update packages to git2 v0.21.0 to address two RUSTSEC advisories

decathorpe commented

2026-06-19 11:54:00 +00:00

Owner

There are two recently published RUSTSEC advisories for the git2 crate:

Both are only fixed in versions >=0.21.0.

I'm working on updating rust-git2 to version 0.21.0, but due to the large number of dependent packages, porting everything at the same time is not something I can commit to - so I'm adding a rust-git2_0.20 compat package temporarily. I hope that it will be short-lived and that packages can be ported to v0.21 soon.

The git2 crate usually has very few API changes between major versions, so I hope that this is also the case for v0.20 -> v0.21 (but I have not checked yet).

Affected packages:

envision
nushell
rust-asyncgit
rust-bat
rust-built
rust-cargo
rust-eza
rust-git-delta
rust-git-interactive-rebase-tool
rust-git2-curl
rust-git2-hooks
rust-lsd
rust-pretty-git-prompt
rust-sequoia-git
rust-shadow-rs
rust-tokei
rust-vergen

I assume there are three groups of packages that will each need to be handled together:

bat + git-delta
git2-curl + cargo
git2-hooks + asyncgit (+ gitui)

There are two recently published RUSTSEC advisories for the `git2` crate: - <https://rustsec.org/advisories/RUSTSEC-2026-0183.html> - <https://rustsec.org/advisories/RUSTSEC-2026-0184.html> Both are only fixed in versions `>=0.21.0`. I'm working on updating `rust-git2` to version 0.21.0, but due to the large number of dependent packages, porting everything at the same time is not something I can commit to - so I'm adding a `rust-git2_0.20` compat package temporarily. I hope that it will be short-lived and that packages can be ported to v0.21 soon. The git2 crate usually has very few API changes between major versions, so I hope that this is also the case for v0.20 -> v0.21 (but I have not checked yet). Affected packages: - [ ] envision - [ ] nushell - [ ] rust-asyncgit - [ ] rust-bat - [x] rust-built - [ ] rust-cargo - [x] rust-eza - [ ] rust-git-delta - [ ] rust-git-interactive-rebase-tool - [ ] rust-git2-curl - [x] rust-git2-hooks - [ ] rust-lsd - [ ] rust-pretty-git-prompt - [ ] rust-sequoia-git - [ ] rust-shadow-rs - [x] rust-tokei - [ ] rust-vergen I assume there are three groups of packages that will each need to be handled together: - bat + git-delta - git2-curl + cargo - git2-hooks + asyncgit (+ gitui)

decathorpe added the

coordination

label

2026-06-19 11:54:00 +00:00

music commented

2026-06-19 20:12:37 +00:00

Member

The usage in tokei is trival, just a call to git2::Repository::init() in the tests, so we decided in the past to remove the SemVer upper bound on the dev-dependency because it was almost guaranteed never to break: rust-tokei : crate(git2) >= 0.19.0. We shouldn’t need to touch this package.

The usage in `tokei` is trival, just a call to `git2::Repository::init()` in the tests, so we decided in the past to remove the SemVer upper bound on the dev-dependency because it was almost guaranteed never to break: `rust-tokei : crate(git2) >= 0.19.0`. We shouldn’t need to touch this package.

👍 1

decathorpe added the

rebuild

label

2026-07-14 22:22:41 +00:00

Rows
Columns

update packages to git2 v0.21.0 to address two RUSTSEC advisories #30