From d23d7d4906798ae68c5e246522c126a3dd1f0c3a Mon Sep 17 00:00:00 2001 From: CBL-Mariner Servicing Account Date: Fri, 21 Aug 2026 12:28:06 +0000 Subject: [PATCH] Upgrade libgit2 to 1.8.7 for CVE-2026-53586, CVE-2026-53585, CVE-2026-53587, CVE-2026-53583, CVE-2026-53584 --- SPECS/libgit2/libgit2.signatures.json | 2 +- SPECS/libgit2/libgit2.spec | 5 ++++- cgmanifest.json | 4 ++-- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/SPECS/libgit2/libgit2.signatures.json b/SPECS/libgit2/libgit2.signatures.json index b07d67e623d..6378a673966 100644 --- a/SPECS/libgit2/libgit2.signatures.json +++ b/SPECS/libgit2/libgit2.signatures.json @@ -1,5 +1,5 @@ { "Signatures": { - "libgit2-1.7.2.tar.gz": "de384e29d7efc9330c6cdb126ebf88342b5025d920dcb7c645defad85195ea7f" + "libgit2-1.8.7.tar.gz": "a548a2209c3e99d6bb685d843396fff3a7d3ffd8340adb5d8851637cfe8cd134" } } diff --git a/SPECS/libgit2/libgit2.spec b/SPECS/libgit2/libgit2.spec index 7bfc949eceb..f3c859548eb 100644 --- a/SPECS/libgit2/libgit2.spec +++ b/SPECS/libgit2/libgit2.spec @@ -1,6 +1,6 @@ Summary: C implementation of the Git core methods as a library with a solid API Name: libgit2 -Version: 1.7.2 +Version: 1.8.7 Release: 1%{?dist} License: GPLv2 with exceptions Vendor: Microsoft Corporation @@ -79,6 +79,9 @@ popd %{_bindir}/git2 %changelog +* Fri Aug 21 2026 CBL-Mariner Servicing Account - 1.8.7-1 +- Auto-upgrade to 1.8.7 - for CVE-2026-53586, CVE-2026-53585, CVE-2026-53587, CVE-2026-53583, CVE-2026-53584 + * Thu Feb 15 2024 Yash Panchal - 1.7.2-1 - Update to 1.7.2 diff --git a/cgmanifest.json b/cgmanifest.json index 216b9f8dd27..8489731cef5 100644 --- a/cgmanifest.json +++ b/cgmanifest.json @@ -9791,8 +9791,8 @@ "type": "other", "other": { "name": "libgit2", - "version": "1.7.2", - "downloadUrl": "https://github.com/libgit2/libgit2/archive/v1.7.2/libgit2-1.7.2.tar.gz" + "version": "1.8.7", + "downloadUrl": "https://github.com/libgit2/libgit2/archive/v1.8.7/libgit2-1.8.7.tar.gz" } } },