Sync Collecting Fix Commits: Sat Jul 25 07:41:15 UTC 2026

Signed-off-by: AboutCode Automation <automation@aboutcode.org>

Author: aboutcode-automation

data/fix-commits/advisory-database-b78f1d41.json

@@ -1,6 +1,10 @@
 {
   "vcs_url": "https://github.com/bcgit/bc-java",
   "vulnerabilities": {
+    "CVE-2026-3505": {
+      "71b8e3657adce9828102d33772f290bfc60a1004": "Revert \"OpenPGP v6 SEIPDv2 AEAD chunkSize is unbounded on decrypt \u2192 1L<<(chunkSize+6) buffer: chunkSize 24 \u2192 1 GiB alloc (memory-DoS), 25 \u2192 NegativeArraySizeException. Concrete sibling asymmetry: v5 AEADEncDataPacket:51 has if (chunkSize > 16) throw (CVE-2026-3505) but v6 SymmetricEncIntegrityPacket:54 reads chunkSize=in.read() with no bound \u2014 the missed sibling. Attacker needs only the recipient's public key.\"\n\nThis reverts commit 1299519c70c21b4b56296762295528124f5825a7.",
+      "1299519c70c21b4b56296762295528124f5825a7": "OpenPGP v6 SEIPDv2 AEAD chunkSize is unbounded on decrypt \u2192 1L<<(chunkSize+6) buffer: chunkSize 24 \u2192 1 GiB alloc (memory-DoS), 25 \u2192 NegativeArraySizeException. Concrete sibling asymmetry: v5 AEADEncDataPacket:51 has if (chunkSize > 16) throw (CVE-2026-3505) but v6 SymmetricEncIntegrityPacket:54 reads chunkSize=in.read() with no bound \u2014 the missed sibling. Attacker needs only the recipient's public key."
+    },
     "CVE-2018-5382": {
       "faf5daa6e9b8460f862afc0af1cc0da365f7d4d2": "Gate loading of legacy 16-bit-MAC BKS v0/v1 keystores behind enable_v1 (CVE-2018-5382)",
       "c014f78b148685527c5646b1204cd7f595005afa": "updates from FIPS API\nadded ref to CVE-2018-5382 in releasenotes.",

data/fix-commits/bc-java-fd129cd9.json

@@ -1,6 +1,12 @@
 {
   "vcs_url": "https://github.com/neovim/neovim",
   "vulnerabilities": {
+    "GHSA-9JQX-HGPR-6V64": {
+      "ba0e5b25bcaf307019b619db25bd19c78bb59846": "vim-patch:9.2.0846: [security]: heap buffer overflow in set_sofo()\n\nProblem:  [security]: heap buffer overflow in set_sofo()\n          (Yazan Balawneh)\nSolution: Reset sl_sal_first (Yasuhiro Matsumoto).\n\nA crafted spell file with an empty SN_SAL section before an SN_SOFO\nsection reaches set_sofo() with sl_sal_first[] already set to -1 by\nset_sal_first(). The counting loop then under-counts colliding\nmulti-byte \"from\" characters, allocates an undersized list and writes\npast its end.\n\nGithub Security Advisory:\nhttps://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64\n\nhttps://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a\n\nCo-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>"
+    },
+    "GHSA-CX73-PHCG-3J5G": {
+      "72b2c713ea79ee4abcd6b3d32f735f39f46d0fdf": "vim-patch:9.2.0845: [security]: arbitrary Ex command execution during C omni-completion\n\nProblem:  [security]: arbitrary Ex command execution during C\n          omni-completion (Threonine)\nSolution: Match tags typeref literally to block Ex command injection\n          (Yasuhiro Matsumoto).\n\nEscaping only \"/\" and \"\\\" left the typeref able to break out of the\n:vimgrep pattern without a \"/\": an unclosed \"[\" makes vimgrep's pattern\nskipping fail, and the parser then treats a following \"|\" as a command\nseparator, so the tag value runs as Ex commands during C omni-completion.\nMatch the field literally with \\V so no regex metacharacter can affect\npattern parsing.\n\nGithub Security Advisory:\nhttps://github.com/vim/vim/security/advisories/GHSA-cx73-phcg-3j5g\n\nhttps://github.com/vim/vim/commit/2f628d8104958fa7421664f792ca6d4f7a39a10f\n\nCo-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>"
+    },
     "GHSA-RCR7-F3WR-22R2": {
       "8d1f8d8dc3d65d2b8b6cf2925b6f13706d29b95e": "vim-patch:9.2.0840: [security]: code injection in netrw via bookmarks\n\nProblem:  [security]: code injection in netrw via bookmarks and history\n          (David Carliez)\nSolution: Escape the '|' explicitly (Yasuhiro Matsumoto)\n\nThe bookmark and history menu builders interpolate paths into :execute'd\n:menu commands using g:netrw_menu_escape, which did not escape the Ex\ncommand separator '|'. A crafted path could break out of the :menu command\nand run arbitrary Ex/shell commands when the menu was built or triggered.\n\nAdd '|' to g:netrw_menu_escape for the menu names, escape the :e right-hand\nside with fnameescape(), and quote the netrw#MakeTgt() argument with\nstring() instead of raw single-quote interpolation.\n\nGithub Security Advisory:\nhttps://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2\n\nhttps://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69\n\nCo-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>"
     },

data/fix-commits/git-e83ef8ed.json

@@ -1,6 +1,9 @@
 {
   "vcs_url": "https://github.com/pytorch/pytorch",
   "vulnerabilities": {
+    "GHSA-RWJ8-PGH3-R573": {
+      "55d182046edce7face6d9eb894f23b3a2588d876": "Bump gitpython from 3.1.50 to 3.1.54 in /.ci/lumen_cli (#191054)\n\nBumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.50 to 3.1.54.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a href=\"https://github.com/gitpython-developers/GitPython/releases\">gitpython's releases</a>.</em></p>\n<blockquote>\n<h2>3.1.54 - SECURITY</h2>\n<h2>What's Changed</h2>\n<ul>\n<li>Harden unsafe Git option validation by <a href=\"https://github.com/Byron\"><code>@\u200bByron</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2180\">gitpython-developers/GitPython#2180</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54\">https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54</a></p>\n<h2>3.1.53 - Security</h2>\n<h2>What's Changed</h2>\n<ul>\n<li>feat(submodule): add deinit method to Submodule (<a href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2014\">#2014</a>) by <a href=\"https://github.com/mvanhorn\"><code>@\u200bmvanhorn</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2129\">gitpython-developers/GitPython#2129</a></li>\n<li>typing: introduce sensible basedpyright defaults by <a href=\"https://github.com/Byron\"><code>@\u200bByron</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2174\">gitpython-developers/GitPython#2174</a></li>\n<li>fix: make <code>submodule.update()</code> after <code>submodule.deinit()</code> work by <a href=\"https://github.com/Byron\"><code>@\u200bByron</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2175\">gitpython-developers/GitPython#2175</a></li>\n<li>Fix commit hooks respecting core.hooksPath by <a href=\"https://github.com/Siesta0217\"><code>@\u200bSiesta0217</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2159\">gitpython-developers/GitPython#2159</a></li>\n<li>fix: validate config section delimiters by <a href=\"https://github.com/Byron\"><code>@\u200bByron</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2176\">gitpython-developers/GitPython#2176</a></li>\n</ul>\n<h2>New Contributors</h2>\n<ul>\n<li><a href=\"https://github.com/Siesta0217\"><code>@\u200bSiesta0217</code></a> made their first contribution in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2159\">gitpython-developers/GitPython#2159</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.52...3.1.53\">https://github.com/gitpython-developers/GitPython/compare/3.1.52...3.1.53</a></p>\n<h2>3.1.52 Security</h2>\n<p><a href=\"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573\">https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573</a>: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL</p>\n<h2>What's Changed</h2>\n<ul>\n<li>Skip cross-drive relative config test on Windows by <a href=\"https://github.com/Byron\"><code>@\u200bByron</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2171\">gitpython-developers/GitPython#2171</a></li>\n<li>fix: preserve literal clone URLs by <a href=\"https://github.com/Byron\"><code>@\u200bByron</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2172\">gitpython-developers/GitPython#2172</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.51...3.1.52\">https://github.com/gitpython-developers/GitPython/compare/3.1.51...3.1.52</a></p>\n<h2>3.1.51 - Security</h2>\n<h2>What's Changed</h2>\n<ul>\n<li>Add AI-disclosure and quality requirements to the contribution guidelines by <a href=\"https://github.com/Byron\"><code>@\u200bByron</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2143\">gitpython-developers/GitPython#2143</a></li>\n<li>docs(cmd): clarify Git.execute() string vs list command argument by <a href=\"https://github.com/mvanhorn\"><code>@\u200bmvanhorn</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2144\">gitpython-developers/GitPython#2144</a></li>\n<li>Rewrite Git.execute() command parameter docstring per <a href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2146\">#2146</a> by <a href=\"https://github.com/EliahKagan\"><code>@\u200bEliahKagan</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2147\">gitpython-developers/GitPython#2147</a></li>\n<li>Document init script behavior with multiple master remotes by <a href=\"https://github.com/EliahKagan\"><code>@\u200bEliahKagan</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2148\">gitpython-developers/GitPython#2148</a></li>\n<li>Bump git/ext/gitdb from <code>335c0f6</code> to <code>0a019a2</code> by <a href=\"https://github.com/dependabot\"><code>@\u200bdependabot</code></a>[bot] in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2149\">gitpython-developers/GitPython#2149</a></li>\n<li>Support relative worktree paths (git 2.48+ worktree.useRelativePaths) by <a href=\"https://github.com/elovelan\"><code>@\u200belovelan</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2151\">gitpython-developers/GitPython#2151</a></li>\n<li>Defer xfail condition evaluation with xfail_if_raises context manager by <a href=\"https://github.com/elovelan\"><code>@\u200belovelan</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2153\">gitpython-developers/GitPython#2153</a></li>\n<li>Run more submodule tests on Cygwin (fix flaky xfails) by <a href=\"https://github.com/EliahKagan\"><code>@\u200bEliahKagan</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2154\">gitpython-developers/GitPython#2154</a></li>\n<li>Cut xtrace noise from POSIX-ownership diagnostic steps by <a href=\"https://github.com/EliahKagan\"><code>@\u200bEliahKagan</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2156\">gitpython-developers/GitPython#2156</a></li>\n<li>Support index diffs against the empty tree by <a href=\"https://github.com/puneetdixit200\"><code>@\u200bpuneetdixit200</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2155\">gitpython-developers/GitPython#2155</a></li>\n<li>refactor: seperate out Progress type by <a href=\"https://github.com/LoeschMaximilian\"><code>@\u200bLoeschMaximilian</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2157\">gitpython-developers/GitPython#2157</a></li>\n<li>Bump <a href=\"https://github.com/astral-sh/ruff-pre-commit\">https://github.com/astral-sh/ruff-pre-commit</a> from v0.15.12 to 0.15.15 in the pre-commit group by <a href=\"https://github.com/dependabot\"><code>@\u200bdependabot</code></a>[bot] in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2160\">gitpython-developers/GitPython#2160</a></li>\n<li>Bump actions/checkout from 6 to 7 by <a href=\"https://github.com/dependabot\"><code>@\u200bdependabot</code></a>[bot] in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2164\">gitpython-developers/GitPython#2164</a></li>\n<li>Bump git/ext/gitdb from <code>0a019a2</code> to <code>4950ea9</code> by <a href=\"https://github.com/dependabot\"><code>@\u200bdependabot</code></a>[bot] in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2165\">gitpython-developers/GitPython#2165</a></li>\n<li>Bump <a href=\"https://github.com/astral-sh/ruff-pre-commit\">https://github.com/astral-sh/ruff-pre-commit</a> from v0.15.15 to 0.15.20 in the pre-commit group by <a href=\"https://github.com/dependabot\"><code>@\u200bdependabot</code></a>[bot] in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2166\">gitpython-developers/GitPython#2166</a></li>\n<li>Add Commit.is_shallow property; document stats() limitation at shallow boundary by <a href=\"https://github.com/harshitayadavv\"><code>@\u200bharshitayadavv</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2167\">gitpython-developers/GitPython#2167</a></li>\n<li>Allow relative config paths with includes by <a href=\"https://github.com/Byron\"><code>@\u200bByron</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2169\">gitpython-developers/GitPython#2169</a></li>\n<li>Reject abbreviated forms of unsafe git options by <a href=\"https://github.com/Byron\"><code>@\u200bByron</code></a> in <a href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2168\">gitpython-developers/GitPython#2168</a></li>\n</ul>\n<!-- raw HTML omitted -->\n</blockquote>\n<p>... (truncated)</p>\n</details>\n<details>\n<summary>Commits</summary>\n<ul>\n<li><a href=\"https://github.com/gitpython-developers/GitPython/commit/e59d9bab02b095a97e179f47019afee95f4e3c18\"><code>e59d9ba</code></a> prepare next release</li>\n<li><a href=\"https://github.com/gitpython-developers/GitPython/commit/a4dc70d4eec15825aac2dfd7484c961f6fc8491b\"><code>a4dc70d</code></a> Merge pull request <a href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2180\">#2180</a> from gitpython-developers/single-char-kwarg</li>\n<li><a href=\"https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6\"><code>1d51b89</code></a> fix: guard diff output options</li>\n<li><a href=\"https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97\"><code>ffcb535</code></a> fix: reject unsafe clone templates</li>\n<li><a href=\"https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453\"><code>e8d0fbf</code></a> fix: validate split short-option values</li>\n<li><a href=\"https://github.com/gitpython-developers/GitPython/commit/faf3c09038b03bc2bdd8545ef34bbf6d7f1cd11f\"><code>faf3c09</code></a> prepare for security fix</li>\n<li><a href=\"https://github.com/gitpython-developers/GitPython/commit/6a5eb6a53407cfd7964447fa417d73a7ab32e700\"><code>6a5eb6a</code></a> Merge pull request <a href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2176\">#2176</a> from gitpython-developers/fix-config-injection</li>\n<li><a href=\"https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1\"><code>1ed1b92</code></a> fix: validate config section delimiters</li>\n<li><a href=\"https://github.com/gitpython-developers/GitPython/commit/354eb2fc505042d2f4cd913783b689bce6c49fd3\"><code>354eb2f</code></a> Merge pull request <a href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2159\">#2159</a> from Siesta0217/fix-core-hooks-path-commit-hooks</li>\n<li><a href=\"https://github.com/gitpython-developers/GitPython/commit/9bc287a2b1eb331b6051d2ba704a603c3e0ddc6f\"><code>9bc287a</code></a> Address review feedback about hook resolution</li>\n<li>Additional commits viewable in <a href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.50...3.1.54\">compare view</a></li>\n</ul>\n</details>\n<br />\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gitpython&package-manager=pip&previous-version=3.1.50&new-version=3.1.54)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n<details>\n<summary>Dependabot commands and options</summary>\n<br />\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/pytorch/pytorch/network/alerts).\n\n</details>\nPull Request resolved: https://github.com/pytorch/pytorch/pull/191054\nApproved by: https://github.com/Skylion007\n\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>"
+    },
     "CVE-2026-0846": {
       "55ca7c9d4c7fa02c5f424f5e5509d4db2134ff7b": "Update FBGEMM submodule to v1.6.0 (#180694)\n\nBumps third_party/fbgemm to v1.6.0 (d08742c6) to pick up FBGEMM's bump of its own nlohmann/json submodule, which removes the unused nltk entry from docs/mkdocs/requirements.txt that was triggering Wiz CVE-2026-0846 alerts on PyTorch CI runners.\nPull Request resolved: https://github.com/pytorch/pytorch/pull/180694\nApproved by: https://github.com/Skylion007\n\n(cherry picked from commit 4c910af94eb3454633e0080adc16bcda9e44fd93)",
       "4c910af94eb3454633e0080adc16bcda9e44fd93": "Update FBGEMM submodule to v1.6.0 (#180694)\n\nBumps third_party/fbgemm to v1.6.0 (d08742c6) to pick up FBGEMM's bump of its own nlohmann/json submodule, which removes the unused nltk entry from docs/mkdocs/requirements.txt that was triggering Wiz CVE-2026-0846 alerts on PyTorch CI runners.\nPull Request resolved: https://github.com/pytorch/pytorch/pull/180694\nApproved by: https://github.com/Skylion007"

data/fix-commits/langchain-c5a32632.json

@@ -1,6 +1,9 @@
 {
   "vcs_url": "https://github.com/vim/vim",
   "vulnerabilities": {
+    "GHSA-R22P-FHW4-84P2": {
+      "581a2f3ac9c6f96a26324f6b2c8c11415fd0d452": "patch 9.2.0847: [security]: vimball: code execution via .VimballRecord file\n\nProblem:  [security]: vimball: code execution via .VimballRecord file\n          (tdjackey)\nSolution: Forbid arbitrary commands, fix broken directory deletion code,\n          refactor code\n\nGithub Security Advisory:\nhttps://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2\n\nSigned-off-by: Christian Brabandt <cb@256bit.org>"
+    },
     "GHSA-9JQX-HGPR-6V64": {
       "05c41c922309c7a11b6ec2f124be66551c90d66a": "patch 9.2.0846: [security]: heap buffer overflow in set_sofo()\n\nProblem:  [security]: heap buffer overflow in set_sofo()\n          (Yazan Balawneh)\nSolution: Reset sl_sal_first (Yasuhiro Matsumoto).\n\nA crafted spell file with an empty SN_SAL section before an SN_SOFO\nsection reaches set_sofo() with sl_sal_first[] already set to -1 by\nset_sal_first(). The counting loop then under-counts colliding\nmulti-byte \"from\" characters, allocates an undersized list and writes\npast its end.\n\nGithub Security Advisory:\nhttps://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64\n\nSigned-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>\nSigned-off-by: Christian Brabandt <cb@256bit.org>"
     },