gnu: libgit2-1.9: Graft to 1.9.7 [security fixes].

This version contains a fix for CVE-2026-5917.

* gnu/packages/version-control.scm (libgit2-1.9.7): New variable.
  (libgit2-1.9)[replacement]: Use it.

Merges: https://codeberg.org/guix/guix/pulls/10550
Signed-off-by: Nguyễn Gia Phong <cnx@loang.net>

1 files changed, 22 insertions, 0 deletions

diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm
index 6c7d2f30645..cc0d9897336 100644
--- a/gnu/packages/version-control.scm
+++ b/gnu/packages/version-control.scm
@@ -1421,6 +1421,7 @@ other git-like projects such as @code{libgit2}.")
   (package
     (name "libgit2")
     (version "1.9.4")
+    (replacement libgit2-1.9.7)
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -1486,6 +1487,27 @@ write native speed custom Git applications in any language with bindings.")
     ;; GPLv2 with linking exception
     (license license:gpl2)))
 
+(define-public libgit2-1.9.7
+  (package
+    (inherit libgit2-1.9)
+    (name "libgit2")
+    (version "1.9.7")
+    (source
+     (origin
+       (inherit (package-source libgit2-1.9))
+       (uri (git-reference
+             (url "https://github.com/libgit2/libgit2")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name "libgit2" version))
+       (sha256 (base32 "0jhm723bc9v18yanlqvmwn9kpmnvbcavnlhd4jcw0n082d7jl54h"))
+       (snippet #~(for-each delete-file-recursively
+                    '("deps/chromium-zlib"
+                      "deps/llhttp"
+                      "deps/ntlmclient"
+                      "deps/pcre2"
+                      "deps/winhttp"
+                      "deps/zlib")))))))
+
 (define-public libgit2-1.9/pinned
   ;; This is a pinned version used as a dependency for 'rust-cargo-c'.
   ;; Update periodically.