dangling-pointer warning by @ethomson in
  https://github.com/libgit2/libgit2/pull/7206
* pcre: update cmake warnings for non-gcc by @ethomson in
  https://github.com/libgit2/libgit2/pull/7205
* Fix some warnings with gcc by @ethomson in
  https://github.com/libgit2/libgit2/pull/7203
* fix: apply insteadOf from global config for detached remotes by
  @weihanglo in https://github.com/libgit2/libgit2/pull/7195
* Fix `git_index_entry` documentation by @bakersdozen123 in
  https://github.com/libgit2/libgit2/pull/7192
* config: Fix potential null value passed to %s by @ethomson in
  https://github.com/libgit2/libgit2/pull/7190
* index: support USE_NSEC=OFF by @ethomson in
  https://github.com/libgit2/libgit2/pull/7187
* feat(remote): expose `git_remote_oid_type` by @weihanglo in
  https://github.com/libgit2/libgit2/pull/7185
* fix(smart): keep caps across RPC stream resets by @weihanglo in
  https://github.com/libgit2/libgit2/pull/7183
* fix wrong comment by @Murmele in
  https://github.com/libgit2/libgit2/pull/7181
* fix(sha256): pass correct oid type by @weihanglo in
  https://github.com/libgit2/libgit2/pull/7179
* examples: correct `git_commit_time` comment by @qaqland in
  https://github.com/libgit2/libgit2/pull/7175
* tests: update to latest clar by @ethomson in
  https://github.com/libgit2/libgit2/pull/7173
* delta: fix undefined behavior in hdr_sz varint parsing
  by @Oblivionsage in https://github.com/libgit2/libgit2/pull/7172
* ci: Update macos-13 to macos-14 images on GitHub Actions by @ambv
  in https://github.com/libgit2/libgit2/pull/7167
* ci: Fix cases of -Werror=discarded-qualifiers raised by @gcc 15.2
  by @ambv in https://github.com/libgit2/libgit2/pull/7164
* Use CMAKE_INSTALL_INCLUDEDIR for libgit2package INSTALL_INTERFACE
  by @aware70 in https://github.com/libgit2/libgit2/pull/7155
* Fix C4703 uninitialized pointer variable warnings by
  @ShiningMassXAcc in https://github.com/libgit2/libgit2/pull/7154
* test: check the correct filesystem for case-sensitivity by @ambv
  in https://github.com/libgit2/libgit2/pull/7153
* ci: update ci/docker/fedora to work with Rawhide 44 by @ambv
  in https://github.com/libgit2/libgit2/pull/7152
* refs: honor REFSPEC_SHORTHAND for multi-segment refs by @roberth
  in https://github.com/libgit2/libgit2/pull/7148
* config: Fix potential null value passed to %s by @orgads in
  https://github.com/libgit2/libgit2/pull/7131
* Fix potential access to uninitialized variables by @orgads
  in https://github.com/libgit2/libgit2/pull/7130
* refspec: Detect DEL character in is_valid_name by @xokdvium
  in https://github.com/libgit2/libgit2/pull/7120
* Update documentation to clarify that cert cb is always called
  by @ehuss in https://github.com/libgit2/libgit2/pull/7119
* Update `racy.c` reference by @emmanuel-ferdman in
  https://github.com/libgit2/libgit2/pull/7091
* Avoid duplicate definition of git_http_auth_dummy. by
  @JohannesWilde in https://github.com/libgit2/libgit2/pull/7077

Log message:
devel/libgit2, graphics/freeglut, graphics/inkscape: don't leak buildlink3
paths in installed cmake files.
Bump PKGREVISION

Log message:
*: recursive bump for nettle 4.0 shlib major bump

Log message:
*: recursive bump for icu 78.1