fix(deps): update rust crate git2 to 0.20.0 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
git2	dependencies	minor	0.19.0 → 0.20.0

GitHub Vulnerability Alerts

GHSA-j39j-6gw9-jw6h

If the Buf struct is dereferenced immediately after calling new() or default() on the Buf struct, a null pointer is passed to the unsafe function slice::from_raw_parts. According to the safety section documentation of the function, data must be non-null and aligned even for zero-length slices or slices of ZSTs. Thus, passing a null pointer will lead to undefined behavior.

---

Release Notes

rust-lang/git2-rs (git2)

v0.20.4

Compare Source

v0.20.3

Compare Source

v0.20.2

Compare Source

0.20.1...0.20.2

Added

• Added Status::WT_UNREADABLE.
  #​1151

Fixed

• Added missing codes for GIT_EDIRECTORY, GIT_EMERGECONFLICT, GIT_EUNCHANGED, GIT_ENOTSUPPORTED, and GIT_EREADONLY to Error::raw_code.
  #​1153
• Fixed missing initialization in Indexer::new.
  #​1160

v0.20.1

Compare Source

0.20.1...0.20.2

Added

• Added Status::WT_UNREADABLE.
  #​1151

Fixed

• Added missing codes for GIT_EDIRECTORY, GIT_EMERGECONFLICT, GIT_EUNCHANGED, GIT_ENOTSUPPORTED, and GIT_EREADONLY to Error::raw_code.
  #​1153
• Fixed missing initialization in Indexer::new.
  #​1160

v0.20.0

Compare Source

0.20.0...0.20.1

Added

• Added Repository::branch_upstream_merge()
  #​1131
• Added Index::conflict_get()
  #​1134
• Added Index::conflict_remove()
  #​1133
• Added opts::set_cache_object_limit()
  #​1118
• Added Repo::merge_file_from_index() and associated MergeFileOptions and MergeFileResult.
  #​1062

Changed

• The url dependency minimum raised to 2.5.4
  #​1128
• Changed the tracing callback to abort the process if the callback panics instead of randomly detecting the panic in some other function.
  #​1121
• Credential helper config (loaded with CredentialHelper::config) now checks for helpers that start with something that looks like an absolute path, rather than checking for a / or \ anywhere in the helper string (which resolves an issue if the helper had arguments with / or \).
  #​1137

Fixed

• Fixed panic in Remote::url_bytes if the url is empty.
  #​1120
• Fixed incorrect lifetimes on Patch::delta, Patch::hunk, and Patch::line_in_hunk. The return values must not outlive the Patch.
  #​1141
• Bumped requirement to libgit2-sys 0.18.1, which fixes linking of advapi32 on Windows.
  #​1143

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Coverage after merging renovate/crate-git2-vulnerability into main will be

92.20%

Coverage Report

File	Stmts	Branches	Funcs	Lines	Uncovered Lines
engine.rs	92.86%	85.71%	100%	93.01%	100, 103, 109–111, 127, 58–59, 88–89, 92, 99
parser.rs	82.80%	83.33%	88.89%	81.98%	109, 155–158, 182–186, 210, 214–217, 245, 247–251, 279, 283, 296–300, 309–312, 322, 324–330, 334–335
testing.rs	100%	100%	100%	100%
bin
if-changed.rs	100%	100%	100%	100%
engine
git.rs	94.95%	65%	96.55%	97.18%	168–169, 176–177, 179–180, 193, 195