Log message:
git: Update devel/git to 2.19.2

Changes:
Git v2.19.2 Release Notes
=========================
Fixes since v2.19.1
-------------------

 * "git interpret-trailers" and its underlying machinery had a buggy
   code that attempted to ignore patch text after commit log message,
   which triggered in various codepaths that will always get the log
   message alone and never get such an input.

 * "git rebase -i" did not clear the state files correctly when a run
   of "squash/fixup" is aborted and then the user manually amended the
   commit instead, which has been corrected.

 * When fsmonitor is in use, after operation on submodules updates
   .gitmodules, we lost track of the fact that we did so and relied on
   stale fsmonitor data.

 * Fix for a long-standing bug that leaves the index file corrupt when
   it shrinks during a partial commit.

 * Further fix for O_APPEND emulation on Windows

 * A corner case bugfix in "git rerere" code.

 * "git add ':(attr:foo)'" is not supported and is supposed to be
   rejected while the command line arguments are parsed, but we fail
   to reject such a command line upfront.

 * "git rebase" etc. in Git 2.19 fails to abort when given an empty
   commit log message as result of editing, which has been corrected.

 * The code to backfill objects in lazily cloned repository did not
   work correctly, which has been corrected.

 * Update error messages given by "git remote" and make them consistent.

 * "git update-ref" learned to make both "--no-deref" and \ 
"--stdin"
   work at the same time.

 * Recently added "range-diff" had a corner-case bug to cause it
   segfault, which has been corrected.

 * The recently introduced commit-graph auxiliary data is incompatible
   with mechanisms such as replace & grafts that "breaks" immutable
   nature of the object reference relationship.  Disable optimizations
   based on its use (and updating existing commit-graph) when these
   incompatible features are in use in the repository.

 * The mailmap file update.

 * The code in "git status" sometimes hit an assertion failure.  This
   was caused by a structure that was reused without cleaning the data
   used for the first run, which has been corrected.

 * A corner-case bugfix.

 * A partial clone that is configured to lazily fetch missing objects
   will on-demand issue a "git fetch" request to the originating
   repository to fill not-yet-obtained objects.  The request has been
   optimized for requesting a tree object (and not the leaf blob
   objects contained in it) by telling the originating repository that
   no blobs are needed.

 * The codepath to support the experimental split-index mode had
   remaining "racily clean" issues fixed.

 * "git log --graph" showing an octopus merge sometimes miscounted the
   number of display columns it is consuming to show the merge and its
   parent commits, which has been corrected.

 * The implementation of run_command() API on the UNIX platforms had a
   bug that caused a command not on $PATH to be found in the current
   directory.

 * A mutex used in "git pack-objects" were not correctly initialized
   and this caused "git repack" to dump core on Windows.

 * Under certain circumstances, "git diff D:/a/b/c D:/a/b/d" on
   Windows would strip initial parts from the paths because they
   were not recognized as absolute, which has been corrected.

 * The receive.denyCurrentBranch=updateInstead codepath kicked in even
   when the push should have been rejected due to other reasons, such
   as it does not fast-forward or the update-hook rejects it, which
   has been corrected.

 * "git repack" in a shallow clone did not correctly update the
   shallow points in the repository, leading to a repository that
   does not pass fsck.

 * Operations on promisor objects make sense in the context of only a
   small subset of the commands that internally use the revisions
   machinery, but the "--exclude-promisor-objects" option were taken
   and led to nonsense results by commands like "log", to which it
   didn't make much sense.  This has been corrected.

 * The "container" mode of TravisCI is going away.  Our .travis.yml
   file is getting prepared for the transition.

 * Our test scripts can now take the '-V' option as a synonym for the
   '--verbose-log' option.

 * A regression in Git 2.12 era made "git fsck" fall into an infinite
   loop while processing truncated loose objects.

Also contains various documentation updates and code clean-ups.

Log message:
Git: update to 2.19.1

These releases fix a security flaw (CVE-2018-17456), which allowed an
attacker to execute arbitrary code by crafting a malicious .gitmodules
file in a project cloned with --recurse-submodules.

When running "git clone --recurse-submodules", Git parses the supplied
.gitmodules file for a URL field and blindly passes it as an argument
to a "git clone" subprocess.  If the URL field is set to a string that
begins with a dash, this "git clone" subprocess interprets the URL as
an option.  This can lead to executing an arbitrary script shipped in
the superproject as the user who ran "git clone".

In addition to fixing the security issue for the user running "clone",
the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can
be used to detect such malicious repository content when fetching or
accepting a push. See "transfer.fsckObjects" in git-config(1).

Credit for finding and fixing this vulnerability goes to joernchen
and Jeff King, respectively.

Log message:
git: updated to 2.19.0

Git 2.19 Release Notes

Updates since v2.18
-------------------

UI, Workflows & Features

 * "git diff" compares the index and the working tree.  For paths
   added with intent-to-add bit, the command shows the full contents
   of them as added, but the paths themselves were not marked as new
   files.  They are now shown as new by default.

   "git apply" learned the "--intent-to-add" option so that an
   otherwise working-tree-only application of a patch will add new
   paths to the index marked with the "intent-to-add" bit.

 * "git grep" learned the "--column" option that gives not \ 
just the
   line number but the column number of the hit.

 * The "-l" option in "git branch -l" is an unfortunate \ 
short-hand for
   "--create-reflog", but many users, both old and new, somehow expect
   it to be something else, perhaps "--list".  This step warns when \ 
"-l"
   is used as a short-hand for "--create-reflog" and warns about the
   future repurposing of the it when it is used.

 * The userdiff pattern for .php has been updated.

 * The content-transfer-encoding of the message "git send-email" sends
   out by default was 8bit, which can cause trouble when there is an
   overlong line to bust RFC 5322/2822 limit.  A new option 'auto' to
   automatically switch to quoted-printable when there is such a line
   in the payload has been introduced and is made the default.

 * "git checkout" and "git worktree add" learned to honor
   checkout.defaultRemote when auto-vivifying a local branch out of a
   remote tracking branch in a repository with multiple remotes that
   have tracking branches that share the same names.
   (merge 8d7b558bae ab/checkout-default-remote later to maint).

 * "git grep" learned the "--only-matching" option.

 * "git rebase --rebase-merges" mode now handles octopus merges as
   well.

 * Add a server-side knob to skip commits in exponential/fibbonacci
   stride in an attempt to cover wider swath of history with a smaller
   number of iterations, potentially accepting a larger packfile
   transfer, instead of going back one commit a time during common
   ancestor discovery during the "git fetch" transaction.
   (merge 42cc7485a2 jt/fetch-negotiator-skipping later to maint).

 * A new configuration variable core.usereplacerefs has been added,
   primarily to help server installations that want to ignore the
   replace mechanism altogether.

 * Teach "git tag -s" etc. a few configuration variables (gpg.format
   that can be set to "openpgp" or "x509", and \ 
gpg.<format>.program
   that is used to specify what program to use to deal with the format)
   to allow x.509 certs with CMS via "gpgsm" to be used instead of
   openpgp via "gnupg".

 * Many more strings are prepared for l10n.

 * "git p4 submit" learns to ask its own pre-submit hook if it should
   continue with submitting.

 * The test performed at the receiving end of "git push" to prevent
   bad objects from entering repository can be customized via
   receive.fsck.* configuration variables; we now have gained a
   counterpart to do the same on the "git fetch" side, with
   fetch.fsck.* configuration variables.

 * "git pull --rebase=interactive" learned "i" as a \ 
short-hand for
   "interactive".

 * "git instaweb" has been adjusted to run better with newer Apache on
   RedHat based distros.

 * "git range-diff" is a reimplementation of "git tbdiff" \ 
that lets us
   compare individual patches in two iterations of a topic.

 * The sideband code learned to optionally paint selected keywords at
   the beginning of incoming lines on the receiving end.

 * "git branch --list" learned to take the default sort order from the
   'branch.sort' configuration variable, just like "git tag --list"
   pays attention to 'tag.sort'.

 * "git worktree" command learned "--quiet" option to make \ 
it less
   verbose.

Performance, Internal Implementation, Development Support etc.

 * The bulk of "git submodule foreach" has been rewritten in C.

 * The in-core "commit" object had an all-purpose "void \ 
*util" field,
   which was tricky to use especially in library-ish part of the
   code.  All of the existing uses of the field has been migrated to a
   more dedicated "commit-slab" mechanism and the field is eliminated.

 * A less often used command "git show-index" has been modernized.
   (merge fb3010c31f jk/show-index later to maint).

 * The conversion to pass "the_repository" and then \ 
"a_repository"
   throughout the object access API continues.

 * Continuing with the idea to programatically enumerate various
   pieces of data required for command line completion, teach the
   codebase to report the list of configuration variables
   subcommands care about to help complete them.

 * Separate "rebase -p" codepath out of "rebase -i" \ 
implementation to
   slim down the latter and make it easier to manage.

 * Make refspec parsing codepath more robust.

 * Some flaky tests have been fixed.

 * Continuing with the idea to programmatically enumerate various
   pieces of data required for command line completion, the codebase
   has been taught to enumerate options prefixed with "--no-" to
   negate them.

 * Build and test procedure for netrc credential helper (in contrib/)
   has been updated.

 * Remove unused function definitions and declarations from ewah
   bitmap subsystem.

 * Code preparation to make "git p4" closer to be usable with Python 3.

 * Tighten the API to make it harder to misuse in-tree .gitmodules
   file, even though it shares the same syntax with configuration
   files, to read random configuration items from it.

 * "git fast-import" has been updated to avoid attempting to create
   delta against a zero-byte-long string, which is pointless.

 * The codebase has been updated to compile cleanly with -pedantic
   option.
   (merge 2b647a05d7 bb/pedantic later to maint).

 * The character display width table has been updated to match the
   latest Unicode standard.
   (merge 570951eea2 bb/unicode-11-width later to maint).

 * test-lint now looks for broken use of "VAR=VAL shell_func" in test
   scripts.

 * Conversion from uchar[40] to struct object_id continues.

 * Recent "security fix" to pay attention to contents of \ 
".gitmodules"
   while accepting "git push" was a bit overly strict than necessary,
   which has been adjusted.

 * "git fsck" learns to make sure the optional commit-graph file is in
   a sane state.

 * "git diff --color-moved" feature has further been tweaked.

 * Code restructuring and a small fix to transport protocol v2 during
   fetching.

 * Parsing of -L[<N>][,[<M>]] parameters "git blame" and \ 
"git log"
   take has been tweaked.

 * lookup_commit_reference() and friends have been updated to find
   in-core object for a specific in-core repository instance.

 * Various glitches in the heuristics of merge-recursive strategy have
   been documented in new tests.

 * "git fetch" learned a new option "--negotiation-tip" to \ 
limit the
   set of commits it tells the other end as "have", to reduce wasted
   bandwidth and cycles, which would be helpful when the receiving
   repository has a lot of refs that have little to do with the
   history at the remote it is fetching from.

 * For a large tree, the index needs to hold many cache entries
   allocated on heap.  These cache entries are now allocated out of a
   dedicated memory pool to amortize malloc(3) overhead.

 * Tests to cover various conflicting cases have been added for
   merge-recursive.

 * Tests to cover conflict cases that involve submodules have been
   added for merge-recursive.

 * Look for broken "&&" chains that are hidden in subshell, many of
   which have been found and corrected.

 * The singleton commit-graph in-core instance is made per in-core
   repository instance.

 * "make DEVELOPER=1 DEVOPTS=pedantic" allows developers to compile
   with -pedantic option, which may catch more problematic program
   constructs and potential bugs.

 * Preparatory code to later add json output for telemetry data has
   been added.

 * Update the way we use Coccinelle to find out-of-style code that
   need to be modernised.

 * It is too easy to misuse system API functions such as strcat();
   these selected functions are now forbidden in this codebase and
   will cause a compilation failure.

 * Add a script (in contrib/) to help users of VSCode work better with
   our codebase.

 * The Travis CI scripts were taught to ship back the test data from
   failed tests.
   (merge aea8879a6a sg/travis-retrieve-trash-upon-failure later to maint).

 * The parse-options machinery learned to refrain from enclosing
   placeholder string inside a "<bra" and "ket>" pair \ 
automatically
   without PARSE_OPT_LITERAL_ARGHELP.  Existing help text for option
   arguments that are not formatted correctly have been identified and
   fixed.
   (merge 5f0df44cd7 rs/parse-opt-lithelp later to maint).

 * Noiseword "extern" has been removed from function decls in the
   header files.

 * A few atoms like %(objecttype) and %(objectsize) in the format
   specifier of "for-each-ref --format=<format>" can be filled \ 
without
   getting the full contents of the object, but just with the object
   header.  These cases have been optimized by calling
   oid_object_info() API (instead of reading and inspecting the data).

 * The end result of documentation update has been made to be
   inspected more easily to help developers.

 * The API to iterate over all objects learned to optionally list
   objects in the order they appear in packfiles, which helps locality
   of access if the caller accesses these objects while as objects are
   enumerated.

 * Improve built-in facility to catch broken &&-chain in the tests.

 * The more library-ish parts of the codebase learned to work on the
   in-core index-state instance that is passed in by their callers,
   instead of always working on the singleton "the_index" instance.

 * A test prerequisite defined by various test scripts with slightly
   different semantics has been consolidated into a single copy and
   made into a lazily defined one.
   (merge 6ec633059a wc/make-funnynames-shared-lazy-prereq later to maint).

 * After a partial clone, repeated fetches from promisor remote would
   have accumulated many packfiles marked with .promisor bit without
   getting them coalesced into fewer packfiles, hurting performance.
   "git repack" now learned to repack them.

 * Partially revert the support for multiple hash functions to regain
   hash comparison performance; we'd think of a way to do this better
   in the next cycle.

 * "git help --config" (which is used in command line completion)
   missed the configuration variables not described in the main
   config.txt file but are described in another file that is included
   by it, which has been corrected.

 * The test linter code has learned that the end of here-doc mark
   "EOF" can be quoted in a double-quote pair, not just in a
   single-quote pair.

Log message:
git: updated to 2.18.0

2.18.0:

UI, Workflows & Features

 * Rename detection logic that is used in "merge" and \ 
"cherry-pick" has
   learned to guess when all of x/a, x/b and x/c have moved to z/a,
   z/b and z/c, it is likely that x/d added in the meantime would also
   want to move to z/d by taking the hint that the entire directory
   'x' moved to 'z'.  A bug causing dirty files involved in a rename
   to be overwritten during merge has also been fixed as part of this
   work.  Incidentally, this also avoids updating a file in the
   working tree after a (non-trivial) merge whose result matches what
   our side originally had.

 * "git filter-branch" learned to use a different exit code to allow
   the callers to tell the case where there was no new commits to
   rewrite from other error cases.

 * When built with more recent cURL, GIT_SSL_VERSION can now specify
   "tlsv1.3" as its value.

 * "git gui" learned that "~/.ssh/id_ecdsa.pub" and
   "~/.ssh/id_ed25519.pub" are also possible SSH key files.
   (merge 2e2f0288ef bb/git-gui-ssh-key-files later to maint).

 * "git gui" performs commit upon CTRL/CMD+ENTER but the
   CTRL/CMD+KP_ENTER (i.e. enter key on the numpad) did not have the
   same key binding.  It now does.
   (merge 28a1d94a06 bp/git-gui-bind-kp-enter later to maint).

 * "git gui" has been taught to work with old versions of tk (like
   8.5.7) that do not support "ttk::style theme use" as a way to query
   the current theme.
   (merge 4891961105 cb/git-gui-ttk-style later to maint).

 * "git rebase" has learned to honor "--signoff" option when \ 
using
   backends other than "am" (but not "--preserve-merges").

 * "git branch --list" during an interrupted "rebase -i" now lets
   users distinguish the case where a detached HEAD is being rebased
   and a normal branch is being rebased.

 * "git mergetools" learned talking to guiffy.

 * The scripts in contrib/emacs/ have outlived their usefulness and
   have been replaced with a stub that errors out and tells the user
   there are replacements.

 * The new "working-tree-encoding" attribute can ask Git to convert the
   contents to the specified encoding when checking out to the working
   tree (and the other way around when checking in).

 * The "git config" command uses separate options e.g. "--int",
   "--bool", etc. to specify what type the caller wants the value to
   be interpreted as.  A new "--type=<typename>" option has been
   introduced, which would make it cleaner to define new types.

 * "git config --get" learned the "--default" option, to help the
   calling script.  Building on top of the above changes, the
   "git config" learns "--type=color" type.  Taken together, \ 
you can
   do things like "git config --get foo.color --default blue" and get
   the ANSI color sequence for the color given to foo.color variable,
   or "blue" if the variable does not exist.

 * "git ls-remote" learned an option to allow sorting its output based
   on the refnames being shown.

 * The command line completion (in contrib/) has been taught that "git
   stash save" has been deprecated ("git stash push" is the preferred
   spelling in the new world) and does not offer it as a possible
   completion candidate when "git stash push" can be.

 * "git gc --prune=nonsense" spent long time repacking and then
   silently failed when underlying "git prune --expire=nonsense"
   failed to parse its command line.  This has been corrected.

 * Error messages from "git push" can be painted for more visibility.

 * "git http-fetch" (deprecated) had an optional and experimental
   "feature" to fetch only commits and/or trees, which nobody used.
   This has been removed.

 * The functionality of "$GIT_DIR/info/grafts" has been superseded by
   the "refs/replace/" mechanism for some time now, but the internal
   code had support for it in many places, which has been cleaned up
   in order to drop support of the "grafts" mechanism.

 * "git worktree add" learned to check out an existing branch.

 * "git --no-pager cmd" did not have short-and-sweet single letter
   option. Now it does as "-P".
   (merge 7213c28818 js/no-pager-shorthand later to maint).

 * "git rebase" learned "--rebase-merges" to transplant the whole
   topology of commit graph elsewhere.

 * "git status" learned to pay attention to UI related diff
   configuration variables such as diff.renames.

 * The command line completion mechanism (in contrib/) learned to load
   custom completion file for "git $command" where $command is a
   custom "git-$command" that the end user has on the $PATH when using
   newer version of bash-completion.

 * "git send-email" can sometimes offer confirmation dialog "Send this
   email?" with choices 'Yes', 'No', 'Quit', and 'All'.  A new action
   'Edit' has been added to this dialog's choice.

 * With merge.renames configuration set to false, the recursive merge
   strategy can be told not to spend cycles trying to find renamed
   paths and merge them accordingly.

 * "git status" learned to honor a new status.renames configuration to
   skip rename detection, which could be useful for those who want to
   do so without disabling the default rename detection done by the
   "git diff" command.

 * Command line completion (in contrib/) learned to complete pathnames
   for various commands better.

 * "git blame" learns to unhighlight uninteresting metadata from the
   originating commit on lines that are the same as the previous one,
   and also paint lines in different colors depending on the age of
   the commit.

 * Transfer protocol v2 learned to support the partial clone.

 * When a short hexadecimal string is used to name an object but there
   are multiple objects that share the string as the prefix of their
   names, the code lists these ambiguous candidates in a help message.
   These object names are now sorted according to their types for
   easier eyeballing.

 * "git fetch $there $refspec" that talks over protocol v2 can take
   advantage of server-side ref filtering; the code has been extended
   so that this mechanism triggers also when fetching with configured
   refspec.

 * Our HTTP client code used to advertise that we accept gzip encoding
   from the other side; instead, just let cURL library to advertise
   and negotiate the best one.

 * "git p4" learned to "unshelve" shelved commit from P4.
   (merge 123f631761 ld/p4-unshelve later to maint).

Log message:
git: updated to 2.17.1

Git v2.17.1:

Fixes:

 * This release contains the same fixes made in the v2.13.7 version of
   Git, covering CVE-2018-11233 and 11235, and forward-ported to
   v2.14.4, v2.15.2 and v2.16.4 releases.  See release notes to
   v2.13.7 for details.

 * In addition to the above fixes, this release has support on the
   server side to reject pushes to repositories that attempt to create
   such problematic .gitmodules file etc. as tracked contents, to help
   hosting sites protect their customers by preventing malicious
   contents from spreading.

Log message:
git: updated to 2.17.0

Git 2.17:

UI, Workflows & Features
* "diff" family of commands learned \ 
"--find-object=<object-id>" option
  to limit the findings to changes that involve the named object.
* "git format-patch" learned to give 72-cols to diffstat, which is
  consistent with other line length limits the subcommand uses for
  its output meant for e-mails.
* The log from "git daemon" can be redirected with a new option; one
  relevant use case is to send the log to standard error (instead of
  syslog) when running it from inetd.
* "git rebase" learned to take "--allow-empty-message" option.
* "git am" has learned the "--quit" option, in addition to the
  existing "--abort" option; having the pair mirrors a few other
  commands like "rebase" and "cherry-pick".
* "git worktree add" learned to run the post-checkout hook, just like
  "git clone" runs it upon the initial checkout.
* "git tag" learned an explicit "--edit" option that allows the
  message given via "-m" and "-F" to be further edited.
* "git fetch --prune-tags" may be used as a handy short-hand for
  getting rid of stale tags that are locally held.
* The new "--show-current-patch" option gives an end-user facing way
  to get the diff being applied when "git rebase" (and "git am")
  stops with a conflict.
* "git add -p" used to offer "/" (look for a matching hunk) as a
  choice, even there was only one hunk, which has been corrected.
  Also the single-key help is now given only for keys that are
  enabled (e.g. help for '/' won't be shown when there is only one
  hunk).
* Since Git 1.7.9, "git merge" defaulted to --no-ff (i.e. even when
  the side branch being merged is a descendant of the current commit,
  create a merge commit instead of fast-forwarding) when merging a
  tag object.  This was appropriate default for integrators who pull
  signed tags from their downstream contributors, but caused an
  unnecessary merges when used by downstream contributors who
  habitually "catch up" their topic branches with tagged releases
  from the upstream.  Update "git merge" to default to --no-ff only
  when merging a tag object that does *not* sit at its usual place in
  refs/tags/ hierarchy, and allow fast-forwarding otherwise, to
  mitigate the problem.
* "git status" can spend a lot of cycles to compute the relation
  between the current branch and its upstream, which can now be
  disabled with "--no-ahead-behind" option.
* "git diff" and friends learned funcname patterns for Go language
  source files.
* "git send-email" learned "--reply-to=<address>" option.
* Funcname pattern used for C# now recognizes "async" keyword.
* In a way similar to how "git tag" learned to honor the pager
  setting only in the list mode, "git config" learned to ignore the
  pager setting when it is used for setting values (i.e. when the
  purpose of the operation is not to "show").

Performance, Internal Implementation, Development Support etc.
* More perf tests for threaded grep
* "perf" test output can be sent to codespeed server.
* The build procedure for perl/ part has been greatly simplified by
  weaning ourselves off of MakeMaker.
* Perl 5.8 or greater has been required since Git 1.7.4 released in
  2010, but we continued to assume some core modules may not exist and
  used a conditional "eval { require <<module>> }"; we no \ 
longer do
  this.  Some platforms (Fedora/RedHat/CentOS, for example) ship Perl
  without all core modules by default (e.g. Digest::MD5, File::Temp,
  File::Spec, Net::Domain, Net::SMTP).  Users on such platforms may
  need to install these additional modules.
* As a convenience, we install copies of Perl modules we require which
  are not part of the core Perl distribution (e.g. Error and
  Mail::Address).  Users and packagers whose operating system provides
  these modules can set NO_PERL_CPAN_FALLBACKS to avoid installing the
  bundled modules.
* In preparation for implementing narrow/partial clone, the machinery
  for checking object connectivity used by gc and fsck has been
  taught that a missing object is OK when it is referenced by a
  packfile specially marked as coming from trusted repository that
  promises to make them available on-demand and lazily.
* The machinery to clone & fetch, which in turn involves packing and
  unpacking objects, has been told how to omit certain objects using
  the filtering mechanism introduced by another topic.  It now knows
  to mark the resulting pack as a promisor pack to tolerate missing
  objects, laying foundation for "narrow" clones.
* The first step to getting rid of mru API and using the
  doubly-linked list API directly instead.
* Retire mru API as it does not give enough abstraction over
  underlying list API to be worth it.
* Rewrite two more "git submodule" subcommands in C.
* The tracing machinery learned to report tweaking of environment
  variables as well.
* Update Coccinelle rules to catch and optimize strbuf_addf(&buf, \ 
"%s", str)
* Prevent "clang-format" from breaking line after function return type.
* The sequencer infrastructure is shared across "git cherry-pick",
  "git rebase -i", etc., and has always spawned "git commit" \ 
when it
  needs to create a commit.  It has been taught to do so internally,
  when able, by reusing the codepath "git commit" itself uses, which
  gives performance boost for a few tens of percents in some sample
  scenarios.
* Push the submodule version of collision-detecting SHA-1 hash
  implementation a bit harder on builders.
* Avoid mmapping small files while using packed refs (especially ones
  with zero size, which would cause later munmap() to fail).
* Conversion from uchar[20] to struct object_id continues.
* More tests for wildmatch functions.
* The code to binary search starting from a fan-out table (which is
  how the packfile is indexed with object names) has been refactored
  into a reusable helper.
* We now avoid using identifiers that clash with C++ keywords.  Even
  though it is not a goal to compile Git with C++ compilers, changes
  like this help use of code analysis tools that targets C++ on our
  codebase.
* The executable is now built in 'script' phase in Travis CI integration,
  to follow the established practice, rather than during 'before_script'
  phase.  This allows the CI categorize the failures better ('failed'
  is project's fault, 'errored' is build environment's).
* Writing out the index file when the only thing that changed in it
  is the untracked cache information is often wasteful, and this has
  been optimized out.
* Various pieces of Perl code we have have been cleaned up.
* Internal API clean-up to allow write_locked_index() optionally skip
  writing the in-core index when it is not modified.

Log message:
git: updated to 2.16.3

Git v2.16.3 Release Notes

* "git status" after moving a path in the working tree (hence making
  it appear "removed") and then adding with the -N option (hence
  making that appear "added") detected it as a rename, but did not
  report the  old and new pathnames correctly.

* "git commit --fixup" did not allow "-m<message>" \ 
option to be used
  at the same time; allow it to annotate resulting commit with more
  text.

* When resetting the working tree files recursively, the working tree
  of submodules are now also reset to match.

* Fix for a commented-out code to adjust it to a rather old API change
  around object ID.

* When there are too many changed paths, "git diff" showed a warning
  message but in the middle of a line.

* The http tracing code, often used to debug connection issues,
  learned to redact potentially sensitive information from its output
  so that it can be more safely sharable.

* Crash fix for a corner case where an error codepath tried to unlock
  what it did not acquire lock on.

* The split-index mode had a few corner case bugs fixed.

* Assorted fixes to "git daemon".

* Completion of "git merge -s<strategy>" (in contrib/) did not work
  well in non-C locale.

* Workaround for segfault with more recent versions of SVN.

* Recently introduced leaks in fsck have been plugged.

* Travis CI integration now builds the executable in 'script' phase
  to follow the established practice, rather than during
  'before_script' phase.  This allows the CI categorize the failures
  better ('failed' is project's fault, 'errored' is build
  environment's).

Log message:
git: updated to 2.16.2

Git v2.16.2 Release Notes

Fixes since v2.16.1

 * An old regression in "git describe --all $annotated_tag^0" has been
   fixed.

 * "git svn dcommit" did not take into account the fact that a
   svn+ssh:// URL with a username@ (typically used for pushing) refers
   to the same SVN repository without the username@ and failed when
   svn.pushmergeinfo option is set.

 * "git merge -Xours/-Xtheirs" learned to use our/their version when
   resolving a conflicting updates to a symbolic link.

 * "git clone $there $here" is allowed even when here directory exists
   as long as it is an empty directory, but the command incorrectly
   removed it upon a failure of the operation.

 * "git stash -- <pathspec>" incorrectly blew away untracked files in
   the directory that matched the pathspec, which has been corrected.

 * "git add -p" was taught to ignore local changes to submodules as
   they do not interfere with the partial addition of regular changes
   anyway.

Log message:
git: updated to 2.16.1

Git v2.16.1 Release Notes

Fixes since v2.16
* "git clone" segfaulted when cloning a project that happens to
  track two paths that differ only in case on a case insensitive
  filesystem.

Log message:
git: updated to 2.16.0

Git 2.16 Release Notes
Backward compatibility notes and other notable changes.
 * Use of an empty string as a pathspec element that is used for
   'everything matches' is now an error.

Updates since v2.15
UI, Workflows & Features

 * An empty string as a pathspec element that means "everything"
   i.e. 'git add ""', is now illegal.  We started this by first
   deprecating and warning a pathspec that has such an element in
   2.11 (Nov 2016).

 * A hook script that is set unexecutable is simply ignored.  Git
   notifies when such a file is ignored, unless the message is
   squelched via advice.ignoredHook configuration.

 * "git pull" has been taught to accept "--[no-]signoff" \ 
option and
   pass it down to "git merge".

 * The "--push-option=<string>" option to "git push" \ 
now defaults to a
   list of strings configured via push.pushOption variable.

 * "gitweb" checks if a directory is searchable with Perl's "-x"
   operator, which can be enhanced by using "filetest 'access'"
   pragma, which now we do.

 * "git stash save" has been deprecated in favour of "git stash \ 
push".

 * The set of paths output from "git status --ignored" was tied
   closely with its "--untracked=<mode>" option, but now it can be
   controlled more flexibly.  Most notably, a directory that is
   ignored because it is listed to be ignored in the ignore/exclude
   mechanism can be handled differently from a directory that ends up
   to be ignored only because all files in it are ignored.

 * The remote-helper for talking to MediaWiki has been updated to
   truncate an overlong pagename so that ".mw" suffix can still be
   added.

 * The remote-helper for talking to MediaWiki has been updated to
   work with mediawiki namespaces.

 * The "--format=..." option "git for-each-ref" takes \ 
learned to show
   the name of the 'remote' repository and the ref at the remote side
   that is affected for 'upstream' and 'push' via "%(push:remotename)"
   and friends.

 * Doc and message updates to teach users "bisect view" is a synonym
   for "bisect visualize".

 * "git bisect run" that did not specify any command to run used to go
   ahead and treated all commits to be tested as 'good'.  This has
   been corrected by making the command error out.

 * The SubmittingPatches document has been converted to produce an
   HTML version via AsciiDoc/Asciidoctor.

 * We learned to optionally talk to a file system monitor via new
   fsmonitor extension to speed up "git status" and other operations
   that need to see which paths have been modified.  Currently we only
   support "watchman".  See File System Monitor section of
   git-update-index(1) for more detail.

 * The "diff" family of commands learned to ignore differences in
   carriage return at the end of line.

 * Places that know about "sendemail.to", like documentation and shell
   completion (in contrib/) have been taught about "sendemail.tocmd",
   too.

 * "git add --renormalize ." is a new and safer way to record the fact
   that you are correcting the end-of-line convention and other
   "convert_to_git()" glitches in the in-repository data.

 * "git branch" and "git checkout -b" are now forbidden from \ 
creating
   a branch whose name is "HEAD".

 * "git branch --list" learned to show its output through the pager by
   default when the output is going to a terminal, which is controlled
   by the pager.branch configuration variable.  This is similar to a
   recent change to "git tag --list".

 * "git grep -W", "git diff -W" and their friends learned a \ 
heuristic
   to extend a pre-context beyond the line that matches the "function
   pattern" (aka "diff.*.xfuncname") to include a comment block, if
   exists, that immediately precedes it.

 * "git config --expiry-date gc.reflogexpire" can read \ 
"2.weeks" from
   the configuration and report it as a timestamp, just like "--int"
   would read "1k" and report 1024, to help consumption by scripts.

 * The shell completion (in contrib/) learned that "git pull" can take
   the "--autostash" option.

 * The tagnames "git log --decorate" uses to annotate the commits can
   now be limited to subset of available refs with the two additional
   options, --decorate-refs[-exclude]=<pattern>.

 * "git grep" compiled with libpcre2 sometimes triggered a segfault,
   which is being fixed.

 * "git send-email" tries to see if the sendmail program is available
   in /usr/lib and /usr/sbin; extend the list of locations to be
   checked to also include directories on $PATH.

 * "git diff" learned, "--anchored", a variant of the \ 
"--patience"
   algorithm, to which the user can specify which 'unique' line to be
   used as anchoring points.

 * The way "git worktree add" determines what branch to create from
   where and checkout in the new worktree has been updated a bit.

 * Ancient part of codebase still shows dots after an abbreviated
   object name just to show that it is not a full object name, but
   these ellipses are confusing to people who newly discovered Git
   who are used to seeing abbreviated object names and find them
   confusing with the range syntax.

 * With a configuration variable rebase.abbreviateCommands set,
   "git rebase -i" produces the todo list with a single-letter
   command names.

 * "git worktree add" learned to run the post-checkout hook, just like
   "git checkout" does, after the initial checkout.

 * "git svn" has been updated to strip CRs in the commit messages, as
   recent versions of Subversion rejects them.

 * "git imap-send" did not correctly quote the folder name when
   making a request to the server, which has been corrected.

 * Error messages from "git rebase" have been somewhat cleaned up.

 * Git has been taught to support an https:// URL used for http.proxy
   when using recent versions of libcurl.

 * "git merge" learned to pay attention to merge.verifySignatures
   configuration variable and pretend as if '--verify-signatures'
   option was given from the command line.

 * "git describe" was taught to dig trees deeper to find a
   <commit-ish>:<path> that refers to a given blob object.