Bump dulwich from 1.2.7 to 1.2.10

[dependabot]

Bumps dulwich from 1.2.7 to 1.2.10.

Release notes

Sourced from dulwich's releases.

dulwich-1.2.10

• Fix regression in 1.2.9 where loose objects whose content inflates to more than 8192 bytes failed to parse with `zlib.error: object header exceeds maximum size`. (Jelmer Vernooij, #2292)

dulwich-1.2.9

Highlights of this release:

Security fixes

• Reject checkout paths whose leading component is a DOS drive-letter prefix on Windows (e.g. C:), which os.path.join would otherwise treat as absolute and let a crafted tree write outside the work tree. (reported by Luke Baton)
• Bound zlib decompression of pack entries and loose objects against decompression-bomb DoS. read_zlib_chunks now caps the inflated size at the declared decomp_len, and loose-object parsing accepts max_size defaulting to git's core.bigFileThreshold (512 MiB). (reported by Luke Bento)
• Reject OFS_DELTA pack entries whose delta_base_offset is zero. Such an entry references itself, so Pack.resolve_object would loop forever growing its delta stack until OOM. (reported by Luke Banto)
• Bound Transfer-Encoding: chunked request bodies in dulwich.web: strip chunk extensions, reject negative sizes, enforce per-chunk and per-request size limits, and cap requests that omit Content-Length.
• Bound the running length when decoding EWAH bitmaps so a corrupt or malformed .bitmap index raises ValueError instead of hanging in an unbounded loop that exhausts memory.

Other changes

• web: Reject smart HTTP git-upload-pack / git-receive-pack POSTs whose Content-Type is not the exact application/x-<service>-request value, matching git http-backend.
• dulwich.web: Warn at startup that running python3 -m dulwich.web is not intended as a production web server (no authentication, etc.).

See NEWS for the full list.

dulwich-1.2.8

Security

• GHSA-8w8g-wq8h-fq33: Write files through build_file_from_blob in path-restricted porcelain.checkout(paths=...) instead of a raw os.open. The old path followed a symlink left at the target, so a crafted repository could write attacker content outside the work tree (e.g. into .git/hooks) on checkout.
• GHSA-5fqc-mrg8-w798: Build the temporary index for filter-branch --index-filter in memory instead of materializing tree entries into CWD. Persisted entries between commits let a symlink from an ancestor commit redirect a descendant's writes outside the work tree.
• Refuse to write a stash entry through an intermediate symlink on stash.pop. The old os.path.exists check followed symlinks, so a crafted stash whose parent path was a symlink already present in the worktree (e.g. link -> .git/hooks) let the subsequent write land outside the work tree.
• Refuse path-restricted porcelain.checkout, restore and reset_file writes whose leading directory is an existing symlink, so a crafted repository can no longer land sub as a link to .git/hooks and have a write to sub/anything traverse it.
• Canonicalize file modes to 0o644/0o755 before chmod on checkout and patch apply, matching git. An untrusted tree entry or patch `new file mode` could otherwise set setuid/setgid/sticky or world-writable bits on a materialized file.
• Reject non-hex pkt-line length prefixes in the protocol parser. int(sizestr, 16) accepted a leading -, whose negative length made the following `read(size - 4)` slurp the rest of the stream and caused `PktLineParser` to loop without consuming its buffer. (#2267)
• Escape the repository path passed to the remote in the SSH client, so a path containing a single quote can no longer close the quoting and have the remainder interpreted by the remote shell. (#2254)
• Reject an option-like host in TCPGitClient before invoking the core.gitProxy command, matching the SubprocessSSHVendor guard, so a URL like `git://-oProxyCommand=...` can no longer be interpreted as a flag by the proxy program. (#2240)
• Validate object ids in the object store and refs container. An id containing path separators would previously be joined into a filename by `DiskObjectStore._get_shafile_path` (escaping the objects directory) or stored as a ref value. (#2256)
• Validate the object id in LFS server request handlers before it reaches the store, so a request path containing .. cannot escape the LFS directory. (#2255)
• Don't expand config include/includeIf directives when parsing bundle lists served by an untrusted bundle-uri host, matching the handling of `.gitmodules`. (#2243)
• Read the signing key from gpg's --status-fd (VALIDSIG) in `GPGCliSignatureVendor.verify` instead of the human-readable stderr text, which could be spoofed by embedding a matching line in the signed payload. (#2245)
• Raise UntrustedSignature from verify_commit/verify_tag when keyids is set and the object carries no signature, instead of silently accepting it. (#2238)
• Fix quadratic backtracking in _find_scissors_line so a crafted patch can no longer stall mailinfo/git am --scissors. (#2239)
• Collapse consecutive * wildcards to at most ** in .gitattributes, .gitignore and config glob translation to avoid catastrophic backtracking (ReDoS). (#2237)
• Fix quadratic buffering in web.ChunkReader.read. (#2262)
• Skip invalid tree paths (containing .., .git, etc.) in `diff_working_tree_to_tree` instead of joining them onto the work tree; a working-tree diff against an untrusted commit could otherwise read a file outside the work tree and disclose its contents. (#2261)
• Fix quadratic header accumulation in ShaFile._parse_message. (#2273)

Fixes

• Enumerate the objects to push before the HTTP git-receive-pack request body starts streaming. `generate_pack_data` previously ran lazily inside the body generator, after the header pkt-lines were already on the wire, so on large repositories the request stalled mid-body while objects were counted and servers such as GitHub aborted the push with a timeout / broken pipe. (#2248)
• Replace a symlink left at the target path with a fresh regular file in build_file_from_blob instead of writing through it, matching git on checkout. (#2259)
• Raise GitProtocolError carrying the server's message when the fetch/send-pack tail loop sees a fatal side-band channel (\x03), instead of crashing with `AssertionError: Invalid sideband channel 3` and swallowing the server's error text.

... (truncated)

Changelog

Sourced from dulwich's changelog.

1.2.10 2026-07-07

• Fix regression in 1.2.9 where loose objects whose content inflates to more than 8192 bytes failed to parse with zlib.error: object header exceeds maximum size. (Jelmer Vernooij, #2292)

1.2.9 2026-07-06

• Bound the running length when decoding EWAH bitmaps, so a corrupt or malformed .bitmap index raises ValueError instead of hanging in an unbounded loop that exhausts memory. (Jelmer Vernooij)

• web: Reject smart HTTP git-upload-pack / git-receive-pack POSTs whose Content-Type is not the exact application/x-<service>-request value, matching git http-backend. Real git clients (and dulwich's own client) already send this header, so there is no interop cost; the check is defense in depth against cross-origin POSTs for deployments that wrap dulwich.web in a cookie-based auth layer.

• SECURITY: On Windows, reject checkout paths whose leading component is a DOS drive-letter prefix like C:. os.path.join(root, "C:...") discards root and writes to the absolute drive path, so a tree entry named C: could otherwise write arbitrary files outside the work tree. (reported by Luke Baton, Jelmer Vernooij)

• SECURITY: Bound zlib decompression of pack entries and loose objects against decompression-bomb DoS. read_zlib_chunks now caps the inflated size at the declared decomp_len, and loose-object parsing (ShaFile.from_file/from_path) accepts a max_size argument defaulting to Git's core.bigFileThreshold (512 MiB). The disk object store reads core.bigFileThreshold from config and enforces it on _get_loose_object. (reported by Luke Bento, Jelmer Vernooij)

• SECURITY: Reject OFS_DELTA pack entries whose delta_base_offset is zero. Such an entry references itself, so Pack.resolve_object would loop forever growing its delta stack until the process ran out of memory. unpack_object now raises ApplyDeltaError at parse time, matching git's delta offset == 0 is invalid guard. (reported by Luke Banto, Jelmer Vernooij)

• dulwich.web: Warn at startup that running python3 -m dulwich.web is not meant to provide a production web server. It does not support authentication, for example. (Jelmer Vernooij)

• SECURITY: Bound Transfer-Encoding: chunked request bodies in dulwich.web. _chunk_iter now strips chunk extensions, rejects negative sizes, and enforces per-chunk and per-request size limits; LimitedInputFilter also caps requests that omit Content-Length. (Jelmer Vernooij)

... (truncated)

Commits

• 9c45439 Release 1.2.10
• 6100e4e Fix regression parsing loose objects that inflate past 8KB (#2293)
• f489f7d Fix regression parsing loose objects that inflate past 8KB
• c93ab9b Release 1.2.9
• 3526b18 Fix resource warnings (#2291)
• 8bbb5e8 Fix Windows tempdir cleanup in pack index writing tests
• 2c9f698 Stop tests from writing to stdout
• e5f79c9 Fix resource warnings
• 7c94365 Fix more fallout from running tests in parallel (#2290)
• d70c70b Add overrideHome test helper; use in maintenance tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Coverage Report

File	Stmts	Miss	Branch	BrPart	Cover	Missing
src/dm_mac
__init__.py	75	0	6	0	100%
cli_utils.py	15	0	0	0	100%
neon_fob_adder.py	232	15	60	5	93%	78->79, 79, 116–117, 124, 208->205, 269->270, 270, 333–334, 341, 364–367, 440->445, 454–456, 551->549
neongetter.py	211	1	54	3	99%	308->309, 309, 412->416, 492->494
slack_handler.py	220	0	56	0	100%
utils.py	25	0	4	0	100%
webhook.py	62	0	10	0	100%
src/dm_mac/models
__init__.py	0	0	0	0	100%
api_schemas.py	49	0	0	0	100%
machine.py	648	15	216	16	97%	670->671, 671, 677->exit, 750->751, 751, 799->801, 1110->1111, 1111–1113, 1176->1178, 1228->1229, 1229–1238, 1401->exit
users.py	103	0	32	0	100%
src/dm_mac/views
__init__.py	0	0	0	0	100%
api.py	41	0	0	0	100%
machine.py	103	0	12	0	100%
prometheus.py	132	0	12	1	100%	67->69
TOTAL	1916	31	462	25	98%

Tests	Skipped	Failures	Errors	Time
348	0 💤	0 ❌	0 🔥	26.328s ⏱️