Skip to content

crypto 0.21.0 in git-lfs 3.6.0 #5941

@daipok

Description

@daipok

Describe the issue
We noticed this is already done:
4e2d7b0

Mainly concerning about CVE-2024-45337

What is the possible timeline of another release?

Currently we are still on 3.5.1 thinking of upgrading to 3.6.0 but getting another vulnerability issue so we are evaluating

System environment
Rocky8

Output of git lfs env
The output of running git lfs env as a code block.
`
git-lfs/3.5.1 (GitHub; linux amd64; go 1.21.7; git e237bb3)
git version 2.43.5

LocalWorkingDir=
LocalGitDir=
LocalGitStorageDir=
LocalMediaDir=lfs/objects
LocalReferenceDirs=
TempDir=lfs/tmp
ConcurrentTransfers=8
TusTransfers=false
BasicTransfersOnly=false
SkipDownloadErrors=false
FetchRecentAlways=false
FetchRecentRefsDays=7
FetchRecentCommitsDays=0
FetchRecentRefsIncludeRemotes=true
PruneOffsetDays=3
PruneVerifyRemoteAlways=false
PruneVerifyUnreachableAlways=false
PruneRemoteName=origin
LfsStorageDir=lfs
AccessDownload=none
AccessUpload=none
DownloadTransfers=basic,lfs-standalone-file,ssh
UploadTransfers=basic,lfs-standalone-file,ssh
GIT_EXEC_PATH=/usr/libexec/git-core
git config filter.lfs.process = ""
git config filter.lfs.smudge = ""
git config filter.lfs.clean = ""
`

Additional context
Any other relevant context about the problem here.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions