Repository navigation
Merge Git for Windows v2.56.0(4) - #1017
Merged
Merged
Conversation
We haven't been on Gitter in quite a while. Let's remove the misleading badge. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Apparently the badge URL has changed at some stage. I must have missed this, and I do not regularly look at that badge. But when I did, I saw that it says "failing" even though the CI runs were successful (I checked, after re-enabling Actions in git-for-windows/git that GitHub so helpfully "disabled [...] on this forked repository because of its Actions usage"). So I followed the guidance (or more correctly: **tried* to follow) at https://docs.github.com/en/actions/how-tos/monitor-workflows/add-a-status-badge, which kind of worked after not finding the promised `⋯` menu but realizing that there was a section on how to manually construct the URL. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
The linux32 job is used to exercise Git on a 32 bit platform. That job uses i386/ubuntu:20.04 though, and that version of Ubuntu is end of life nowadays. Furthermore, Ubuntu 20.04 is the last release that has support for 32 bit, so we cannot upgrade the image to a later version, either. Switch the job over to use i386/debian instead. Note that starting with Debian 13, support for i386 has been reduced [1]. But Debian still releases 32 bit Docker images for the latest release nowadays, so we will have coverage until at least 2030. [1]: https://www.debian.org/releases/trixie/release-notes/issues.en.html#i386-reduced-support Backported from a8dc3aa (ci: switch away from unsupported i386/ubuntu image, 2026-10-15). Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Since 00fa850 (ci: bump debian-11 job to debian-12, 2026-09-05), the `debian-12` job has intermittently failed t5559's half-auth clone with: curl 92 Stream error in the HTTP/2 framing layer Anonymous discovery succeeds, but the upload-pack POST requires authentication. Apache can return an early 401 and close the HTTP/2 stream before libcurl finishes sending the request body. Debian 12's curl 7.88.1 treats that closure as a transport error instead of allowing an authentication retry. Curl fixed this handling in 331b89a319d0 (http2: polish things around POST), included in 8.3.0: curl/curl#11756 This did not happen before switching to Debian 12 because Debian 11 ships with libcurl 7.74.0-1.3+deb11u16, which does not have that bug, it was only introduced in cURL 7.88.0. Replacing the packaged libcurl with a modern build would defeat this job's purpose of testing older supported distributions. So let's simply skip the flaky test cases when a buggy libcurl version is detected. Backported from 64172cf (ci: work around Debian 12's HTTP/2 authentication failures, 2026-09-24) with e2d64bd (t5551: fix quoting in curl version bug prereq, 2026-10-05) squashed in. Assisted-by: GPT-6 Astra, GPT-6 Sol Helped-by: Jeff King <peff@peff.net> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
When replacing `dirname`, elevation is required, otherwise the command will fail with: + ln -sfT /usr/bin/gnudirname /usr/bin/dirname ln: failed to create symbolic link '/usr/bin/dirname': Already exists as observed in https://github.com/git-for-windows/git/actions/runs/40223871341/job/121274294974?pr=6473#step:3:909 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
The linux32 job fails DNS resolution before checkout because Docker 29.4.2's seccomp profile on Ubuntu 26.04 blocks socketcall in i386 glibc containers. Ubuntu 24.04 avoids this host-side regression. actions/runner-images#14790 Assisted-by: GPT-6.1 Sol Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Git for Windows v2.56.0(4) Changes since Git for Windows v2.56.0(3) (October 22nd 2026) This is another urgent security bug fix release, addressing CVE-2026-111497. Bug Fixes * The executables included in the 32-bit MinGit had corrupt code-signatures, which has been fixed. * Upgrades the included brotli component to v1.2.1 to address CVE-2026-111497. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Matthew John Cheetham (mjcheetham)
approved these changes
Oct 26, 2026
Johannes Schindelin (dscho)
merged commit Oct 26, 2026
c91b11b
into
vfs-2.56.0
236 of 237 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This version addresses CVE-2026-111497 by upgrading brotli to v1.2.1.