libgit2-sys

0.18.7...0.18.8

Changed

• Updated to libgit2 1.9.7. This fixes CVE-2026-5917, a potential command injection on the remote host via unescaped repository paths in the libssh2 SSH transport.

0.18.6...0.18.7

Changed

• Updated to libgit2 1.9.6. This fixes SSH known-host loading with an invalid home directory, an Android crash when HOME is unset, and hidden symbol visibility for static builds.

0.18.5...0.18.6

Added

• Added bindings for GIT_OPT_ADD_SSL_X509_CERT.
• Added bindings for GIT_OPT_GET_PACK_MAX_OBJECT_SIZE and GIT_OPT_SET_PACK_MAX_OBJECT_SIZE.

Changed

• Updated to libgit2 1.9.5. This fixes CVE-2026-53583, CVE-2026-53584, CVE-2026-53585, CVE-2026-53586, CVE-2026-53587, and GHSA-wfx7-g85r-q6vw.
• Updated the vendored build to use libgit2's bundled PCRE2 regex backend.

0.18.4...0.18.5

Changed

• Updated to libgit2 1.9.4 #1260

0.18.3...0.18.4

Changed

• Updated to libgit2 1.9.3 #1242

Fixed

• Fixed the signature of git_config_backend::unlock. Previously the second c_int argument was missing and the declaration was unusable. #1181

Added

• Added experimental SHA256 OID support behind a new unstable-sha256 Cargo feature. This reflects upstream libgit2's GIT_EXPERIMENTAL_SHA256 feature gate, and requires the linked libgit2 C library to be built with the experimental flag. When enabled, the build supports linking against a system libgit2-experimental.so. See the feature description in Cargo.toml for ABI-stability caveats. #1201
• Added binding for git_repository_oid_type. #1204
• Added binding for git_oid_is_zero, replacing the deprecated git_oid_iszero. #1205
• Added binding for git_remote_oid_type. #1242
• Added GIT_REPOSITORY_INIT_RELATIVE_GITLINK flag. #1242
• Added bindings for the git_merge_file_input API, including git_merge_file_input_init. #1210
• Added bindings for git_odb_stream and git_odb_stream_t. #1181
• Added bindings for git_reference_iterator. #1181
• Added bindings for APIs from git2/sys/config.h, including the missing iterator function on git_config_backend. #1181
• Added binding for git_reference_dup. #1233
• Added binding for git_signature_default_from_env. #1237

0.18.2...0.18.3

Changed

• Updated to libgit2 1.9.2 #1195

  Note that this release fixes two security issues. However, the Rust bindings do not provide direct support for the affected APIs. In particular:

  • The libgit2-sys crate does not support building the vendored C library with the GIT_SSH_EXEC setting. This will only be an issue if you are binding to a system-provided library built with this setting.
  • The git2 crate does not support custom SSH credentials. However, the libgit2-sys crate does export the git_cred_ssh_custom_new C-binding. Any projects using the C bindings directly are affected.

0.18.1...0.18.2

Changed

• Updated to libgit2 1.9.1 #1169

0.18.0...0.18.1

Added

• Added binding for git_branch_upstream_merge #1131
• Added bindings for git_merge_file_options and git_merge_file_result, git_merge_file_options_init, git_merge_file_from_index, git_merge_file_result_free, and updated git_merge_file_flag_t. #1062

Fixed

• Fixed linking to advapi32 on Windows for recent nightly versions of Rust. #1143

0.16.2...0.17.0

Added

• Added bindings for git_repository_commondir #1079
• Added bindings for git_merge_base_octopus #1088

Changed

• ❗ Updated to libgit2 1.9.0 #1111
• ❗ Removed the ssh_key_from_memory Cargo feature, it was unused. #1087

0.16.2...0.17.0

Changed

• ❗ Updated to libgit2 1.8.1 #1032

0.16.1...0.16.2

Added

• Added binding for git_commit_lookup_prefix. #1011
• Added binding for git_object_lookup_prefix. #1014

Changed

• ❗ Updated to libgit2 1.7.2. This fixes CVE-2024-24575 and CVE-2024-24577. #1017

0.16.0...0.16.1

Fixed

• Fixed publish of 0.16.0 missing the libgit2 submodule.

0.15.2...0.16.0

Added

• Added LIBGIT2_NO_VENDOR environment variable to force using the system libgit2. #966
• Added binding for git_blame_buffer. #981

Changed

• Updated to libgit2 1.7.0. #968
• Updated to libgit2 1.7.1. #982

Fixed

• Fixed builds with cargo's -Zminimal-versions. #960

0.15.1...0.15.2

Added

• Added bindings for stash options. #930

0.15.0...0.15.1

Changed

• Updated to libgit2 1.6.4. This brings in a minor fix on Windows when the ProgramData directory does not exist. #948

0.14.2...0.15.0

Added

• Added bindings for git_remote_name_is_valid, git_reference_name_is_valid, and git_tag_name_is_valid. #882
• Added bindings for git_indexer support. #911
• Added bindings for git_index_find_prefix. #903
• Added support for the deprecated group-writeable blob file mode. #887

Changed

• Updated libssh2-sys from 0.2 to 0.3. This brings in numerous changes, including SHA2 algorithm support with RSA. #919
• Updated to libgit2 1.6.3. This brings in many changes, including better SSH host key support on Windows and better SSH host key algorithm negotiation. 1.6.3 is now the minimum supported version. #935
• The GIT_DIFF_ constants have been changed to be a git_diff_option_t type. #935

Fixed

• Fixed the rerun-if-changed build script support on Windows. This is only relevant for those working within the git2-rs source tree. #916

0.14.1...0.14.2

Changed

• Updated the bundled libgit2 to 1.5.1. a233483a3952d6112653be86fb5ce65267e3d5ac
  • Changes: fbea439d4b6fc91c6b619d01b85ab3b7746e4c19...42e5db98b963ae503229c63e44e06e439df50e56:
  • Fixes GHSA-8643-3wh5-rmjq to validate SSH host keys.
  • The supported libgit2 system library range is 1.5.1 to less than 1.6.0 or 1.4.5 to less than 1.5.0, which should include this fix.

0.14.0...0.14.1

Added

• Added variants to git_cert_ssh_raw_type_t. #909

0.13.4...0.14.0

Added

• Added bindings for ownership validation. #839

Changed

• Updated the bundled libgit2 to 1.5.0. #839 #858
  • Changes: 2a0d0bd19b5d13e2ab7f3780e094404828cbb9a7...fbea439d4b6fc91c6b619d01b85ab3b7746e4c19:
  • The supported libgit2 system library range is 1.4.4 to less than 1.6.0.
  • Fixes CVE 2022-24765.

0.13.4...0.13.5

Changed

• Updated the bundled libgit2 to 1.4.5.
  • Changes: 2a0d0bd19b5d13e2ab7f3780e094404828cbb9a7...cd6f679af401eda1f172402006ef8265f8bd58ea:
  • Fixes GHSA-8643-3wh5-rmjq to validate SSH host keys.
  • The supported libgit2 system library range is 1.4.5 to less than 1.5.0.

0.13.3...0.13.4

Added

• Added bindings for git_commit_body #835

0.13.2...0.13.3

Changed

• Updated the bundled libgit2 to 1.5.0-alpha. #822
  • Changes: 182d0d1ee933de46bf0b5a6ec269bafa77aba9a2...2a0d0bd19b5d13e2ab7f3780e094404828cbb9a7
• Changed the pkg-config probe to restrict linking against a version of a system-installed libgit2 to a version less than 1.5.0. Previously it would allow any version above 1.4.0 which could pick up an API-breaking version. #817
• When using pkg-config to locate libgit2, the system lib dirs are no longer added to the search path. #831
• When using the zlib-ng-compat Cargo feature, libssh2-sys is no longer automatically included unless you also enable the ssh feature. #833

0.13.1...0.13.2

Added

• Added bindings for git_odb_exists_ext. #818

0.13.0...0.13.1

Changed

• Updated the bundled libgit2 to 1.4.2. #815
  • Changes: fdd15bcfca6b2ec4b7ecad1aa11a396cb15bd064...182d0d1ee933de46bf0b5a6ec269bafa77aba9a2.

0.12.26...0.13.0

Changed

• Changed libgit2-sys to use the presence of the src directory instead of .git to determine if it has a git submodule that needs updating. #801
• Updated the bundled libgit2 to 1.4.1 (see also 1.4.0) #806 #811
  • Changes: b7bad55e4bb0a285b073ba5e02b01d3f522fc95d...fdd15bcfca6b2ec4b7ecad1aa11a396cb15bd064
  • The supported libgit2 system library range is 1.4.0 or greater.