Log message:
git: updated to 2.49.0

Git v2.49 Release Notes
=======================

UI, Workflows & Features
------------------------

* Completion script updates for zsh

* "git pack-objects" and its wrapper "git repack" learned an \ 
option
  to use an alternative path-hash function to improve delta-base
  selection to produce a packfile with deeper history than window
  size.

* "git gc" learned the "--expire-to" option and passes it down to
  underlying "git repack".

* "[help] autocorrect = 1" used to be a way to say "please wait for
  0.1 second after suggesting a typofix of the command name before
  running that command"; now it means "yes, if there is a plausible
  typofix for the command name, please run it immediately".

* "git clone" learned to make a shallow clone for a single commit
  that is not necessarily be at the tip of any branch.

* Lazy-loading missing files in a blobless clone on demand is costly
  as it tends to be one-blob-at-a-time.  "git backfill" is introduced
  to help bulk-download necessary files beforehand.

* "git push --atomic --porcelain" used to ignore failures from the
  other side, losing the error status from the child process, which
  has been corrected.

* "git rev-list --missing=" learned to accept "print-info" \ 
that gives
  known details expected of the missing objects, like path and type.

* Comes with an updated "gitk".

* The documentation of "git commit" and "git rebase" now refer to
  commit titles as such, not "subject".

* The value of "uname -s" is by default sent over the wire as a part
  of the "version" capability.

* "git refs migrate" can optionally be told not to migrate the reflog.

* The netrc support (via the cURL library) for the HTTP transport has
  been re-enabled.

* Removal of ".git/branches" and ".git/remotes" support in the
  BreakingChanges document has been further clarified.

* What happens to submodules during merge has been documented in a
  bit more detail.

Performance, Internal Implementation, Development Support etc.
--------------------------------------------------------------

* More -Wsign-compare fixes.

* meson-based build now supports the unsafe-sha1 build knob.

* The meson-based build procedure covers contrib/ and other places as
  well.

* The code to check LSan results has been simplified and made more
  robust.
  (merge 164a2516eb jk/lsan-race-ignore-false-positive later to maint).

* More code paths have a repository passed through the callchain,
  instead of assuming the primary the_repository object.

* Move a few more unit tests to the clar test framework.

* Introduce a new API to visit objects in batches based on a common
  path, or by type.

* Following the procedure we established to introduce breaking
  changes for Git 3.0, allow an early opt-in for removing support of
  $GIT_DIR/branches/ and $GIT_DIR/remotes/ directories to configure
  remotes.

* The code paths to interact with zlib has been cleaned up in
  preparation for building with zlib-ng.

* Foreign language interface for Rust into our code base has been added.

* All the documentation .txt files have been renamed to .adoc to help
  content aware editors.

* "git difftool" code clean-up.

* Rename processing in the recursive merge backend has seen a micro
  optimization.

* The path.[ch] API takes an explicit repository parameter passed
  throughout the callchain, instead of relying on the_repository
  singleton instance.

* Large-object promisor protocol extension has been introduced.

* The editorconfig file is updated to tell us that bash scripts are
  similar to general Bourne shell scripts.

* Meson-based build procedure forgot to build some docs, which has
  been corrected.

Fixes since v2.48
-----------------

* "git submodule" learned various ways to spell the same option,
  e.g. "--branch=B" can be spelled "--branch B" or \ 
"-bB".
  (merge b86f0f9071 re/submodule-parse-opt later to maint).

* Tweak the help text used for the option value placeholders by
  parse-options API so that translations can customize the "<>"
  placeholder signal (e.g. "--option=<value>").
  (merge 5b34dd08d0 as/long-option-help-i18n later to maint).

* CI jobs gave sporadic failures, which turns out that that the
  object finalization code was giving an error when it did not have
  to.
  (merge d7fcbe2c56 ps/object-collision-check later to maint).

* The code to compute "unique" name used git_rand() which can fail or
  get stuck; the callsite does not require cryptographic security.
  Introduce the "insecure" mode and use it appropriately.
  (merge 0b4f8afef6 ps/reftable-get-random-fix later to maint).

* A misconfigured "fsck.skiplist" configuration variable was not
  diagnosed as an error, which has been corrected.
  (merge ca7158076f jt/fsck-skiplist-parse-fix later to maint).

* Extended SHA-1 expression parser did not work well when a branch
  with an unusual name (e.g. "foo{bar") is involved.
  (merge 191f0c8db2 en/object-name-with-funny-refname-fix later to maint).

* The meson build procedure looked for the 'version-def.h' file in a
  wrong directory, which has been corrected.
  (merge 4771501c0a tc/meson-use-our-version-def-h later to maint).

* The meson build procedure for Documentation/technical/ hierarchy was
  missing necessary dependencies, which has been corrected.
  (merge 1dca492edd sj/meson-doc-technical-dependency-fix later to maint).

* The "instaweb" bound only to local IP address without \ 
"--local" and
  to all addresses with "--local", which was the other way around, when
  using Python's http.server class, which has been corrected.
  (merge 76baf97fa1 ak/instaweb-python-port-binding-fix later to maint).

* Document that it is insecure to use Personal Access Tokens, which
  some hosting providers take as username/password, embedded in URLs.
  (merge a90ff409f0 mh/doc-credential-helpers-with-pat later to maint).

* The help text from "git $cmd -h" appear on the standard output for
  some $cmd and the standard error for others.  The built-in commands
  have been fixed to show them on the standard output consistently.
  (merge f66d1423f5 jc/show-usage-help later to maint).

* The meson-driven build is now aware of "git-subtree" housed in
  contrib/subtree hierarchy.
  (merge 8454b42f94 ps/build-meson-subtree later to maint).

* It was possible for "git unpack-objects" and "git \ 
index-pack" to
  make an unaligned access, which has been corrected.
  (merge 98046591b9 jk/pack-header-parse-alignment-fix later to maint).

* The "cache" credential back-end did not handle authtype correctly,
  which has been corrected.
  (merge 0b43274850 mh/credential-cache-authtype-request-fix later to maint).

* "git branch --sort=..." and "git for-each-ref --format=... \ 
--sort=..."
  did not work as expected with some atoms, which has been corrected.
  (merge c5490ce9d1 rs/ref-fitler-used-atoms-value-fix later to maint).

* reflog entries for symbolic ref updates were broken, which has been
  corrected.
  (merge 3519492430 kn/reflog-symref-fix later to maint).

* The trace2 code was not prepared to show a configuration variable
  that is set to true using the valueless true syntax, which has been
  corrected.
  (merge 2fd367cf63 am/trace2-with-valueless-true later to maint).

* The "git refs migrate" command did not migrate the reflog for
  refs/stash, which is the contents of the stashes, which has been
  corrected.
  (merge a0bea0978f ps/reflog-migration-with-logall-fix later to maint).

* Doc and short-help text for "show-index" has been clarified to
  stress that the command reads its data from the standard input.
  (merge 49edce4ff9 jc/show-index-h-update later to maint).

* The API around choosing to use unsafe variant of SHA-1
  implementation has been updated in an attempt to make it harder to
  abuse.
  (merge 04292c3796 tb/unsafe-hash-cleanup later to maint).

* Fix bugs in an earlier attempt to fix "git refs migration".
  (merge f11f0a5a2d kn/reflog-migration-fix-fix later to maint).

* The code path used when "git fetch" fetches from a bundle file
  closed the same file descriptor twice, which sometimes broke things
  unexpectedly when the file descriptor was reused, which has been
  corrected.
  (merge 9a84794ad8 js/bundle-unbundle-fd-reuse-fix later to maint).

* "git init" to reinitialize a repository that already exists cannot
  change the hash function and ref backends; such a request is
  silently ignored now.
  (merge 7e88640cd1 ps/setup-reinit-fixes later to maint).

* "git apply" internally uses unsigned long for line numbers and uses
  strtoul() to parse numbers on the hunk headers.  It however forgot
  to check parse errors.
  (merge a206058fda pw/apply-ulong-overflow-check later to maint).

* Two CI tasks, whitespace check and style check, work on the
  difference from the base version and the version being checked, but
  the base was computed incorrectly in GitLab CI in some cases, which
  has been corrected.
  (merge acc4fb302b jt/gitlab-ci-base-fix later to maint).

* "git repack --keep-unreachable" to send unreachable objects to the
  main pack "git repack -ad" produces did not work when there is no
  existing packs, which has been corrected.
  (merge 414c82300a ps/repack-keep-unreachable-in-unpacked-repo later to maint).

* Going into a secondary worktree and asking "is the main worktree
  bare?" did not work correctly when per-worktree configuration
  option was in use, which has been corrected.

* Fetching into a bare repository incorrectly assumed it always used
  a mirror layout when deciding to update remote-tracking HEAD, which
  has been corrected.
  (merge 93dc16483a bf/fetch-set-head-fix later to maint).

* A thunderbird helper script lost its bashism.
  (merge 59d26bd961 bc/contrib-thunderbird-patch-inline-fix later to maint).

* The -G/-S options to the "diff" family of commands caused us to hit
  a BUG() when they get no values; they have been corrected.
  (merge a620046b29 bc/diff-reject-empty-arg-to-pickaxe later to maint).

* "git merge-tree --stdin" has been improved (including a workaround
  for a deadlock).
  (merge 6a9ae81015 pw/merge-tree-stdin-deadlock-fix later to maint).

* Correct the default target in Documentation/Makefile, and
  future-proof all Makefiles from similar breakages by declaring the
  default target (which happens to be "all") upfront.
  (merge 5309c1e9fb ad/set-default-target-in-makefiles later to maint).

* "git check-mailmap" used to segfault when queried without human
  readable name.
  (merge bb60c52131 jk/check-mailmap-wo-name-fix later to maint).

* Support for renaming of symbolic links on Windows has been improved.

* "git rebase -i" failed to allow rewording an empty commit that has
  been fast-forwarded.
  (merge af8fc7be10 pw/rebase-i-ff-empty-commit later to maint).

* The use of "paste" command for aggregating the test results have
  been corrected.
  (merge ce98863204 dk/test-aggregate-results-paste-fix later to maint).

* Other code cleanup, docfix, build fix, etc.

Log message:
git: updated to 2.48.1

Git v2.48.1 Release Notes

This release merges up the fix that appears in v2.40.4, v2.41.3,
v2.42.4, v2.43.6, v2.44.3, v2.45.3, v2.46.3, and v2.47.2 to address
the security issues CVE-2024-50349 and CVE-2024-52006; see the release
notes for these versions for details.

Log message:
git: updated to 2.46.0

Git v2.46 Release Notes
=======================

UI, Workflows & Features

 * The "--rfc" option of "git format-patch" learned to take an
   optional string value to be used in place of "RFC" to tweak the
   "[PATCH]" on the subject header.

 * The credential helper protocol, together with the HTTP layer, have
   been enhanced to support authentication schemes different from
   username & password pair, like Bearer and NTLM.

 * Command line completion script (in contrib/) learned to complete
   "git symbolic-ref" a bit better (you need to enable plumbing
   commands to be completed with GIT_COMPLETION_SHOW_ALL_COMMANDS).

 * When the user responds to a prompt given by "git add -p" with an
   unsupported command, list of available commands were given, which
   was too much if the user knew what they wanted to type but merely
   made a typo.  Now the user gets a much shorter error message.

 * The color parsing code learned to handle 12-bit RGB colors, spelled
   as "#RGB" (in addition to "#RRGGBB" that is already \ 
supported).

 * The operation mode options (like "--get") the "git \ 
config" command
   uses have been deprecated and replaced with subcommands (like "git
   config get").

 * "git tag" learned the "--trailer" option to futz with the \ 
trailers
   in the same way as "git commit" does.

 * A new global "--no-advice" option can be used to disable all advice
   messages, which is meant to be used only in scripts.

 * Updates to symbolic refs can now be made as a part of ref
   transaction.

 * The trailer API has been reshuffled a bit.

 * Terminology to call various ref-like things are getting
   straightened out.

 * The command line completion script (in contrib/) has been adjusted
   to the recent update to "git config" that adopted subcommand based
   UI.

 * The knobs to tweak how reftable files are written have been made
   available as configuration variables.

 * When "git push" notices that the commit at the tip of the ref on
   the other side it is about to overwrite does not exist locally, it
   used to first try fetching it if the local repository is a partial
   clone. The command has been taught not to do so and immediately
   fail instead.

 * The promisor.quiet configuration knob can be set to true to make
   lazy fetching from promisor remotes silent.

 * The inter/range-diff output has been moved to the end of the patch
   when format-patch adds it to a single patch, instead of writing it
   before the patch text, to be consistent with what is done for a
   cover letter for a multi-patch series.

 * A new command has been added to migrate a repository that uses the
   files backend for its ref storage to use the reftable backend, with
   limitations.

 * "git diff --exit-code --ext-diff" learned to take the exit status
   of the external diff driver into account when deciding the exit
   status of the overall "git diff" invocation when configured to do
   so.

 * "git update-ref --stdin" learned to handle transactional updates of
   symbolic-refs.

 * "git format-patch --interdiff" for multi-patch series learned to
   turn on cover letters automatically (unless told never to enable
   cover letter with "--no-cover-letter" and such).

 * The "--heads" option of "ls-remote" and \ 
"show-ref" has been been
   deprecated; "--branches" replaces "--heads".

 * For over a year, setting add.interactive.useBuiltin configuration
   variable did nothing but giving a "this does not do anything"
   warning.  The warning has been removed.

 * The http transport can now be told to send request with
   authentication material without first getting a 401 response.

 * A handful of entries are added to the GitFAQ document.

 * "git var GIT_SHELL_PATH" should report the path to the shell used
   to spawn external commands, but it didn't do so on Windows, which
   has been corrected.

Performance, Internal Implementation, Development Support etc.

 * Advertise "git contacts", a tool for newcomers to find people to
   ask review for their patches, a bit more in our developer
   documentation.

 * In addition to building the objects needed, try to link the objects
   that are used in fuzzer tests, to make sure at least they build
   without bitrot, in Linux CI runs.

 * Code to write out reftable has seen some optimization and
   simplification.

 * Tests to ensure interoperability between reftable written by jgit
   and our code have been added and enabled in CI.

 * The singleton index_state instance "the_index" has been eliminated
   by always instantiating "the_repository" and replacing references
   to "the_index"  with references to its .index member.

 * Git-GUI has a new maintainer, Johannes Sixt.

 * The "test-tool" has been taught to run testsuite tests in parallel,
   bypassing the need to use the "prove" tool.

 * The "whitespace check" task that was enabled for GitHub Actions CI
   has been ported to GitLab CI.

 * The refs API lost functions that implicitly assumes to work on the
   primary ref_store by forcing the callers to pass a ref_store as an
   argument.

 * Code clean-up to reduce inter-function communication inside
   builtin/config.c done via the use of global variables.

 * The pack bitmap code saw some clean-up to prepare for a follow-up topic.

 * Preliminary code clean-up for "git send-email".

 * The default "creation-factor" used by "git format-patch" \ 
has been
   raised to make it more aggressively find matching commits.

 * Before discovering the repository details, We used to assume SHA-1
   as the "default" hash function, which has been corrected. Hopefully
   this will smoke out codepaths that rely on such an unwarranted
   assumptions.

 * The project decision making policy has been documented.

 * The strcmp-offset tests have been rewritten using the unit test
   framework.

 * "git add -p" learned to complain when an answer with more than one
   letter is given to a prompt that expects a single letter answer.

 * The alias-expanded command lines are logged to the trace output.

 * A new test was added to ensure git commands that are designed to
   run outside repositories do work.

 * A few tests in reftable library have been rewritten using the
   unit test framework.

 * A pair of test helpers that essentially are unit tests on hash
   algorithms have been rewritten using the unit-tests framework.

 * A test helper that essentially is unit tests on the "decorate"
   logic has been rewritten using the unit-tests framework.

 * Many memory leaks in the sparse-checkout code paths have been
   plugged.

 * "make check-docs" noticed problems and reported to its output but
   failed to signal its findings with its exit status, which has been
   corrected.

 * Building with "-Werror -Wwrite-strings" is now supported.

 * To help developers, the build procedure now allows builders to use
   CFLAGS_APPEND to specify additional CFLAGS.

 * "oidtree" tests were rewritten to use the unit test framework.

 * The structure of the document that records longer-term project
   decisions to deprecate/remove/update various behaviour has been
   outlined.

 * The pseudo-merge reachability bitmap to help more efficient storage
   of the reachability bitmap in a repository with too many refs has
   been added.

 * When "git merge" sees that the index cannot be refreshed (e.g. due
   to another process doing the same in the background), it died but
   after writing MERGE_HEAD etc. files, which was useless for the
   purpose to recover from the failure.

 * The output from "git cat-file --batch-check" and "--batch-command
   (info)" should not be unbuffered, for which some tests have been
   added.

 * A CPP macro USE_THE_REPOSITORY_VARIABLE is introduced to help
   transition the codebase to rely less on the availability of the
   singleton the_repository instance.

 * "git version --build-options" reports the version information of
   OpenSSL and other libraries (if used) in the build.

 * Memory ownership rules for the in-core representation of
   remote.*.url configuration values have been straightened out, which
   resulted in a few leak fixes and code clarification.

 * When bundleURI interface fetches multiple bundles, Git failed to
   take full advantage of all bundles and ended up slurping duplicated
   objects, which has been corrected.

 * The code to deal with modified paths that are out-of-cone in a
   sparsely checked out working tree has been optimized.

 * An existing test of oidmap API has been rewritten with the
   unit-test framework.

 * The "ort" merge backend saw one bugfix for a crash that happens
   when inner merge gets killed, and assorted code clean-ups.

 * A new warning message is issued when a command has to expand a
   sparse index to handle working tree cruft that are outside of the
   sparse checkout.

 * The test framework learned to take the test body not as a single
   string but as a here-document.

 * "git push '' HEAD:there" used to hit a BUG(); it has been corrected
   to die with "fatal: bad repository ''".

 * What happens when http.cookieFile gets the special value "" has
   been clarified in the documentation.

Fixes since v2.45
-----------------

 * "git rebase --signoff" used to forget that it needs to add a
   sign-off to the resulting commit when told to continue after a
   conflict stops its operation.

 * The procedure to build multi-pack-index got confused by the
   replace-refs mechanism, which has been corrected by disabling the
   latter.

 * The "-k" and "--rfc" options of "format-patch" \ 
will now error out
   when used together, as one tells us not to add anything to the
   title of the commit, and the other one tells us to add "RFC" in
   addition to "PATCH".

 * "git stash -S" did not handle binary files correctly, which has
   been corrected.

 * A scheduled "git maintenance" job is expected to work on all
   repositories it knows about, but it stopped at the first one that
   errored out.  Now it keeps going.

 * zsh can pretend to be a normal shell pretty well except for some
   glitches that we tickle in some of our scripts. Work them around
   so that "vimdiff" and our test suite works well enough with it.

 * Command line completion support for zsh (in contrib/) has been
   updated to stop exposing internal state to end-user shell
   interaction.

 * Tests that try to corrupt in-repository files in chunked format did
   not work well on macOS due to its broken "mv", which has been
   worked around.

 * The maximum size of attribute files is enforced more consistently.

 * Unbreak CI jobs so that we do not attempt to use Python 2 that has
   been removed from the platform.

 * Git 2.43 started using the tree of HEAD as the source of attributes
   in a bare repository, which has severe performance implications.
   For now, revert the change, without ripping out a more explicit
   support for the attr.tree configuration variable.

 * The "--exit-code" option of "git diff" command learned to \ 
work with
   the "--ext-diff" option.

 * Windows CI running in GitHub Actions started complaining about the
   order of arguments given to calloc(); the imported regex code uses
   the wrong order almost consistently, which has been corrected.

 * Expose "name conflict" error when a ref creation fails due to D/F
   conflict in the ref namespace, to improve an error message given by
   "git fetch".
   (merge 9339fca23e it/refs-name-conflict later to maint).

 * The SubmittingPatches document now refers folks to manpages
   translation project.

 * The documentation for "git diff --name-only" has been clarified
   that it is about showing the names in the post-image tree.

 * The credential helper that talks with osx keychain learned to avoid
   storing back the authentication material it just got received from
   the keychain.
   (merge e1ab45b2da kn/osxkeychain-skip-idempotent-store later to maint).

 * The chainlint script (invoked during "make test") did nothing when
   it failed to detect the number of available CPUs.  It now falls
   back to 1 CPU to avoid the problem.

 * Revert overly aggressive "layered defence" that went into 2.45.1
   and friends, which broke "git-lfs", "git-annex", and other use
   cases, so that we can rebuild necessary counterparts in the open.

 * "git init" in an already created directory, when the user
   configuration has includeif.onbranch, started to fail recently,
   which has been corrected.

 * Memory leaks in "git mv" has been plugged.

 * The safe.directory configuration knob has been updated to
   optionally allow leading path matches.

 * An overly large ".gitignore" files are now rejected silently.

 * Upon expiration event, the credential subsystem forgot to clear
   in-core authentication material other than password (whose support
   was added recently), which has been corrected.

 * Fix for an embarrassing typo that prevented Python2 tests from running
   anywhere.

 * Varargs functions that are unannotated as printf-like or execl-like
   have been annotated as such.

 * "git am" has a safety feature to prevent it from starting a new
   session when there already is a session going.  It reliably
   triggers when a mbox is given on the command line, but it has to
   rely on the tty-ness of the standard input.  Add an explicit way to
   opt out of this safety with a command line option.
   (merge 62c71ace44 jk/am-retry later to maint).

 * A leak in "git imap-send" that somehow escapes LSan has been
   plugged.

 * Setting core.abbrev too early before the repository set-up
   (typically in "git clone") caused segfault, which as been
   corrected.

 * When the user adds to "git rebase -i" instruction to \ 
"pick" a merge
   commit, the error experience is not pleasant.  Such an error is now
   caught earlier in the process that parses the todo list.

 * We forgot to normalize the result of getcwd() to NFC on macOS where
   all other paths are normalized, which has been corrected.  This still
   does not address the case where core.precomposeUnicode configuration
   is not defined globally.

 * Earlier we stopped using the tree of HEAD as the default source of
   attributes in a bare repository, but failed to document it.  This
   has been corrected.

 * "git update-server-info" and "git commit-graph --write" \ 
have been
   updated to use the tempfile API to avoid leaving cruft after
   failing.

 * An unused extern declaration for mingw has been removed to prevent
   it from causing build failure.

 * A helper function shared between two tests had a copy-paste bug,
   which has been corrected.

 * "git fetch-pack -k -k" without passing "--lock-pack" (which we
   never do ourselves) did not work at all, which has been corrected.

 * CI job to build minimum fuzzers learned to pass NO_CURL=NoThanks to
   the build procedure, as its build environment does not offer, or
   the rest of the build needs, anything cURL.
   (merge 4e66b5a990 jc/fuzz-sans-curl later to maint).

 * "git diff --no-ext-diff" when diff.external is configured ignored
   the "--color-moved" option.
   (merge 0f4b0d4cf0 rs/diff-color-moved-w-no-ext-diff-fix later to maint).

 * "git archive --add-virtual-file=<path>:<contents>" \ 
never paid
   attention to the --prefix=<prefix> option but the documentation
   said it would. The documentation has been corrected.
   (merge 72c282098d jc/archive-prefix-with-add-virtual-file later to maint).

 * When GIT_PAGER failed to spawn, depending on the code path taken,
   we failed immediately (correct) or just spew the payload to the
   standard output (incorrect).  The code now always fail immediately
   when GIT_PAGER fails.
   (merge 78f0a5d187 rj/pager-die-upon-exec-failure later to maint).

 * date parser updates to be more careful about underflowing epoch
   based timestamp.
   (merge 9d69789770 db/date-underflow-fix later to maint).

 * The Bloom filter used for path limited history traversal was broken
   on systems whose "char" is unsigned; update the implementation and
   bump the format version to 2.
   (merge 9c8a9ec787 tb/path-filter-fix later to maint).

 * Typofix.
   (merge 231cf7370e as/pathspec-h-typofix later to maint).

 * Code clean-up.
   (merge 4b837f821e rs/simplify-submodule-helper-super-prefix-invocation later \ 
to maint).

 * "git describe --dirty --broken" forgot to refresh the index before
   seeing if there is any chang, ("git describe --dirty" correctly did
   so), which has been corrected.
   (merge b8ae42e292 as/describe-broken-refresh-index-fix later to maint).

 * Test suite has been taught not to unnecessarily rely on DNS failing
   a bogus external name.
   (merge 407cdbd271 jk/tests-without-dns later to maint).

 * GitWeb update to use committer date consistently in rss/atom feeds.
   (merge cf6ead095b am/gitweb-feed-use-committer-date later to maint).

 * Custom control structures we invented more recently have been
   taught to the clang-format file.
   (merge 1457dff9be rs/clang-format-updates later to maint).

 * Developer build procedure fix.
   (merge df32729866 tb/dev-build-pedantic-fix later to maint).

 * "git push" that pushes only deletion gave an unnecessary and
   harmless error message when push negotiation is configured, which
   has been corrected.
   (merge 4d8ee0317f jc/disable-push-nego-for-deletion later to maint).

 * Address-looking strings found on the trailer are now placed on the
   Cc: list after running through sanitize_address by "git send-email".
   (merge c852531f45 cb/send-email-sanitize-trailer-addresses later to maint).

 * Tests that use GIT_TEST_SANITIZE_LEAK_LOG feature got their exit
   status inverted, which has been corrected.
   (merge 8c1d6691bc rj/test-sanitize-leak-log-fix later to maint).

 * The http.cookieFile and http.saveCookies configuration variables
   have a few values that need to be avoided, which are now ignored
   with warning messages.
   (merge 4f5822076f jc/http-cookiefile later to maint).

 * Repacking a repository with multi-pack index started making stupid
   pack selections in Git 2.45, which has been corrected.
   (merge 8fb6d11fad ds/midx-write-repack-fix later to maint).

 * Fix documentation mark-up regression in 2.45.
   (merge 6474da0aa4 ja/doc-markup-updates-fix later to maint).

 * Work around asciidoctor's css that renders `monospace` material
   in the SYNOPSIS section of manual pages as block elements.
   (merge d44ce6ddd5 js/doc-markup-updates-fix later to maint).

 * Other code cleanup, docfix, build fix, etc.
   (merge 493fdae046 ew/object-convert-leakfix later to maint).
   (merge 00f3661a0a ss/doc-eol-attr-fix later to maint).
   (merge 428c40da61 ri/doc-show-branch-fix later to maint).
   (merge 58696bfcaa jc/where-is-bash-for-ci later to maint).
   (merge 616e94ca24 tb/doc-max-tree-depth-fix later to maint).

Log message:
git: updated to 2.44.0

Git v2.44 Release Notes
=======================

Backward Compatibility Notes

 * "git checkout -B <branch>" used to allow switching to a \ 
branch that
   is in use on another worktree, but this was by mistake.  The users
   need to use "--ignore-other-worktrees" option.

UI, Workflows & Features

 * "git add" and "git stash" learned to support the \ 
":(attr:...)"
   magic pathspec.

 * "git rebase --autosquash" is now enabled for non-interactive rebase,
   but it is still incompatible with the apply backend.

 * Introduce "git replay", a tool meant on the server side without
   working tree to recreate a history.

 * "git merge-file" learned to take the "--diff-algorithm" \ 
option to
   use algorithm different from the default "myers" diff.

 * Command line completion (in contrib/) learned to complete path
   arguments to the "add/set" subcommands of "git \ 
sparse-checkout"
   better.

 * "git checkout -B <branch> [<start-point>]" allowed a \ 
branch that is
   in use in another worktree to be updated and checked out, which
   might be a bit unexpected.  The rule has been tightened, which is a
   breaking change.  "--ignore-other-worktrees" option is required to
   unbreak you, if you are used to the current behaviour that "-B"
   overrides the safety.

 * The builtin_objectmode attribute is populated for each path
   without adding anything in .gitattributes files, which would be
   useful in magic pathspec, e.g., ":(attr:builtin_objectmode=100755)"
   to limit to executables.

 * "git fetch" learned to pay attention to "fetch.all" \ 
configuration
   variable, which pretends as if "--all" was passed from the command
   line when no remote parameter was given.

 * In addition to (rather cryptic) Security Identifiers, show username
   and domain in the error message when we barf on mismatch between
   the Git directory and the current user on Windows.

 * The error message given when "git branch -d branch" fails due to
   commits unique to the branch has been split into an error and a new
   conditional advice message.

 * When given an existing but unreadable file as a configuration file,
   gitweb behaved as if the file did not exist at all, but now it
   errors out.  This is a change that may break backward compatibility.

 * When $HOME/.gitconfig is missing but XDG config file is available, we
   should write into the latter, not former.  "git gc" and "git
   maintenance" wrote into a wrong "global config" file, which have
   been corrected.

 * Define "special ref" as a very narrow set that consists of
   FETCH_HEAD and MERGE_HEAD, and clarify everything else that used to
   be classified as such are actually just pseudorefs.

 * All conditional "advice" messages show how to turn them off, which
   becomes repetitive.  Setting advice.* configuration explicitly on
   now omits the instruction part.

 * The "disable repository discovery of a bare repository" check,
   triggered by setting safe.bareRepository configuration variable to
   'explicit', has been loosened to exclude the ".git/" directory inside
   a non-bare repository from the check.  So you can do "cd .git &&
   git cmd" to run a Git command that works on a bare repository without
   explicitly specifying $GIT_DIR now.

 * The completion script (in contrib/) learned more options that can
   be used with "git log".

 * The labels on conflict markers for the common ancestor, our version,
   and the other version are available to custom 3-way merge driver
   via %S, %X, and %Y placeholders.

 * The write codepath for the reftable data learned to honor
   core.fsync configuration.

 * The "--fsck-objects" option of "git index-pack" now can \ 
take the
   optional parameter to tweak severity of different fsck errors.

 * The wincred credential backend has been taught to support oauth
   refresh token the same way as credential-cache and
   credential-libsecret backends.

 * Command line completion support (in contrib/) has been
   updated for "git bisect".

 * "git branch" and friends learned to use the formatted text as
   sorting key, not the underlying timestamp value, when the --sort
   option is used with author or committer timestamp with a format
   specifier (e.g., "--sort=creatordate:format:%H:%M:%S").

 * The command line completion script (in contrib/) learned to
   complete configuration variable names better.

Performance, Internal Implementation, Development Support etc.

 * Process to add some form of low-level unit tests has started.

 * Add support for GitLab CI.

 * "git for-each-ref --no-sort" still sorted the refs alphabetically
   which paid non-trivial cost.  It has been redefined to show output
   in an unspecified order, to allow certain optimizations to take
   advantage of.

 * Simplify API implementation to delete references by eliminating
   duplication.

 * Subject approxidate() and show_date() machinery to OSS-Fuzz.

 * A new helper to let us pretend that we called lstat() when we know
   our cache_entry is up-to-date via fsmonitor.

 * The optimization based on fsmonitor in the "diff --cached"
   codepath is resurrected with the "fake-lstat" introduced earlier.

 * Test balloon to use C99 "bool" type from <stdbool.h> has been
   added.

 * "git clone" has been prepared to allow cloning a repository with
   non-default hash function into a repository that uses the reftable
   backend.

 * Streaming spans of packfile data used to be done only from a
   single, primary, pack in a repository with multiple packfiles.  It
   has been extended to allow reuse from other packfiles, too.

 * Comment updates to help developers not to attempt to modify
   messages from plumbing commands that must stay constant.

   It might make sense to reassess the plumbing needs every few years,
   but that should be done as a separate effort.

 * Move test-ctype helper to the unit-test framework.

 * Instead of manually creating refs/ hierarchy on disk upon a
   creation of a secondary worktree, which is only usable via the
   files backend, use the refs API to populate it.

 * CI for GitLab learned to drive macOS jobs.

 * A few tests to "git commit -o <pathspec>" and "git commit -i
   <pathspec>" has been added.

 * Tests on ref API are moved around to prepare for reftable.

 * The Makefile often had to say "-L$(path) -R$(path)" that repeats
   the path to the same library directory for link time and runtime.
   A Makefile template is used to reduce such repetition.

 * The priority queue test has been migrated to the unit testing
   framework.

 * Setting `feature.experimental` opts the user into multi-pack reuse
   experiment

 * Squelch node.js 16 deprecation warnings from GitHub Actions CI
   by updating actions/github-script and actions/checkout that use
   node.js 20.

 * The mechanism to report the filename in the source code, used by
   the unit-test machinery, assumed that the compiler expanded __FILE__
   to the path to the source given to the $(CC), but some compilers
   give full path, breaking the output.  This has been corrected.

Fixes since v2.43
-----------------

 * The way CI testing used "prove" could lead to running the test
   suite twice needlessly, which has been corrected.

 * Update ref-related tests.

 * "git format-patch --encode-email-headers" ignored the option when
   preparing the cover letter, which has been corrected.

 * Newer versions of Getopt::Long started giving warnings against our
   (ab)use of it in "git send-email".  Bump the minimum version
   requirement for Perl to 5.8.1 (from September 2002) to allow
   simplifying our implementation.

 * Earlier we stopped relying on commit-graph that (still) records
   information about commits that are lost from the object store,
   which has negative performance implications.  The default has been
   flipped to disable this pessimization.

 * Stale URLs have been updated to their current counterparts (or
   archive.org) and HTTP links are replaced with working HTTPS links.

 * trace2 streams used to record the URLs that potentially embed
   authentication material, which has been corrected.

 * The sample pre-commit hook that tries to catch introduction of new
   paths that use potentially non-portable characters did not notice
   an existing path getting renamed to such a problematic path, when
   rename detection was enabled.

 * The command line parser for the "log" family of commands was too
   loose when parsing certain numbers, e.g., silently ignoring the
   extra 'q' in "git log -n 1q" without complaining, which has been
   tightened up.

 * "git $cmd --end-of-options --rev -- --path" for some $cmd failed
   to interpret "--rev" as a rev, and "--path" as a path.  \ 
This was
   fixed for many programs like "reset" and "checkout".

 * "git bisect reset" has been taught to clean up state files and refs
   even when BISECT_START file is gone.

 * Some codepaths did not correctly parse configuration variables
   specified with valueless "true", which has been corrected.

 * Code clean-up for sanity checking of command line options for "git
   show-ref".

 * The code to parse the From e-mail header has been updated to avoid
   recursion.

 * "git fetch --atomic" issued an unnecessary empty error message,
   which has been corrected.

 * Command line completion script (in contrib/) learned to work better
   with the reftable backend.

 * "git status" is taught to show both the branch being bisected and
   being rebased when both are in effect at the same time.

 * "git archive --list extra garbage" silently ignored excess command
   line parameters, which has been corrected.

 * "git sparse-checkout set" added default patterns even when the
   patterns are being fed from the standard input, which has been
   corrected.

 * "git sparse-checkout (add|set) --[no-]cone --end-of-options" did
   not handle "--end-of-options" correctly after a recent update.

 * Unlike other environment variables that took the usual
   true/false/yes/no as well as 0/1, GIT_FLUSH only understood 0/1,
   which has been corrected.

 * Clearing in-core repository (happens during e.g., "git fetch
   --recurse-submodules" with commit graph enabled) made in-core
   commit object in an inconsistent state by discarding the necessary
   data from commit-graph too early, which has been corrected.

 * Update to a new feature recently added, "git show-ref --exists".

 * oss-fuzz tests are built and run in CI.
   (merge c4a9cf1df3 js/oss-fuzz-build-in-ci later to maint).

 * Rename detection logic ignored the final line of a file if it is an
   incomplete line.

 * GitHub CI update.
   (merge 0188b2c8e0 pb/ci-github-skip-logs-for-broken-tests later to maint).

 * "git diff --no-rename A B" did not disable rename detection but did
   not trigger an error from the command line parser.

 * "git archive --remote=<remote>" learned to talk over the smart
   http (aka stateless) transport.
   (merge 176cd68634 jx/remote-archive-over-smart-http later to maint).

 * Fetching via protocol v0 over Smart HTTP transport sometimes failed
   to correctly auto-follow tags.
   (merge fba732c462 jk/fetch-auto-tag-following-fix later to maint).

 * The documentation for the --exclude-per-directory option marked it
   as deprecated, which confused readers into thinking there may be a
   plan to remove it in the future, which was not our intention.
   (merge 0009542cab jc/ls-files-doc-update later to maint).

 * "git diff --no-index file1 file2" segfaulted while invoking the
   external diff driver, which has been corrected.

 * Rewrite //-comments to /* comments */ in files whose comments
   prevalently use the latter.

 * Cirrus CI jobs started breaking because we specified version of
   FreeBSD that is no longer available, which has been corrected.
   (merge 81fffb66d3 cb/use-freebsd-13-2-at-cirrus-ci later to maint).

 * A caller called index_file_exists() that takes a string expressed
   as <ptr, length> with a wrong length, which has been corrected.
   (merge 156e28b36d jh/sparse-index-expand-to-path-fix later to maint).

 * A failed "git tag -s" did not necessarily result in an error
   depending on the crypto backend, which has been corrected.

 * "git stash" sometimes was silent even when it failed due to
   unwritable index file, which has been corrected.

 * "git show-ref --verify" did not show things like \ 
"CHERRY_PICK_HEAD",
   which has been corrected.

 * Recent conversion to allow more than 0/1 in GIT_FLUSH broke the
   mechanism by flipping what yes/no means by mistake, which has been
   corrected.

 * The sequencer machinery does not use the ref API and instead
   records names of certain objects it needs for its correct operation
   in temporary files, which makes these objects susceptible to loss
   by garbage collection.  These temporary files have been added as
   starting points for reachability analysis to fix this.
   (merge bc7f5db896 pw/gc-during-rebase later to maint).

 * "git cherry-pick" invoked during "git rebase -i" session lost
   the authorship information, which has been corrected.
   (merge e4301f73ff vn/rebase-with-cherry-pick-authorship later to maint).

 * The code paths that call repo_read_object_file() have been
   tightened to react to errors.
   (merge 568459bf5e js/check-null-from-read-object-file later to maint).

 * Other code cleanup, docfix, build fix, etc.
   (merge 5aea3955bc rj/clarify-branch-doc-m later to maint).
   (merge 9cce3be2df bk/bisect-doc-fix later to maint).
   (merge 8430b438f6 vd/fsck-submodule-url-test later to maint).
   (merge 3cb4384683 jc/t0091-with-unknown-git later to maint).
   (merge 020456cb74 rs/receive-pack-remove-find-header later to maint).
   (merge bc47139f4f la/trailer-cleanups later to maint).

Log message:
Mass-change BUILD_DEPENDS to TOOL_DEPENDS outside mk/.

Almost all uses, if not all of them, are wrong, according to the
semantics of BUILD_DEPENDS (packages built for target available for
use _by_ tools at build-time) and TOOL_DEPEPNDS (packages built for
host available for use _as_ tools at build-time).

No change to BUILD_DEPENDS as used correctly inside buildlink3.

As proposed on tech-pkg:
https://mail-index.netbsd.org/tech-pkg/2023/06/03/msg027632.html

Log message:
git: updated to 2.38.0

Git v2.38 Release Notes
=======================

UI, Workflows & Features

 * "git remote show [-n] frotz" now pays attention to negative
   pathspec.

 * "git push" sometimes performs poorly when reachability bitmaps are
   used, even in a repository where other operations are helped by
   bitmaps.  The push.useBitmaps configuration variable is introduced
   to allow disabling use of reachability bitmaps only for "git push".

 * "git grep -m<max-hits>" is a way to limit the hits shown per file.

 * "git merge-tree" learned a new mode where it takes two commits and
   computes a tree that would result in the merge commit, if the
   histories leading to these two commits were to be merged.

 * "git mv A B" in a sparsely populated working tree can be asked to
   move a path between directories that are "in cone" (i.e. expected
   to be materialized in the working tree) and "out of cone"
   (i.e. expected to be hidden).  The handling of such cases has been
   improved.

 * Earlier, HTTP transport clients learned to tell the server side
   what locale they are in by sending Accept-Language HTTP header, but
   this was done only for some requests but not others.

 * Introduce a safe.barerepository configuration variable that
   allows users to forbid discovery of bare repositories.

 * Various messages that come from the pack-bitmap codepaths have been
   tweaked.

 * "git rebase -i" learns to update branches whose tip appear in the
   rebased range with "--update-refs" option.

 * "git ls-files" learns the "--format" option to tweak its \ 
output.

 * "git cat-file" learned an option to use the mailmap when showing
   commit and tag objects.

 * When "git merge" finds that it cannot perform a merge, it should
   restore the working tree to the state before the command was
   initiated, but in some corner cases it didn't.

 * Operating modes like "--batch" of "git cat-file" command \ 
learned to
   take NUL-terminated input, instead of one-item-per-line.

 * "git rm" has become more aware of the sparse-index feature.

 * "git rev-list --disk-usage" learned to take an optional value
   "human" to show the reported value in human-readable format, like
   "3.40MiB".

 * The "diagnose" feature to create a zip archive for diagnostic
   material has been lifted from "scalar" and made into a feature of
   "git bugreport".

 * The namespaces used by "log --decorate" from "refs/" \ 
hierarchy by
   default has been tightened.

 * "git rev-list --ancestry-path=C A..B" is a natural extension of
   "git rev-list A..B"; instead of choosing a subset of A..B to those
   that have ancestry relationship with A, it lets a subset with
   ancestry relationship with C.

 * "scalar" now enables built-in fsmonitor on enlisted repositories,
   when able.

 * The bash prompt (in contrib/) learned to optionally indicate when
   the index is unmerged.

 * "git clone" command learned the "--bundle-uri" option to \ 
coordinate
   with hosting sites the use of pre-prepared bundle files.

 * "git range-diff" learned to honor pathspec argument if given.

 * "git format-patch --from=<ident>" can be told to add an in-body
   "From:" line even for commits that are authored by the given
   <ident> with "--force-in-body-from" option.

 * The built-in fsmonitor refuses to work on a network mounted
   repositories; a configuration knob for users to override this has
   been introduced.

 * The "scalar" addition from Microsoft is now part of the core Git
   installation.

Performance, Internal Implementation, Development Support etc.

 * Collection of what is referenced by objects in promisor packs have
   been optimized to inspect these objects in the in-pack order.

 * Introduce a helper to see if a branch is already being worked on
   (hence should not be newly checked out in a working tree), which
   performs much better than the existing find_shared_symref() to
   replace many uses of the latter.

 * Teach "git archive" to (optionally and then by default) avoid
   spawning an external "gzip" process when creating \ 
".tar.gz" (and
   ".tgz") archives.

 * Allow large objects read from a packstream to be streamed into a
   loose object file straight, without having to keep it in-core as a
   whole.

 * Further preparation to turn git-submodule.sh into a builtin
   continues.

 * Apply Coccinelle rule to turn raw memmove() into MOVE_ARRAY() cpp
   macro, which would improve maintainability and readability.

 * Teach "make all" to build gitweb as well.

 * Tweak tests so that they still work when the "git init" template
   did not create .git/info directory.

 * Add Coccinelle rules to detect the pattern of initializing and then
   finalizing a structure without using it in between at all, which
   happens after code restructuring and the compilers fail to
   recognize as an unused variable.

 * The code to convert between GPG trust level strings and internal
   constants we use to represent them have been cleaned up.

 * Support for libnettle as SHA256 implementation has been added.

 * The way "git multi-pack" uses parse-options API has been improved.

 * A Coccinelle rule (in contrib/) to encourage use of COPY_ARRAY
   macro has been improved.

 * API tweak to make it easier to run fuzz testing on commit-graph parser.

 * Omit fsync-related trace2 entries when their values are all zero.

 * The codepath to write multi-pack index has been taught to release a
   large chunk of memory that holds an array of objects in the packs,
   as soon as it is done with the array, to reduce memory consumption.

 * Add a level of redirection to array allocation API in xdiff part,
   to make it easier to share with the libgit2 project.

 * "git fetch" client logs the partial clone filter used in the trace2
   output.

 * The "bundle URI" design gets documented.

 * The common ancestor negotiation exchange during a "git fetch"
   session now leaves trace log.

 * Test portability improvements.
   (merge 4d1d843be7 mt/rot13-in-c later to maint).

 * The "subcommand" mode is introduced to parse-options API and update
   the command line parser of Git commands with subcommands.

 * The pack bitmap file gained a bitmap-lookup table to speed up
   locating the necessary bitmap for a given commit.

 * The assembly version of SHA-1 implementation for PPC has been
   removed.

 * The server side that responds to "git fetch" and "git clone"
   request has been optimized by allowing it to send objects in its
   object store without recomputing and validating the object names.

 * Annotate function parameters that are not used (but cannot be
   removed for structural reasons), to prepare us to later compile
   with -Wunused warning turned on.

 * Share the text used to explain configuration variables used by "git
   <subcmd>" in "git help <subcmd>" with the text \ 
from "git help config".

 * "git mv A B" in a sparsely populated working tree can be asked to
   move a path from a directory that is "in cone" to another directory
   that is "out of cone".  Handling of such a case has been improved.

 * The chainlint script for our tests has been revamped.

Fixes since v2.37
-----------------

 * Rewrite of "git add -i" in C that appeared in Git 2.25 didn't
   correctly record a removed file to the index, which was fixed.

 * Certain diff options are currently ignored when combined-diff is
   shown; mark them as incompatible with the feature.

 * Adjust technical/bitmap-format to be formatted by AsciiDoc, and
   add some missing information to the documentation.

 * Fixes for tests when the source directory has unusual characters in
   its path, e.g. whitespaces, double-quotes, etc.

 * "git mktree --missing" lazily fetched objects that are missing from
   the local object store, which was totally unnecessary for the purpose
   of creating the tree object(s) from its input.

 * Give _() markings to fatal/warning/usage: labels that are shown in
   front of these messages.

 * References to commands-to-be-typed-literally in "git rebase"
   documentation mark-up have been corrected.

 * In a non-bare repository, the behavior of Git when the
   core.worktree configuration variable points at a directory that has
   a repository as its subdirectory, regressed in Git 2.27 days.

 * Recent update to vimdiff layout code has been made more robust
   against different end-user vim settings.

 * Plug various memory leaks, both in the main code and in test-tool
   commands.

 * Fixes a long-standing corner case bug around directory renames in
   the merge-ort strategy.

 * The resolve-undo information in the index was not protected against
   GC, which has been corrected.

 * A corner case bug where lazily fetching objects from a promisor
   remote resulted in infinite recursion has been corrected.

 * "git clone" from a repository with some ref whose HEAD is unborn
   did not set the HEAD in the resulting repository correctly, which
   has been corrected.

 * An earlier attempt to plug leaks placed a clean-up label to jump to
   at a bogus place, which as been corrected.

 * Variable quoting fix in the vimdiff driver of "git mergetool"

 * "git shortlog -n" relied on the underlying qsort() to be stable,
   which shouldn't have.  Fixed.

 * A fix for a regression in test framework.

 * mkstemp() emulation on Windows has been improved.

 * Add missing documentation for "include" and "includeIf" \ 
features in
   "git config" file format, which incidentally teaches the command
   line completion to include them in its offerings.

 * Avoid "white/black-list" in documentation and code comments.

 * Workaround for a compiler warning against use of die() in
   osx-keychain (in contrib/).

 * Workaround for a false positive compiler warning.

 * "git p4" working on UTF-16 files on Windows did not implement
   CRLF-to-LF conversion correctly, which has been corrected.

 * "git p4" did not handle non-ASCII client name well, which has been
   corrected.

 * "rerere-train" script (in contrib/) used to honor commit.gpgSign
   while recreating the throw-away merges.

 * "git checkout" miscounted the paths it updated, which has been
   corrected.

 * Fix for a bug that makes write-tree to fail to write out a
   non-existent index as a tree, introduced in 2.37.

 * There was a bug in the codepath to upgrade generation information
   in commit-graph from v1 to v2 format, which has been corrected.

 * Gitweb had legacy URL shortener that is specific to the way
   projects hosted on kernel.org used to (but no longer) work, which
   has been removed.

 * Fix build procedure for Windows that uses CMake so that it can pick
   up the shell interpreter from local installation location.

 * Conditionally allow building Python interpreter on Windows

 * Fix to lstat() emulation on Windows.

 * Older gcc with -Wall complains about the universal zero initializer
   "struct s = { 0 };" idiom, which makes developers' lives
   inconvenient (as -Werror is enabled by DEVELOPER=YesPlease).  The
   build procedure has been tweaked to help these compilers.

 * Plug memory leaks in the failure code path in the "merge-ort" merge
   strategy backend.

 * "git symbolic-ref symref non..sen..se" is now diagnosed as an error.

 * A follow-up fix to a fix for a regression in 2.36 around hooks.

 * Avoid repeatedly running getconf to ask libc version in the test
   suite, and instead just as it once per script.

 * Platform-specific code that determines if a directory is OK to use
   as a repository has been taught to report more details, especially
   on Windows.

 * "vimdiff3" regression fix.

 * "git fsck" reads mode from tree objects but canonicalizes the mode
   before passing it to the logic to check object sanity, which has
   hid broken tree objects from the checking logic.  This has been
   corrected, but to help existing projects with broken tree objects
   that they cannot fix retroactively, the severity of anomalies this
   code detects has been demoted to "info" for now.

 * Fixes to sparse index compatibility work for "reset" and \ 
"checkout"
   commands.

 * An earlier optimization discarded a tree-object buffer that is
   still in use, which has been corrected.

 * Fix deadlocks between main Git process and subprocess spawned via
   the pipe_command() API, that can kill "git add -p" that was
   reimplemented in C recently.

 * The sequencer machinery translated messages left in the reflog by
   mistake, which has been corrected.

 * xcalloc(), imitating calloc(), takes "number of elements of the
   array", and "size of a single element", in this order.  A call that
   does not follow this ordering has been corrected.

 * The preload-index codepath made copies of pathspec to give to
   multiple threads, which were left leaked.

 * Update the version of Ubuntu used for GitHub Actions CI from 18.04
   to 22.04.

 * The auto-stashed local changes created by "git merge --autostash"
   was mixed into a conflicted state left in the working tree, which
   has been corrected.

 * Multi-pack index got corrupted when preferred pack changed from one
   pack to another in a certain way, which has been corrected.
   (merge 99e4d084ff tb/midx-with-changing-preferred-pack-fix later to maint).

 * The clean-up of temporary files created via mks_tempfile_dt() was
   racy and attempted to unlink() the leading directory when signals
   are involved, which has been corrected.
   (merge babe2e0559 rs/tempfile-cleanup-race-fix later to maint).

 * FreeBSD portability fix for "git maintenance" that spawns \ 
"crontab"
   to schedule tasks.
   (merge ee69e7884e bc/gc-crontab-fix later to maint).

 * Those who use diff-so-fancy as the diff-filter noticed a regression
   or two in the code that parses the diff output in the built-in
   version of "add -p", which has been corrected.
   (merge 0a101676e5 js/add-p-diff-parsing-fix later to maint).

 * Segfault fix-up to an earlier fix to the topic to teach "git reset"
   and "git checkout" work better in a sparse checkout.
   (merge 037f8ea6d9 vd/sparse-reset-checkout-fixes later to maint).

 * "git diff --no-index A B" managed its the pathnames of its two
   input files rather haphazardly, sometimes leaking them.  The
   command line argument processing has been straightened out to clean
   it up.
   (merge 2b43dd0eb5 rs/diff-no-index-cleanup later to maint).

 * "git rev-list --verify-objects" ought to inspect the contents of
   objects and notice corrupted ones, but it didn't when the commit
   graph is in use, which has been corrected.
   (merge b27ccae34b jk/rev-list-verify-objects-fix later to maint).

 * More fixes to "add -p"
   (merge 64ec8efb83 js/builtin-add-p-portability-fix later to maint).

 * The parser in the script interface to parse-options in "git
   rev-parse" has been updated to diagnose a bogus input correctly.
   (merge f20b9c36d0 ow/rev-parse-parseopt-fix later to maint).

 * The code that manages list-object-filter structure, used in partial
   clones, leaked the instances, which has been plugged.
   (merge 66eede4a37 jk/plug-list-object-filter-leaks later to maint).

 * Fix another UI regression in the reimplemented "add -p".
   (merge f6f0ee247f rs/add-p-worktree-mode-prompt-fix later to maint).

 * "git fetch" over protocol v2 sent an incorrect ref prefix request
   to the server and made "git pull" with configured fetch refspec
   that does not cover the remote branch to merge with fail, which has
   been corrected.
   (merge 49ca2fba39 jk/proto-v2-ref-prefix-fix later to maint).

 * A result from opendir() was leaking in the commit-graph expiration
   codepath, which has been plugged.
   (merge 12f1ae5324 ml/commit-graph-expire-dir-leak-fix later to maint).

 * Just like we have coding guidelines, we now have guidelines for
   reviewers.
   (merge e01b851923 vd/doc-reviewing-guidelines later to maint).

 * Other code cleanup, docfix, build fix, etc.
   (merge 77b9e85c0f vd/fix-perf-tests later to maint).
   (merge 0682bc43f5 jk/test-crontab-fixes later to maint).
   (merge b46dd1726c cc/doc-trailer-whitespace-rules later to maint).

Log message:
git: updated to 2.37.0

Git v2.37 Release Notes
=======================

UI, Workflows & Features

 * "vimdiff[123]" mergetool drivers have been reimplemented with a
   more generic layout mechanism.

 * "git -v" and "git -h" are now understood as "git \ 
--version" and
   "git --help".

 * The temporary files fed to external diff command are now generated
   inside a new temporary directory under the same basename.

 * "git log --since=X" will stop traversal upon seeing a commit that
   is older than X, but there may be commits behind it that is younger
   than X when the commit was created with a faulty clock.  A new
   option is added to keep digging without stopping, and instead
   filter out commits with timestamp older than X.

 * "git -c branch.autosetupmerge=simple branch $A $B" will set the $B
   as $A's upstream only when $A and $B shares the same name, and "git
   -c push.default=simple" on branch $A would push to update the
   branch $A at the remote $B came from.  Also more places use the
   sole remote, if exists, before defaulting to 'origin'.

 * A new doc has been added that lists tips for tools to work with
   Git's codebase.

 * "git remote -v" now shows the list-objects-filter used during
   fetching from the remote, if available.

 * With the new http.curloptResolve configuration, the CURLOPT_RESOLVE
   mechanism that allows cURL based applications to use pre-resolved
   IP addresses for the requests is exposed to the scripts.

 * "git add -i" was rewritten in C some time ago and has been in
   testing; the reimplementation is now exposed to general public by
   default.

 * Deprecate non-cone mode of the sparse-checkout feature.

 * Introduce a filesystem-dependent mechanism to optimize the way the
   bits for many loose object files are ensured to hit the disk
   platter.

 * The "do not remove the directory the user started Git in" logic,
   when Git cannot tell where that directory is, is disabled.  Earlier
   we refused to run in such a case.

 * A mechanism to pack unreachable objects into a "cruft pack",
   instead of ejecting them into loose form to be reclaimed later, has
   been introduced.

 * Update the doctype written in gitweb output to xhtml5.

 * The "transfer.credentialsInURL" configuration variable controls what
   happens when a URL with embedded login credential is used on either
   "fetch" or "push". Credentials are currently only detected in
   `remote.<name>.url` config, not `remote.<name>.pushurl`.

 * "git revert" learns "--reference" option to use more \ 
human-readable
   reference to the commit it reverts in the message template it
   prepares for the user.

 * Various error messages that talk about the removal of
   "--preserve-merges" in "rebase" have been strengthened, \ 
and "rebase
   --abort" learned to get out of a state that was left by an earlier
   use of the option.

Performance, Internal Implementation, Development Support etc.

 * The performance of the "untracked cache" feature has been improved
   when "--untracked-files=<mode>" and \ 
"status.showUntrackedFiles"
   are combined.

 * "git stash" works better with sparse index entries.

 * "git show :<path>" learned to work better with the sparse-index
   feature.

 * Introduce and apply coccinelle rule to discourage an explicit
   comparison between a pointer and NULL, and applies the clean-up to
   the maintenance track.

 * Preliminary code refactoring around transport and bundle code.

 * "sparse-checkout" learns to work better with the sparse-index
   feature.

 * A workflow change for translators are being proposed.  git.pot is
   no longer version controlled and it is local responsibility of
   translators to generate it.

 * Plug the memory leaks from the trickiest API of all, the revision
   walker.

 * Rename .env_array member to .env in the child_process structure.

  * The fsmonitor--daemon handles even more corner cases when
    watching filesystem events.

 * A new bug() and BUG_if_bug() API is introduced to make it easier to
   uniformly log "detect multiple bugs and abort in the end" pattern.

Fixes since v2.36
-----------------

 * "git submodule update" without pathspec should silently skip an
   uninitialized submodule, but it started to become noisy by mistake.
   (merge 4f1ccef87c gc/submodule-update-part2 later to maint).

 * "diff-tree --stdin" has been broken for about a year, but 2.36
   release broke it even worse by breaking running the command with
   <pathspec>, which in turn broke "gitk" and got noticed.  This has
   been corrected by aligning its behaviour to that of "log".
   (merge f8781bfda3 jc/diff-tree-stdin-fix later to maint).

 * Regression fix for 2.36 where "git name-rev" started to sometimes
   reference strings after they are freed.
   (merge 45a14f578e rs/name-rev-fix-free-after-use later to maint).

 * "git show <commit1> <commit2>... -- <pathspec>" \ 
lost the pathspec
   when showing the second and subsequent commits, which has been
   corrected.
   (merge 5cdb38458e jc/show-pathspec-fix later to maint).

 * "git fast-export -- <pathspec>" lost the pathspec when showing the
   second and subsequent commits, which has been corrected.
   (merge d1c25272f5 rs/fast-export-pathspec-fix later to maint).

 * "git format-patch <args> -- <pathspec>" lost the \ 
pathspec when
   showing the second and subsequent commits, which has been
   corrected.
   (merge 91f8f7e46f rs/format-patch-pathspec-fix later to maint).

 * "git clone --origin X" leaked piece of memory that held value read
   from the clone.defaultRemoteName configuration variable, which has
   been plugged.
   (merge 6dfadc8981 jc/clone-remote-name-leak-fix later to maint).

 * Get rid of a bogus and over-eager coccinelle rule.
   (merge 08bdd3a185 jc/cocci-xstrdup-or-null-fix later to maint).

 * The path taken by "git multi-pack-index" command from the end user
   was compared with path internally prepared by the tool without first
   normalizing, which lead to duplicated paths not being noticed,
   which has been corrected.
   (merge 11f9e8de3d ds/midx-normalize-pathname-before-comparison later to maint).

 * Correct choices of C compilers used in various CI jobs.
   (merge 3506cae04f ab/cc-package-fixes later to maint).

 * Various cleanups to "git p4".
   (merge 4ff0108d9e jh/p4-various-fixups later to maint).

 * The progress meter of "git blame" was showing incorrect numbers
   when processing only parts of the file.
   (merge e5f5d7d42e ea/progress-partial-blame later to maint).

 * "git rebase --keep-base <upstream> <branch-to-rebase>" \ 
computed the
   commit to rebase onto incorrectly, which has been corrected.
   (merge 9e5ebe9668 ah/rebase-keep-base-fix later to maint).

 * Fix a leak of FILE * in an error codepath.
   (merge c0befa0c03 kt/commit-graph-plug-fp-leak-on-error later to maint).

 * Avoid problems from interaction between malloc_check and address
   sanitizer.
   (merge 067109a5e7 pw/test-malloc-with-sanitize-address later to maint).

 * The commit summary shown after making a commit is matched to what
   is given in "git status" not to use the break-rewrite heuristics.
   (merge 84792322ed rs/commit-summary-wo-break-rewrite later to maint).

 * Update a few end-user facing messages around EOL conversion.
   (merge c970d30c2c ah/convert-warning-message later to maint).

 * Trace2 documentation updates.
   (merge a6c80c313c js/trace2-doc-fixes later to maint).

 * Build procedure fixup.
   (merge 1fbfd96f50 mg/detect-compiler-in-c-locale later to maint).

 * "git pull" without "--recurse-submodules=<arg>" made
   submodule.recurse take precedence over fetch.recurseSubmodules by
   mistake, which has been corrected.
   (merge 5819417365 gc/pull-recurse-submodules later to maint).

 * "git bisect" was too silent before it is ready to start computing
   the actual bisection, which has been corrected.
   (merge f11046e6de cd/bisect-messages-from-pre-flight-states later to maint).

 * macOS CI jobs have been occasionally flaky due to tentative version
   skew between perforce and the homebrew packager.  Instead of
   failing the whole CI job, just let it skip the p4 tests when this
   happens.
   (merge f15e00b463 cb/ci-make-p4-optional later to maint).

 * A bit of test framework fixes with a few fixes to issues found by
   valgrind.
   (merge 7c898554d7 ab/valgrind-fixes later to maint).

 * "git archive --add-file=<path>" picked up the raw permission bits
   from the path and propagated to zip output in some cases, without
   normalization, which has been corrected (tar output did not have
   this issue).
   (merge 6a61661967 jc/archive-add-file-normalize-mode later to maint).

 * "make coverage-report" without first running "make \ 
coverage" did
   not produce any meaningful result, which has been corrected.
   (merge 96ddfecc5b ep/coverage-report-wants-test-to-have-run later to maint).

 * The "--current" option of "git show-branch" should have \ 
been made
   incompatible with the "--reflog" mode, but this was not enforced,
   which has been corrected.
   (merge 41c64ae0e7 jc/show-branch-g-current later to maint).

 * "git fetch" unnecessarily failed when an unexpected optional
   section appeared in the output, which has been corrected.
   (merge 7709acf7be jt/fetch-peek-optional-section later to maint).

 * The way "git fetch" without "--update-head-ok" ensures \ 
that HEAD in
   no worktree points at any ref being updated was too wasteful, which
   has been optimized a bit.
   (merge f7400da800 os/fetch-check-not-current-branch later to maint).

 * "git fetch --recurse-submodules" from multiple remotes (either from
   a remote group, or "--all") used to make one extra "git \ 
fetch" in
   the submodules, which has been corrected.
   (merge 0353c68818 jc/avoid-redundant-submodule-fetch later to maint).

 * With a recent update to refuse access to repositories of other
   people by default, "sudo make install" and "sudo git describe"
   stopped working, which has been corrected.
   (merge 6b11e3d52e cb/path-owner-check-with-sudo-plus later to maint).

 * The tests that ensured merges stop when interfering local changes
   are present did not make sure that local changes are preserved; now
   they do.
   (merge 4b317450ce jc/t6424-failing-merge-preserve-local-changes later to maint).

 * Some real problems noticed by gcc 12 have been fixed, while false
   positives have been worked around.

 * Update the version of FreeBSD image used in Cirrus CI.
   (merge c58bebd4c6 pb/use-freebsd-12.3-in-cirrus-ci later to maint).

 * The multi-pack-index code did not protect the packfile it is going
   to depend on from getting removed while in use, which has been
   corrected.
   (merge 4090511e40 tb/midx-race-in-pack-objects later to maint).

 * Teach "git repack --geometric" work better with \ 
"--keep-pack" and
   avoid corrupting the repository when packsize limit is used.
   (merge 66731ff921 tb/geom-repack-with-keep-and-max later to maint).

 * The documentation on the interaction between "--add-file" and
   "--prefix" options of "git archive" has been improved.
   (merge a75910602a rs/document-archive-prefix later to maint).

 * A git subcommand like "git add -p" spawns a separate git process
   while relaying its command line arguments.  A pathspec with only
   negative elements was mistakenly passed with an empty string, which
   has been corrected.
   (merge b02fdbc80a jc/all-negative-pathspec later to maint).

 * With a more targeted workaround in http.c in another topic, we may
   be able to lift this blanket "GCC12 dangling-pointer warning is
   broken and unsalvageable" workaround.
   (merge 419141e495 cb/buggy-gcc-12-workaround later to maint).

 * A misconfigured 'branch..remote' led to a bug in configuration
   parsing.
   (merge f1dfbd9ee0 gc/zero-length-branch-config-fix later to maint).

 * "git -c diff.submodule=log range-diff" did not show anything for
   submodules that changed in the ranges being compared, and
   "git -c diff.submodule=diff range-diff" did not work correctly.
   Fix this by including the "--submodule=short" output
   unconditionally to be compared.

 * In Git 2.36 we revamped the way how hooks are invoked.  One change
   that is end-user visible is that the output of a hook is no longer
   directly connected to the standard output of "git" that spawns the
   hook, which was noticed post release.  This is getting corrected.
   (merge a082345372 ab/hooks-regression-fix later to maint).

 * Updating the graft information invalidates the list of parents of
   in-core commit objects that used to be in the graft file.

 * "git show-ref --heads" (and "--tags") still iterated over \ 
all the
   refs only to discard refs outside the specified area, which has
   been corrected.
   (merge c0c9d35e27 tb/show-ref-optim later to maint).

 * Remove redundant copying (with index v3 and older) or possible
   over-reading beyond end of mmapped memory (with index v4) has been
   corrected.
   (merge 6d858341d2 zh/read-cache-copy-name-entry-fix later to maint).

 * Sample watchman interface hook sometimes failed to produce
   correctly formatted JSON message, which has been corrected.
   (merge 134047b500 sn/fsmonitor-missing-clock later to maint).

 * Use-after-free (with another forget-to-free) fix.
   (merge 323822c72b ab/remote-free-fix later to maint).

 * Remove a coccinelle rule that is no longer relevant.
   (merge b1299de4a1 jc/cocci-cleanup later to maint).

 * Other code cleanup, docfix, build fix, etc.
   (merge e6b2582da3 cm/reftable-0-length-memset later to maint).
   (merge 0b75e5bf22 ab/misc-cleanup later to maint).
   (merge 52e1ab8a76 ea/rebase-code-simplify later to maint).
   (merge 756d15923b sg/safe-directory-tests-and-docs later to maint).
   (merge d097a23bfa ds/do-not-call-bug-on-bad-refs later to maint).
   (merge c36c27e75c rs/t7812-pcre2-ws-bug-test later to maint).
   (merge 1da312742d gf/unused-includes later to maint).
   (merge 465b30a92d pb/submodule-recurse-mode-enum later to maint).
   (merge 82b28c4ed8 km/t3501-use-test-helpers later to maint).
   (merge 72315e431b sa/t1011-use-helpers later to maint).
   (merge 95b3002201 cg/vscode-with-gdb later to maint).
   (merge fbe5f6b804 tk/p4-utf8-bom later to maint).
   (merge 17f273ffba tk/p4-with-explicity-sync later to maint).
   (merge 944db25c60 kf/p4-multiple-remotes later to maint).
   (merge b014cee8de jc/update-ozlabs-url later to maint).
   (merge 4ec5008062 pb/ggg-in-mfc-doc later to maint).
   (merge af845a604d tb/receive-pack-code-cleanup later to maint).
   (merge 2acf4cf001 js/ci-gcc-12-fixes later to maint).
   (merge 05e280c0a6 jc/http-clear-finished-pointer later to maint).
   (merge 8c49d704ef fh/transport-push-leakfix later to maint).
   (merge 1d232d38bd tl/ls-tree-oid-only later to maint).
   (merge db7961e6a6 gc/document-config-worktree-scope later to maint).
   (merge ce18a30bb7 fs/ssh-default-key-command-doc later to maint).

Log message:
*: recursive bump for perl 5.36