Skip to content

Rebase to v2.56.0-rc0 - #6407

Open
dscho wants to merge 1171 commits into
git-for-windows:mainfrom
dscho:rebase-to-v2.56.0-rc0
Open

Rebase to v2.56.0-rc0#6407
dscho wants to merge 1171 commits into
git-for-windows:mainfrom
dscho:rebase-to-v2.56.0-rc0

Conversation

@dscho

@dscho dscho commented Sep 11, 2026

Copy link
Copy Markdown
Member
Range-diff relative to main
  • 1: d14c7fe (upstream: bad766f) < -: ------------- ci(dockerized): reduce the PID limit for private repositories

  • 2: af27e77 (upstream: c57c052) < -: ------------- mingw: skip symlink type auto-detection for network share targets

  • 3: 66899cc = 1: c40850d unix-socket: avoid leak when initialization fails

  • 4: 785f0eb = 2: 95142af grep: prevent ^$ false match at end of file

  • 5: 374678a = 3: eef30cb t9350: point out that refs are not updated correctly

  • 6: c50d941 = 4: baf7d59 transport-helper: add trailing --

  • 7: 882f0ab = 5: 8592dfd remote-helper: check helper status after import/export

  • 12: c66c364 = 6: 5c9d8ea mingw: include the Python parts in the build

  • 8: 40dea9c = 7: 587c4de ci: bump actions/checkout from 6 to 7

  • 9: b520203 = 8: c3605aa Always auto-gc after calling a fast-import transport

  • 13: 35e6727 = 9: 8d27eff mingw: prevent regressions with "drive-less" absolute paths

  • 14: 97557f9 = 10: 6fb88bb transport: optionally disable side-band-64k

  • 15: 59f7d97 = 11: d692620 mingw: fix fatal error working on mapped network drives on Windows

  • 16: aa65e17 = 12: ebd08c4 clink.pl: fix MSVC compile script to handle libcurl-d.lib

  • 18: db9c85d = 13: 1e25bb4 ci(vs-build): adapt to Visual Studio 2026 default on windows-latest

  • 19: 1746400 = 14: 61df6fb vcpkg_install: detect lack of Git

  • 21: 34e9d7f = 15: 25732c5 vcpkg_install: add comment regarding slow network connections

  • 28: 1ee8fa8 = 16: b62f2d7 vcbuild: install ARM64 dependencies when building ARM64 binaries

  • 29: c595f1b = 17: 1890726 vcbuild: add an option to install individual 'features'

  • 30: 5c06fe1 = 18: 429946d cmake: allow building for Windows/ARM64

  • 31: c0966a9 = 19: e53c7f0 ci(vs-build) also build Windows/ARM64 artifacts

  • 10: 16eafc7 = 20: c8beebf mingw: demonstrate a git add issue with NTFS junctions

  • 32: 9b4aa71 = 21: b342b0f vcbuild: stop hard-coding OpenSSL as a dependency

  • 20: 40b9c78 = 22: 03fa4f4 t5505/t5516: allow running without .git/branches/ in the templates

  • 11: 8f9894b = 23: df9a02e strbuf_realpath(): use platform-dependent API if available

  • 33: ef39dd2 = 24: 798dc29 cmake(): allow setting HOST_CPU for cross-compilation

  • 22: cb7a30d = 25: cb43f5e http: use new "best effort" strategy for Secure Channel revoke checking

  • 23: 0350f6c = 26: 70f1c80 t5505/t5516: fix white-space around redirectors

  • 17: 955b4cc = 27: 354c641 mingw: implement a platform-specific strbuf_realpath()

  • 24: dc7d556 = 28: 8bee1fd t3701: verify that we can add lots of files interactively

  • 25: 806f591 = 29: 6e34c83 commit: accept "scissors" with CR/LF line endings

  • 26: 66b8a42 ! 30: dddb018 t0014: fix indentation

    @@ Commit message
         Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
     
      ## t/t0014-alias.sh ##
    -@@ t/t0014-alias.sh: test_expect_success 'looping aliases - deprecated builtins' '
    +@@ t/t0014-alias.sh: test_expect_success HAVE_DEPRECATED 'looping aliases - deprecated builtins' '
      #'
      
      test_expect_success 'run-command formats empty args properly' '
  • 27: 3dfcb74 = 31: 2550471 git-gui: accommodate for intent-to-add files

  • 39: 72e90be = 32: 43ecdf4 CMake: default Visual Studio generator has changed

  • 41: 2527673 = 33: eb45aa4 .gitignore: add Visual Studio CMakeSetting.json file

  • 43: 85b91d4 = 34: 48df73b subtree: update contrib/subtree test target

  • 44: b3bfe91 = 35: ea5ab9f CMakeLists: add default "x64-windows" arch for Visual Studio

  • 49: 8e5f364 ! 36: 618a8a8 setup: properly use "%(prefix)/" when in WSL

    @@ Commit message
         Signed-off-by: Derrick Stolee <derrickstolee@github.com>
     
      ## setup.c ##
    -@@ setup.c: const char *setup_git_directory_gently(struct repository *repo, int *nongit_ok)
    +@@ setup.c: static void repo_discover(struct repo_discovery *discovery, int *nongit_ok)
      		break;
      	case GIT_DIR_INVALID_OWNERSHIP:
      		if (!nongit_ok) {
  • 50: 97ca3a4 ! 37: aa69a4a Add config option windows.appendAtomically

    @@ Documentation/config/windows.adoc (new)
     
      ## compat/mingw.c ##
     @@
    - #include "dir.h"
      #include "environment.h"
    + #include "repository.h"
      #include "gettext.h"
     +#include "repository.h"
      #include "run-command.h"
  • 51: 3247bed = 38: ca173b5 MinGW: link as terminal server aware

  • 34: 728344b = 39: cc6c3c5 mingw: allow for longer paths in parse_interpreter()

  • 35: d76effc = 40: 8a81150 compat/vcbuild: document preferred way to build in Visual Studio

  • 36: b61056e = 41: 263d125 http: optionally send SSL client certificate

  • 37: 758e5fb (upstream: d1b74b6) < -: ------------- hash-object: demonstrate a >4GB/LLP64 problem

  • 38: acdc5d7 (upstream: a39fda4) < -: ------------- object-file.c: use size_t for header lengths

  • 40: 7809b68 (upstream: 58823d4) < -: ------------- hash algorithms: use size_t for section lengths

  • 42: 9bacd42 (upstream: 9729b5e) < -: ------------- hash-object --stdin: verify that it works with >4GB/LLP64

  • 45: 3a16614 (upstream: 2fefea3) < -: ------------- hash-object: add another >4GB/LLP64 test case

  • 46: c3b7537 = 42: 037238f ci: run contrib/subtree tests in CI builds

  • 47: 60c7071 = 43: d14fa87 CMake: show Win32 and Generator_platform build-option values

  • 48: 9f841f9 (upstream: d99e13d) < -: ------------- hash-object: add a >4GB/LLP64 test case using filtered input

  • 52: 963d550 = 44: 31a085b compat/mingw.c: do not warn when failing to get owner

  • 53: 53344ce = 45: a84176e mingw: $env:TERM="xterm-256color" for newer OSes

  • 54: 086ff42 = 46: e951dbd winansi: check result and Buffer before using Name

  • 55: 9b74743 = 47: fa224c4 mingw: change core.fsyncObjectFiles = 1 by default

  • 56: c45087d = 48: 592db7d Fix Windows version resources

  • 57: fa6db0a = 49: bc44196 windows: skip linking git-<command> for built-ins

  • 58: 471141c = 50: 171d7de mingw: stop hard-coding CC = gcc

  • 59: e7adae6 = 51: 03737fa mingw: drop the -D_USE_32BIT_TIME_T option

  • 60: d746cbb = 52: a8165e8 mingw: only use -Wl,--large-address-aware for 32-bit builds

  • 61: e929281 = 53: fbd9602 mingw: avoid over-specifying --pic-executable

  • 62: 98d857f = 54: f178073 mingw: set the prefix and HOST_CPU as per MSYS2's settings

  • 63: 62c761b = 55: 22a9970 mingw: only enable the MSYS2-specific stuff when compiling in MSYS2

  • 64: dfd9bd2 ! 56: 5da2a33 mingw: rely on MSYS2's metadata instead of hard-coding it

    @@ contrib/buildsystems/CMakeLists.txt: if(CMAKE_SYSTEM_NAME STREQUAL "Windows")
     -				HAVE_WPGMPTR ENSURE_MSYSTEM_IS_SET HAVE_RTLGENRANDOM)
     +				HAVE_WPGMPTR HAVE_RTLGENRANDOM)
     +	if(CMAKE_GENERATOR_PLATFORM STREQUAL "x64")
    -+		add_compile_definitions(ENSURE_MSYSTEM_IS_SET="MINGW64" MINGW_PREFIX="mingw64")
    ++		add_compile_definitions(ENSURE_MSYSTEM_IS_SET="UCRT64" MINGW_PREFIX="ucrt64")
     +	elseif(CMAKE_GENERATOR_PLATFORM STREQUAL "arm64")
     +		add_compile_definitions(ENSURE_MSYSTEM_IS_SET="CLANGARM64" MINGW_PREFIX="clangarm64")
     +	elseif(CMAKE_GENERATOR_PLATFORM STREQUAL "x86")
  • 65: 055cc8a = 57: fab9e01 mingw: always define ETC_* for MSYS2 environments

  • 66: 1bd0017 = 58: 20c55d0 max_tree_depth: lower it for clang builds in general on Windows

  • 67: 33bcead ! 59: f685fa8 mingw: ensure valid CTYPE

    @@ Commit message
     
      ## compat/mingw.c ##
     @@ compat/mingw.c: static void setup_windows_environment(void)
    + 		if (!tmp && (tmp = getenv("USERPROFILE")))
      			setenv("HOME", tmp, 1);
      	}
    - 
    ++
     +	if (!getenv("LC_ALL") && !getenv("LC_CTYPE") && !getenv("LANG"))
     +		setenv("LC_CTYPE", "C.UTF-8", 1);
    -+
    - 	/*
    - 	 * Change 'core.symlinks' default to false, unless native symlinks are
    - 	 * enabled in MSys2 (via 'MSYS=winsymlinks:nativestrict'). Thus we can
    + }
    + 
    + int mingw_platform_has_symlinks(void)
  • 68: ad1a584 ! 60: cd85dd6 mingw: allow git.exe to be used instead of the "Git wrapper"

    @@ compat/mingw.c: static void setup_windows_environment(void)
     +
      	if (!getenv("LC_ALL") && !getenv("LC_CTYPE") && !getenv("LANG"))
      		setenv("LC_CTYPE", "C.UTF-8", 1);
    - 
    + }
     
      ## config.mak.uname ##
     @@ config.mak.uname: endif
  • 70: dec44ca = 61: d9f9dca mingw: ignore HOMEDRIVE/HOMEPATH if it points to Windows' system directory

  • 71: 584f7df = 62: 6c95696 clink.pl: fix libexpatd.lib link error when using MSVC

  • 72: 363e250 = 63: 6613638 Makefile: clean up .ilk files when MSVC=1

  • 73: e42bbf4 ! 64: ff71d24 vcbuild: add support for compiling Windows resource files

    @@ config.mak.uname: ifeq ($(uname_S),Windows)
     +	SANE_TOOL_PATH ?= $(msvc_bin_dir_msys):$(sdk_ver_bin_dir_msys)
      	HAVE_ALLOCA_H = YesPlease
      	NO_PREAD = YesPlease
    - 	NEEDS_CRYPTO_WITH_SSL = YesPlease
    + 	NO_WRITEV = YesPlease
     @@ config.mak.uname: endif
      	# See https://msdn.microsoft.com/en-us/library/ms235330.aspx
      	EXTLIBS = user32.lib advapi32.lib shell32.lib wininet.lib ws2_32.lib invalidcontinue.obj kernel32.lib ntdll.lib
  • 74: fd68f01 = 65: f414c76 config.mak.uname: add git.rc to MSVC builds

  • 69: d2a7526 = 66: 3de5e73 status: fix for old-style submodules with commondir

  • 75: b653fa2 = 67: 532279f clink.pl: ignore no-stack-protector arg on MSVC=1 builds

  • 79: 110cf4d = 68: c7b8be8 http: optionally load libcurl lazily

  • 76: af005e2 = 69: a435fcf clink.pl: move default linker options for MSVC=1 builds

  • 80: 0b68eb7 = 70: c85e9eb http: support lazy-loading libcurl also on Windows

  • 77: 3e13c06 = 71: 1d53dcb cmake: install headless-git.

  • 81: 934b065 = 72: 1f64288 http: when loading libcurl lazily, allow for multiple SSL backends

  • 78: 5688352 = 73: 21549c0 git.rc: include winuser.h

  • 82: ea73840 = 74: 6912d08 mingw: do load libcurl dynamically by default

  • 83: ddacb57 = 75: a8846df Add a GitHub workflow to verify that Git/Scalar work in Nano Server

  • 84: c1086c7 = 76: a98994a mingw: suggest windows.appendAtomically in more cases

  • 85: 6656931 = 77: 6d30cd0 win32: use native ANSI sequence processing, if possible

  • 87: 67ecfcf = 78: cea66bc common-main.c: fflush stdout buffer upon exit

  • 88: eeac35b = 79: 8ac6e08 t5601/t7406(mingw): do run tests with symlink support

  • 89: ff08a3c = 80: 6a87007 Fallback to AppData if XDG_CONFIG_HOME is unset

  • 86: d5ce477 = 81: 76888ca revision: create mark_trees_uninteresting_dense()

  • 90: 7d5245b < -: ------------- run-command: be helpful with Git LFS fails on Windows 7

  • 91: 4df70a4 ! 82: f9b8cc9 survey: stub in new experimental 'git-survey' command

    @@ t/meson.build: integration_tests = [
     
      ## t/t1517-outside-repo.sh ##
     @@ t/t1517-outside-repo.sh: do
    - 	merge-octopus | merge-one-file | merge-resolve | mergetool | \
    + 	http-backend | http-fetch | http-push | init-db | \
      	mktag | p4 | p4.py | pickaxe | remote-ftp | remote-ftps | \
      	remote-http | remote-https | replay | send-email | \
    --	sh-i18n--envsubst | shell | show | stage | submodule | svn | \
    -+	sh-i18n--envsubst | shell | show | stage | submodule | survey | svn | \
    - 	upload-archive--writer | upload-pack | web--browse | whatchanged)
    - 		expect_outcome=expect_failure ;;
    - 	*)
    +-	sh-i18n--envsubst | shell | show | stage | \
    ++	sh-i18n--envsubst | shell | show | stage | survey | \
    + 	upload-archive--writer | upload-pack | whatchanged)
    + 		h_expect_outcome=expect_failure
    + 		all_expect_outcome=expect_failure
     
      ## t/t8100-git-survey.sh (new) ##
     @@
    @@ t/t8100-git-survey.sh (new)
     +. ./test-lib.sh
     +
     +test_expect_success 'git survey -h shows experimental warning' '
    -+	test_expect_code 129 git survey -h >usage &&
    -+	grep "EXPERIMENTAL!" usage
    ++	test_expect_code 0 git survey -h >usage &&
    ++	test_grep "EXPERIMENTAL!" usage
     +'
     +
     +test_done
  • 92: f5aa03a ! 83: 6591981 survey: add command line opts to select references

    @@ builtin/survey.c: int cmd_survey(int argc, const char **argv, const char *prefix
     
      ## t/t8100-git-survey.sh ##
     @@ t/t8100-git-survey.sh: test_expect_success 'git survey -h shows experimental warning' '
    - 	grep "EXPERIMENTAL!" usage
    + 	test_grep "EXPERIMENTAL!" usage
      '
      
     +test_expect_success 'create a semi-interesting repo' '
  • 93: 35ecab6 = 84: ce96282 survey: start pretty printing data in table form

  • 94: 098aeda = 85: b536fa1 survey: add object count summary

  • 95: d2d7657 = 86: 9d2cf59 survey: summarize total sizes by object type

  • 96: 9929c61 = 87: 983b7ae survey: show progress during object walk

  • 100: 66e1be9 = 88: aebd49d mingw: make sure errno is set correctly when socket operations fail

  • 97: cd19a00 = 89: 36b3c74 survey: add ability to track prioritized lists

  • 103: f801035 = 90: 7f7709f compat/mingw: handle WSA errors in strerror

  • 98: 6be9db7 = 91: c08ddc4 survey: add report of "largest" paths

  • 105: b9111c1 = 92: e4ccdcc compat/mingw: drop outdated comment

  • 99: e69d05f = 93: c5dd7d2 survey: add --top= option and config

  • 107: 95af445 = 94: ac75455 t0301: actually test credential-cache on Windows

  • 101: 8ea36b6 = 95: dc330ec survey: clearly note the experimental nature in the output

  • 109: 8215d0d = 96: fcaa5fe credential-cache: handle ECONNREFUSED gracefully

  • 110: 2f66493 ! 97: addf72e reftable: do make sure to use custom allocators

    @@ Commit message
     
      ## refs/reftable-backend.c ##
     @@ refs/reftable-backend.c: static struct ref_store *reftable_be_init(struct repository *repo,
    - 	mask = umask(0);
    - 	umask(mask);
    + 	struct strbuf path = STRBUF_INIT;
    + 	bool is_worktree;
      
     +	reftable_set_alloc(malloc, realloc, free);
     +
  • 111: 8cf83e2 = 98: ee43848 check-whitespace: avoid alerts about upstream commits

  • 112: d02d96a = 99: e8cf253 t/t5571-prep-push-hook.sh: Add test with writing to stderr

  • 113: 4729347 = 100: 2622830 mingw: Support git_terminal_prompt with more terminals

  • 114: e38ec6f = 101: 2de73af compat/terminal.c: only use the Windows console if bash 'read -r' fails

  • 115: 201144e = 102: c1f6c30 mingw (git_terminal_prompt): do fall back to CONIN$/CONOUT$ method

  • 102: fa66c2a = 103: 05621d5 t5563: verify that NTLM authentication works

  • 122: 6f26c2e = 104: 1ae80bd mingw: introduce code to detect whether we're inside a Windows container

  • 104: 4ca4b4c = 105: e81ff93 http: disallow NTLM authentication by default

  • 124: 1d0d2da = 106: 6e6cf0f mingw: when running in a Windows container, try to rename() harder

  • 106: 03398c0 = 107: 429ca2c http: warn if might have failed because of NTLM

  • 126: 6efb3e0 = 108: c6874c9 mingw: move the file_attr_to_st_mode() function definition

  • 108: 51703f5 = 109: 3913548 credential: advertise NTLM suppression and allow helpers to re-enable

  • 128: 0aec489 = 110: 4528e9c mingw: Windows Docker volumes are not symbolic links

  • 116: 80eee1e = 111: e68c829 dir: do not traverse mount points

  • 117: e36e8b3 = 112: 1b9eff5 win32: thread-utils: handle multi-socket systems

  • 118: daa7cb8 = 113: f9fd88e t5563: add tests for http.emptyAuth with Negotiate

  • 119: 696cadb = 114: 8080f51 entry: flush fscache after creating directories and writing files

  • 120: 2425a00 = 115: 29c5f36 ci(macos): skip the git p4 tests

  • 146: 877b9f1 = 116: 9d4fefb diff: stop truncating the deflated-binary-diff size on Windows

  • 121: edef24d = 117: c455bf9 Win32: symlink: move phantom symlink creation to a separate function

  • 147: b0ab6b3 = 118: 06687de convert: widen gather_convert_stats() helpers to size_t

  • 123: 7742d6e ! 119: 8804c57 Introduce helper to create symlinks that knows about index_state

    @@ compat/mingw.c: int link(const char *oldpath, const char *newpath)
     
      ## entry.c ##
     @@ entry.c: static int write_entry(struct cache_entry *ce, char *path, struct conv_attrs *ca
    - 		if (!has_symlinks || to_tempfile)
    + 				       state->istate->repo : the_repository) || to_tempfile)
      			goto write_file_entry;
      
     -		ret = symlink(new_blob, path);
  • 148: c809997 = 120: 24a7e3f read-cache: stop truncating index blob sizes on Windows

  • 125: 3b0859e = 121: 26bcd89 mingw: allow to specify the symlink type in .gitattributes

  • 149: d7b636e = 122: c99db80 xdiff-interface: widen buffer_is_binary() size parameter to size_t

  • 127: 00cc072 = 123: 849dce0 Win32: symlink: add test for symlink attribute

  • 150: 1d1c735 = 124: e7273b7 combine-diff: stop truncating combined-diff blob sizes on Windows

  • 129: 9c7424b = 125: d798bb1 clean: do not traverse mount points

  • 154: b9a3a29 = 126: bca0a57 diff: widen textconv_object() size out-param to size_t

  • 151: 8588db3 = 127: da8067b pack-bitmap: stop truncating blob sizes used by --filter=blob:limit

  • 130: a373517 = 128: 469e682 mingw: work around rename() failing on a read-only file

  • 131: ad46370 = 129: 7f71467 clean: remove mount points when possible

  • 132: 08aa7f0 (upstream: 073d4d6) < -: ------------- diff-delta: widen struct delta_index size fields to size_t

  • 133: f547327 (upstream: 92b77c4) < -: ------------- delta: widen create_delta_index() parameter to size_t

  • 134: f9115fb < -: ------------- pack-objects: widen delta-cache accounting to size_t

  • 135: e3eeda3 (upstream: e0af3c8) < -: ------------- pack-objects: widen free_unpacked() return to size_t

  • 136: d6a088d (upstream: 58f35ee) < -: ------------- pack-objects: widen mem_usage and try_delta out-param to size_t

  • 137: d0c0268 (upstream: 9efb6d5) < -: ------------- delta: widen create_delta() and diff_delta() to size_t

  • 138: b314d6d = 130: 30acab3 mingw: optionally enable wsl compability file mode bits

  • 139: f9b8367 ! 131: 0aea2c1 Refuse to follow invalid paths in .git files

    @@ compat/mingw.h: char *mingw_query_user_email(void);
       * Verifies that the given path is a valid one on Windows.
     
      ## setup.c ##
    -@@ setup.c: void read_gitfile_error_die(int error_code, const char *path, const char *dir)
    +@@ setup.c: void read_gitfile_error_die(int error_code, const char *path)
      	}
      }
      
    @@ setup.c: void read_gitfile_error_die(int error_code, const char *path, const cha
       * Try to read the location of the git directory from the .git file,
       * return path to git directory if found. The return value comes from
     @@ setup.c: const char *read_gitfile_gently(const char *path, int *return_error_code)
    - 		free(buf);
    - 		buf = dir;
    + 		strbuf_addstr(&contents, dir);
    + 		free(dir);
      	}
     +#if (defined _WIN32 || defined __WIN32__)
    -+	if (is_dir_sep(dir[0]) && is_invalid_dotgit_path(path, dir)) {
    ++	if (is_dir_sep(contents.buf[0]) &&
    ++	    is_invalid_dotgit_path(path, contents.buf)) {
     +		strbuf_reset(&realpath);
    -+		strbuf_add(&realpath, dir, strlen(dir));
    ++		strbuf_add(&realpath, contents.buf, contents.len);
     +		path = realpath.buf;
     +		goto cleanup_return;
     +	}
     +#endif
    - 	if (!is_git_directory(dir)) {
    + 	if (!is_git_directory(contents.buf)) {
      		error_code = READ_GITFILE_ERR_NOT_A_REPO;
      		goto cleanup_return;
      	}
      
     +	strbuf_reset(&realpath);
    - 	strbuf_realpath(&realpath, dir, 1);
    - 	path = realpath.buf;
    + 	strbuf_realpath(&realpath, contents.buf, 1);
      
    + cleanup_return:
     
      ## t/t5580-unc-paths.sh ##
     @@ t/t5580-unc-paths.sh: test_expect_success clone '
  • 140: a3d106d (upstream: 4211a2b) < -: ------------- packfile, git-zlib: widen use_pack() and zstream avail fields to size_t

  • 141: f7abcba (upstream: 335f996) < -: ------------- archive-zip: widen zlib_deflate_raw()'s maxsize local to size_t

  • 142: b114b4c (upstream: 1f324b9) < -: ------------- diff: widen deflate_it()'s bound local from int to size_t

  • 143: b191f55 (upstream: 9cb9f41) < -: ------------- http-push: widen start_put()'s size local from ssize_t to size_t

  • 144: 214e5aa (upstream: aed4048) < -: ------------- t/helper/test-pack-deltas: widen do_compress()'s maxsize local to size_t

  • 145: 574d35e (upstream: b4b9a8c) < -: ------------- git-zlib: widen git_deflate_bound() to size_t

  • 152: 83f79b2 = 132: 5b357f4 tree-walk: drop link_len cast in get_tree_entry_follow_symlinks()

  • 153: 4887591 = 133: 8298ddc tree-walk: widen init_tree_desc() and init_tree_desc_gently() to size_t

  • 155: 7c52478 = 134: 152fd7e pack-objects: drop the two tree-walk casts in the preferred-base path

  • 156: 3fbab76 = 135: cc9a607 diffcore: widen struct diff_filespec.size to size_t

  • 157: 23707af < -: ------------- diff-delta: widen sizeof_delta_index() return to size_t

  • 158: b0482ec = 136: 5b67be8 tree: widen struct tree.size and parse_tree_buffer() to size_t

  • 159: 1a8ee4a = 137: 8aaff57 commit: widen the commit-buffer API to size_t

  • 160: ae5ac8f = 138: 8235158 blame: widen find_line_starts() len parameter to size_t

  • 161: 38e4d60 = 139: 6c33d82 grep: widen struct grep_source.size and grep_buffer() to size_t

  • 162: 663a6fb = 140: f5a8848 fast-export: drop the export_blob() size cast and widen anonymize_blob()

  • 163: f91302c = 141: b07f290 repo: drop the inflated-size cast in count_objects()

  • 164: b0512d0 ! 142: c9efcfc unpack-objects: widen the size-passing infrastructure to size_t

    @@ builtin/unpack-objects.c: static void added_object(unsigned nr, enum object_type
      				   unsigned nr)
      {
      	void *buf = get_data(size);
    -@@ builtin/unpack-objects.c: static ssize_t feed_input_zstream(struct odb_write_stream *in_stream,
    +@@ builtin/unpack-objects.c: static ssize_t zlib_stream_read(struct odb_stream *in_stream,
      	return buf_len - zstream->avail_out;
      }
      
    @@ builtin/unpack-objects.c: static ssize_t feed_input_zstream(struct odb_write_str
     +static void stream_blob(size_t size, unsigned nr)
      {
      	git_zstream zstream = { 0 };
    - 	struct input_zstream_data data = { 0 };
    + 	struct zlib_stream in_stream = {
     @@ builtin/unpack-objects.c: static void stream_blob(unsigned long size, unsigned nr)
      }
      
  • 165: b2c4636 = 143: f0f649b pack-objects: drop cast_size_t_to_ulong shims in get_delta()

  • 166: a79a242 = 144: c7263d4 pack-objects: drop cast_size_t_to_ulong shims in try_delta()

  • 167: 2299301 = 145: c6be84b pack-objects: drop the last size shim in write_no_reuse_object()

  • 168: 9550ed9 = 146: 583b4e2 blame: widen struct blame_scoreboard.final_buf_size to size_t

  • 169: 5eced98 ! 147: 6972bc1 fast-import: drop the six size casts in the object-read paths

    @@ builtin/fast-import.c: static int store_object(
      	struct object_entry *e;
      	unsigned char hdr[96];
      	struct object_id oid;
    --	unsigned long hdrlen, deltalen;
    -+	size_t hdrlen, deltalen;
    +-	unsigned long hdrlen, deltalen = 0;
    ++	size_t hdrlen, deltalen = 0;
      	struct git_hash_ctx c;
      	git_zstream s;
      	struct repo_config_values *cfg = repo_config_values(the_repository);
    @@ builtin/fast-import.c: static int store_object(
      
      	if (last && last->data.len && last->data.buf && last->depth < max_depth
      		&& dat->len > the_hash_algo->rawsz) {
    --		size_t deltalen_st = 0;
    +-		size_t deltalen_st;
     -
      		delta_count_attempts_by_type[type]++;
      		delta = diff_delta(last->data.buf, last->data.len,
    @@ builtin/fast-import.c: static void parse_from_existing(struct branch *b)
      		parse_from_commit(b, buf, size);
      		free(buf);
      	}
    -@@ builtin/fast-import.c: static int parse_objectish(struct branch *b, const char *objectish)
    +@@ builtin/fast-import.c: static int parse_objectish(struct fast_import_state *state,
      		if (!oideq(&b->oid, &oe->idx.oid)) {
      			oidcpy(&b->oid, &oe->idx.oid);
      			if (oe->pack_id != MAX_PACK_ID) {
    @@ builtin/fast-import.c: static int parse_objectish(struct branch *b, const char *
      				char *buf = gfi_unpack_entry(oe, &size);
      				parse_from_commit(b, buf, size);
      				free(buf);
    -@@ builtin/fast-import.c: static void cat_blob_write(const char *buf, unsigned long size)
    - static void cat_blob(struct object_entry *oe, struct object_id *oid)
    +@@ builtin/fast-import.c: static void cat_blob(struct object_entry *oe, struct object_id *oid)
      {
      	struct strbuf line = STRBUF_INIT;
    + 	struct iovec iov[3];
     -	unsigned long size;
     +	size_t size;
      	enum object_type type = 0;
    @@ builtin/fast-import.c: static void cat_blob_write(const char *buf, unsigned long
      	} else {
      		type = oe->type;
      		buf = gfi_unpack_entry(oe, &size);
    -@@ builtin/fast-import.c: static void parse_cat_blob(const char *p)
    +@@ builtin/fast-import.c: static void parse_cat_blob(struct fast_import_state *state UNUSED,
      static struct object_entry *dereference(struct object_entry *oe,
      					struct object_id *oid)
      {
  • 170: c0930a7 = 148: 6cc4439 t/helper/test-pack-deltas: drop the delta_size cast in write_ref_delta()

  • 171: cbebf58 = 149: 1ed8620 Drop the cast_size_t_to_ulong() helper

  • 172: 9948570 = 150: 2d4ab11 coverity: skip building with Rust, for now

  • 181: 34867a3 = 151: 59c4ffe git-gui--askyesno: fix funny text wrapping

  • 173: 5295125 = 152: eaac418 Win32: make FILETIME conversion functions public

  • 183: 97841aa = 153: 6ab7a60 git-gui--askyesno (mingw): use Git for Windows' icon, if available

  • 174: 1fbc575 = 154: aa3abd2 Win32: dirent.c: Move opendir down

  • 175: e47f876 = 155: 5a51292 mingw: make the dirent implementation pluggable

  • 176: 789cce3 = 156: e45d6c4 Win32: make the lstat implementation pluggable

  • 177: 828fba0 = 157: fc436b0 mingw: add infrastructure for read-only file system level caches

  • 178: f721b71 = 158: 20c67d6 mingw: add a cache below mingw's lstat and dirent implementations

  • 179: 76033a2 = 159: e266b40 fscache: load directories only once

  • 180: 57f1941 = 160: fc4c8bb fscache: add key for GIT_TRACE_FSCACHE

  • 182: dae9786 = 161: e256b7c fscache: remember not-found directories

  • 184: 3f6cb81 = 162: 427565b fscache: add a test for the dir-not-found optimization

  • 185: a2acda4 = 163: 8dc5c85 add: use preload-index and fscache for performance

  • 186: 60a91f2 = 164: ef52d1d dir.c: make add_excludes aware of fscache during status

  • 187: 781696d = 165: d606bda fscache: make fscache_enabled() public

  • 188: a9cb81e = 166: 85fc9f6 dir.c: regression fix for add_excludes with fscache

  • 189: d967a00 = 167: 40ca9e8 fetch-pack.c: enable fscache for stats under .git/objects

  • 190: 7cd9b48 = 168: e966b00 checkout.c: enable fscache for checkout again

  • 191: 045ecbb = 169: 1599c88 Enable the filesystem cache (fscache) in refresh_index().

  • 192: 633549a = 170: 273de1a fscache: use FindFirstFileExW to avoid retrieving the short name

  • 193: ffc2bcb = 171: ce779c2 fscache: add GIT_TEST_FSCACHE support

  • 194: 930225d = 172: deeca3a fscache: add fscache hit statistics

  • 195: bf04a41 = 173: d670196 unpack-trees: enable fscache for sparse-checkout

  • 196: e3fc287 = 174: 1a14880 status: disable and free fscache at the end of the status command

  • 197: cb4b2b6 = 175: ed1e062 mem_pool: add GIT_TRACE_MEMPOOL support

  • 198: 33c9b66 = 176: 5c2725e fscache: fscache takes an initial size

  • 199: 2c8b97f = 177: add8a76 fscache: update fscache to be thread specific instead of global

  • 200: 7591efa = 178: 97bd2d2 fscache: teach fscache to use mempool

  • 201: 3eda567 = 179: c470997 fscache: make fscache_enable() thread safe

  • 202: dfbce1b = 180: 14ae4c9 fscache: teach fscache to use NtQueryDirectoryFile

  • 203: 5164e8b = 181: 3a8fa5c fscache: remember the reparse tag for each entry

  • 204: 292e0c1 = 182: 5c615c8 fscache: Windows Docker volumes are not symbolic links

  • 205: 98f89db = 183: 6e28f28 fscache: optionally enable wsl compability file mode bits

  • 206: 2c42f63 = 184: 8bf5447 fscache: implement an FSCache-aware is_mount_point()

  • 207: e9e642f = 185: 952e3ea clean: make use of FSCache

  • 272: db14c17 ! 186: 0365b5d fixup! compat/poll: do not collect more handles than the wait supports

    @@
      ## Metadata ##
    -Author: Johannes Schindelin <Johannes.Schindelin@gmx.de>
    +Author: Tyrie Vella <tyrielv@gmail.com>
     
      ## Commit message ##
    -    fixup! compat/poll: do not collect more handles than the wait supports
    +    compat/poll: do not collect more handles than the wait supports
     
    -    The parallel-checkout test caps the worker count at 62, but does not
    -    exercise the poll() handle limit directly. It still passes if the root
    -    guard and reset_socket_events() are removed, leaving both the
    -    memory-safety boundary and overflow cleanup without regression coverage.
    +    The Windows implementation of poll() collects one wait handle per polled
    +    descriptor in
     
    -    Exercise poll() directly on Windows. Verify that 62 waitable handles
    -    succeed while a 63rd returns EINVAL, that sparse entries and sockets do
    -    not consume wait-handle slots, and that overflow cleanup preserves an
    -    event association on a socket this poll() invocation did not register.
    +        HANDLE h, handle_array[FD_SETSIZE + 2];
     
    -    Assisted-by: GPT-5.6 Sol
    -    Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
    +    and appends to it without a bounds check. It then writes a NULL sentinel
    +    at handle_array[nhandles]. A caller with enough live descriptors
    +    therefore writes past the end of the array and corrupts the stack. The
    +    corruption is silent, and when it reaches the stack cookie the process
    +    aborts with STATUS_STACK_BUFFER_OVERRUN.
    +
    +    The array is not the only limit. The collected handles are passed to
    +
    +        MsgWaitForMultipleObjects (nhandles, handle_array, FALSE,
    +                                   wait_timeout, QS_ALLINPUT);
    +
    +    which waits on at most MAXIMUM_WAIT_OBJECTS objects, and QS_ALLINPUT adds
    +    the thread message queue as one more object beyond the handles. The code
    +    shows this, because it reports the message queue as
    +    WAIT_OBJECT_0 + nhandles. One further handle is poll()'s own event
    +    object. So at most MAXIMUM_WAIT_OBJECTS - 2 descriptors can be waited on,
    +    which is the tighter of the two bounds and is well inside the array.
    +
    +    Define that limit as POLL_MAX_DESCRIPTORS next to the poll() declaration,
    +    and refuse to collect beyond it, returning EINVAL. Two preprocessor
    +    checks tie the constant to MAXIMUM_WAIT_OBJECTS and to the size of
    +    handle_array, so the two cannot drift apart. poll() is now memory-safe
    +    for every input, and a case that previously smashed the stack fails
    +    cleanly.
    +
    +    Undo the WSAEventSelect() registrations before returning. The loop that
    +    normally does this runs after the wait, and the new error path skips it,
    +    which would otherwise leave those sockets associated with poll()'s static
    +    event object and let later socket activity disturb an unrelated poll().
    +
    +    Note that the limit is on the number of handles actually collected, not
    +    on nfd. Those are different: a descriptor only takes a handle when it is
    +    non-negative, is not a socket, and has no events pending yet. Sockets are
    +    all multiplexed onto the one event object. Callers routinely pass sparse
    +    arrays, for example run_processes_parallel(), which sizes its pollfd
    +    array to the configured job count and leaves the unused slots at fd = -1.
    +    Rejecting a large nfd would break such callers even though they never
    +    come close to the wait limit.
    +
    +    For platforms with a native poll(), which has no such limit, define
    +    POLL_MAX_DESCRIPTORS to INT_MAX so that callers can clamp against it
    +    unconditionally.
    +
    +    Signed-off-by: Tyrie Vella <tyrielv@gmail.com>
     
      ## Makefile ##
     @@ Makefile: CLAR_TEST_SUITES += u-odb-inmemory
    @@ Makefile: CLAR_TEST_SUITES += u-odb-inmemory
      CLAR_TEST_SUITES += u-reftable-basics
      CLAR_TEST_SUITES += u-reftable-block
     
    + ## compat/poll/poll.c ##
    +@@ compat/poll/poll.c: compute_revents (int fd, int sought, fd_set *rfds, fd_set *wfds, fd_set *efds)
    + }
    + #endif /* !MinGW */
    + 
    ++#ifdef WIN32_NATIVE
    ++/* POLL_MAX_DESCRIPTORS descriptors, plus hEvent and the QS_ALLINPUT message
    ++   queue, must fit in one MsgWaitForMultipleObjects call, and the collected
    ++   handles plus the NULL sentinel must fit in handle_array.  */
    ++#if POLL_MAX_DESCRIPTORS + 2 > MAXIMUM_WAIT_OBJECTS
    ++#error POLL_MAX_DESCRIPTORS exceeds MAXIMUM_WAIT_OBJECTS
    ++#endif
    ++#if POLL_MAX_DESCRIPTORS + 2 > FD_SETSIZE + 2
    ++#error POLL_MAX_DESCRIPTORS does not fit in handle_array
    ++#endif
    ++
    ++/* Undo the WSAEventSelect() calls made for the first NFD descriptors.  */
    ++static void
    ++reset_socket_events (struct pollfd *pfd, nfds_t nfd)
    ++{
    ++  nfds_t i;
    ++
    ++  for (i = 0; i < nfd; i++)
    ++    {
    ++      HANDLE h;
    ++
    ++      if (pfd[i].fd < 0)
    ++	continue;
    ++      if (!(pfd[i].events & (POLLIN | POLLRDNORM | POLLOUT | POLLWRNORM |
    ++			     POLLWRBAND | POLLPRI | POLLRDBAND)))
    ++	continue;
    ++
    ++      h = (HANDLE) _get_osfhandle (pfd[i].fd);
    ++      if (h == NULL || h == INVALID_HANDLE_VALUE)
    ++	continue;
    ++
    ++      if (IsSocketHandle (h))
    ++	WSAEventSelect ((SOCKET) h, NULL, 0);
    ++    }
    ++}
    ++#endif
    ++
    + int
    + poll (struct pollfd *pfd, nfds_t nfd, int timeout)
    + {
    +@@ compat/poll/poll.c: poll (struct pollfd *pfd, nfds_t nfd, int timeout)
    + 	     bits for the "wrong" direction. */
    + 	  pfd[i].revents = win32_compute_revents (h, &sought);
    + 	  if (sought)
    +-	    handle_array[nhandles++] = h;
    ++	    {
    ++	      /* hEvent occupies handle_array[0].  See POLL_MAX_DESCRIPTORS.  */
    ++	      if (nhandles > POLL_MAX_DESCRIPTORS)
    ++		{
    ++		  reset_socket_events (pfd, i);
    ++		  errno = EINVAL;
    ++		  return -1;
    ++		}
    ++	      handle_array[nhandles++] = h;
    ++	    }
    + 	  if (pfd[i].revents)
    + 	    timeout = 0;
    + 	}
    +
    + ## compat/poll/poll.h ##
    +@@ compat/poll/poll.h: typedef unsigned long nfds_t;
    + 
    + extern int poll (struct pollfd *pfd, nfds_t nfd, int timeout);
    + 
    ++#if (defined _WIN32 || defined __WIN32__) && ! defined __CYGWIN__
    ++/*
    ++ * This poll() is emulated with MsgWaitForMultipleObjects(), which waits on at
    ++ * most MAXIMUM_WAIT_OBJECTS (64) objects. Two of those are never available for
    ++ * polled descriptors: poll() waits on its own event object, and QS_ALLINPUT
    ++ * adds the thread message queue. Sockets do not count, because they are all
    ++ * multiplexed onto that one event object; every other descriptor takes a wait
    ++ * slot of its own.
    ++ *
    ++ * Callers that poll one or more descriptors per child must keep the number of
    ++ * simultaneously live descriptors within this limit. Exceeding it fails with
    ++ * EINVAL.
    ++ */
    ++#define POLL_MAX_DESCRIPTORS 62
    ++#endif
    ++
    + /* Define INFTIM only if doing so conforms to POSIX.  */
    + #if !defined (_POSIX_C_SOURCE) && !defined (_XOPEN_SOURCE)
    + #define INFTIM (-1)
    +
    + ## compat/posix.h ##
    +@@
    + /* Pull the compat stuff */
    + #include <poll.h>
    + #endif
    ++
    ++/*
    ++ * compat/poll defines POLL_MAX_DESCRIPTORS to the largest number of
    ++ * descriptors its poll() emulation can wait on. A native poll() has no such
    ++ * limit, so callers that fan out one descriptor per child can clamp against
    ++ * this unconditionally.
    ++ */
    ++#ifndef POLL_MAX_DESCRIPTORS
    ++#define POLL_MAX_DESCRIPTORS INT_MAX
    ++#endif
    + #ifdef HAVE_BSD_SYSCTL
    + #include <sys/sysctl.h>
    + #endif
    +
      ## t/meson.build ##
     @@ t/meson.build: clar_test_suites = [
        'unit-tests/u-oid-array.c',
  • 266: b301399 = 187: 7954bc4 parallel-checkout: limit worker count to what poll() can wait on

  • 271: a819110 ! 188: 1cbacd1 fixup! run-command: limit concurrent children to what poll() can wait on

    @@
      ## Metadata ##
    -Author: Johannes Schindelin <Johannes.Schindelin@gmx.de>
    +Author: Tyrie Vella <tyrielv@gmail.com>
     
      ## Commit message ##
    -    fixup! run-command: limit concurrent children to what poll() can wait on
    +    run-command: limit concurrent children to what poll() can wait on
     
    -    The target commit budgets two poll descriptors for every grouped child:
    -    one for output and one for standard input. Most callers, including
    -    parallel fetches, submodule fetches and updates, and the test-suite
    -    runner, never request the latter. On Windows, this unnecessarily caps
    -    safe output-only workloads of 32 through 62 children at 31.
    +    pp_buffer_io() polls one pipe for each child that is sending output, and a
    +    second one for each child that is being fed on stdin. On Windows poll() is
    +    emulated with MsgWaitForMultipleObjects(), which cannot wait on more than
    +    POLL_MAX_DESCRIPTORS descriptors at once.
     
    -    Let callers that guarantee no standard-input pipe use one descriptor per
    -    child. Keep the conservative two-descriptor default, and BUG if a caller
    -    claims the invariant but requests such a pipe.
    +    A job count above that limit is reachable in practice. fetch.parallel,
    +    submodule.fetchJobs and hook.jobs all accept an explicit value, and a value
    +    of 0 means "use online_cpus()", which on a machine with many cores is well
    +    above the limit. Before the previous commit such a run corrupted the stack.
    +    Now poll() returns EINVAL, and pp_buffer_io() turns that into
    +    die_errno("poll"), so the operation fails outright.
     
    -    Tests cover both budgets and verify that all queued tasks complete when
    -    the lower limit requires slot reuse.
    +    Limit how many children run at the same time, so that a large job count
    +    degrades into less concurrency instead of an error. Only concurrency is
    +    limited. The configured maximum is still used for the size of the child and
    +    pollfd arrays, and is still reported by the trace, so the number of tasks
    +    that are run in total does not change. Unused pollfd slots hold -1 and are
    +    skipped by poll(), so the larger array costs nothing.
     
    -    Assisted-by: GPT-5.6 Sol
    -    Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
    +    Divide the limit by two, because a child can hold two descriptors: one for
    +    its output and one for its input. Callers that group output are the only ones
    +    affected; with opts.ungroup set the caller does its own I/O and poll() is not
    +    involved.
    +
    +    On platforms with a native poll() there is no such limit,
    +    POLL_MAX_DESCRIPTORS is INT_MAX, and this is a no-op.
    +
    +    Signed-off-by: Tyrie Vella <tyrielv@gmail.com>
     
      ## builtin/fetch.c ##
     @@ builtin/fetch.c: static int fetch_multiple(struct string_list *list, int max_children,
    @@ run-command.c: static int pp_start_one(struct parallel_processes *pp,
      		pp->children[i].process.err = -1;
      		pp->children[i].process.stdout_to_stderr = 1;
     @@ run-command.c: void run_processes_parallel(const struct run_process_parallel_opts *opts)
    + 	int i, code;
    + 	int timeout = 100;
    + 	int spawn_cap = 4;
    ++	size_t max_live;
    + 	struct parallel_processes_for_signal pp_sig;
    + 	struct parallel_processes pp = {
    + 		.buffered_output = STRBUF_INIT,
    +@@ run-command.c: void run_processes_parallel(const struct run_process_parallel_opts *opts)
    + 	const char *tr2_label = opts->tr2_label;
    + 	const int do_trace2 = tr2_category && tr2_label;
      
    - 	/*
    - 	 * Unless the caller handles its own output, pp_buffer_io() polls one
    --	 * pipe for each child that is sending output and a second one for each
    --	 * child that is being fed on stdin. Limit how many children run at once
    --	 * so that the worst case stays within what poll() can wait on. Only
    --	 * concurrency is limited; the configured maximum is still honoured for
    --	 * the number of tasks that are run in total.
    ++	/*
    ++	 * Unless the caller handles its own output, pp_buffer_io() polls one
     +	 * output pipe per child and, unless excluded by no_stdin_pipe, may also
     +	 * poll an input pipe. Limit the number of live children so that all of
     +	 * their descriptors fit in one poll() call.
    - 	 */
    - 	max_live = opts->processes;
    --	if (!opts->ungroup && max_live > POLL_MAX_DESCRIPTORS / 2)
    --		max_live = POLL_MAX_DESCRIPTORS / 2;
    ++	 */
    ++	max_live = opts->processes;
     +	if (!opts->ungroup) {
     +		size_t fds_per_process = opts->no_stdin_pipe ? 1 : 2;
     +
     +		if (max_live > POLL_MAX_DESCRIPTORS / fds_per_process)
     +			max_live = POLL_MAX_DESCRIPTORS / fds_per_process;
     +	}
    - 
    ++
      	if (do_trace2)
      		trace2_region_enter_printf(tr2_category, tr2_label, NULL,
    + 					   "max:%"PRIuMAX,
    +@@ run-command.c: void run_processes_parallel(const struct run_process_parallel_opts *opts)
    + 	while (1) {
    + 		for (i = 0;
    + 		    i < spawn_cap && !pp.shutdown &&
    +-		    pp.nr_processes < opts->processes;
    ++		    pp.nr_processes < max_live;
    + 		    i++) {
    + 			code = pp_start_one(&pp, opts);
    + 			if (!code)
     
      ## run-command.h ##
     @@ run-command.h: struct run_process_parallel_opts
  • 208: 84a8e06 = 189: 667b01b pack-objects (mingw): demonstrate a segmentation fault with large deltas

  • 209: 9b7881d ! 190: a77615d mingw: support long paths

    @@ compat/mingw.c: ssize_t mingw_write(int fd, const void *buf, size_t len)
     +	if (xutftowcs_long_path(wdirname, dirname) < 0)
      		return -1;
      
    - 	if (has_symlinks) {
    + 	if (repo_has_symlinks(the_repository)) {
     @@ compat/mingw.c: int mingw_chdir(const char *dirname)
      		CloseHandle(hnd);
      	}
    @@ t/t2031-checkout-long-paths.sh (new)
     +test_expect_success 'checkout of long paths without core.longpaths fails' '
     +	git config core.longpaths false &&
     +	test_must_fail git checkout -f 2>error &&
    -+	grep -q "Filename too long" error &&
    ++	test_grep -q "Filename too long" error &&
     +	test ! -d longpa*
     +'
     +
  • 210: acd19f6 ! 191: bdba649 win32(long path support): leave drive-less absolute paths intact

    @@ t/t2031-checkout-long-paths.sh: test_expect_success SHORTABSPATH 'clean up path
     +	git update-index --add --cacheinfo 120000,$symlink_target_oid,PF &&
     +	git -c core.symlinks=true checkout -- PF &&
     +	cmd //c dir >actual &&
    -+	grep "<SYMLINKD\\?> *PF *\\[\\\\Program Files\\]" actual
    ++	test_grep "<SYMLINKD\\?> *PF *\\[\\\\Program Files\\]" actual
     +'
     +
      test_done
  • 211: 3830de6 = 192: 36d96df compat/fsmonitor/fsm-*-win32: support long paths

  • 212: 73ae0c9 = 193: 6d71571 clean: suggest using core.longPaths if paths are too long to remove

  • 213: 277c715 = 194: 79ce1ef mingw: explicitly specify with which cmd to prefix the cmdline

  • 214: dd28789 ! 195: 6c92aff mingw: when path_lookup() failed, try BusyBox

    @@ compat/mingw.c: static char *path_lookup(const char *cmd, int exe_only)
      
     
      ## t/t0014-alias.sh ##
    -@@ t/t0014-alias.sh: test_expect_success 'looping aliases - deprecated builtins' '
    +@@ t/t0014-alias.sh: test_expect_success HAVE_DEPRECATED 'looping aliases - deprecated builtins' '
      
      test_expect_success 'run-command formats empty args properly' '
      	test_must_fail env GIT_TRACE=1 git frotz a "" b " " c 2>actual.raw &&
  • 215: 5fbb8d2 = 196: 2a7ba47 test-tool: learn to act as a drop-in replacement for iconv

  • 216: c9f34f8 = 197: ff10adb tests(mingw): if iconv is unavailable, use test-helper --iconv

  • 217: 7cd1dff = 198: dad1077 gitattributes: mark .png files as binary

  • 218: d48d198 ! 199: af77fa5 tests: move test PNGs into t/lib-diff/

    @@ t/t6403-merge-file.sh: test_expect_success "expected conflict markers" '
      	test_must_fail git merge-file -p \
     -		orig.txt "$TEST_DIRECTORY"/test-binary-1.png new1.txt 2> merge.err &&
     +		orig.txt "$TEST_DIRECTORY"/lib-diff/test-binary-1.png new1.txt 2> merge.err &&
    - 	grep "Cannot merge binary files" merge.err
    + 	test_grep "Cannot merge binary files" merge.err
      '
      
      test_expect_success 'binary files cannot be merged with --object-id' '
  • 219: 044182f = 200: 46ce3ca tests: only override sort & find if there are usable ones in /usr/bin/

  • 220: 2c48841 = 201: 57b6a34 tests: use the correct path separator with BusyBox

  • 221: 0fd4359 = 202: ef148af mingw: only use Bash-ism builtin pwd -W when available

  • 222: 67df04a = 203: 95244de tests (mingw): remove Bash-specific pwd option

  • 223: af4f1d4 = 204: fb37494 test-lib: add BUSYBOX prerequisite

  • 224: d586260 = 205: 1569550 t5003: use binary file from t/lib-diff/

  • 225: 39ea2c0 = 206: 81e7c58 t5532: workaround for BusyBox on Windows

  • 226: 95bb69c = 207: cdd9421 t5605: special-case hardlink test for BusyBox-w32

  • 227: 53cbcfc = 208: 099a1bd t5813: allow for $PWD to be a Windows path

  • 228: a6aa3c8 = 209: ec7210a t9200: skip tests when $PWD contains a colon

  • 229: c831b76 = 210: 2c249e7 Partially un-revert "editor: save and reset terminal after calling EDITOR"

  • 231: efc4344 = 211: 0e81006 Describe Git for Windows' architecture

  • 232: 0e7582c = 212: fb78f3a Add an AGENTS.md file to help with AI-assisted debugging/development

  • 233: 790003f = 213: 5e3e03a Modify the Code of Conduct for Git for Windows

  • 234: 9511b9f = 214: ecd6bbb CONTRIBUTING.md: add guide for first-time contributors

  • 235: ab988e9 ! 215: 5041f6b README.md: Add a Windows-specific preamble

    @@ Commit message
     
      ## README.md ##
     @@
    --[![Build status](https://github.com/git/git/workflows/CI/badge.svg)](https://github.com/git/git/actions?query=branch%3Amaster+event%3Apush)
    +-[![GitHub build status](https://github.com/git/git/workflows/CI/badge.svg)](https://github.com/git/git/actions?query=branch%3Amaster+event%3Apush)
    +-[![GitLab build status](https://gitlab.com/git-scm/git/badges/master/pipeline.svg)](https://gitlab.com/git-scm/git/-/pipelines?ref=master)
     +Git for Windows
     +===============
     +
  • 237: 3913a2a = 216: af1cdf3 Add an issue template

  • 240: e47c424 = 217: e674481 Modify the GitHub Pull Request template (to reflect Git for Windows)

  • 236: bdbc5a5 ! 218: 631f04e Add a GitHub workflow to monitor component updates

    @@ .github/workflows/monitor-components.yml (new)
     +            feed: https://github.com/msys2/MINGW-packages/commits/master/mingw-w64-llvm.atom
     +          - label: innosetup
     +            feed: https://github.com/jrsoftware/issrc/tags.atom
    -+          - label: mimalloc
    -+            feed: https://github.com/microsoft/mimalloc/tags.atom
    -+            title-pattern: ^(?!v1\.|v3\.[01]\.)
     +      fail-fast: false
     +    steps:
     +      - uses: git-for-windows/rss-to-issues@v0
  • 241: bf2f042 = 219: a62e04b SECURITY.md: document Git for Windows' policies

  • 230: 369e489 = 220: be4ccfe reset: reinstate support for the deprecated --stdin option

  • 238: 2d5aad5 = 221: 9d0daf7 fsmonitor: reintroduce core.useBuiltinFSMonitor

  • 239: 463c323 = 222: 22e814c dependabot: help keeping GitHub Actions versions up to date

  • 242: a0840aa ! 223: 7502e7e ci: only run the expensive tests in the Windows tests for now

    @@ ci/lib.sh: export SKIP_DASHED_BUILT_INS=YesPlease
      # In order to catch bugs introduced at integration time by mismerges,
      # enable the long tests for pushes to the integration branches as well.
     +test -z "$MSYSTEM" ||
    - case "$GITHUB_EVENT_NAME,$CI_BRANCH" in
    + case "$CI_EVENT,$CI_BRANCH" in
      pull_request,*|push,*next*|push,*master*|push,*main*|push,*maint*)
    - 	export GIT_TEST_LONG=YesPlease
    + 	export GIT_TEST_LONG=${GIT_TEST_LONG:-true}
  • 243: 6ffd1dd = 224: 1f60ad3 build(deps): bump actions/cache from 5 to 6

  • 244: 6abbdd6 < -: ------------- fixup! object-file.c: use size_t for header lengths

  • 245: 3ae86cd < -: ------------- fixup! hash algorithms: use size_t for section lengths

  • 246: 6bcaa3b < -: ------------- fixup! hash-object --stdin: verify that it works with >4GB/LLP64

  • 247: ede99ee < -: ------------- fixup! hash-object: add another >4GB/LLP64 test case

  • 248: c8dff95 < -: ------------- fixup! hash-object: add a >4GB/LLP64 test case using filtered input

  • 249: 88213df = 225: 5905644 repo: split annotated tags out from total tag count in structure

  • 250: 0b30a78 ! 226: f9584af repo: filter the structure scope via --ref-filter=

    @@ t/t1901-repo-structure.sh: test_expect_success 'progress meter option' '
     +
     +		git repo structure --format=lines \
     +			--ref-filter="refs/heads/*" >out &&
    -+		grep "^references.branches.count=1$" out &&
    -+		grep "^references.tags.count=0$" out &&
    -+		grep "^references.remotes.count=0$" out
    ++		test_grep "^references.branches.count=1$" out &&
    ++		test_grep "^references.tags.count=0$" out &&
    ++		test_grep "^references.remotes.count=0$" out
     +	)
     +'
     +
    @@ t/t1901-repo-structure.sh: test_expect_success 'progress meter option' '
     +		git repo structure --format=lines \
     +			--ref-filter="refs/heads/*" \
     +			--ref-filter="refs/tags/*" >out &&
    -+		grep "^references.branches.count=1$" out &&
    -+		grep "^references.tags.count=2$" out &&
    -+		grep "^references.remotes.count=0$" out
    ++		test_grep "^references.branches.count=1$" out &&
    ++		test_grep "^references.tags.count=2$" out &&
    ++		test_grep "^references.remotes.count=0$" out
     +	)
     +'
     +
      test_expect_success 'git repo structure -h shows only repo structure usage' '
    - 	test_must_fail git repo structure -h >actual &&
    + 	git repo structure -h >actual &&
      	test_grep "git repo structure" actual &&
  • 251: 24998ca = 227: 11ead4e repo: report top-N paths by count, disk, and inflated size in structure

  • 252: 78b5b18 ! 228: d11303a t1901: cover the --top option of git repo structure

    @@ t/t1901-repo-structure.sh: test_expect_success '--ref-filter unions multiple pat
     +		test_commit foo &&
     +
     +		git repo structure --format=lines >out &&
    -+		! grep "\.top\." out
    ++		test_grep ! "\.top\." out
     +	)
     +'
     +
    @@ t/t1901-repo-structure.sh: test_expect_success '--ref-filter unions multiple pat
     +			for type in trees blobs
     +			do
     +				key=objects.${type}.top.${axis} &&
    -+				grep -E "^${key}\.1\.path=" out &&
    -+				grep -E "^${key}\.2\.path=" out &&
    -+				! grep -E "^${key}\.3\." out || return 1
    ++				test_grep -E "^${key}\.1\.path=" out &&
    ++				test_grep -E "^${key}\.2\.path=" out &&
    ++				test_grep ! -E "^${key}\.3\." out || return 1
     +			done
     +		done &&
     +
     +		# The big blob outranks the small one on disk and inflated.
     +		key=objects.blobs.top &&
    -+		grep "^${key}.by_disk_size.1.path=dir2/big.txt$" out &&
    -+		grep "^${key}.by_inflated_size.1.path=dir2/big.txt$" out
    ++		test_grep "^${key}.by_disk_size.1.path=dir2/big.txt$" out &&
    ++		test_grep "^${key}.by_inflated_size.1.path=dir2/big.txt$" out
     +	)
     +'
     +
    @@ t/t1901-repo-structure.sh: test_expect_success '--ref-filter unions multiple pat
     +'
     +
      test_expect_success 'git repo structure -h shows only repo structure usage' '
    - 	test_must_fail git repo structure -h >actual &&
    + 	git repo structure -h >actual &&
      	test_grep "git repo structure" actual &&
  • 253: 722b232 ! 229: 50ee67f repo: read the --top default from repo.structure.top

    @@ Commit message
         Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
     
      ## Documentation/config.adoc ##
    -@@ Documentation/config.adoc: include::config/remotes.adoc[]
    +@@ Documentation/config.adoc: include::config/repack.adoc[]
      
    - include::config/repack.adoc[]
    + include::config/replay.adoc[]
      
     +include::config/repo.adoc[]
     +
    @@ t/t1901-repo-structure.sh: test_expect_success '--top rejects negative values' '
     +
     +		git -c repo.structure.top=2 \
     +			repo structure --format=lines >with-config &&
    -+		grep "^objects.blobs.top.by_count.1.path=" with-config &&
    ++		test_grep "^objects.blobs.top.by_count.1.path=" with-config &&
     +
     +		git -c repo.structure.top=2 \
     +			repo structure --format=lines --top=0 >cli-override &&
    -+		! grep "\.top\." cli-override
    ++		test_grep ! "\.top\." cli-override
     +	)
     +'
     +
      test_expect_success 'git repo structure -h shows only repo structure usage' '
    - 	test_must_fail git repo structure -h >actual &&
    + 	git repo structure -h >actual &&
      	test_grep "git repo structure" actual &&
  • 254: 9b8b919 = 230: 015ec0b git-survey: announce the upcoming pivot into git repo structure

  • 260: a935247 = 231: 8c27fe3 bundle-uri: refuse advertised URIs by protocol

  • 255: 87d1212 ! 232: 48a1d61 survey: turn into a thin shim over git repo structure

    @@ t/t8100-git-survey.sh: export TEST_PASSES_SANITIZE_LEAK
      
     -test_expect_success 'git survey -h shows experimental warning' '
     +test_expect_success 'git survey -h shows the deprecated banner' '
    - 	test_expect_code 129 git survey -h >usage &&
    --	grep "EXPERIMENTAL!" usage
    -+	grep "DEPRECATED!" usage
    + 	test_expect_code 0 git survey -h >usage &&
    +-	test_grep "EXPERIMENTAL!" usage
    ++	test_grep "DEPRECATED!" usage
      '
      
      test_expect_success 'create a semi-interesting repo' '
    @@ t/t8100-git-survey.sh: test_expect_success 'create a semi-interesting repo' '
     -	    Commits |    10
     -	      Trees |    10
     -	      Blobs |    10
    -+	grep "is deprecated" err
    ++	test_grep "is deprecated" err
     +'
      
     -	TOTAL OBJECT SIZES BY TYPE
  • 256: b4d1fb6 (upstream: 936eb75) < -: ------------- wincred: avoid memory corruption when erasing a credential

  • 257: 52ca111 (upstream: f635ab9) < -: ------------- wincred: prevent silent credential loss when storing OAuth tokens

  • 258: e9d0fac < -: ------------- fixup! run-command: be helpful with Git LFS fails on Windows 7

  • 259: 2db2a66 < -: ------------- fixup! Add a GitHub workflow to monitor component updates

  • 264: 32c4f76 = 233: ae18d95 git-for-windows: prepare for 2.55.0(5)

  • 261: d7753d7 ! 234: 7be713c mingw: handle staging 4GB+ files correctly

    @@ Commit message
     
         Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
     
    - ## git-zlib.c ##
    -@@ git-zlib.c: static const char *zerr_to_string(int status)
    - 
    - /* uLong is 32-bit on Windows, even on 64-bit systems */
    - #define ULONG_MAX_VALUE maximum_unsigned_value_of_type(uLong)
    --static inline uInt zlib_buf_cap(unsigned long len)
    -+static inline uInt zlib_buf_cap(size_t len)
    - {
    - 	return (ZLIB_BUF_MAX < len) ? ZLIB_BUF_MAX : len;
    - }
    -
    - ## object-file.c ##
    -@@ object-file.c: static int end_loose_object_common(struct odb_source_loose *loose,
    - 
    - int write_loose_object(struct odb_source_loose *loose,
    - 		       const struct object_id *oid, char *hdr,
    --		       int hdrlen, const void *buf, unsigned long len,
    -+		       int hdrlen, const void *buf, size_t len,
    - 		       time_t mtime, unsigned flags)
    - {
    - 	int fd, ret;
    -
    - ## object-file.h ##
    -@@ object-file.h: void write_object_file_prepare(const struct git_hash_algo *algo,
    - 			       char *hdr, size_t *hdrlen);
    - int write_loose_object(struct odb_source_loose *loose,
    - 		       const struct object_id *oid, char *hdr,
    --		       int hdrlen, const void *buf, unsigned long len,
    -+		       int hdrlen, const void *buf, size_t len,
    - 		       time_t mtime, unsigned flags);
    - 
    - /* Helper to check and "touch" a file */
    -
      ## odb.c ##
     @@ odb.c: void odb_assert_oid_type(struct object_database *odb,
      }
    @@ odb.c: void odb_assert_oid_type(struct object_database *odb,
     +			 const void *buf, size_t len,
      			 enum object_type type,
      			 struct object_id *oid,
    - 			 struct object_id *compat_oid,
    + 			 const struct object_id *compat_oid_in,
     
      ## odb.h ##
     @@ odb.h: enum odb_write_object_flags {
    @@ odb.h: enum odb_write_object_flags {
     +			 const void *buf, size_t len,
      			 enum object_type type,
      			 struct object_id *oid,
    - 			 struct object_id *compat_oid,
    + 			 const struct object_id *compat_oid,
      			 enum odb_write_object_flags flags);
      
      static inline int odb_write_object(struct object_database *odb,
    @@ odb.h: enum odb_write_object_flags {
      				   struct object_id *oid)
      {
     
    + ## odb/source-loose.c ##
    +@@ odb/source-loose.c: static int end_loose_object_common(struct odb_source_loose *loose,
    + 
    + static int write_loose_object(struct odb_source_loose *loose,
    + 			      const struct object_id *oid, char *hdr,
    +-			      int hdrlen, const void *buf, unsigned long len,
    ++			      int hdrlen, const void *buf, size_t len,
    + 			      const time_t *mtime, unsigned flags)
    + {
    + 	int fd, ret;
    +
      ## odb/source.h ##
     @@ odb/source.h: static inline int odb_source_freshen_object(struct odb_source *source,
       * object ID and the compatibility object ID, if non-NULL.
    @@ odb/source.h: static inline int odb_source_freshen_object(struct odb_source *sou
     -					  const void *buf, unsigned long len,
     +					  const void *buf, size_t len,
      					  enum object_type type,
    - 					  struct object_id *oid,
    - 					  struct object_id *compat_oid,
    + 					  const struct object_id *oid,
    + 					  const struct object_id *compat_oid,
  • 262: a60a705 ! 235: c0cf0e7 mingw: support unpacking loose 4GB+ objects

    @@ odb/source-loose.c: struct odb_loose_read_stream {
      	char hdr[32];
      	int hdr_avail;
      	int hdr_used;
    -@@ odb/source-loose.c: static int odb_source_loose_read_object_stream(struct odb_read_stream **out,
    +@@ odb/source-loose.c: static int odb_source_loose_read_object_stream(struct odb_stream **out,
      	struct odb_source_loose *loose = odb_source_loose_downcast(source);
      	struct object_info oi = OBJECT_INFO_INIT;
      	struct odb_loose_read_stream *st;
  • 263: 5d1c2d2 = 236: 58043fa t: add an expensive test to verify that 4GB+ blobs can be staged/read

  • 265: 4c1f109 < -: ------------- compat/poll: do not collect more handles than the wait supports

  • 267: f8d1137 < -: ------------- run-command: limit concurrent children to what poll() can wait on

  • 268: 00fa850 = 237: c419d20 ci: bump debian-11 job to debian-12

  • 269: 318303d < -: ------------- fixup! compat/poll: do not collect more handles than the wait supports

  • 270: ff02714 < -: ------------- fixup! compat/poll: do not collect more handles than the wait supports

  • 273: d7db566 < -: ------------- fixup! mingw: rely on MSYS2's metadata instead of hard-coding it

  • -: ------------- > 238: 13e7ca3 fixup! Add config option windows.appendAtomically

This closes #6406.

@dscho dscho added this to the Next release milestone Sep 11, 2026
@dscho dscho self-assigned this Sep 11, 2026
derrickstolee and others added 28 commits September 11, 2026 14:47
Signed-off-by: Derrick Stolee <stolee@gmail.com>
The winsock2 library provides functions that work on different data
types than file descriptors, therefore we wrap them.

But that is not the only difference: they also do not set `errno` but
expect the callers to enquire about errors via `WSAGetLastError()`.

Let's translate that into appropriate `errno` values whenever the socket
operations fail so that Git's code base does not have to change its
expectations.

This closes git-for-windows#2404

Helped-by: Jeff Hostetler <jeffhost@microsoft.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
In future changes, we will make use of these methods. The intention is to
keep track of the top contributors according to some metric. We don't want
to store all of the entries and do a sort at the end, so track a
constant-size table and remove rows that get pushed out depending on the
chosen sorting algorithm.

Co-authored-by: Jeff Hostetler <git@jeffhostetler.com>
Signed-off-by; Jeff Hostetler <git@jeffhostetler.com>
Signed-off-by: Derrick Stolee <stolee@gmail.com>
We map WSAGetLastError() errors to errno errors in winsock_error_to_errno(),
but the MSVC strerror() implementation only produces "Unknown error" for
most of them. Produce some more meaningful error messages in these
cases.

Our builds for ARM64 link against the newer UCRT strerror() that does know
these errors, so we won't change the strerror() used there.

The wording of the messages is copied from glibc strerror() messages.

Reported-by: M Hickford <mirth.hickford@gmail.com>
Signed-off-by: Matthias Aßhauer <mha1993@live.de>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Since we are already walking our reachable objects using the path-walk API,
let's now collect lists of the paths that contribute most to different
metrics. Specifically, we care about

 * Number of versions.
 * Total size on disk.
 * Total inflated size (no delta or zlib compression).

This information can be critical to discovering which parts of the
repository are causing the most growth, especially on-disk size. Different
packing strategies might help compress data more efficiently, but the toal
inflated size is a representation of the raw size of all snapshots of those
paths. Even when stored efficiently on disk, that size represents how much
information must be processed to complete a command such as 'git blame'.

The exact disk size seems to be not quite robust enough for testing, as
could be seen by the `linux-musl-meson` job consistently failing, possibly
because of zlib-ng deflates differently: t8100.4(git survey
(default)) was failing with a symptom like this:

   TOTAL OBJECT SIZES BY TYPE
   ===============================================
   Object Type | Count | Disk Size | Inflated Size
   ------------+-------+-----------+--------------
  -    Commits |    10 |      1523 |          2153
  +    Commits |    10 |      1528 |          2153
         Trees |    10 |       495 |          1706
         Blobs |    10 |       191 |           101
  -       Tags |     4 |       510 |           528
  +       Tags |     4 |       547 |           528

This means: the disk size is unlikely something we can verify robustly.
Since zlib-ng seems to increase the disk size of the tags from 528 to
547, we cannot even assume that the disk size is always smaller than the
inflated size. We will most likely want to either skip verifying the
disk size altogether, or go for some kind of fuzzy matching, say, by
replacing `s/ 1[45][0-9][0-9] / ~1.5k /` and `s/ [45][0-9][0-9] / ~½k /`
or something like that.

Signed-off-by: Derrick Stolee <stolee@gmail.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
This comment has been true for the longest time; The combination of the
two preceding commits made it incorrect, so let's drop that comment.

Signed-off-by: Matthias Aßhauer <mha1993@live.de>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
The 'git survey' builtin provides several detail tables, such as "top
files by on-disk size". The size of these tables defaults to 10,
currently.

Allow the user to specify this number via a new --top=<N> option or the
new survey.top config key.

Signed-off-by: Derrick Stolee <stolee@gmail.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Commit 2406bf5 (Win32: detect unix socket support at runtime,
2024-04-03) introduced a runtime detection for whether the operating
system supports unix sockets for Windows, but a mistake snuck into the
tests. When building and testing Git without NO_UNIX_SOCKETS we
currently skip t0301-credential-cache on Windows if unix sockets are
supported and run the tests if they aren't.

Flip that logic to actually work the way it was intended.

Signed-off-by: Matthias Aßhauer <mha1993@live.de>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
The sparse tree walk algorithm was created in d5d2e93 (revision:
implement sparse algorithm, 2019-01-16) and involves using the
mark_trees_uninteresting_sparse() method. This method takes a repository
and an oidset of tree IDs, some of which have the UNINTERESTING flag and
some of which do not.

Create a method that has an equivalent set of preconditions but uses a
"dense" walk (recursively visits all reachable trees, as long as they
have not previously been marked UNINTERESTING). This is an important
difference from mark_tree_uninteresting(), which short-circuits if the
given tree has the UNINTERESTING flag.

A use of this method will be added in a later change, with a condition
set whether the sparse or dense approach should be used.

Signed-off-by: Derrick Stolee <stolee@gmail.com>
While this command is definitely something we _want_, chances are that
upstreaming this will require substantial changes.

We still want to be able to experiment with this before that, to focus
on what we need out of this command: To assist with diagnosing issues
with large repositories, as well as to help monitoring the growth and
the associated painpoints of such repositories.

To that end, we are about to integrate this command into
`microsoft/git`, to get the tool into the hands of users who need it
most, with the idea to iterate in close collaboration between these
users and the developers familar with Git's internals.

However, we will definitely want to avoid letting anybody have the
impression that this command, its exact inner workings, as well as its
output format, are anywhere close to stable. To make that fact utterly
clear (and thereby protect the freedom to iterate and innovate freely
before upstreaming the command), let's mark its output as experimental
in all-caps, as the first thing we do.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
In 245670c (credential-cache: check for windows specific errors, 2021-09-14)
we concluded that on Windows we would always encounter ENETDOWN where we
would expect ECONNREFUSED on POSIX systems, when connecting to unix sockets.
As reported in [1], we do encounter ECONNREFUSED on Windows if the
socket file doesn't exist, but the containing directory does and ENETDOWN if
neither exists. We should handle this case like we do on non-windows systems.

[1] git-for-windows#4762 (comment)

This fixes git-for-windows#5314

Helped-by: M Hickford <mirth.hickford@gmail.com>
Signed-off-by: Matthias Aßhauer <mha1993@live.de>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
The reftable library goes out of its way to use its own set of allocator
functions that can be configured using `reftable_set_alloc()`. However,
Git does not configure this.

That is not typically a problem, except when Git uses a custom allocator
via some definitions in `git-compat-util.h`, as is the case in Git for
Windows (which switched away from the long-unmaintained nedmalloc to
mimalloc).

Then, it is quite possible that Git assigns a `strbuf` (allocated via
the custom allocator) to, say, the `refname` field of a
`reftable_log_record` in `write_transaction_table()`, and later on asks
the reftable library function `reftable_log_record_release()` to release
it, but that function was compiled without using `git-compat-util.h` and
hence calls regular `free()` (i.e. _not_ the custom allocator's own
function).

This has been a problem for a long time and it was a matter of some sort
of "luck" that 1) reftables are not commonly used on Windows, and 2)
mimalloc can often ignore gracefully when it is asked to release memory
that it has not allocated.

However, a recent update to `seen` brought this problem to the
forefront, letting t1460 fail in Git for Windows, with symptoms much in
the same way as the problem I had to address in d02c37c
(t-reftable-basics: allow for `malloc` to be `#define`d, 2025-01-08)
where exit code 127 was also produced in lieu of
`STATUS_HEAP_CORRUPTION` (C0000374) because exit codes are only 7 bits
wide.

It was not possible to figure out what change in particular caused these
new failures within a reasonable time frame, as there are too many
changes in `seen` that conflict with Git for Windows' patches, I had to
stop the investigation after spending four hours on it fruitlessly.

To verify that this patch fixes the issue, I avoided using mimalloc and
temporarily patched in a "custom allocator" that would more reliably
point out problems, like this:

  diff --git a/refs/reftable-backend.c b/refs/reftable-backend.c
  index 68f3829..9421d630b9f5 100644
  --- a/refs/reftable-backend.c
  +++ b/refs/reftable-backend.c
  @@ -353,6 +353,69 @@ static int reftable_be_fsync(int fd)
   	return fsync_component(FSYNC_COMPONENT_REFERENCE, fd);
   }

  +#define DEBUG_REFTABLE_ALLOC
  +#ifdef DEBUG_REFTABLE_ALLOC
  +#include "khash.h"
  +
  +static inline khint_t __ac_X31_hash_ptr(void *ptr)
  +{
  +	union {
  +		void *ptr;
  +		char s[sizeof(void *)];
  +	} u;
  +	size_t i;
  +	khint_t h;
  +
  +	u.ptr = ptr;
  +	h = (khint_t)*u.s;
  +	for (i = 0; i < sizeof(void *); i++)
  +		h = (h << 5) - h + (khint_t)u.s[i];
  +	return h;
  +}
  +
  +#define kh_ptr_hash_func(key) __ac_X31_hash_ptr(key)
  +#define kh_ptr_hash_equal(a, b) ((a) == (b))
  +
  +KHASH_INIT(ptr, void *, int, 0, kh_ptr_hash_func, kh_ptr_hash_equal)
  +
  +static kh_ptr_t *my_malloced;
  +
  +static void *my_malloc(size_t sz)
  +{
  +	int dummy;
  +	void *ptr = malloc(sz);
  +	if (ptr)
  +		kh_put_ptr(my_malloced, ptr, &dummy);
  +	return ptr;
  +}
  +
  +static void *my_realloc(void *ptr, size_t sz)
  +{
  +	int dummy;
  +	if (ptr) {
  +		khiter_t pos = kh_get_ptr(my_malloced, ptr);
  +		if (pos >= kh_end(my_malloced))
  +			die("Was not my_malloc()ed: %p", ptr);
  +		kh_del_ptr(my_malloced, pos);
  +	}
  +	ptr = realloc(ptr, sz);
  +	if (ptr)
  +		kh_put_ptr(my_malloced, ptr, &dummy);
  +	return ptr;
  +}
  +
  +static void my_free(void *ptr)
  +{
  +	if (ptr) {
  +		khiter_t pos = kh_get_ptr(my_malloced, ptr);
  +		if (pos >= kh_end(my_malloced))
  +			die("Was not my_malloc()ed: %p", ptr);
  +		kh_del_ptr(my_malloced, pos);
  +	}
  +	free(ptr);
  +}
  +#endif
  +
   static struct ref_store *reftable_be_init(struct repository *repo,
   					  const char *gitdir,
   					  unsigned int store_flags)
  @@ -362,6 +425,11 @@ static struct ref_store *reftable_be_init(struct repository *repo,
   	int is_worktree;
   	mode_t mask;

  +#ifdef DEBUG_REFTABLE_ALLOC
  +	my_malloced = kh_init_ptr();
  +	reftable_set_alloc(my_malloc, my_realloc, my_free);
  +#endif
  +
   	mask = umask(0);
   	umask(mask);

I briefly considered contributing this "custom allocator" patch, too,
but it is unwieldy (for example, it would not work at all when compiling
with mimalloc support) and it would only waste space (or even time, if a
compile flag was introduced and exercised as part of the CI builds).
Given that it is highly unlikely that Git will lose the new
`reftable_set_alloc()` call by mistake, I rejected that idea as simply
too wasteful.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Every once in a while, whitespace errors are introduced in Git for
Windows' rebases to newer Git versions, simply by virtue of integrating
upstream commits that do not follow upstream Git's own whitespace rule.
In Git v2.50.0-rc0, for example, 03f2915 (xdiff: disable
cleanup_records heuristic with --minimal, 2025-04-29) introduced a
trailing space.

Arguably, non-actionable alerts are worse than no alerts at all, so
let's suppress those alerts that we cannot do anything about, anyway.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
The 2.53.0.rc0.windows release candidate had a regression where
writing to stderr from a pre-push hook would error out.

The regression was fixed in 2.53.0.rc1.windows and the test here ensures
that this stays fixed.

Signed-off-by: Thomas Braun <thomas.braun@virtuell-zuhause.de>
Although NTLM authentication is considered weak (extending even to
NTLMv2, which purportedly allows brute-forcing reasonably complex
8-character passwords in a matter of days, given ample compute
resources), it _is_ one of the authentication methods supported by
libcurl.

Note: The added test case *cannot* reuse the existing `custom_auth`
facility. The reason is that that facility is backed by an NPH script
("No Parse Headers"), which does not allow handling the 3-phase NTLM
authentication correctly (in my hands, the NPH script would not even be
called upon the Type 3 message, a "200 OK" would be returned, but no
headers, let alone the `git http-backend` output as payload). Having a
separate NTLM authentication script makes the exact workings clearer and
more readable, anyway.

Co-authored-by: Matthew John Cheetham <mjcheetham@outlook.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
This will come in handy in the next commit.

Signed-off-by: JiSeop Moon <zcube@zcube.kr>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
NTLM authentication is relatively weak. This is the case even with the
default setting of modern Windows versions, where NTLMv1 and LanManager
are disabled and only NTLMv2 is enabled: NTLMv2 hashes of even
reasonably complex 8-character passwords can be broken in a matter of
days, given enough compute resources.

Even worse: On Windows, NTLM authentication uses Security Support
Provider Interface ("SSPI"), which provides the credentials without
requiring the user to type them in.

Which means that an attacker could talk an unsuspecting user into
cloning from a server that is under the attacker's control and extracts
the user's NTLMv2 hash without their knowledge.

For that reason, let's disallow NTLM authentication by default.

NTLM authentication is quite simple to set up, though, and therefore
there are still some on-prem Azure DevOps setups out there whose users
and/or automation rely on this type of authentication. To give them an
escape hatch, introduce the `http.<url>.allowNTLMAuth` config setting
that can be set to `true` to opt back into using NTLM for a specific
remote repository.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
The `git_terminal_prompt()` function expects the terminal window to be
attached to a Win32 Console. However, this is not the case with terminal
windows other than `cmd.exe`'s, e.g. with MSys2's own `mintty`.

Non-cmd terminals such as `mintty` still have to have a Win32 Console
to be proper console programs, but have to hide the Win32 Console to
be able to provide more flexibility (such as being resizeable not only
vertically but also horizontally). By writing to that Win32 Console,
`git_terminal_prompt()` manages only to send the prompt to nowhere and
to wait for input from a Console to which the user has no access.

This commit introduces a function specifically to support `mintty` -- or
other terminals that are compatible with MSys2's `/dev/tty` emulation. We
use the `TERM` environment variable as an indicator for that: if the value
starts with "xterm" (such as `mintty`'s "xterm_256color"), we prefer to
let `xterm_prompt()` handle the user interaction.

The most prominent user of `git_terminal_prompt()` is certainly
`git-remote-https.exe`. It is an interesting use case because both
`stdin` and `stdout` are redirected when Git calls said executable, yet
it still wants to access the terminal.

When running inside a `mintty`, the terminal is not accessible to the
`git-remote-https.exe` program, though, because it is a MinGW program
and the `mintty` terminal is not backed by a Win32 console.

To solve that problem, we simply call out to the shell -- which is an
*MSys2* program and can therefore access `/dev/tty`.

Helped-by: nalla <nalla@hamal.uberspace.de>
Signed-off-by: Karsten Blees <blees@dcon.de>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
It is a known issue that a rename() can fail with an "Access denied"
error at times, when copying followed by deleting the original file
works. Let's just fall back to that behavior.

Signed-off-by: JiSeop Moon <zcube@zcube.kr>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
The new default of Git is to disable NTLM authentication by default.

To help users find the escape hatch of that config setting, should they
need it, suggest it when the authentication failed and the server had
offered NTLM, i.e. if re-enabling it would fix the problem.

Helped-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Accessing the Windows console through the special CONIN$ / CONOUT$ devices
doesn't work properly for non-ASCII usernames an passwords.

It also doesn't work for terminal emulators that hide the native console
window (such as mintty), and 'TERM=xterm*' is not necessarily a reliable
indicator for such terminals.

The new shell_prompt() function, on the other hand, works fine for both
MSys1 and MSys2, in native console windows as well as mintty, and properly
supports Unicode. It just needs bash on the path (for 'read -s', which is
bash-specific).

On Windows, try to use the shell to read from the terminal. If that fails
with ENOENT (i.e. bash was not found), use CONIN/OUT as fallback.

Note: To test this, create a UTF-8 credential file with non-ASCII chars,
e.g. in git-bash: 'echo url=http://täst.com > cred.txt'. Then in git-cmd,
'git credential fill <cred.txt' works (shell version), while calling git
without the git-wrapper (i.e. 'mingw64\bin\git credential fill <cred.txt')
mangles non-ASCII chars in both console output and input.

Signed-off-by: Karsten Blees <blees@dcon.de>
In preparation for making this function a bit more complicated (to allow
for special-casing the `ContainerMappedDirectories` in Windows
containers, which look like a symbolic link, but are not), let's move it
out of the header.

Signed-off-by: JiSeop Moon <zcube@zcube.kr>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
The previous commits disabled NTLM authentication by default due to its
cryptographic weaknesses. Users can re-enable it via the config setting
http.<url>.allowNTLMAuth, but this requires manual intervention.

Credential helpers may have knowledge about which servers are trusted
for NTLM authentication (e.g., known on-prem Azure DevOps instances).
To allow them to signal this trust, introduce a simple negotiation:
when NTLM is suppressed and the server offered it, Git advertises
ntlm=suppressed to the credential helper. The helper can respond with
ntlm=allow to re-enable NTLM for this request.

This happens precisely at the point where we would otherwise warn the
user about NTLM being suppressed, ensuring the capability is only
advertised when relevant.

Helped-by: Matthew John Cheetham <mjcheetham@outlook.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
It was already decided in ef22148 (clean: do not traverse mount points,
2018-12-07) that we shouldn't traverse NTFS junctions/bind mounts when
using `git clean`, partly because they're sometimes used in worktrees.
But the same check wasn't applied to `remove_dir_recurse()` in `dir.c`,
which `git worktree remove` uses. So removing a worktree suffers the
same problem we had previously with `git clean`.

Let's add the same guard from ef22148.

Signed-off-by: Maks Kuznia <makskuznia244@gmail.com>
While the currently used way to detect the number of CPU cores on
Windows is nice and straight-forward, GetSystemInfo() only gives us
access to the number of processors within the current group. [1]

While that is usually fine for systems with a single physical CPU,
separate physical sockets are typically separate groups.

Switch to using GetLogicalProcessorInformationEx() to handle multi-socket
systems better.

[1] https://learn.microsoft.com/en-us/windows/win32/api/sysinfoapi/ns-sysinfoapi-system_info#members

This fixes git-for-windows#4766

Co-Authored-by: Herman Semenov <GermanAizek@yandex.ru>
Signed-off-by: Matthias Aßhauer <mha1993@live.de>
Add tests exercising the interaction between http.emptyAuth and
servers that advertise Negotiate (SPNEGO) authentication.

Verify that auto mode gives Negotiate a chance via empty auth
(resulting in two 401 responses before falling through to
credential_fill with Basic credentials), and that false mode
strips Negotiate immediately (only one 401 response).

Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
When checkout.workers > 1 and core.fscache is enabled on Windows,
'git checkout <tree> -- <pathspec>' fails when restoring files into
directories that do not yet exist on disk. Two failure modes occur:

1. create_directories(): the fscache returns a stale directory listing
   that does not include a just-created directory. has_dirs_only_path()
   reports it as non-existent, triggering the unlink+mkdir recovery
   path which fails with 'cannot create directory: Directory not empty'.

2. write_pc_item(): after writing and closing a file, lstat() cannot
   see it through the stale fscache, failing with 'unable to stat
   just-written file'.

With workers=1, write_entry() calls flush_fscache() after each file,
keeping the cache in sync. With workers>1, enqueue_checkout() defers
the write (and the flush), leaving the cache stale for subsequent
entries.

Fix both by adding flush_fscache() calls after mkdir() in
create_directories() and before lstat() in write_pc_item(). On
non-Windows platforms flush_fscache() is a no-op.

Assisted-by: Claude Opus 4.6
Signed-off-by: Tyrie Vella <tyrielv@gmail.com>
Historically, the macOS jobs have always been among the longest-running
ones, and recently the `git p4` tests became another liability: They
started to fail much more often (maybe as of the switch away from the
`macos-13` pool?), requiring re-runs of the jobs that already were
responsible for long CI build times.

Of the 35 test scripts that exercise `git p4`, 32 are actually run on
macOS (3 are skipped for reasons like case-sensitivee filesystem), and
they take an accumulated runtime of over half an hour.

Furthermore, the `git p4` command is not really affected by Git for
Windows' patches, at least not as far as macOS is concerned, therefore
it is not only causing developer friction to have these long-running,
frequently failing tests, it is also quite wasteful: There has not been
a single instance so far where any `git p4` test failure in Git for
Windows had demonstrated an actionable bug.

While upstream Git is confident to have addressed the flakiness of the
`git p4` tests via ffff0bb (Use Perforce arm64 binary on macOS CI
jobs, 2025-11-16) (which got slipped in at the 11th hour into the
v2.52.0 release, fast-tracked without ever hitting `seen` even after
-rc2 was released), I am not quite so confident, and besides, the
runtime penalty of running those tests in Git for Windows' CI runs is
still a worrisome burden.

So let's just disable those tests in the CI runs, at least on macOS.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
dscho and others added 25 commits September 11, 2026 14:47
A fix for calling `vim` in Windows Terminal caused a regression and was
reverted. We partially un-revert this, to get the fix again.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
This topic branch re-adds the deprecated --stdin/-z options to `git
reset`. Those patches were overridden by a different set of options in
the upstream Git project before we could propose `--stdin`.

We offered this in MinGit to applications that wanted a safer way to
pass lots of pathspecs to Git, and these applications will need to be
adjusted.

Instead of `--stdin`, `--pathspec-from-file=-` should be used, and
instead of `-z`, `--pathspec-file-nul`.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Originally introduced as `core.useBuiltinFSMonitor` in Git for Windows
and developed, improved and stabilized there, the built-in FSMonitor
only made it into upstream Git (after unnecessarily long hemming and
hawing and throwing overly perfectionist style review sticks into the
spokes) as `core.fsmonitor = true`.

In Git for Windows, with this topic branch, we re-introduce the
now-obsolete config setting, with warnings suggesting to existing users
how to switch to the new config setting, with the intention to
ultimately drop the patch at some stage.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Mirror what git survey already reports: lightweight tags
(pointing straight at a commit/tree/blob) and annotated tags
(pointing at an OBJ_TAG that is itself stored as a separate
object) are different things in many monorepo contexts, and one
of the differences git survey users routinely care about. Add
an annotated_tags counter to struct ref_stats, populate it in
count_references() by peeking at the ref OID's object type, and
expose it as a sub-row under Tags in the table output and as
references.tags.annotated.count in the machine-readable formats.

Step toward pivoting the standalone git survey command onto
git repo structure; this fills the first of the four feature
gaps documented in the assessment.

Tests in t1901 widened to assert the new row and key.

Assisted-by: Opus 4.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
`git repo structure` walks every reference enumerated by
`refs_for_each_ref()` and feeds each reference's tip into the path
walk that produces the object counts. There is no way to scope the
inquiry to a subset of refs, even though that is the most common
need when an operator is investigating what part of the history is
driving cost: only branches, only release tags, only one remote's
view, etc.

Add a single `--ref-filter=<pattern>` option that, when given,
restricts both the reference count and the object walk to refs whose
full name matches one of the patterns. The option is repeatable;
multiple patterns form a union, so `--ref-filter='refs/heads/*'
--ref-filter='refs/tags/v*'` includes local branches and tags whose
short name starts with `v`. Patterns use `wildmatch()` with
`WM_PATHNAME` semantics so a `*` does not cross `/`, matching the
convention used by `git for-each-ref` positional arguments.

Choosing a single flexible filter, rather than a proliferation of
per-kind flags like `--branches`, `--tags`, `--remotes`, keeps the
option surface small and lets the same mechanism express
narrow selections the per-kind flags could not, such as "only release
tags" (`'refs/tags/v*'`) or "only one remote's branches"
(`'refs/remotes/origin/*'`). Without `--ref-filter`, behaviour is
unchanged: every ref `refs_for_each_ref()` enumerates contributes.

Both the reference counter and the path-walk seeding (via
`add_pending_oid()`) sit on the same callback, so an early return
when no pattern matches naturally excludes a ref from both. No
separate object-walk machinery is needed.

Cover the two interesting code paths with tests in t1901: a single
filter narrowing to branches, and two filters unioning to include
both branches and tags.

Assisted-by: Opus 4.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
`git survey` distinguishes itself from `git repo structure` largely by
its path-level reporting: in addition to whole-repo totals it lists the
paths whose object histories dominate the repository, ranked by raw
count, on-disk size, and inflated size, separately for trees and blobs.
That is often the most actionable output from `git survey`, since it
points an operator at the directories and files that should be reviewed
for cleanup, sparse-checkout exclusion, or rewriting.

`git repo structure` already drives the same path-walk traversal that
`git survey` uses to gather its per-path numbers; the callback simply
discards the path. Aggregate per-(path, type) summaries inside that
existing callback and add a bounded, descending-sorted "top-N" table
keyed by each of the three axes. Gate the feature behind a new
`--top=<n>` option, defaulting to 0, so unadorned invocations are
unaffected and pay no extra work for the top-N tracking.

Mirror the sort and eviction strategy from `builtin/survey.c`: keep an
array of at most N entries sorted from largest to smallest, walk it
from the bottom on each candidate, and shift entries down when a new
one belongs. Compared to `builtin/survey.c`, drop the void-pointer
indirection in the table data, type the comparator's arguments, and
fold the trivial comparators into the `(a > b) - (a < b)` idiom.

For the human-readable `table` output, extend the existing nested
bullet layout with two new top-level sections, `* Top trees` and
`* Top blobs`, each containing three sub-tables (`Top by count`,
`Top by disk size`, `Top by inflated size`). The path becomes the row
name and the relevant scalar becomes the value, reusing
`stats_table_count_addf` and `stats_table_size_addf` so units and
column alignment match the rest of the table.

For the `lines`/`nul` key-value formats, emit one
`objects.<type>.top.by_<axis>.<rank>.path=<path>` entry alongside an
`objects.<type>.top.by_<axis>.<rank>.<axis>=<value>` entry per ranked
path, so consumers can dispatch by axis without parsing the schema.
The root tree's path is the empty string as produced by the path-walk
machinery; preserve that as-is to stay faithful to the upstream
representation rather than fabricating a placeholder.

This is the first piece of folding `git survey`'s functionality into
`git repo structure`. Subsequent commits will add the corresponding
configuration knob and, eventually, turn `git survey` into a thin
deprecated shim over `git repo structure`.

Assisted-by: Opus 4.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
The preceding commit added `--top=<n>` to `git repo structure`,
reporting the top-N paths per type ranked by count, on-disk size, and
inflated size. Cover the three behaviors that matter for that option:

  * Without `--top`, the key-value output emits no `top.*` keys, so
    existing parsers stay unaffected.

  * `--top=N` produces exactly N ranked entries on each of the six
    `objects.<type>.top.by_<axis>` axes (count/disk_size/inflated_size
    crossed with trees/blobs), and a constructed input where one blob
    is several orders of magnitude bigger than the other lets us
    assert the ordering on the disk-size and inflated-size axes.

  * A negative `--top` is rejected with a non-zero exit and a message
    naming the constraint, so a typo cannot silently degrade into the
    default zero.

Avoid grep patterns starting with `--`; grep would parse the leading
double dash as an option terminator.

Assisted-by: Opus 4.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
`git survey` exposes its `--top` default via `survey.top` so that a
site or per-repository operator can switch the detail tables on once
and have every subsequent invocation include them. Mirror that
ergonomics for `git repo structure` so that, as `git survey`'s
functionality is folded into `git repo structure`, the configuration
side of the migration story stays equivalent.

Add a small `git_config_int` callback bound to `repo.structure.top`
and invoke it before `parse_options()`, so a `--top=<N>` on the
command line cleanly overrides the configured default (including
`--top=0` to opt out of the detail tables when configuration enables
them). Reject negative configured values with the same wording as the
command-line guard, since `git_config_int()` happily returns negative
integers.

Document the new variable in a fresh `Documentation/config/repo.adoc`
and wire it into the alphabetical includes in `Documentation/config.adoc`
between `repack.adoc` and `rerere.adoc`. Cover the precedence
behaviour with a t1901 test: a configured value enables the tables by
default, and a command-line `--top=0` suppresses them again.

Note that the reported paths respect the `core.quotePath` setting.

Assisted-by: Opus 4.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
…updates

Start monitoring updates of Git for Windows' component in the open
`git survey` started life as an experimental scale-measurement tool;
the preceding commits give `git repo structure` the path-level detail
tables and ref-scoping mechanism that were `git survey`'s main draw,
so the two now overlap substantially. Plan the migration explicitly:
add a short notice at the top of the description making clear which
of `git survey`'s knobs map to which `git repo structure` option, and
state that a future release will turn `git survey` into a thin shim
over `git repo structure`.

Putting the notice in the description (rather than only the synopsis)
ensures it shows up in `git help survey` rendering before the reader
sees any option specifics, so an operator skimming the page learns
about the replacement before adopting any survey-specific flags.

Assisted-by: Opus 4.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v5...v6)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Add a README.md for GitHub goodness.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
`git survey` was an experimental scale-measurement tool whose
distinctive features (ref-kind filters, top-N path tables) are now
all available in `git repo structure`. With the path-level reporting
in place (commits "repo: filter the structure scope via
--ref-filter=<pattern>" and "repo: report top-N paths by count, disk,
and inflated size in structure"), there is no functionality `git
survey` provides that `git repo structure` cannot.

Replace the 764-line `git survey` implementation with a roughly
hundred-line shim that:

  * Accepts the existing `git survey` command line so callers in
    scripts continue to parse without changes.
  * Emits a deprecation warning naming the replacement command, so
    interactive users learn about the migration target.
  * Translates the survey-specific knobs into the equivalent
    `git repo structure` invocation and re-execs the canonical
    command via `execv_git_cmd()`. Per-kind ref selectors fan out
    into the corresponding `refs/heads/*`, `refs/tags/*`, etc.
    `--ref-filter` patterns; `--top=<N>` is forwarded directly;
    `--all-refs` becomes the absence of any `--ref-filter`.

Two survey options have no `git repo structure` counterpart:
`--verbose` controlled per-step trace output the new command does
not emit, and `--detached` selected the detached HEAD which
`git repo structure` does not enumerate separately. Both are
silently accepted and produce a single warning each, so old
invocations keep working while the absence of these knobs in `git
repo structure` is made visible.

Rewrite t8100 to assert the shim's contract: the deprecation
warning is printed, the output is byte-identical to a corresponding
`git repo structure` invocation, and the per-kind selector
translation produces the right `--ref-filter` pattern. The
preceding survey-specific output assertions (the multi-column
plaintext tables) no longer apply, since `git repo structure`'s
output format is now the canonical one and is covered by t1901.

The `survey.*` configuration keys (`survey.top`, `survey.progress`,
`survey.verbose`) are no longer honored by the shim. They were
mirrored by the preceding `repo.structure.top` work for the most
useful knob; users with `survey.top` set in config should migrate
to `repo.structure.top`. This is a backward-incompatible removal
documented by the deprecation notice in `git-survey.adoc`.

Assisted-by: Opus 4.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases">actions/cache's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update packages, migrate to ESM by <a
href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p>
<h2>v5.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p>
<h2>v5.0.5</h2>
<h2>What's Changed</h2>
<ul>
<li>Update ts-http-runtime dependency by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1747">actions/cache#1747</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.5">https://github.com/actions/cache/compare/v5...v5.0.5</a></p>
<h2>v5.0.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Add release instructions and update maintainer docs by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1696">actions/cache#1696</a></li>
<li>Potential fix for code scanning alert no. 52: Workflow does not
contain permissions by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1697">actions/cache#1697</a></li>
<li>Fix workflow permissions and cleanup workflow names / formatting by
<a href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1699">actions/cache#1699</a></li>
<li>docs: Update examples to use the latest version by <a
href="https://github.com/XZTDean"><code>@​XZTDean</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li>
<li>Fix proxy integration tests by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1701">actions/cache#1701</a></li>
<li>Fix cache key in examples.md for bun.lock by <a
href="https://github.com/RyPeck"><code>@​RyPeck</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li>
<li>Update dependencies &amp; patch security vulnerabilities by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1738">actions/cache#1738</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/XZTDean"><code>@​XZTDean</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li>
<li><a href="https://github.com/RyPeck"><code>@​RyPeck</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.4">https://github.com/actions/cache/compare/v5...v5.0.4</a></p>
<h2>v5.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.3">https://github.com/actions/cache/compare/v5...v5.0.3</a></p>
<h2>v.5.0.2</h2>
<h1>v5.0.2</h1>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's
changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a
href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a
href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a>
with the new version and changes in the <code>## Changelog</code>
section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by
updating the <a
href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a>
file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed
and merged.</li>
<li>Draft a new release <a
href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a>
use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you
made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a
href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a>
<ol>
<li>There should be a workflow run queued with the same version
number.</li>
<li>Approve the run to publish the new version and update the major tags
for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>6.1.0</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a
href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435
Handle cache write error due to read-only token</a></li>
<li>Switch redundant &quot;Cache save failed&quot; warning to debug log
in save-only</li>
</ul>
<h3>6.0.0</h3>
<ul>
<li>Updated <code>@actions/cache</code> to ^6.0.1,
<code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to
^3.0.0, <code>@actions/io</code> to ^3.0.2</li>
<li>Migrated to ESM module system</li>
<li>Upgraded Jest to v30 and test infrastructure to be ESM
compatible</li>
</ul>
<h3>5.0.4</h3>
<ul>
<li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar
patterns)</li>
<li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb
protection, header validation fixes)</li>
<li>Bump <code>fast-xml-parser</code> to v5.5.6</li>
</ul>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1768">#1768</a>
from jasongin/readonly-cache</li>
<li><a
href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a>
Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error
due to RO token</li>
<li><a
href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1760">#1760</a>
from actions/samirat/esm_migration_and_package_update</li>
<li><a
href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a>
Prettier fixes</li>
<li><a
href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a>
Rebuild dist</li>
<li><a
href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a>
Fixed licenses</li>
<li><a
href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a>
Fix test mock return order</li>
<li><a
href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a>
PR feedback</li>
<li><a
href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a>
Rebuild dist bundles as ESM to match type:module</li>
<li><a
href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a>
Fix lint and jest issues</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/cache/compare/v5...v6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/cache&package-manager=github_actions&previous-version=5&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
Servers may advertise bundle URIs that are not HTTP(S);
copy_uri_to_file() then opens it as a local path. On Windows that can be
a UNC path like `//attacker/share/x`, i.e. a clone can be manipulated
into making an outbound SMB connection that leaks NTLM credentials
(CVE-2026-62960).

Subject advertised URIs to the usual protocol allow-list
(`protocol.*.allow`), which drops "file" (and bare/UNC paths) by default
but keeps http/https/git/ssh. Do it in fetch_bundle_list(), the
clone/fetch consume path, so ls-remote still lists everything; each
skipped URI is reported. A user-supplied `--bundle-uri` is unaffected,
and `protocol.file.allow=always` re-enables an advertised file URI.

Assisted-by: Opus 4.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Prepare a new Git for Windows release with the rebuilt Bash package that no longer carries the expired Authenticode signature.

Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
This is yet another set of `unsigned long` declarations that should have
been `size_t` ones.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
…it-for-windows#6268)

`git survey` was always experimental, and I never got around to
upstreaming it to make it non-experimental.

In the meantime, the `git repo structure` command was upstreamed
upstream, which covers most of the same ground with a cleaner option
surface and a stable output contract. This PR closes the remaining gap
(annotated-tag breakdown, ref scoping, top-N paths by
count/disk/inflated, and the corresponding configuration knob) and then
turns `git survey` into a thin shim that warns about deprecation,
translates its old command line into the equivalent `git repo structure`
invocation, and re-execs the canonical command. Net result: one
user-facing tool to maintain and to teach instead of two.

The intent is that scripts pinned to `git survey` keep working (a
warning aside), and that operators have a single answer when they ask
"how do I see what's making my repository large?". The `survey.*`
configuration keys are intentionally dropped; the only one that
mattered, `survey.top`, has a direct replacement in
`repo.structure.top`.
... and yet another round of `unsigned long` -> `size_t`
transmogrifications.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Git for Windows v2.55.0(4)

Changes since Git for Windows v2.55.0(3) (July 14th 2026):

Following the MSYS2 project, on which Git for Windows is based, Windows
8.1 support will be dropped after Git for Windows v2.55.

This is a security fix release, addressing CVE-2026-62960.

  * CVE-2026-62960, Git for Windows: Attacker-controlled servers may
    advertise bundle URIs that point to network shares, causing Windows
    to transparently perform NTLM authentication and disclose the
    user's NTLMv2 hash. Since NTLM hashing is weak, the captured hash
    can potentially be brute-forced to recover the user's credentials.
    This is addressed by limiting the bundle URIs that git clone
    respects by the same protocol.<name>.allow rules as usual, which
    excludes file:// URIs by default.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
I should have added this test as soon as
git-for-windows#6012 was opened.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Debian 11 just recently went out of its LTS period, and is unmaintained
by the project (there is "Extended LTS", but it is a paid service
provided by a third party).

The point of the debian-11 job was to cover older releases in the LTS
state, per ac112fd (Add additional CI jobs to avoid accidental
breakage, 2024-10-31). Bumping to debian-12 will cover us there for the
next 2 years.

Signed-off-by: Jeff King <peff@peff.net>
Git for Windows v2.55.0(5)

Changes since Git for Windows v2.55.0(4) (August 11th 2026)

Following the MSYS2 project, on which Git for Windows is based, Windows
8.1 support will be dropped after Git for Windows v2.55.

New Features

  * The experimental git survey command (which was never upstreamed to
    the core Git project) was deprecated and converted into a small
    shim on top of git repo structure. In the future, git repo
    structure should be used instead, as the git survey command will be
    retired eventually.
  * Git for Windows' installer is now a 64-bit executable (x64 instead
    of 86).
  * Comes with the MSYS2 runtime (Git for Windows flavor) based on
    Cygwin v3.6.10.
  * Comes with OpenSSH v10.5.P1.

Bug Fixes

  * The long-standing bug where Git Bash's screen was cleared after
    git.exe called vim (e.g. to edit a commit message) was fixed.
  * The Bash executables in the 64-bit and ARM64 distributions no
    longer carry an invalid Authenticode signature.

Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
When I merged the massive amount of work in git-for-windows#6289, I thought that that
was the end of it. But simply staging and unpacking loose blobs that are
4GB or larger _still_ does not work. This PR addresses that.

This fixes git-for-windows#6012
Debian 11 just recently went out of its LTS period, and is unmaintained
by the project (there is "Extended LTS", but it is a paid service
provided by a third party).

The point of the debian-11 job was to cover older releases in the LTS
state, per ac112fd (Add additional CI jobs to avoid accidental
breakage, 2024-10-31). Bumping to debian-12 will cover us there for the
next 2 years.

This fixes [this kind of
error](https://github.com/microsoft/git/actions/runs/34140012025/job/102061159993#step:4:28):

> Get:1 http://deb.debian.org/debian bullseye InRelease [75.1 kB]
> Get:2 http://deb.debian.org/debian-security bullseye-security
InRelease [27.2 kB]
> Get:3 http://deb.debian.org/debian bullseye-updates InRelease [44.0
kB]
> Get:4 http://deb.debian.org/debian bullseye/main amd64 Packages [8066
kB]
> Get:5 http://deb.debian.org/debian bullseye-updates/main amd64
Packages [18.8 kB]
> Reading package lists...
> E: Release file for
http://deb.debian.org/debian-security/dists/bullseye-security/InRelease
is expired (invalid since 15h 16min 10s). Updates for this repository
will not be applied.
> Error: Process completed with exit code 100.

This is a sibling of microsoft#982.
@dscho
dscho force-pushed the rebase-to-v2.56.0-rc0 branch from 324d4bb to 40e870d Compare September 11, 2026 12:48
We need to be very careful _not_ to read the config too early. The
reason is that some Git commands want to delay reading the config until
they configured something beforehand.

For example, `cmd_commit()` sets the `warn_on_auto_comment_char = true`
before reading the config, implicitly telling the function
`check_auto_comment_char_config()` to warn (once) when encountering the
corresponding, deprecated construct.

If `mingw_open()` reads the config already at the point when the gitdir
is discovered, i.e. way before `cmd_commit()` can do its thing, that
global flag will still be `false` when the warning should be produced.

Earlier, we already had to fiddle with the condition, to ensure that the
commondir is already initialized (and therefore it should be safe to
read the config). That was still not enough, apparently.

The symptom is that both t3404.86 (rebase -i respects
core.commentchar=auto) and t7502.85 (core.commentChar=auto is rejected)
will fail.

The good news is that the config setting we want to read in
`mingw_open()` concerns itself with _appending to files_, something we
will never do before reaching `cmd_commit()`. Therefore, simply
extending the guard around config reading makes this logic "delayed
enough" so that aforementioned test cases pass successfully.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
@dscho

dscho commented Sep 11, 2026

Copy link
Copy Markdown
Member Author

/git-artifacts

The tag-git workflow run was started

@gitforwindowshelper

Copy link
Copy Markdown

Validate the installer manually

The installer was built successfully;
Please download, install, and run through the pre-flight check-list.
@dscho ☝️

@dscho

dscho commented Sep 11, 2026

Copy link
Copy Markdown
Member Author

Please download, install, and run through the pre-flight check-list.

Well, installation started well enough:

welcome screen of the Git for Windows v2.56.0-rc0 installer

A bit strange: even though I have a previous installation and there were no new options, the button does not say "Install", but "Next". Let's click it.

Git for Windows v2.56.0-rc0 installer, Components page

There's nothing new there. Strange. Let's click "Next".

Git for Windows v2.56.0-rc0 installer, OpenSSH selector

Hmm. I kind of understand that, as there has been that problem in v2.55.0(5) with the failure to find the external ssh.exe. Maybe the option wasn't recorded as a consequence of not finding it? Hmm. Nope:

Registry Editor: OpenSSH option was selected

Okay, fine, let's still continue, there's an "Install" button now, finally. Unfortunately, I now run into problems with uninstalling the previous version, without helpful information to figure out why:

uninstaller failed

Obviously, this leaves all the /mingw64/ stuff in place, which is not what I wanted. It gets even worse, though:

Access denied creating /dev/fd

Hmm. This sure doesn't look good. I'll have to investigate instead of releasing this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[New git version] v2.56.0-rc0