[Buildroot] [PATCH 1/1] package/libgit2: security bump version to 1.9.6

[Buildroot] [PATCH 1/1] package/libgit2: security bump version to 1.9.6

[Nicolas Cavallari]

v1.9.5 fixes CVE-2026-53586, CVE-2026-53587, CVE-2026-53585,
CVE-2026-53584, CVE-2026-53583.  v1.9.6 fixes other non-security issues.

Release notes:
https://github.com/libgit2/libgit2/releases/tag/v1.9.5
https://github.com/libgit2/libgit2/releases/tag/v1.9.6

v1.9.5 also replaces a bundled vulnerable libpcre with libpcre2 and
updated the PCRE license in COPYING as a result.  This is mostly useful
on Windows; On POSIX systems, libgit2 can use regcomp() and Buildroot
already asks for it.

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
---
 package/libgit2/libgit2.hash | 4 ++--
 package/libgit2/libgit2.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/libgit2/libgit2.hash b/package/libgit2/libgit2.hash
index f30f0c528c..38486c4e4d 100644
--- a/package/libgit2/libgit2.hash
+++ b/package/libgit2/libgit2.hash
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  824b73bd13647800fe4b566a1008ae77fea0e3e3424edab632fcfd8c0b14ba8b  libgit2-1.9.4.tar.gz
-sha256  e3712465634e97cfd850822a4eb5ac7d2f8a10f753189366d5a2060046f28288  COPYING
+sha256  a88a42a4ea9bdab7aa8686eead3bf7d9c6dd74529caca16ab22eaa92433d31d9  libgit2-1.9.6.tar.gz
+sha256  e0938121c0554985fe17196ac38fc590d149268e9c46e0c0e7a2eae1354fae71  COPYING
diff --git a/package/libgit2/libgit2.mk b/package/libgit2/libgit2.mk
index 5f18be9550..b4d9984540 100644
--- a/package/libgit2/libgit2.mk
+++ b/package/libgit2/libgit2.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBGIT2_VERSION = 1.9.4
+LIBGIT2_VERSION = 1.9.6
 LIBGIT2_SITE = $(call github,libgit2,libgit2,v$(LIBGIT2_VERSION))
 LIBGIT2_LICENSE = \
 	GPL-2.0 with linking exception, \
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/libgit2: security bump version to 1.9.6

[Julien Olivain via buildroot]

On 10/08/2026 10:43, Nicolas Cavallari wrote:
> v1.9.5 fixes CVE-2026-53586, CVE-2026-53587, CVE-2026-53585,
> CVE-2026-53584, CVE-2026-53583.  v1.9.6 fixes other non-security 
> issues.
> 
> Release notes:
> https://github.com/libgit2/libgit2/releases/tag/v1.9.5
> https://github.com/libgit2/libgit2/releases/tag/v1.9.6
> 
> v1.9.5 also replaces a bundled vulnerable libpcre with libpcre2 and
> updated the PCRE license in COPYING as a result.  This is mostly useful
> on Windows; On POSIX systems, libgit2 can use regcomp() and Buildroot
> already asks for it.
> 
> Signed-off-by: Nicolas Cavallari 
> <nicolas.cavallari@green-communications.fr>

Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/libgit2: security bump version to 1.9.6

[Titouan Christophe via buildroot]

On 10/08/26 10:43, Nicolas Cavallari wrote:
> v1.9.5 fixes CVE-2026-53586, CVE-2026-53587, CVE-2026-53585,
> CVE-2026-53584, CVE-2026-53583.  v1.9.6 fixes other non-security issues.
>
> Release notes:
> https://github.com/libgit2/libgit2/releases/tag/v1.9.5
> https://github.com/libgit2/libgit2/releases/tag/v1.9.6
>
> v1.9.5 also replaces a bundled vulnerable libpcre with libpcre2 and
> updated the PCRE license in COPYING as a result.  This is mostly useful
> on Windows; On POSIX systems, libgit2 can use regcomp() and Buildroot
> already asks for it.
>
> Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>

Applied to 2025.02.x and 2026.05.x, thanks !

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot