git - Debian Package Tracker

general

source: git (main)
version: 1:2.55.0-1
maintainer: Jonathan Nieder (DMD)
uploaders: Anders Kaseorg (DMD)
arch: all any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1:2.30.2-1+deb11u2
o-o-sec: 1:2.30.2-1+deb11u5
oldstable: 1:2.39.5-0+deb12u3
old-sec: 1:2.39.5-0+deb12u2
stable: 1:2.47.3-0+deb13u1
testing: 1:2.53.0-1
unstable: 1:2.55.0-1
exp: 1:2.55.0+next.20260731-1

versioned links

1:2.30.2-1+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.30.2-1+deb11u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.39.5-0+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.39.5-0+deb12u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.47.3-0+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.53.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.53.0+next.20260227-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.55.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.55.0+next.20260731-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

git (298 bugs: 2, 143, 153, 0)
git-all (2 bugs: 0, 0, 2, 0)
git-cvs (8 bugs: 0, 3, 5, 0)
git-doc (7 bugs: 0, 1, 6, 0)
git-email (18 bugs: 0, 7, 11, 0)
git-gui (21 bugs: 0, 11, 10, 0)
git-man (28 bugs: 0, 7, 21, 0)
git-svn (27 bugs: 0, 10, 17, 0)
gitk (30 bugs: 0, 11, 19, 0)
gitweb (17 bugs: 0, 7, 10, 0)

action needed

6 security issues in trixie high

There are 6 open security issues in trixie.

6 important issues:

CVE-2026-105437: Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. That total was kept in a 32-bit signed integer. The conflict-marker-size attribute, which can be set from a committed .gitattributes file, accepts any positive integer, and the markers are written several times for every conflict. A small file with a huge marker size and many separate conflicts can therefore push the total past 4 GiB, so the integer wraps to a small value and Git writes attacker-controlled merge output past the end of a buffer that is too small. At minimum this crashes Git, and because the overflow is large and its contents are largely attacker-controlled, worse heap corruption is possible. Any command that does a textual three-way merge can trigger it, such as git-merge(1), git-rebase(1), git-cherry-pick(1), and git-merge-tree(1). The latter is most likely a target for Git forges, which might use git-merge-tree(1) on the server-side to check mergeability. When the server reads attributes from trees in the repository (for example through attr.tree or --attr-source), any user who can push branches and request that they be merged (for example by opening a pull or merge request) can trigger the overflow without anyone else doing anything, and the data they push is small because the oversized output only appears during the merge. The problem has been patched by computing the size as size_t and checking every addition for overflow, so Git stops with an error instead of overflowing. Servers that cannot upgrade right away can add * conflict-marker-size=7 to each repository's info/attributes as a workaround, which overrides any in-tree .gitattributes, or turn off server-side mergeability checks for untrusted repositories.
CVE-2026-111760:
CVE-2026-113408:
CVE-2026-114466:
CVE-2026-114467:
CVE-2026-114469:

Created: 2026-11-10 Last update: 2026-11-11 05:31

6 security issues in sid high

There are 6 open security issues in sid.

6 important issues:

CVE-2026-105437: Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. That total was kept in a 32-bit signed integer. The conflict-marker-size attribute, which can be set from a committed .gitattributes file, accepts any positive integer, and the markers are written several times for every conflict. A small file with a huge marker size and many separate conflicts can therefore push the total past 4 GiB, so the integer wraps to a small value and Git writes attacker-controlled merge output past the end of a buffer that is too small. At minimum this crashes Git, and because the overflow is large and its contents are largely attacker-controlled, worse heap corruption is possible. Any command that does a textual three-way merge can trigger it, such as git-merge(1), git-rebase(1), git-cherry-pick(1), and git-merge-tree(1). The latter is most likely a target for Git forges, which might use git-merge-tree(1) on the server-side to check mergeability. When the server reads attributes from trees in the repository (for example through attr.tree or --attr-source), any user who can push branches and request that they be merged (for example by opening a pull or merge request) can trigger the overflow without anyone else doing anything, and the data they push is small because the oversized output only appears during the merge. The problem has been patched by computing the size as size_t and checking every addition for overflow, so Git stops with an error instead of overflowing. Servers that cannot upgrade right away can add * conflict-marker-size=7 to each repository's info/attributes as a workaround, which overrides any in-tree .gitattributes, or turn off server-side mergeability checks for untrusted repositories.
CVE-2026-111760:
CVE-2026-113408:
CVE-2026-114466:
CVE-2026-114467:
CVE-2026-114469:

Created: 2026-11-10 Last update: 2026-11-11 05:31

6 security issues in forky high

There are 6 open security issues in forky.

6 important issues:

CVE-2026-105437: Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. That total was kept in a 32-bit signed integer. The conflict-marker-size attribute, which can be set from a committed .gitattributes file, accepts any positive integer, and the markers are written several times for every conflict. A small file with a huge marker size and many separate conflicts can therefore push the total past 4 GiB, so the integer wraps to a small value and Git writes attacker-controlled merge output past the end of a buffer that is too small. At minimum this crashes Git, and because the overflow is large and its contents are largely attacker-controlled, worse heap corruption is possible. Any command that does a textual three-way merge can trigger it, such as git-merge(1), git-rebase(1), git-cherry-pick(1), and git-merge-tree(1). The latter is most likely a target for Git forges, which might use git-merge-tree(1) on the server-side to check mergeability. When the server reads attributes from trees in the repository (for example through attr.tree or --attr-source), any user who can push branches and request that they be merged (for example by opening a pull or merge request) can trigger the overflow without anyone else doing anything, and the data they push is small because the oversized output only appears during the merge. The problem has been patched by computing the size as size_t and checking every addition for overflow, so Git stops with an error instead of overflowing. Servers that cannot upgrade right away can add * conflict-marker-size=7 to each repository's info/attributes as a workaround, which overrides any in-tree .gitattributes, or turn off server-side mergeability checks for untrusted repositories.
CVE-2026-111760:
CVE-2026-113408:
CVE-2026-114466:
CVE-2026-114467:
CVE-2026-114469:

Created: 2026-11-10 Last update: 2026-11-11 05:31

6 security issues in bookworm high

There are 6 open security issues in bookworm.

6 important issues:

CVE-2026-105437: Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. That total was kept in a 32-bit signed integer. The conflict-marker-size attribute, which can be set from a committed .gitattributes file, accepts any positive integer, and the markers are written several times for every conflict. A small file with a huge marker size and many separate conflicts can therefore push the total past 4 GiB, so the integer wraps to a small value and Git writes attacker-controlled merge output past the end of a buffer that is too small. At minimum this crashes Git, and because the overflow is large and its contents are largely attacker-controlled, worse heap corruption is possible. Any command that does a textual three-way merge can trigger it, such as git-merge(1), git-rebase(1), git-cherry-pick(1), and git-merge-tree(1). The latter is most likely a target for Git forges, which might use git-merge-tree(1) on the server-side to check mergeability. When the server reads attributes from trees in the repository (for example through attr.tree or --attr-source), any user who can push branches and request that they be merged (for example by opening a pull or merge request) can trigger the overflow without anyone else doing anything, and the data they push is small because the oversized output only appears during the merge. The problem has been patched by computing the size as size_t and checking every addition for overflow, so Git stops with an error instead of overflowing. Servers that cannot upgrade right away can add * conflict-marker-size=7 to each repository's info/attributes as a workaround, which overrides any in-tree .gitattributes, or turn off server-side mergeability checks for untrusted repositories.
CVE-2026-111760:
CVE-2026-113408:
CVE-2026-114466:
CVE-2026-114467:
CVE-2026-114469:

Created: 2026-11-10 Last update: 2026-11-11 05:31

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

more than one main upstream tarballs listed.

Created: 2025-11-27 Last update: 2026-11-11 05:02

A new upstream version is available: 2.56.0 high

A new upstream version 2.56.0 is available, you should consider packaging it.

Created: 2026-10-01 Last update: 2026-11-11 05:02

1 security issue in buster high

There is 1 open security issue in buster.

1 important issue:

CVE-2024-32020: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. If the source repository is owned by a different user, then those hardlinked files may be rewritten at any point in time by the untrusted user. Cloning local repositories will cause Git to either copy or hardlink files of the source repository into the target repository. This significantly speeds up such local clones compared to doing a "proper" clone and saves both disk space and compute time. When cloning a repository located on the same disk that is owned by a different user than the current user we also end up creating such hardlinks. These files will continue to be owned and controlled by the potentially-untrusted user and can be rewritten by them at will in the future. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.

Created: 2024-05-15 Last update: 2024-06-26 14:02

Depends on packages which need a new maintainer normal

The packages that git depends on which need a new maintainer are:

cvsps (#501257)
- Depends: cvsps
- Build-Depends: cvsps
docbook-xsl (#802370)
- Build-Depends-Indep: docbook-xsl

Created: 2019-11-22 Last update: 2026-11-11 08:01

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2026-08-13 Last update: 2026-11-11 08:01

31 bugs with a patch to review in the bug tracker normal

The bug tracker contains patches fixing 31 bugs (40 if counting merged bugs) to review: include them, or remove the patch tag.

Created: 2026-09-02 Last update: 2026-11-11 08:00

Multiarch hinter reports 2 issue(s) normal

There are issues with the multiarch metadata for this package.

git-gui could have its dependency on tk annotated with :any
gitk could have its dependency on tk annotated with :any

Created: 2026-11-01 Last update: 2026-11-11 06:32

lintian reports 68 warnings normal

Lintian reports 68 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-08-03 Last update: 2026-08-03 02:31

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2019-07-08 Last update: 2026-08-02 22:30

testing migrations

excuses:
- Migration status for git (1:2.53.0-1 to 1:2.55.0-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Updating git would introduce bugs in testing: #1146518
- ∙ ∙ Autopkgtest for cmake/4.3.4-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, riscv64: Test triggered (failure will be ignored), s390x: Pass
- ∙ ∙ Autopkgtest for cyrus-imapd/3.12.4-1: amd64: Pass, arm64: Test triggered (failure will be ignored), armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for debusine/0.16.2: amd64: Pass, arm64: Pass, armhf: Failed (not a regression) ♻ (reference ♻), i386: Pass, loong64: Pass, ppc64el: Pass, riscv64: Test triggered (failure will be ignored), s390x: Pass
- ∙ ∙ Autopkgtest for dgit/17.0: amd64: Regression ♻ (reference ♻), arm64: Failed (not a regression) ♻ (reference ♻), armhf: Regression ♻ (reference ♻), i386: Regression ♻ (reference ♻), loong64: Pass, ppc64el: Regression ♻ (reference ♻), riscv64: Pass, s390x: Regression ♻ (reference ♻)
- ∙ ∙ Autopkgtest for git-lfs/3.8.1-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Regression ♻ (reference ♻), riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for gitbatch/0.6.1-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Test triggered, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for nlohmann-json3/3.12.0.really.3.12.0.really.3.11.3-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, riscv64: Test triggered (failure will be ignored), s390x: Pass
- ∙ ∙ Autopkgtest for racket-mode/20261025~git.1ba63e2-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, riscv64: Test triggered (failure will be ignored), s390x: Pass
- ∙ ∙ Autopkgtest for rubocop/1.91.0+dfsg-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, riscv64: Regression ♻ (reference ♻), s390x: Pass
- ∙ ∙ Autopkgtest for runc/1.3.6+ds1-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Failed (not a regression) ♻ (reference ♻), ppc64el: Test triggered, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for scantpaper/4.0.3-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, riscv64: Pass, s390x: Regression ♻ (reference ♻)
- ∙ ∙ Autopkgtest for snapd/2.77.1-2: amd64: Pass, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: No tests, superficial or marked flaky ♻, loong64: No tests, superficial or marked flaky ♻, ppc64el: No tests, superficial or marked flaky ♻, riscv64: Test triggered (failure will be ignored), s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- Additional info (not blocking):
- ∙ ∙ Updating git will fix bugs in testing: #1146774
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/g/git.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ 100 days old (needed 5 days)
- Not considered

news

[rss feed]

[2026-08-02] Accepted git 1:2.55.0+next.20260731-1 (source) into experimental (Jonathan Nieder)
[2026-08-02] Accepted git 1:2.55.0-1 (source) into unstable (Jonathan Nieder)
[2026-03-19] git 1:2.53.0-1 MIGRATED to testing (Debian testing watch)
[2026-03-01] Accepted git 1:2.53.0+next.20260227-1 (source) into experimental (Jonathan Nieder)
[2026-03-01] Accepted git 1:2.53.0-1 (source) into unstable (Jonathan Nieder)
[2025-10-19] Accepted git 1:2.39.5-0+deb12u3 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Lee Garrett)
[2025-10-06] Accepted git 1:2.30.2-1+deb11u5 (source) into oldoldstable-security (Lee Garrett) (signed by: Andrew Shadura)
[2025-09-06] git 1:2.51.0-1 MIGRATED to testing (Debian testing watch)
[2025-08-26] Accepted git 1:2.51.0+next.20250825-1 (source) into experimental (Jonathan Nieder)
[2025-08-26] Accepted git 1:2.51.0-1 (source) into unstable (Jonathan Nieder)
[2025-08-22] Accepted git 1:2.47.3-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Adrian Bunk)
[2025-08-13] git 1:2.50.1-0.1 MIGRATED to testing (Debian testing watch)
[2025-07-30] Accepted git 1:2.50.1-0.1 (source) into unstable (Adrian Bunk)
[2025-06-24] git 1:2.47.2-0.2 MIGRATED to testing (Debian testing watch)
[2025-06-22] Accepted git 1:2.47.2-0.2 (source) into testing-proposed-updates (Sebastian Andrzej Siewior)
[2025-06-17] Accepted git 1:2.50.0+next.20250615-1 (source) into experimental (Jonathan Nieder)
[2025-06-17] Accepted git 1:2.50.0-1 (source) into unstable (Jonathan Nieder)
[2025-06-17] Accepted git 1:2.49.0-3 (source) into unstable (Jonathan Nieder)
[2025-05-29] Accepted git 1:2.50.0~rc0+next.20250528-1 (source) into experimental (Jonathan Nieder)
[2025-05-29] Accepted git 1:2.49.0-2 (source) into unstable (Jonathan Nieder)
[2025-03-16] Accepted git 1:2.49.0+next.20250314-1 (source) into experimental (Jonathan Nieder)
[2025-03-15] Accepted git 1:2.49.0-1 (source) into unstable (Jonathan Nieder)
[2025-01-29] git 1:2.47.2-0.1 MIGRATED to testing (Debian testing watch)
[2025-01-28] Accepted git 1:2.30.2-1+deb11u4 (source) into oldstable-security (Sean Whitton)
[2025-01-27] Accepted git 1:2.39.5-0+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2025-01-26] Accepted git 1:2.39.5-0+deb12u2 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2025-01-21] Accepted git 1:2.47.2-0.1 (source) into unstable (Salvatore Bonaccorso)
[2025-01-02] Accepted git 1:2.48.0~rc1+next.20250101-1 (source) into experimental (Jonathan Nieder)
[2025-01-02] Accepted git 1:2.47.1-1 (source) into unstable (Jonathan Nieder)
[2024-12-22] Accepted git 1:2.45.2-1.3 (source) into unstable (Chris Hofstaedtler) (signed by: Christian Hofstaedtler)

bugs [bug history graph]

all: 464 482
RC: 2 3
I&N: 214 215
M&W: 248 264
F&P: 0
patch: 31 40

links

homepage
lintian (0, 68)
buildd: logs, exp, reproducibility, cross
popcon
browse source code
other distros
security tracker
screenshots
l10n (-, 94)

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:2.55.0-1ubuntu1.1
93 bugs (2 patches)
patches for 1:2.55.0-1ubuntu1.1