chore(deps): update rust crate git2 to v0.20.4 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
git2	dependencies	patch	0.20.2 → 0.20.4

---

git2 has potential undefined behavior when dereferencing Buf struct

GHSA-j39j-6gw9-jw6h

More information

Details

If the Buf struct is dereferenced immediately after calling new() or default() on the Buf struct, a null pointer is passed to the unsafe function slice::from_raw_parts. According to the safety section documentation of the function, data must be non-null and aligned even for zero-length slices or slices of ZSTs. Thus, passing a null pointer will lead to undefined behavior.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://github.com/rust-lang/git2-rs/issues/1211
• https://github.com/rust-lang/git2-rs/pull/1213
• https://github.com/rust-lang/git2-rs/commit/9e160f15bd056f82143109bb330573381e5de719
• https://rustsec.org/advisories/RUSTSEC-2026-0008.html
• https://github.com/advisories/GHSA-j39j-6gw9-jw6h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

rust-lang/git2-rs (git2)

v0.20.4

Compare Source

0.20.4...main

Added

• Added experimental SHA256 repository support behind the new unstable-sha256 Cargo feature,
  along with *_ext API variants that accept an ObjectFormat.
  #​1206
• Added opts::set_cache_max_size() and opts::get_cached_memory().
  #​1188
• Added Repository::object_format() and a new ObjectFormat enum.
  #​1204
• Added Repository::set_config().
  #​1208
• Added merge_file() along with MergeFileInput.
  #​1210
• Added Repository::refdb_compress() for packing loose refs.
  #​1221
• Added public Refdb type, along with Repository::refdb() and Repository::set_refdb(). Repository::refdb_compress() now delegates to Refdb::compress().
  #​1228
• Added Revspec::into_objects().
  #​1230
• Added BlameHunk::final_committer(), BlameHunk::orig_committer(), BlameHunk::summary(), and BlameHunk::summary_bytes().
  #​1231
• Implemented Clone for Reference.
  #​1233
• Added Repository::author_from_env() and Repository::committer_from_env().
  #​1237
• Added impl From<Utf8Error> for Error.
  #​1239

Changed

• ❗ The ssh, https, and cred Cargo features are no longer enabled by default.
  Previously default = ["ssh", "https"]; now default = [].
  Enable them explicitly if you rely on credential helpers or transport support.
  #​1168
• ❗ CredentialHelper and the url dependency are now gated behind the new cred Cargo feature.
  Enabling ssh or https transitively enables cred.
  #​1168
• ❗ Updated to the 2021 edition.
  #​1173
• ❗ Many string accessors that previously returned Option<&str>
  now return Result<&str, Error> or Result<Option<&str>, Error>,
  so callers can distinguish a missing value from a non-UTF-8 one.
  #​1241
• ❗ BlameHunk::final_signature, BlameHunk::final_committer, BlameHunk::orig_signature, and BlameHunk::orig_committer
  now return Option to avoid segfaults when signature information is missing.
  #​1254
• Bumped requirement to libgit2-sys 0.18.4, which updates libgit2 to 1.9.3.
  #​1242

Fixed

• Fixed MergeOptions::skip_reuc() to use the correct GIT_MERGE_SKIP_REUC flag.
  #​1194
• Repository::submodules() now returns an Error when the underlying git_submodule_lookup() call to libgit2 fails, rather than panicking with a failed assertion.
  #​1220
• Reference::is_valid_name() now propagates errors from CString conversion instead of panicking.
  #​1229
• Fixed Remote::list() to return an empty list instead of erroring
  when the remote advertises no refs.
  #​1250
• ReferenceNames now returns an Err for non-UTF-8 branch names instead of panicking.
  #​1239

Documentation

• Added note regarding potentially confusing behavior of git_checkout_head.
  #​1149
• Added comments describing the IndexAddOption flags.
  #​1163
• Updated README note about the ssh feature.
  #​1187
• Improved function docs for Repository::tag_foreach().
  #​1190
• Fixed doc comment typo in StatusOptions.
  #​1199
• Fixed missing period in module documentation.
  #​1219
• Small wording fix in Signature::from_raw_const() docs.
  #​1222
• Replaced discussion of missing gist in README.
  #​1223
• Documented the bitflag methods for checking flags.
  #​1224
• Clarified CheckoutBuilder::update_index() documentation.
  #​1232
• Added more missing documentation.
  #​1235
• Fixed typo in Repository::stash_save_ext() docs.
  #​1245
• Added example showing retrieval of the latest commit for a file.
  #​1243
• Replaced comma with period in CheckoutBuilder::refresh() docs.
  #​1252

Internals

• Dropped civet/conduit from dev-dependencies.
  #​1170
• Updated dependencies.
  #​1171
• Fixed lockfile verification in CI.
  #​1177
• Updated CI and documentation to cover feature combinations.
  #​1182
• Listed all examples that may need HTTP and SSH.
  #​1196
• Allowed publishing from any ref in the publish workflow.
  #​1198
• Bumped time from 0.3.41 to 0.3.47.
  #​1215
• Added end-to-end test for branch name on initialization.
  #​1244
• Added end-to-end test for stash count.
  #​1246
• Added end-to-end tests demonstrating use of Repository::statuses().
  #​1251
• Internal refactors preparing for experimental SHA256 OID support.
  #​1201
  #​1205

v0.20.3

Compare Source

0.20.3...0.20.4

Fixed

• Fix undefined behavior when dereferencing empty Buf.
  #​1213

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.