chore(deps): update rust crate libgit2-sys to v0.16.2 [security]

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
libgit2-sys	workspace.dependencies	patch	0.16.1+1.7.1 -> 0.16.2

GitHub Vulnerability Alerts

GHSA-22q8-ghmq-63vf

The libgit2 project fixed three security issues in the 1.7.2 release. These issues are:

• The git_revparse_single function can potentially enter an infinite loop on a well-crafted input, potentially causing a Denial of Service. This function is exposed in the git2 crate via the Repository::revparse_single method.
• The git_index_add function may cause heap corruption and possibly lead to arbitrary code execution. This function is exposed in the git2 crate via the Index::add method.
• The smart transport negotiation may experience an out-of-bounds read when a remote server did not advertise capabilities.

The libgit2-sys crate bundles libgit2, or optionally links to a system libgit2 library. In either case, versions of the libgit2 library less than 1.7.2 are vulnerable. The 0.16.2 release of libgit2-sys bundles the fixed version of 1.7.2, and requires a system libgit2 version of at least 1.7.2.

It is recommended that all users upgrade.

---

Release Notes

rust-lang/git2-rs (libgit2-sys)

v0.16.2

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 601ddb6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[sourcery-ai]

PR Type: Enhancement

PR Summary: This pull request addresses critical security vulnerabilities in the libgit2-sys crate by updating it from version 0.16.1+1.7.1 to 0.16.2+1.7.2. The update includes fixes for issues that could potentially lead to Denial of Service, heap corruption, arbitrary code execution, and out-of-bounds read vulnerabilities. It ensures that the libgit2-sys crate now bundles or links to the secure version of the libgit2 library, version 1.7.2, mitigating the risks associated with the previously vulnerable versions.

Decision: Comment

📝 Type: 'Enhancement' - not supported yet.

• Sourcery currently only approves 'Typo fix' PRs.

✅ Issue addressed: this change correctly addresses the issue or implements the desired feature.

No details provided.

📝 Complexity: the changes are too large or complex for Sourcery to approve.

• Unsupported files: the diff contains files that Sourcery does not currently support during reviews.

General suggestions:

• Ensure thorough testing of the updated libgit2-sys crate in the context of your application to verify that the security fixes do not introduce any regressions or compatibility issues.
• Consider setting up automated dependency update tools, if not already in place, to promptly address future security vulnerabilities.
• Review the detailed release notes and vulnerability descriptions to understand the impact of the changes and any potential action required beyond the version update.

Thanks for using Sourcery. We offer it for free for open source projects and would be very grateful if you could help us grow. If you like it, would you consider sharing Sourcery on your favourite social media? ✨

Share Sourcery

• X
• Mastodon
• LinkedIn
• Facebook

---

Help me be more useful! Please click 👍 or 👎 on each comment to tell me if it was helpful.