chore(deps): bump dulwich from 1.2.10 to 1.2.11

[dependabot]

Bumps dulwich from 1.2.10 to 1.2.11.

Release notes

Sourced from dulwich's releases.

dulwich-1.2.11

Security and hardening

• Apply core.protectHFS and core.protectNTFS together when selecting the checkout path-element validator. Previously only the NTFS validator ran when protectNTFS was on (the default), so on macOS an HFS+ spelling of .git using ignorable code points could pass validation and poison .git on checkout.
• Canonicalize file modes in git archive tarballs, so a crafted tree entry can no longer carry setuid/setgid/sticky bits into an extracted file.
• Collapse embedded whitespace in reflog messages, so a crafted multi-line commit message can no longer forge additional reflog entries with attacker-chosen SHAs.
• Verify that a .bitmap index matches the pack it is loaded for, so a stale or swapped-in bitmap can't produce a wrong reachable-object set during fetch negotiation.
• Parse commit-message trailers in linear time, fixing a cubic blowup where a crafted commit message could tie up CPU for minutes to hours.

Features and fixes

• Honour core.worktree, so the working tree can live outside the parent of the control directory.
• Porcelain functions now take an env argument, and read GIT_PROTOCOL, GIT_SSH_COMMAND/GIT_SSH when called as a library rather than only from the CLI (fixes a regression since 1.2.1 where porcelain.clone() silently ignored the SSH variables).
• porcelain.archive() gained a remote argument.
• Recurse into subtrees when merging trees, so non-overlapping changes under a shared directory merge cleanly.
• Clear core.bare when setting up a submodule's working tree.

Security and hardening fixes in this release were contributed by Kartik Kenchi (@​netliomax25-code).

Changelog

Sourced from dulwich's changelog.

1.2.11 2026-07-16

• Let porcelain functions that consult the environment take an env argument overriding os.environ. As a side effect tag_create now honours GIT_COMMITTER_NAME/GIT_COMMITTER_EMAIL for the tagger line and merge/revert honour GIT_AUTHOR_NAME/GIT_AUTHOR_EMAIL, matching git. (Jelmer Vernooij)

• Honour the core.worktree configuration option, so the working tree can live somewhere other than the parent of the control directory. Relative paths are resolved against the control directory, and core.bare and core.worktree are now rejected as incompatible. (Jelmer Vernooij, #1785)

• Clear core.bare when setting up a submodule's working tree. submodule_update cloned the submodule bare and then set core.worktree on it, leaving a configuration git considers invalid. (Jelmer Vernooij)

• Read GIT_PROTOCOL in porcelain rather than only in the command line interface, so clone and pull honour it when called as a library. An explicit protocol_version argument still wins. (Jelmer Vernooij)

• Add a remote argument to porcelain.archive(), so an archive can be retrieved from a remote repository without dropping down to dulwich.client. (Jelmer Vernooij)

• Read GIT_SSH_COMMAND/GIT_SSH in porcelain rather than only in the command line interface, so clone, fetch, ls_remote, pull and push honour them again when called as a library. Since 1.2.1 only the CLI resolved these, so porcelain.clone() silently ignored them. An explicit ssh_command argument still wins, and push and pull gained an env argument. (Jelmer Vernooij, #2209)

• Recurse into subtrees when merging trees, so non-overlapping changes on different sides of a shared directory merge cleanly instead of being reported as a directory-level conflict. (Jelmer Vernooij, #2295)

• HARDEN: Verify that a .bitmap index matches the pack it is loaded for. The bitmap header records the checksum of its pack, but Pack.bitmap never checked it, so a stale or swapped-in bitmap (built for a different object set) was used against this pack's index and silently produced a wrong reachable-object set during fetch negotiation. Pack.bitmap now compares the recorded checksum and ignores a mismatched bitmap, falling back to graph traversal, matching git's load_bitmap_header. (netliomax25-code)

• HARDEN: Parse commit-message trailers in linear time. parse_trailers located the trailer block by re-slicing and re-stripping the tail of the message for every blank line, which is cubic on a message made mostly of blank lines. Trailers are scanned during subtree operations, which walk

... (truncated)

Commits

• 8e8cf0d Release 1.2.11
• 318468d verify a bitmap's pack checksum in Pack.bitmap (#2307)
• 5ab6c2d verify a bitmap's pack checksum in Pack.bitmap
• 7cecd84 Support core.worktree (#2306)
• 7387d25 Honour core.worktree
• 3b254e4 Clear core.bare when setting up a submodule working tree
• f428da4 Move env handling to dulwich.porcelain (#2305)
• 6f0ceb5 Move GIT_PROTOCOL lookup into porcelain
• 8aaa883 Add remote argument to porcelain.archive()
• 0b8f376 Move GIT_SSH_COMMAND/GIT_SSH lookup into porcelain
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)