devel/py-dulwich 1.2.14 NetBSD

1.2.17 2026-10-03 * Define ``__all__`` in all modules, listing the public names each module defines. (Jelmer Vernooij) * Deprecate importing ``LOCAL_TAG_PREFIX``, ``SYMREF``, ``check_ref_format``, ``read_packed_refs``, ``read_packed_refs_with_peeled`` and ``write_packed_refs`` from ``dulwich.repo``; import them from ``dulwich.refs`` instead. Likewise ``BundleList``, ``fetch_bundle_uri`` and ``parse_bundle_list`` should be imported from ``dulwich.bundle_uri`` rather than ``dulwich.client``. (Jelmer Vernooij) * Restore ``dulwich.index.SHA1Reader`` and ``dulwich.index.SHA1Writer``, which were dropped in 1.2.16, as deprecated aliases for the classes in ``dulwich.pack``. (Jelmer Vernooij) * Refuse to write a loose ref through a symref whose target escapes the …

1.2.15 2026-09-14 * Detect delta cycles in ``Pack.resolve_object``: a crafted pack with REF_DELTA objects that name each other sent ``get_raw`` into an unbounded loop. Such chains now raise ``DeltaCycle``. * Fix ``porcelain.clean`` when the target directory and the repository path are spelled differently, such as via a relative path or a symlink. (Jelmer Vernooij) * Memoize tag peeling on the object store, so refs sharing an annotated tag chain no longer re-walk it once per ref. ``show_ref --dereference`` and the ref advertisement were quadratic. * Give a ``.gitignore`` in a subdirectory precedence over one closer to the root, matching git. A negation in a deeper file no longer loses to a rule at the root, and a nested negation no longer re-includes a path whose …

1.2.14 2026-08-28 * Collapse consecutive `**` segments in wildmatch translation, matching git's behavior and avoiding catastrophic regex backtracking on patterns like `a/**/**/**/z` from untrusted repositories. (netliomax25-code) 1.2.13 2026-08-24 * Make concurrent ``Pack.get_raw`` calls thread-safe by synchronizing ``PackData``'s resolved-object offset cache. (Bojan Zivanovic) * Speed up cached `PackData.get_object_at` lookups by acquiring the offset-cache lock directly instead of through a `with` statement. (Bojan Zivanovic) * Bound fetch negotiation the way C Git's ``MAX_IN_VAIN`` does: give up after 256 unacknowledged "have" lines instead of draining the whole graph walker into stateless (HTTP) requests. …

1.2.12 2026-07-19 * Fix ``Bundle.store_objects()`` silently dropping every OFS_DELTA/REF_DELTA object in the bundle's pack instead of resolving it, leaving the target object store missing most objects with no error raised. Delta resolution now goes through ``PackInflater``, matching how packs are ingested elsewhere in the object store code. * SECURITY: Refuse to write a checkout entry whose leading path resolves through a symlink. ``build_index_from_tree`` (used by ``reset_index`` and thus by ``clone``/``checkout``) materialized a tree in sorted order without checking leading components, so a tree pairing a symlink ``link`` with a descendant ``link/foo`` wrote ``foo`` through the link to an arbitrary …

1.2.11 2026-07-16 * Let porcelain functions that consult the environment take an ``env`` argument overriding ``os.environ``. As a side effect ``tag_create`` now honours ``GIT_COMMITTER_NAME``/``GIT_COMMITTER_EMAIL`` for the tagger line and ``merge``/``revert`` honour ``GIT_AUTHOR_NAME``/``GIT_AUTHOR_EMAIL``, matching git. (Jelmer Vernooij) * Honour the ``core.worktree`` configuration option, so the working tree can live somewhere other than the parent of the control directory. Relative paths are resolved against the control directory, and ``core.bare`` and ``core.worktree`` are now rejected as incompatible. (Jelmer Vernooij) * Clear ``core.bare`` when setting up a submodule's working tree. ``submodule_update`` cloned the submodule bare and then set …