When 'core.fsyncMethod' is set to 'batch', the ODB transaction
failed to properly flush large blob packfiles residing in the
temporary directory before migrating the directory's contents to the
main object store. The execution sequence has been corrected by
performing the packfile flush before the temporary directory
migration, averting failure.
* jt/object-file-batch-fsync-fix:
object-file: flush transaction packfile before migrating objects
object-file: lift ODB reprepare out of packfile flush
The sequencer machinery (used by 'git rebase', 'git cherry-pick', and
'git revert') has been updated to defer automatic maintenance tasks
until the end of the operation, preventing nested 'git commit', 'git
merge', and 'exec' commands from triggering GC operations that could
contend for locks or delete open packs while the sequence is in
progress.
* tb/rerere-lock-grace:
sequencer: disable auto maintenance in spawned commands
rebase, cherry-pick, revert: run auto maintenance when done
config: add git_config_append_parameter()
The error reporting machinery in the WinANSI compatibility layer has
been simplified to pass the exact Windows error code and correctly
format arguments for fatal errors.
* yt/winansi-die-lasterr-fix:
compat/winansi: fix die_lasterr() argument formatting
'git pull' has been taught to fail more gracefully instead of
segfaulting when lookup_commit_reference() fails on unparseable
objects.
* jk/pull-null-merge-head:
pull: avoid segfault when commit lookup fails
A bug in git diff --no-index that mishandled reverse (-R) output
when conflicts existed between a file and a directory has been
fixed.
* hd/diff-no-index-reverse-fix:
diff --no-index: fix -R with file/directory conflicts
Assorted fixes for code paths that are not careful with boundary and
error conditions.
* js/coverity-fixes:
test-read-midx: check midx_fill_entry() result
oss-fuzz: handle reftable iterator initialization failures
t/unit-tests: check reftable iterator initialization
rerere: do not record failed conflict resolution data
midx: validate incremental MIDX pack IDs
gpg-interface: make signature-prefix matching length-aware
wrapper: guard writev_in_full() against signed overflow
The server-side protocol v2 response order for 'wanted-refs' and
'shallow-info' has been swapped to match the client's expectation,
fixing a fetch failure when the server has 'uploadpack.allowRefInWant'
enabled and the client performs a shallow fetch.
* rr/upload-pack-swap-shallow-wanted-ref:
upload-pack: swap wanted-ref/shallow-info responses
The can_all_from_reach() and can_all_from_reach_with_flag()
functions have been updated to accept a repository context,
preventing bugs where submodule merging incorrectly reads from the
superproject's commit-graph.
* of/commit-reach-repo-awareness:
commit-reach: parse commits in the given repository
The 'Makefile' has been taught to precompile 'git-compat-util.h' to
speed up overall compilation, while excluding sources that do not
include the compatibility header.
* sg/precompile-git-compat-util:
Makefile: precompile "git-compat-util.h"
Makefile: reintroduce REFTABLE_OBJS
cmake: remove any "$(*_OBJS)" variables when parsing Makefile for sources
Makefile: remove XDIFF_OBJS initialization
The build-time knob 'USE_NSEC' for nanosecond stat precision has been
converted to a runtime configuration 'core.useNanosec', allowing
distributions to bundle one binary that adapts to filesystem
capabilities dynamically.
* dk/use-nsec-runtime:
core: convert build-time USE_NSEC into runtime core.useNanosec
environment: align repo_config_values_init with struct declaration
meson: expose knob for xmlto relative links in manuals
The terminology regarding reference storage formats has been unified
across command-line options, environment variables, configuration
variables, and source code, standardizing on the phrase "ref storage
format" (e.g., `--ref-storage-format`, `'GIT_REF_STORAGE_FORMAT'`).
Additionally, the `--ref-storage-format` option has been updated to
accept payloads in the form `<format>://<payload>`.
* ps/ref-storage-format:
setup: allow "--ref-storage-format=" to specify a payload
setup: rename "init.defaultRefFormat" to "init.defaultRefStorageFormat"
t: rename GIT_TEST_DEFAULT_REF_FORMAT
setup: rename ref storage format environment variables
setup: refactor how we configure the ref storage format
refs: expose function to parse reference URIs
help: rename "default-ref-format" to "default-ref-storage-format"
builtin/rev-parse: rename "--show-ref-format" to "--show-ref-storage-format"
builtin/submodule: rename "--ref-format=" to "--ref-storage-format="
builtin/refs: rename "--ref-format=" to "--ref-storage-format="
builtin/clone: rename "--ref-format=" to "--ref-storage-format="
builtin/init: rename "--ref-format=" to "--ref-storage-format="
parse-options: allow for hidden aliases
The files backend has been updated to avoid unconditionally locking
the 'packed-refs' file when deleting a root ref (which are never
packed).
* ak/refs-files-root-ref-lock:
refs/files: avoid packed-refs lock for root ref deletion
Updates to Coccinelle semantic patches to correctly handle the
'FREE_AND_NULL()' macro and avoid generating broken transformations
for negated pointer checks.
* jc/cocci-free-updates:
cocci: FREE_AND_NULL(E) is safe to call on NULL
cocci: remove risky "if (!E) free(E)" conversion
A new hook 'report' is added to 'git receive-pack', which runs after
reference updates and allows the server to filter or modify the
packet-line status report sent back to the client.
* kn/receive-report-hook:
receive-pack: coccinelle fix
hook: introduce the receive-report hook
receive-pack: move message generation to separate function
receive-pack: drop static variables to track report status version
doc: add proc-receive hook info in 'git-receive-pack.adoc'
The experimental 'git history' command has been taught a new 'squash'
subcommand to fold a range of commits into a single commit, with any
descendants replayed on top.
* hn/history-squash:
history: support editing squashed commit messages
history: create squashed commits without editing
history: protect branches when squashing a range
history: validate squash revision ranges
history: add skeleton for squash subcommand
sequencer: share the squash message marker helpers and flags
history: give commit_tree_ext a message template
history: extract helper for a commit's parent tree
The setup of alternates has been deferred to object database
creation time during clone, which drops the unused ad-hoc alternate
writing API, simplifying the object database backend interface.
* ps/odb-alternates-at-creation:
odb/source: remove the ability to write alternates
builtin/clone: write alternates via `odb_create_on_disk()`
odb/source: support writing alternates when creating the database
builtin/clone: move setup of alternates for non-shared local clones
builtin/clone: move setup of alternates for shared local clones
builtin/clone: refactor handling of "--reference{,-if-able}"
builtin/clone: move around `setup_reference()`
builtin/clone: defer setup of the object database
setup: split up concerns of `init_db()`
Add a full Afrikaans translation of Git (6476 messages) and
register the Afrikaans team in po/TEAMS.
Signed-off-by: Stéfan Driaan Turvey <stefanturvey1912@gmail.com>
Signed-off-by: Jiang Xin <worldhello.net@gmail.com>
Add the initial Brazilian Portuguese translation of Git and register
the language team in po/TEAMS.
All 6476 messages are translated against the git.pot for v2.56.0-rc1.
The file header carries a glossary documenting the terminology in use:
Git command and concept names (branch, commit, merge, rebase, checkout,
push, fetch, stash, tag, pack, worktree, ...) are kept in English while
the surrounding prose is translated, and literal configuration values
and command-line options are never translated.
Signed-off-by: Daniel Pereira <danielmaraboo@gmail.com>
Signed-off-by: Jiang Xin <worldhello.net@gmail.com>
Restore translations for the new translatable strings reintroduced by
commit 0f8e75abeb (Revert "Merge branch 'en/no-amend-during-conflicts'",
2026-09-23).
Signed-off-by: Jiang Xin <worldhello.net@gmail.com>
Signed-off-by: Peter Krefting <peter@softwolves.pp.se>
Reviewed-by: Tuomas Ahola <taahol@utu.fi>
Reviewed-by: AI, by way of Jiang Xin <worldhello.net@gmail.com>
The review_one_batch() function cleans up stale po/review-result*.json
files before starting a new review. On zsh, an unmatched glob causes a
"no matches found" error and aborts the command, because NOMATCH is on
by default.
Fix by enabling null_glob locally when running under zsh. This leaves
bash and other POSIX shells unaffected, since $ZSH_VERSION is unset
there.
Only the cleanup step in review_one_batch() is changed; no other
behavior is affected.
Signed-off-by: Jiang Xin <worldhello.net@gmail.com>
Make/l10n compiles every po/*.po file. The AGENTS.md workflow keeps its
intermediate files in po/, so any .po file written there can be picked
up by a normal `make` run and cause build failures. Switch the workflow
to use GETTEXT JSON for pending/input/review work files instead of PO,
and rename the remaining PO scratch file to l10n-done.po.tmp so
Make/l10n ignores it.
This only affects the helper scripts documented in po/AGENTS.md.
Signed-off-by: Jiang Xin <worldhello.net@gmail.com>
grep -c on msgid lines only works for PO text, not GETTEXT JSON. When
workflow intermediates move from PO to JSON, that count breaks. Use
stat -c instead; it also excludes the header, so ENTRY_COUNT - 1 is
unnecessary.
Signed-off-by: Jiang Xin <worldhello.net@gmail.com>
Task 3 claimed a gettext-only fallback, but validation already needs
git-po-helper, and the awk|tac batch path fails on systems without tac.
Require the helper for Tasks 3 and 4, drop the unused msgattrib/PO
paths, and point agents at msg-select (with msgattrib still noted as an
option).
Pin to git-po-helper >= 0.9.1 to rely on new helper features: version
comparison for the minimum version check, and `git-po-helper stat -c`
used by the next commit to count PO entries.
Signed-off-by: Jiang Xin <worldhello.net@gmail.com>
Reading a counter with "cmd || echo 0" breaks whenever the command
writes output but still exits non-zero. On zero matches, "grep -c"
prints 0 and exits with status 1, so the command substitution
captured two zeros and the arithmetic that follows failed with a
syntax error instead of evaluating to 0.
Fix by ignoring the exit status with "|| true" and defaulting the
empty value with "${VAR:-0}". Apply this to ENTRY_COUNT in both
l10n_one_batch() and review_one_batch(), and to the BATCH counter
read from po/review-batch.txt, which used the same fragile fallback.
Signed-off-by: Jiang Xin <worldhello.net@gmail.com>
A "files" ODB transaction creates a temporary directory to stage newly
written objects in when configured to batch fsync loose objects. Once
the temporary directory is created, it is configured as the primary ODB
and all object are written to it accordingly. This also includes
packfiles containing blobs that exceed `core.bigFileThreshold` written
via `odb_transaction_files_write_object_stream()`.
If a "large" blob packfile is written to the ODB transaction temporary
directory after other loose objects, the ODB transaction fails to commit
as a result of the temporary directory being migrated prior to the
packfile being flushed. Fix this bug by always flushing the packfile
transaction before objects are migrated to the main ODB.
Signed-off-by: Justin Tobler <jltobler@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
When flushing a packfile via `flush_packfile_transaction()`,
`odb_reprepare()` is invoked so the written packfile becomes visible in
the current process. In a subsequent commit, flushing the packfile is
performed earlier when committing a "files" ODB transaction, but the ODB
reprepare needs to remain the last step.
Lift ODB reprepare out of `flush_packfile_transaction()` and instead
require callers to explicitly invoke `odb_reprepare()` if required.
Signed-off-by: Justin Tobler <jltobler@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
get_can_ff() and already_up_to_date() pass the result of
lookup_commit_reference() straight to commit_list_insert() and
repo_is_descendant_of() without checking it. When the object
behind HEAD or one of the merge heads cannot be parsed, e.g. because
a loose object was left truncated by a fetch or gc racing on the
same repository, lookup_commit_reference() returns NULL and
"git pull" segfaults instead of reporting the corruption.
Treat a failed lookup as "cannot fast-forward" and "not up to date",
so that the caller falls through to the normal merge path, which
already diagnoses the broken object and fails cleanly.
An alternative would be to report the breakage at each lookup site,
which could give a more precise diagnosis. The minimal guards are
preferred because they do no more than is needed to avoid the
crash, and will be easy to drop once "git pull" is reworked to
resolve object names into commit objects early and pass those
around, at which point there will not be multiple lookups of the
same object name to guard in the first place.
The test corrupts the loose object in place rather than removing
it: a missing object that is still recorded in the commit-graph is
caught by the consistency check in fetch-pack before "git pull"
reaches the fast-forward check, so removing it would not exercise
the crash.
Signed-off-by: Jiri Kuncar <jiri.kuncar@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
During WinANSI initialization, duplicate_handle() reports the handle
when DuplicateHandle() fails. die_lasterr() collects the formatting
arguments in a va_list, but passes that va_list to die_errno() as an
ordinary variadic argument. die_errno() consequently formats part of
the va_list representation instead of the supplied handle, producing
an incorrect fatal message.
The helper also converts GetLastError() to errno, losing the exact
Windows error code.
Remove die_lasterr() and report GetLastError() directly at its four
call sites, following the existing Windows diagnostic style. This
passes the handle to the formatter correctly and preserves the Windows
error code. Keep the existing %li representation of the handle.
Helped-by: Johannes Sixt <j6t@kdbg.org>
Helped-by: René Scharfe <l.s.r@web.de>
Signed-off-by: Yongqiang Tian <yqtian668@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
When a path is a file on one side and a directory on the other,
queue_diff() queues the file separately before recursing into the
directory. This early queue entry bypasses the reverse_diff handling
used for ordinary files.
As a result, comparing directories d and e where d/sub is a file and
e/sub/file is another file reports both paths as deleted with -R.
Reversing the operands reports both paths as added instead.
Swap the filespecs of the early queue entry when reverse_diff is set,
so that -R reverses the file change as well as the directory contents.
Add regression tests for both directions.
Signed-off-by: Haokai Ding <hk_ding@outlook.com>
Reviewed-by: Jacob Keller <jacob.keller@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
The `--show-objects` mode of `read_midx_file()` uses the output of
`midx_fill_entry()` without checking whether the lookup succeeded. A
failed lookup or unavailable pack can leave that output unusable,
allowing malformed or concurrently changed MIDX data to make this test
helper crash instead of reporting a controlled error.
Reject the entry unless `midx_fill_entry()` returns `MIDX_FILL_HIT`. The
unchecked call was introduced by 86d174b724
(t/helper/test-read-midx.c: add '--show-objects', 2021-03-30); later
incremental-MIDX changes expanded the possible failure modes, but this
remains a test-helper robustness issue, not a production Git attack
surface or an arbitrary-code-execution vulnerability.
It is unclear why Coverity reports this issue in Git for Windows only
after merging v2.56.0-rc0; The issue was not reported before.
Assisted-by: GPT-5.6 Luna
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
The reftable fuzzer introduced by adf45165e6 (oss-fuzz: add fuzzer for
parsing reftables, 2026-07-03) ignored failures from
`reftable_table_init_ref_iterator()` and
`reftable_table_init_log_iterator()`. Coverity reported that under
allocation failure, either constructor can return
`REFTABLE_OUT_OF_MEMORY_ERROR` without installing an ops table, allowing
a subsequent seek to dereference NULL.
Treat iterator initialization failure as a reason to skip the
corresponding seek and iteration while retaining safe destruction for an
uninitialized iterator.
Assisted-by: GPT-5.6 Luna
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Coverity pointed out that the
`test_reftable_table__seek_invalid_log_offset()` test, which was
introduced by a1c085df8d (reftable/table: fix NULL pointer access when
seeking to bogus offsets, 2026-07-03), ignores the result of
`reftable_table_init_log_iterator()` and proceeds to
`reftable_iterator_seek_log()`, although initialization can return
`REFTABLE_OUT_OF_MEMORY_ERROR` without installing an ops table. Under
allocation failure, the test then dereferences a NULL function table.
Assert successful iterator initialization before seeking.
Assisted-by: GPT-5.6 Luna
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
`rerere` can mark a conflict variant as resolved even when writing its
preimage or postimage fails. A later invocation may then replay
incomplete data from the cache, turning a local filesystem failure into
an incorrect working-tree change.
629716d256 (rerere: do use multiple variants, 2015-07-30) introduced
the code paths without checks for those I/O results. Treat such failures
as failures, report them, and leave the rerere status unchanged unless
the corresponding data was recorded successfully.
The defect has been latent since 2015. Git for Windows' Coverity run
only reported it after merging v2.56.0-rc0, for reasons that could not
be figured out in a reasonable amount of time.
Assisted-by: GPT-5.6 Luna
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Incremental MIDX support made object-offset pack IDs local to each layer
and then converted them to chain-global IDs by adding
`num_packs_in_base`. The conversion was introduced by 19419821ba
(midx: teach `nth_midxed_pack_int_id()` about incremental MIDXs,
2024-08-06). Chain-aware pack preparation followed in 1820bd878c
(midx: teach `prepare_midx_pack()` about incremental MIDXs, 2024-08-06),
but the final `midx_fill_entry()` lookup remained tied to the original
layer. Only with 8f909ff4e9 (packfile: recover when a multi-pack-index
names a removed pack, 2026-08-29) did Coverity point out this issue: a
local ID such as `UINT32_MAX` could wrap when the base-pack count was
added, producing a plausible but incorrect global ID. After
`prepare_midx_pack()` resolved the chain, `midx_fill_entry()` could then
underflow or address the wrong layer while indexing the current layer's
pack array, causing an invalid memory access and crashing Git.
Validate each local pack ID against its layer's pack count before adding
the base count, and obtain the final pack through `nth_midxed_pack()`,
which resolves the correct MIDX layer. This prevents an invalid local ID
from wrapping during conversion and ensures that the lookup uses the
layer identified by the resolved chain-global ID.
Assisted-by: GPT-5.6 Luna
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano