Update dependency git-lfs/git-lfs to v3.7.1 #1270
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v3.5.1→v3.7.1Release Notes
git-lfs/git-lfs (git-lfs/git-lfs)
v3.7.1Compare Source
This release introduces security fixes for Linux, macOS, and Windows
systems, which have been collectively assigned CVE-2025-26625.
When populating a Git repository's working tree with the contents of
Git LFS objects, certain Git LFS commands may write to files visible
outside the current Git working tree if symbolic or hard links exist
which collide with the paths of files tracked by Git LFS.
Git LFS has resolved this problem by revising the
git lfs checkoutandgit lfs pullcommands so that they check for symbolic links in the samemanner as performed by Git before writing to files in the working tree.
These commands now also remove existing files in the working tree before
writing new files in their place.
As well, Git LFS has resolved a problem whereby the
git lfs checkoutandgit lfs pullcommands, when run in a bare repository, could write tofiles visible outside the repository. While a specific and relatively
unlikely set of conditions were required for this to occur, it is no
longer possible under any circumstances.
We would like to extend a special thanks to the following open-source
contributors:
Bugs
Misc
Packages
Up to date packages are available on PackageCloud and Homebrew.
RPM RHEL 8/Rocky Linux 8
RPM RHEL 9/Rocky Linux 9
RPM RHEL 10/Rocky Linux 10
Debian 11
Debian 12
SHA-256 hashes:
git-lfs-darwin-amd64-v3.7.1.zip
b5b1b641c0648c83661fa9eda991cd3eff945264dabc2cdf411a80dfe7ec0970
git-lfs-darwin-arm64-v3.7.1.zip
76260fb34f4ee622ff0a66b857e5954aa49c7e343a92e57a1ec4a760618c94b2
git-lfs-freebsd-386-v3.7.1.tar.gz
811cf7b7d459ba507e01d01172b05f5bfea2fce9b6b9a22a98f8de87dfd4d1da
git-lfs-freebsd-amd64-v3.7.1.tar.gz
50931d36415a80f5bd427cbb1e283d4c825a1b24fa6da0481c9fa1b5f5803c6f
git-lfs-linux-386-v3.7.1.tar.gz
a49eed4612d9a33db848db8cb9079b15d5f3116bbca2c1a11cb89a70e3218921
git-lfs-linux-amd64-v3.7.1.tar.gz
1c0b6ee5200ca708c5cebebb18fdeb0e1c98f1af5c1a9cba205a4c0ab5a5ec08
git-lfs-linux-arm-v3.7.1.tar.gz
567002d2735ceb0e876e326736f1b72895931d5ac156002cc8561b072a4ce9a3
git-lfs-linux-arm64-v3.7.1.tar.gz
73a9c90eeb4312133a63c3eaee0c38c019ea7bfa0953d174809d25b18588dd8d
git-lfs-linux-loong64-v3.7.1.tar.gz
10c300a81968b070e331d36abcf21da18e478b17f4a61c009eb9d2b50374132c
git-lfs-linux-ppc64le-v3.7.1.tar.gz
100fbefdd86722dafd56737121510289ece9574c7bb8ec01b4633f8892acc427
git-lfs-linux-riscv64-v3.7.1.tar.gz
4e17b28e64416b680a68cb2ac3e3514cecb86548603c78774519b26686683928
git-lfs-linux-s390x-v3.7.1.tar.gz
d4b68db5d7cc34395b8d6c392326aeff98a297bde2053625560df6c76eb97c69
git-lfs-v3.7.1.tar.gz
8f56058622edfea1d111e50e9844ef2f5ce670b2dbe4d55d48e765c943af4351
git-lfs-windows-386-v3.7.1.zip
06c05c06523abf3930301b3022527ad881b1a7f8bf036ed6d93c8e68569041bb
git-lfs-windows-amd64-v3.7.1.zip
8683cdc3d6c029b49393dcebbaa6265bd6efd9abdcf837be855b4cd42e5e80b6
git-lfs-windows-arm64-v3.7.1.zip
9441383a3928a7f387223711929292a46ace95580ceed443d61e7b8a4d9615c3
git-lfs-windows-v3.7.1.exe
bcd9a40a1ab8e9bdb948d05b736c8129001ba167627d04384aa68086847830a9
hashes.asc
5b28310a24b404f241a6ce25bf528918a4192a7fff083c1b14779bff3a6e8729
sha256sums.asc
4b34ca0f37ff3955a4b8e217b75d4a0b744a13ee6d442989f7ae3c6e7cec07eb
v3.7.0Compare Source
This release is a feature release which introduces several new options
for fetching Git LFS objects, such as the ability to force objects to
be re-downloaded and the capacity to output object URLs and HTTP
metadata in JSON for external tools to consume. This release also adds
a configurable in-memory cache of file path pattern matches, which along
with other changes can help reduce the time required to migrate large
repositories to Git LFS.
Git LFS now supports the same
.netrcfiles on Windows as Git andcurl, retries appropriately after all 429 status code HTTP responses,
permits the use of symbolic links to Git's object storage during
Git LFS migrations, and avoids spurious TLS verification errors when
custom CA certificates are configured on macOS.
Note that the v3.7.x series of Git LFS releases are the first for which
we provide packages and support for versions of Linux distributions
based on Red Hat Enterprise Linux (RHEL) 10, such as Rocky Linux 10.
Note also that beginning with this release, we no longer provide packages
or support for versions of any Linux distribution based on Debian 10
("buster"), RHEL/CentOS 7, or SUSE Linux Enterprise Server (SLES) 12.
This release is built using Go v1.24 and therefore on Linux systems
now requires Linux kernel version 3.2 or later.
We would like to extend a special thanks to the following open-source
contributors:
migratecommandcheckoutcommandmigratecommand.netrcfile support on WindowsprunecommandfetchcommandFeatures
--refetchoption tofetch#5975 (@redsun82)--jsonoption tofetch#5974 (@redsun82)--dry-runoption tofetch#5973 (@redsun82)Bugs
.git/objectsis a symlink #6042 (@bk2204)Retry-Afterheaders #6014 (@chrisd8088)Misc
Makefilepatterns for manual pages #6032 (@chrisd8088)golang.org/x/netfrom 0.23.0 to 0.33.0 #5940 (@gergelyfabian)Packages
Up to date packages are available on PackageCloud and Homebrew.
RPM RHEL 8/Rocky Linux 8
RPM RHEL 9/Rocky Linux 9
RPM RHEL 10/Rocky Linux 10
Debian 11
Debian 12
SHA-256 hashes:
git-lfs-darwin-amd64-v3.7.0.zip
eab348c3985c55b013d5536965b7a102b2925acf09fbf11bf157e64a7e92b798
git-lfs-darwin-arm64-v3.7.0.zip
34ca9df7031061b8471d53076cb76a974768937a209c3fcaa3de6270ec6465ea
git-lfs-freebsd-386-v3.7.0.tar.gz
f4c23fe8fe327603c98057edf09c4fed5f45dca6ba9f32376330f9ec8333a306
git-lfs-freebsd-amd64-v3.7.0.tar.gz
55f56709a49d2621c7615f95c995e502eba5006526e864a682b829ea6fa2cf69
git-lfs-linux-386-v3.7.0.tar.gz
9f0d30fb796b14ea2f2a8c238a8e9e6300457f1a97ea2cefb76146d0b7c2e81f
git-lfs-linux-amd64-v3.7.0.tar.gz
e7ebba491af8a54e560be3a00666fa97e4cf2bbbb223178a0934b8ef74cf9bed
git-lfs-linux-arm-v3.7.0.tar.gz
52438d6522888f36278ec0ff0e3f51849c818f35ffecae999a6daf2fa2cb1c8a
git-lfs-linux-arm64-v3.7.0.tar.gz
88c24cb0c772cb6570e70f336ef4bb7b6539c5fb9ebeda563e9a5458ca82a98e
git-lfs-linux-loong64-v3.7.0.tar.gz
eef9b30f1feb5ac78df82a40ed1b0e79623bd8a77e1b570812bc7b5a4ec04982
git-lfs-linux-ppc64le-v3.7.0.tar.gz
a4a79bd135e7be4d7fedfeb0d8e358f453911d5478a349c8c2ecff07d2ebb2c2
git-lfs-linux-riscv64-v3.7.0.tar.gz
4b2244431525b4e25767ed034d0bd49856d3017456d85828e3da7ebf34e9730b
git-lfs-linux-s390x-v3.7.0.tar.gz
5f3c1167df6f50fe88bea1e17fa8291d85fe5a214ad7326511ec929c09a54ad9
git-lfs-v3.7.0.tar.gz
d078b8393514c65c485d1628e610449ba048af746749912bd082d818b2454348
git-lfs-windows-386-v3.7.0.zip
ea8c5fe2125650fbe6e00b27d139511965b77c2f5f017cb1345b67804de00803
git-lfs-windows-amd64-v3.7.0.zip
10be221ee5a76c6f4fc4d5b0c84d9b6f97b0db4815fb39a1b9579f04d37379ec
git-lfs-windows-arm64-v3.7.0.zip
ec56aef19f3bcd33a239046a82b81a9844db2f66294434c5c54a470aa28ee669
git-lfs-windows-v3.7.0.exe
70a30e7218fa945efbffc8305bcf7308551312b34e193bdb3509dee20367a10e
hashes.asc
1e0b6cd06aa73d799b5a3e18310a01d89b6b98df11ebb7acd9a623111657e4d7
sha256sums.asc
05edaa00a72f6eeea3d6cea1a5a6ed35b468e6942ceb741d9e29eb366bc4080a
v3.6.1Compare Source
This release introduces a security fix for all platforms, which has been assigned CVE-2024-53263.
When requesting credentials from Git for a remote host, prior versions of Git LFS passed portions of the host's URL to the
git-credential(1)command without checking for embedded line-ending control characters, and then sent any credentials received back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker might have been able to retrieve a user's Git credentials.Git LFS now prevents bare line feed (LF) characters from being included in the values sent to the
git-credential(1)command, and also prevents bare carriage return (CR) characters from being included unless thecredential.protectProtocolconfiguration option is set to a value equivalent tofalse.We would like to extend a special thanks to the following open-source contributors:
Bugs
Packages
Up to date packages are available on PackageCloud and Homebrew.
RPM RHEL 7/CentOS 7
RPM RHEL 8/Rocky Linux 8
RPM RHEL 9/Rocky Linux 9
Debian 10
Debian 11
Debian 12
SHA-256 hashes:
git-lfs-darwin-amd64-v3.6.1.zip
b53c361e6c85479507ed39ba99b87ec0888ac52f5afd2084fc68af4103081391
git-lfs-darwin-arm64-v3.6.1.zip
83b4ea3b0c72ba19e3bc46e47e92476f4505cc96693333b9fa0a314dddacc4ba
git-lfs-freebsd-386-v3.6.1.tar.gz
976e6123166ad54cd752a70a50f10d3cac22d35afc622f9ad1129320dc463bce
git-lfs-freebsd-amd64-v3.6.1.tar.gz
77c58f7d9ff207efa371fcf048900fa404d12393434c23c767a2f7dbabd0d8e1
git-lfs-linux-386-v3.6.1.tar.gz
62dd22e2cde54c051faaf58b5432f033a0cb6bf366d00648b1bc1b9ed1e819e1
git-lfs-linux-amd64-v3.6.1.tar.gz
2138d2e405a12f1a088272e06790b76699b79cb90d0317b77aafaf35de908d76
git-lfs-linux-arm-v3.6.1.tar.gz
7e3e7df9d7cc663efab9d996c67af17d99afe8b0ce2fc002703cac0b8826f4f7
git-lfs-linux-arm64-v3.6.1.tar.gz
1c2720ff53528fbe769633d448d830aa7b682141e3c4f6a9f26b9cf3b2548d0a
git-lfs-linux-loong64-v3.6.1.tar.gz
0135b9fa6c8a13d4c7cec6e434b6cc4391b74321aa13743dd7e8f14bd33648f8
git-lfs-linux-ppc64le-v3.6.1.tar.gz
86d42801b6e70522560eb3e33c0512f9733b3dad1ca08471cd135f445029cdfb
git-lfs-linux-riscv64-v3.6.1.tar.gz
e26adb02957e859385159d60dd642b800a265d3fcd38590266d3428aefb4ddba
git-lfs-linux-s390x-v3.6.1.tar.gz
c9aa0391ac58c5ed695fceec891c953d12fe78ae31ecbd5fd3cb4204cf8273a9
git-lfs-v3.6.1.tar.gz
1417b7ee9a8fba8d649a89f070fdcde8b2593ca2caa74e3e808d2bb35d5ca5f7
git-lfs-windows-386-v3.6.1.zip
74fd0d4c9ea314719b6890667b0e528c4467726e1a7302e68221afba806a69b5
git-lfs-windows-amd64-v3.6.1.zip
aaca788e04f91676e58654d5ecf96cf03c76768a63b3a6918281a9678884c20c
git-lfs-windows-arm64-v3.6.1.zip
ad40ab00a73ef4bf63c969472d0e5a824686b495dbc01ea8e9e4cc456c49a4b0
git-lfs-windows-v3.6.1.exe
5492bd2d7b37fcb821f48cac17895feb2506d26ad4cde996a30940e86dfecc27
hashes.asc
a5d1256409e83743608fdc43716bd1dc2fbffe00b5f116016d5886187874dcab
sha256sums.asc
4f16f1db8a18631ac9b21cce1545a692373e2b5edc8e211cd959c447d14dfef2
v3.6.0Compare Source
This release is a feature release which includes support for multi-stage
authentication with Git credential helpers (requires Git 2.46.0) and
relative worktree paths (requires Git 2.48.0), a new object transfer batch
size configuration option, better path handling when installing on Windows,
more POSIX-compliant hook scripts, and improved performance with sparse
checkouts, partial clones, and Git remotes with large numbers of tags.
Note that the 3.6.x series of Git LFS releases will be the last releases
for which we provide packages or support for versions of any Linux
distribution based on either Red Hat Enterprise Linux 7 (RHEL 7) or
SUSE Linux Enterprise Server 12 (SLES 12).
Note also that the 3.6.x series of Git LFS releases may be the last
releases for which we provide packages or support for versions of any
Linux distribution based on Debian 10 ("buster").
This release is built using Go v1.23 and therefore on macOS systems
requires macOS 11 (Big Sur) or later, and on Windows systems requires
at least Windows 10 or Windows Server 2016 (although Windows 8.1 may
suffice).
We would like to extend a special thanks to the following open-source
contributors:
Features
PATHcase insensitively in Windows installer #5680 (@bk2204)Bugs
Misc
charsetparameter inContent-Typeheader #5778 (@chrisd8088)Packages
Up to date packages are available on PackageCloud and Homebrew.
RPM RHEL 7/CentOS 7
RPM RHEL 8/Rocky Linux 8
RPM RHEL 9/Rocky Linux 9
Debian 10
Debian 11
Debian 12
SHA-256 hashes:
git-lfs-darwin-amd64-v3.6.0.zip
80db8e51418816a1d44859b39678c1722b2e3d52894623d6a138b67d52d0ee5c
git-lfs-darwin-arm64-v3.6.0.zip
6d602e04f307f4129d7a4dd8c199c06d53d77555e08164297d943a9acc4afe02
git-lfs-freebsd-386-v3.6.0.tar.gz
52297aacd95b5378e7054b1e5037d18942662b349ff4ac21c3b11dd48306e513
git-lfs-freebsd-amd64-v3.6.0.tar.gz
9621f2d7c935b422d84e9d70ab76694301d8ff2a408c2c6c68e91d5831f1b67f
git-lfs-linux-386-v3.6.0.tar.gz
10da3c2ec46aa76287653a8d8576c271701d1fa899432f5bc3ace2a33c2116f0
git-lfs-linux-amd64-v3.6.0.tar.gz
fff4746159aa7a7b42ef1aa30fed03b534df48a7dbe116d65296c0f0c43c594d
git-lfs-linux-arm-v3.6.0.tar.gz
bc7190755703017d193bee182a4edbf610d6df6d006d6fdd6ad411d552468456
git-lfs-linux-arm64-v3.6.0.tar.gz
9509504b3b825054c3d07af5edc1cc9c00732c6f0fd4a060f04bfbf0f1279fca
git-lfs-linux-loong64-v3.6.0.tar.gz
f80f2e31b9d5725ccabba1e82bfca0261650eb7fa4edd1125f29eab06f0f5dd1
git-lfs-linux-ppc64le-v3.6.0.tar.gz
30b05a380d7015d9ddb9e52b9feedc77a693ee474f36dd9bbca9034ea61116d4
git-lfs-linux-riscv64-v3.6.0.tar.gz
689ecb0f6e96d731ec3424bea0f4aeeb26225dbe44b9b87762baa9ec9d7820f7
git-lfs-linux-s390x-v3.6.0.tar.gz
e54b21c445ac00b4528657d422fd46cea770303a41bf49523313a1fc85b8ec69
git-lfs-v3.6.0.tar.gz
9a5d2a598b4096f0fdde5b2ead6038996c657acafe5a89d22b8c2f1b56aeaf36
git-lfs-windows-386-v3.6.0.zip
58b3029f60d51b8775a0cbb21a39b8504967577a8bb4b3feabb1f1a48bf7fb33
git-lfs-windows-amd64-v3.6.0.zip
62fce4cfd453493966c387db167ba1aa46ecee730ae24a5b902a1d05650fb4ce
git-lfs-windows-arm64-v3.6.0.zip
6e8d6051760bd90372ed7dfcace02f80dddec374bab61b9525e263722f97de7b
git-lfs-windows-v3.6.0.exe
ca1c562d22439d3d6a80957d2b21f6633611db494f1251a46d18d7fa7aea52cd
hashes.asc
d7f8aaba8be9450927a651f10b6c2adbf1b9ec25ec9f9c9b0f14393cefcba9c6
sha256sums.asc
15d2e94804ad866eba43181f03942bef2cf5851ad8433f43c79d0e4f299d8463
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.