Hi all,
The (default) version of libgit2 currently shipped in EPEL 10 and 9,
1.7.2, is no longer supported by upstream and does not receive
security fixes. libgit2 upstream only provides support for the two
most recent branches [0] - in this case, v1.9, and v1.8.
I have recently added a libgit2_1.9 package to EPEL 10 (epel10,
epel10.2) to provide an up-to-date and supported version of libgit2
for packages that need it (currently, this includes Rust applications
and the Nix package manager), and will add libgit2_1.9 to EPEL 9 too
shortly.
I would like to start work on adapting packages that currently still
depend on libgit2 (no suffix) v1.7 to start building them against
libgit2_1.9 to benefit from security fixes, including five CVEs in
1.9.5+ alone [1].
The libgit2 and libgit2-devel packages will continue to be available
(if only for rpmautospec machinery), and existing packages are not
affected by the addition of libgit2_1.9 to the EPEL repositories at
all - so this change does not fit into the "incompatible upgrade
policy" [2] framework.
But I'd still like to get feedback about the plan to move packages
from the obsolete libgit2 v1.7 to the supported v1.9 - and would start
submitting pull requests to affected packages if this sounds like a
good idea.
Fabio
[0]: https://github.com/libgit2/libgit2/blob/main/SECURITY.md
[1]: https://github.com/libgit2/libgit2/releases
[2]: https://docs.fedoraproject.org/en-US/epel/epel-policy-incompatible-upgrades/