Dulwich Files

Make concurrent Pack.get_raw calls thread-safe by synchronizing PackData's resolved-object offset cache. (Bojan Zivanovic)

Speed up cached PackData.get_object_at lookups by acquiring the offset-cache lock directly instead of through a with statement. (Bojan Zivanovic)

Bound fetch negotiation the way C Git's MAX_IN_VAIN does: give up after 256 unacknowledged "have" lines instead of draining the whole graph walker into stateless (HTTP) requests. (Bojan Zivanovic, [#2343])

Add repo.sanitize_user_identity, which builds an identity from a name and an email sanitized the way git's fmt_ident does, for callers who cannot reject invalid input via check_user_identity. (Bojan Zivanovic, [#2342])

Make concurrent PackData reads thread-safe by mmap-ing pack contents and indexing the mapping at explicit offsets instead of sharing the file position. New unpack_object_at, read_pack_header_at, read_zlib_chunks_at, take_msb_bytes_at and compute_buffer_sha read from a buffer; the existing read-callable variants remain for streams. (Bojan Zivanovic, Jelmer Vernooij)

Deduplicate the commit walk in find_shallow and get_depth (dulwich.object_store). Both re-expanded a commit once per path that reached it, so a merge-heavy history walked in exponential time. (netliomax25-code)

SECURITY: Don't follow symlinks when writing messages in porcelain.format_patch, mbox.split_mbox and mbox.split_maildir. A symlink pre-planted at an output filename was followed, writing the message outside the output directory. (Jelmer Vernooij; Reported by wzc)

Only reject reserved Windows device names (aux, nul, con, ...) when actually running on Windows. C git confines this check to its Windows compat layer, so repositories carrying such paths could not be cloned elsewhere. (Jelmer Vernooij, [#2351])

Fix ignore and attrs matching for patterns ending in **/. The trailing slash was dropped when translating the pattern, so foo/**/ also matched foo/ itself and every file directly inside it. Git only ignores the directories below foo. (adarshsm)

Catch PackFileDisappeared in the bitmap probe in get_reachability_provider, which only guarded FileNotFoundError. (Jelmer Vernooij, [#2344])

SECURITY: Widen modes for core.sharedRepository as git does rather than chmodding to a precomputed one, which left .git/hooks and .git/refs world-writable for all. (netliomax25-code, Jelmer Vernooij, [#2323])

parse_shared_repository now returns a SharedPerm, and DiskObjectStore, Index and GitFile take a shared_perm argument in place of file_mode/dir_mode. (Jelmer Vernooij)

Fix commit-graph extra edge indexing: the stored value is a position in a list of 4-byte entries, not a byte offset, so every octopus merge after the first got a wrong parent list. (netliomax25-code)

Refresh the mtime of an existing loose object in DiskObjectStore.add_object(), so that a concurrent git gc cannot prune an object that was just reported as present. (Bojan Zivanovic, [#2340])

HARDEN: Validate shallow object ids received from the remote. (netliomax25-code)

SECURITY: Refuse patch targets addressing the .git control directory. apply_patches (via porcelain.am/apply_patch) previously wrote and ran .git/hooks/pre-commit. (Jelmer Vernooij, reported by @bhaswanthc)

Extend the verify_leading_dirs symlink guard to update_working_tree (used by pull, merge and checkout). The 1.2.12 fix only covered build_index_from_tree, so a tree pairing a symlink x with a descendant x/config could still write through the link and overwrite .git/config on pull. (Jelmer Vernooij, reported by Hugh Lewis)

Translate .gitignore/.gitattributes bracket expressions with Git's wildmatch() semantics: [^...] negation, POSIX classes, backslash escapes and malformed-class handling. ignore and attrs now share one translator, the new public dulwich.wildmatch. (Vincent Gao, [#2326])

Always single-quote the repository path in the SSH command, matching git's sq_quote(). shlex.quote left paths without shell metacharacters bare, which broke cloning from servers that parse the command themselves rather than handing it to a shell, such as Bitbucket Server. (Jelmer Vernooij, [#2319])