git-lfs - Debian Package Tracker

general

source: git-lfs (main)
version: 3.7.1-1
maintainer: Debian Go Packaging Team (DMD)
uploaders: Stephen Gelman [DMD]
arch: all any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.13.2-1
o-o-sec: 2.13.2-1+deb11u2
oldstable: 3.3.0-1+deb12u1
old-sec: 3.3.0-1+deb12u1
stable: 3.6.1-1+deb13u1
testing: 3.7.1-1
unstable: 3.7.1-1

versioned links

2.13.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.13.2-1+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.3.0-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.1-1+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.7.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

git-lfs (3 bugs: 0, 2, 1, 0)
golang-github-git-lfs-git-lfs-dev

action needed

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit b8d2278401bdd9cf0f7246395575744e3bc2a57e
Author: Marcos Talau <talau@debian.org>
Date:   Sun Jul 19 16:12:20 2026 -0300

    debian/salsa-ci.yml: Add to provide CI tests for Salsa

Created: 2026-07-19 Last update: 2026-07-19 21:20

1 low-priority security issue in bookworm low

There is 1 open security issue in bookworm.

1 issue left for the package maintainer to handle:

CVE-2025-26625: (needs triaging) Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.

You can find information about how to handle this issue in the security team's documentation.

Created: 2025-10-17 Last update: 2026-05-31 13:01

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-03-31 15:01

news

[rss feed]

[2026-05-31] Accepted git-lfs 2.13.2-1+deb11u2 (source) into oldoldstable-security (Andrej Shadura) (signed by: Andrew Shadura)
[2026-04-30] Accepted git-lfs 3.6.1-1+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2025-11-27] git-lfs 3.7.1-1 MIGRATED to testing (Debian testing watch)
[2025-11-25] Accepted git-lfs 3.7.1-1 (source) into unstable (Stephen Gelman)
[2025-01-26] git-lfs 3.6.1-1 MIGRATED to testing (Debian testing watch)
[2025-01-25] Accepted git-lfs 3.3.0-1+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Andrew Shadura)
[2025-01-24] Accepted git-lfs 3.3.0-1+deb12u1 (source) into stable-security (Debian FTP Masters) (signed by: Andrew Shadura)
[2025-01-22] Accepted git-lfs 2.13.2-1+deb11u1 (source) into oldstable-security (Andrej Shadura) (signed by: Andrew Shadura)
[2025-01-21] Accepted git-lfs 3.6.1-1 (source) into unstable (Stephen Gelman)
[2025-01-20] Accepted git-lfs 3.5.0-2 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2024-04-09] git-lfs 3.5.0-1 MIGRATED to testing (Debian testing watch)
[2024-03-07] Accepted git-lfs 3.5.0-1 (source) into unstable (Stephen Gelman)
[2023-12-18] git-lfs 3.4.1-1 MIGRATED to testing (Debian testing watch)
[2023-12-18] git-lfs 3.4.1-1 MIGRATED to testing (Debian testing watch)
[2023-12-15] Accepted git-lfs 3.4.1-1 (source) into unstable (Stephen Gelman)
[2023-08-16] git-lfs 3.4.0-1 MIGRATED to testing (Debian testing watch)
[2023-08-14] Accepted git-lfs 3.4.0-1 (source) into unstable (Stephen Gelman)
[2022-12-28] Accepted git-lfs 3.3.0-1~bpo11+1 (source) into bullseye-backports (Stephen Gelman)
[2022-12-03] git-lfs 3.3.0-1 MIGRATED to testing (Debian testing watch)
[2022-12-01] Accepted git-lfs 3.3.0-1 (source) into unstable (Stephen Gelman)
[2022-06-10] Accepted git-lfs 3.2.0-1~bpo11+1 (source) into bullseye-backports (Stephen Gelman)
[2022-05-28] git-lfs 3.2.0-1 MIGRATED to testing (Debian testing watch)
[2022-05-26] Accepted git-lfs 3.2.0-1 (source) into unstable (Stephen Gelman)
[2022-04-28] git-lfs 3.1.4-2 MIGRATED to testing (Debian testing watch)
[2022-04-25] Accepted git-lfs 3.1.4-2 (source) into unstable (Stephen Gelman)
[2022-04-25] Accepted git-lfs 3.1.4-1 (source) into unstable (Stephen Gelman)
[2022-04-25] Accepted git-lfs 3.1.1-1 (source) into unstable (Stephen Gelman)
[2021-11-14] Accepted git-lfs 3.0.2-1~bpo11+1 (source) into bullseye-backports (Stephen Gelman)
[2021-11-08] git-lfs 3.0.2-1 MIGRATED to testing (Debian testing watch)
[2021-11-06] Accepted git-lfs 3.0.2-1 (source) into unstable (Stephen Gelman)

bugs [bug history graph]

all: 3
RC: 0
I&N: 2
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (-, 100)
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.7.1-1