chore(deps): bump dulwich from 1.2.11 to 1.2.12

[dependabot]

Bumps dulwich from 1.2.11 to 1.2.12.

Release notes

Sourced from dulwich's releases.

dulwich-1.2.12

• SECURITY: Refuse to write a checkout entry whose leading path resolves through a symlink. `build_index_from_tree` (used by `reset_index` and thus by `clone`/`checkout`) materialized a tree in sorted order without checking leading components, so a tree pairing a symlink `link` with a descendant `link/foo` wrote `foo` through the link to an arbitrary absolute path. The same `verify_leading_dirs` guard already used by porcelain and stash is now applied here. (Jelmer Vernooij, reported by Hugh Lewis)

• Fix `Bundle.store_objects()` silently dropping every OFS_DELTA/REF_DELTA object in the bundle's pack instead of resolving it, leaving the target object store missing most objects with no error raised. Delta resolution now goes through `PackInflater`, matching how packs are ingested elsewhere in the object store code. (theVinchi, #2312)

Changelog

Sourced from dulwich's changelog.

1.2.12 2026-07-19

• Fix Bundle.store_objects() silently dropping every OFS_DELTA/REF_DELTA object in the bundle's pack instead of resolving it, leaving the target object store missing most objects with no error raised. Delta resolution now goes through PackInflater, matching how packs are ingested elsewhere in the object store code. (theVinchi, #2312)

• SECURITY: Refuse to write a checkout entry whose leading path resolves through a symlink. build_index_from_tree (used by reset_index and thus by clone/checkout) materialized a tree in sorted order without checking leading components, so a tree pairing a symlink link with a descendant link/foo wrote foo through the link to an arbitrary absolute path. The same verify_leading_dirs guard already used by porcelain and stash is now applied here. (Jelmer Vernooij, reported by Hugh Lewis)

Commits

• c9240bc Release 1.2.12
• fabed56 Fix Bundle.store_objects() silently dropping delta objects (#2314)
• d845b3c validate object ids in receive-pack ref commands (#2309)
• e6d123e catch ValueError from ref line unpack instead of checking field count
• 551d0ef Preserve dulwich.porcelain.get_user_identity (#2313)
• 4cc3d60 Fix Bundle.store_objects() silently dropping delta objects
• dbf7f15 Preserve dulwich.porcelain.get_user_identity
• e84043a client: Half-close write side after sending a fetch request (#2311)
• 6dacf2f client: Half-close write side after sending a fetch request
• e633cdc Refuse to write checkout entries through leading symlinks (#2308)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)