chore: bump native binaries pin to natives-1.9.1-v12 STUD-81868 by daniel-dumitrascu · Pull Request #35 · UiPath/libgit2sharp · GitHub
Skip to content

chore: bump native binaries pin to natives-1.9.1-v12 STUD-81868 - #35

Merged
daniel-dumitrascu merged 1 commit into
developfrom
chore/bump-natives-1.9.1-v12
Oct 16, 2026
Merged

daniel-dumitrascu merged 1 commit into
developfrom
chore/bump-natives-1.9.1-v12

Conversation

@daniel-dumitrascu

Copy link
Copy Markdown

Jira: STUD-81868

Rolls natives.lock.json from natives-1.9.1-v10 to natives-1.9.1-v12, the new release of UiPath/libgit2sharp.nativebinaries.

before after
tag natives-1.9.1-v10 natives-1.9.1-v12
sha256 76b1da10…19686b 8a591355…e4fd57

What the release carries

  • OpenSSL 3.6.3 → 3.6.5 (nativebinaries #35 submodule + manifest, #37 deps lock). Closes the 22 OpenSSL CVEs from STUD-81868 that 3.6.3 / 3.5.7 still carried (9 fixed in 3.6.4, 13 fixed in 3.6.5). libcrypto-3-x64.dll and libcrypto-3-arm64.dll report FileVersion 3.6.5.
  • Unchanged: libgit2 1.9.1 at the same commit as v10 (the submodule did not move), libssh2 1.11.1. There is no natives-1.9.1-v11; the number skipped because chore: bump native binaries pin to natives-1.9.1-v12 STUD-81868 #35 and Publish source and PDBs at symbolsource.org libgit2/libgit2sharp#37 were two squash merges on nativebinaries develop.
  • Where OpenSSL is reached: only libssh2.dll imports libcrypto-3-x64.dll (Git over SSH). libgit2.dll / libgit2_ssh.dll import WinHTTP, libgit2_schannel.dll / libgit2_schannel_ssh.dll import neither WinHTTP nor libcrypto, so the Schannel variants are real Schannel builds (no repeat of STUD-81430).

As with v9 and v10, this is four lines in one file, since the lockfile is the single pin.

Verification

  • Pin: fetch.natives.ps1 -Force locally on Windows: the archive downloads, and its SHA256 8a5913551f4badbe437fc866c7d76bcc2b1d77f58edde17826f14bdd38e4fd57 matches the release's .sha256 sidecar.
  • Payload: win-x64 and win-arm64 each carry the six expected DLLs; linux-x64/arm64 and osx-x64/arm64 carry a single liblibgit2.{so,dylib}.
  • CI: this PR's ci.yml run exercises Windows, Ubuntu and macOS.

After merge

  1. Package: ci.yml publishes pkg-1.9.1-v<N> with the .nupkg. develop is at first-parent height 5 from the 1.9.1-v5 tag (= v10), so the squash merge yields 1.9.1-v11 for the managed package, consuming natives v12. The two numbers are independent.
  2. Feed: push it to the UiPath-Internal feed (manual step in .claude/skills/release-libgit2-natives/SKILL.md).
  3. Studio: bump LibGit2Sharp.UiPath to that version in Directory.Build.studio.targets on develop.

🤖 Generated with Claude Code

Rolls natives.lock.json from natives-1.9.1-v10 to natives-1.9.1-v12, the
release built from UiPath/libgit2sharp.nativebinaries develop after the
OpenSSL 3.6.5 bump (#35, libgit2#37). libcrypto-3-x64.dll / libcrypto-3-arm64.dll
in the payload report FileVersion 3.6.5; libgit2 stays 1.9.1, libssh2 1.11.1.

Verified with fetch.natives.ps1 -Force: the archive downloads and its
SHA256 matches the release sidecar.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@daniel-dumitrascu
daniel-dumitrascu merged commit 17f91e5 into develop Oct 16, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants