unstale

pypi / dulwich

dulwich

What changed in dulwich 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.

1 breaking10 security3 deprecations1 behavior and defaults1 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.2 on npm

dulwich 116 changes

Breaking changes 1

  • Writing a loose ref through a symref is refused when its target escapes the ref store.

    1.2.17release notes

Security 10

  • Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths

    1.2.9security advisory

  • Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution

    1.2.9security advisory

  • Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

    1.2.8security advisory

  • Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

    1.2.8security advisory

  • Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

    1.2.8security advisory

  • Dulwich doesn't sanitize commit subjects in porcelain.format_patch

    1.2.5security advisory

  • Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows

    1.2.5security advisory

  • Dulwich has unbounded memory allocation in receive-pack from crafted thin packs

    1.2.5security advisory

  • Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload

    1.2.5security advisory

  • Dulwich Vulnerable to Command Injection via Merge Driver Path

    1.2.5security advisory

Deprecations 3

  • Import LOCAL_TAG_PREFIX, SYMREF, check_ref_format, read_packed_refs, read_packed_refs_with_peeled and write_packed_refs from dulwich.refs instead.

    1.2.17release notes

  • Restored dulwich.index.SHA1Reader as a deprecated alias for the class in dulwich.pack.

    1.2.17release notes

  • Restored dulwich.index.SHA1Writer as a deprecated alias for the class in dulwich.pack.

    1.2.17release notes

Behavior and default changes 1

  • All modules define __all__ listing their public names, affecting which names are exported by star imports.

    1.2.17release notes

Fixes and other changes 1

  • Import BundleList, fetch_bundle_uri and parse_bundle_list from dulwich.bundle_uri instead.

    1.2.17release notes