From 89478b16fec06008f7e31ecc8d372b9466cfa801 Mon Sep 17 00:00:00 2001
From: Fintan Halpenny <fintan.halpenny@gmail.com>
Date: Wed, 18 Feb 2026 16:49:27 +0000
Subject: [PATCH] cargo/git2: Update to 0.20.4

Update to `git2` to 0.20.4` and `radicle-surf` to 0.27.0.

This fixes a low severity vulnerability[^0].

[^0]: https://github.com/advisories/GHSA-j39j-6gw9-jw6h
---
 Cargo.lock | 16 ++++++++--------
 Cargo.toml |  4 ++--
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 5c1142ed..552ca28e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1159,9 +1159,9 @@ dependencies = [
 
 [[package]]
 name = "git2"
-version = "0.19.0"
+version = "0.20.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b903b73e45dc0c6c596f2d37eccece7c1c8bb6e4407b001096387c63d0d93724"
+checksum = "7b88256088d75a56f8ecfa070513a775dd9107f6530ef14919dac831af9cfe2b"
 dependencies = [
  "bitflags 2.9.1",
  "libc",
@@ -2217,9 +2217,9 @@ checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112"
 
 [[package]]
 name = "libgit2-sys"
-version = "0.17.0+1.8.1"
+version = "0.18.3+1.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10472326a8a6477c3c20a64547b0059e4b0d086869eee31e6d7da728a8eb7224"
+checksum = "c9b3acc4b91781bb0b3386669d325163746af5f6e4f73e6d2d630e09a35f3487"
 dependencies = [
  "cc",
  "libc",
@@ -3086,9 +3086,9 @@ dependencies = [
 
 [[package]]
 name = "radicle-git-ext"
-version = "0.11.0"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71a5fbca2ee3fc61a6b467e0b85da7c092421afc2538feb0023ad6792d6e39d0"
+checksum = "db68f47aaf6b8352a733da684f7e24f89aeb03131598628f147ff1bcc633670d"
 dependencies = [
  "git-ref-format",
  "git2",
@@ -3249,9 +3249,9 @@ checksum = "fb935931bdd2a2966f3b584f3031d9d54ec0713ddbc563a0193d54e62a88ec73"
 
 [[package]]
 name = "radicle-surf"
-version = "0.26.0"
+version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c814514d0bf56fbec811099eaa14da1349639b04b8317746c9cd9e6b0f02196"
+checksum = "e2c6a29eac2e55a6d0632c8faeb3cbe91afb1e07be60d157a27fdadb8cc4c508"
 dependencies = [
  "anyhow",
  "base64 0.21.7",
diff --git a/Cargo.toml b/Cargo.toml
index 0ccc59f1..75e456b5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -29,7 +29,7 @@ cypheraddr = "0.4.0"
 cyphernet = "0.5.2"
 dunce = "1.0.5"
 fastrand = { version = "2.0.0", default-features = false }
-git2 = { version = "0.19.0", default-features = false, features = ["vendored-libgit2"] }
+git2 = { version = "0.20.4", default-features = false, features = ["vendored-libgit2"] }
 gix-hash = { version = "0.22.1", default-features = false, features = ["sha1"] }
 gix-packetline = { version = "0.21.1", default-features = false }
 human-panic = "2.0.6"
@@ -82,7 +82,7 @@ zeroize = "1.5.7"
 # `radicle-surf` → `radicle-git-ext` → `git-ref-format` → `git-ref-format-core`
 # Also note that `radicle-surf → git2` so try to also sync with `git2`.
 git-ref-format-core = { version = "0.6.0", default-features = false }
-radicle-surf = "0.26.0"
+radicle-surf = "0.27.0"
 
 [workspace.lints]
 clippy.type_complexity = "allow"