fix(deps): update rust crate git2 to 0.20.0 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
git2	dependencies	minor	0.19.0 → 0.20.0

---

git2 has potential undefined behavior when dereferencing Buf struct

GHSA-j39j-6gw9-jw6h

More information

Details

If the Buf struct is dereferenced immediately after calling new() or default() on the Buf struct, a null pointer is passed to the unsafe function slice::from_raw_parts. According to the safety section documentation of the function, data must be non-null and aligned even for zero-length slices or slices of ZSTs. Thus, passing a null pointer will lead to undefined behavior.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://github.com/rust-lang/git2-rs/issues/1211
• https://github.com/rust-lang/git2-rs/pull/1213
• https://github.com/rust-lang/git2-rs/commit/9e160f15bd056f82143109bb330573381e5de719
• https://rustsec.org/advisories/RUSTSEC-2026-0008.html
• https://github.com/advisories/GHSA-j39j-6gw9-jw6h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

rust-lang/git2-rs (git2)

v0.20.4

Compare Source

0.20.4...main

Added

• Added experimental SHA256 repository support behind the new unstable-sha256 Cargo feature,
  along with *_ext API variants that accept an ObjectFormat.
  #​1206
• Added opts::set_cache_max_size() and opts::get_cached_memory().
  #​1188
• Added Repository::object_format() and a new ObjectFormat enum.
  #​1204
• Added Repository::set_config().
  #​1208
• Added merge_file() along with MergeFileInput.
  #​1210
• Added Repository::refdb_compress() for packing loose refs.
  #​1221
• Added public Refdb type, along with Repository::refdb() and Repository::set_refdb(). Repository::refdb_compress() now delegates to Refdb::compress().
  #​1228
• Added Revspec::into_objects().
  #​1230
• Added BlameHunk::final_committer(), BlameHunk::orig_committer(), BlameHunk::summary(), and BlameHunk::summary_bytes().
  #​1231
• Implemented Clone for Reference.
  #​1233
• Added Repository::author_from_env() and Repository::committer_from_env().
  #​1237
• Added impl From<Utf8Error> for Error.
  #​1239

Changed

• ❗ The ssh, https, and cred Cargo features are no longer enabled by default.
  Previously default = ["ssh", "https"]; now default = [].
  Enable them explicitly if you rely on credential helpers or transport support.
  #​1168
• ❗ CredentialHelper and the url dependency are now gated behind the new cred Cargo feature.
  Enabling ssh or https transitively enables cred.
  #​1168
• ❗ Updated to the 2021 edition.
  #​1173
• ❗ Many string accessors that previously returned Option<&str>
  now return Result<&str, Error> or Result<Option<&str>, Error>,
  so callers can distinguish a missing value from a non-UTF-8 one.
  #​1241
• ❗ BlameHunk::final_signature, BlameHunk::final_committer, BlameHunk::orig_signature, and BlameHunk::orig_committer
  now return Option to avoid segfaults when signature information is missing.
  #​1254
• Bumped requirement to libgit2-sys 0.18.4, which updates libgit2 to 1.9.3.
  #​1242

Fixed

• Fixed MergeOptions::skip_reuc() to use the correct GIT_MERGE_SKIP_REUC flag.
  #​1194
• Repository::submodules() now returns an Error when the underlying git_submodule_lookup() call to libgit2 fails, rather than panicking with a failed assertion.
  #​1220
• Reference::is_valid_name() now propagates errors from CString conversion instead of panicking.
  #​1229
• Fixed Remote::list() to return an empty list instead of erroring
  when the remote advertises no refs.
  #​1250
• ReferenceNames now returns an Err for non-UTF-8 branch names instead of panicking.
  #​1239

Documentation

• Added note regarding potentially confusing behavior of git_checkout_head.
  #​1149
• Added comments describing the IndexAddOption flags.
  #​1163
• Updated README note about the ssh feature.
  #​1187
• Improved function docs for Repository::tag_foreach().
  #​1190
• Fixed doc comment typo in StatusOptions.
  #​1199
• Fixed missing period in module documentation.
  #​1219
• Small wording fix in Signature::from_raw_const() docs.
  #​1222
• Replaced discussion of missing gist in README.
  #​1223
• Documented the bitflag methods for checking flags.
  #​1224
• Clarified CheckoutBuilder::update_index() documentation.
  #​1232
• Added more missing documentation.
  #​1235
• Fixed typo in Repository::stash_save_ext() docs.
  #​1245
• Added example showing retrieval of the latest commit for a file.
  #​1243
• Replaced comma with period in CheckoutBuilder::refresh() docs.
  #​1252

Internals

• Dropped civet/conduit from dev-dependencies.
  #​1170
• Updated dependencies.
  #​1171
• Fixed lockfile verification in CI.
  #​1177
• Updated CI and documentation to cover feature combinations.
  #​1182
• Listed all examples that may need HTTP and SSH.
  #​1196
• Allowed publishing from any ref in the publish workflow.
  #​1198
• Bumped time from 0.3.41 to 0.3.47.
  #​1215
• Added end-to-end test for branch name on initialization.
  #​1244
• Added end-to-end test for stash count.
  #​1246
• Added end-to-end tests demonstrating use of Repository::statuses().
  #​1251
• Internal refactors preparing for experimental SHA256 OID support.
  #​1201
  #​1205

v0.20.3

Compare Source

0.20.3...0.20.4

Fixed

• Fix undefined behavior when dereferencing empty Buf.
  #​1213

v0.20.2

Compare Source

0.20.2...0.20.3

Changed

• Bumped requirement to libgit2-sys 0.18.3, which updates libgit2 from 1.9.0 to 1.9.2.
  #​1197

v0.20.1

Compare Source

0.20.1...0.20.2

Added

• Added Status::WT_UNREADABLE.
  #​1151

Fixed

• Added missing codes for GIT_EDIRECTORY, GIT_EMERGECONFLICT, GIT_EUNCHANGED, GIT_ENOTSUPPORTED, and GIT_EREADONLY to Error::raw_code.
  #​1153
• Fixed missing initialization in Indexer::new.
  #​1160

v0.20.0

Compare Source

0.20.0...0.20.1

Added

• Added Repository::branch_upstream_merge()
  #​1131
• Added Index::conflict_get()
  #​1134
• Added Index::conflict_remove()
  #​1133
• Added opts::set_cache_object_limit()
  #​1118
• Added Repo::merge_file_from_index() and associated MergeFileOptions and MergeFileResult.
  #​1062

Changed

• The url dependency minimum raised to 2.5.4
  #​1128
• Changed the tracing callback to abort the process if the callback panics instead of randomly detecting the panic in some other function.
  #​1121
• Credential helper config (loaded with CredentialHelper::config) now checks for helpers that start with something that looks like an absolute path, rather than checking for a / or \ anywhere in the helper string (which resolves an issue if the helper had arguments with / or \).
  #​1137

Fixed

• Fixed panic in Remote::url_bytes if the url is empty.
  #​1120
• Fixed incorrect lifetimes on Patch::delta, Patch::hunk, and Patch::line_in_hunk. The return values must not outlive the Patch.
  #​1141
• Bumped requirement to libgit2-sys 0.18.1, which fixes linking of advapi32 on Windows.
  #​1143

---

Configuration

📅 Schedule: (in timezone Etc/GMT)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock

    Updating crates.io index
error: failed to get `tree-sitter-facade-sg` as a dependency of package `marzano-core v0.2.0 (/tmp/renovate/repos/github/biomejs/gritql/crates/core)`

Caused by:
  failed to load source for dependency `tree-sitter-facade-sg`

Caused by:
  unable to update /tmp/renovate/repos/github/biomejs/gritql/vendor/tree-sitter-facade

Caused by:
  failed to read `/tmp/renovate/repos/github/biomejs/gritql/vendor/tree-sitter-facade/Cargo.toml`

Caused by:
  No such file or directory (os error 2)

File name: Cargo.lock

    Updating crates.io index
error: failed to get `tree-sitter-facade-sg` as a dependency of package `marzano-core v0.2.0 (/tmp/renovate/repos/github/biomejs/gritql/crates/core)`

Caused by:
  failed to load source for dependency `tree-sitter-facade-sg`

Caused by:
  unable to update /tmp/renovate/repos/github/biomejs/gritql/vendor/tree-sitter-facade

Caused by:
  failed to read `/tmp/renovate/repos/github/biomejs/gritql/vendor/tree-sitter-facade/Cargo.toml`

Caused by:
  No such file or directory (os error 2)