Fix what the last audit of 2.0 found

.gitattributes

@@ -1,4 +1,5 @@
-* text=auto
+# With LF on Windows too: the tests hold the outputs of git they parse.
+* text=auto eol=lf
 /tests/fixtures/*.bundle binary
 
 # Left out of the archive Composer installs: only src/, the docs and the license ship.

.github/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported Versions
 
-Only 2.x gets security fixes: 1.x is no longer maintained. 1.7.1 has the
+Only 2.x gets security fixes: 1.x is no longer maintained. 1.7.2 has the
 security fixes of 2.0 that break nothing of 1.x, and
 [its changelog](https://github.com/gitonomy/gitlib/blob/1.x/CHANGELOG.md) lists
 the ones it doesn't have. To upgrade, see

.github/workflows/docs.yml

@@ -28,13 +28,13 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # The site is published: keep the token out of the workspace.
           persist-credentials: false
 
       - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.14'
           cache: pip
@@ -52,7 +52,7 @@ jobs:
 
       - name: Upload the site
         if: github.ref == 'refs/heads/main'
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: site
 
@@ -69,8 +69,8 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - name: Setup Pages
-        uses: actions/configure-pages@v6
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/tests.yml

@@ -4,6 +4,9 @@ on:
   push:
     branches: [ main ]
   pull_request:
+  schedule:
+    # The dependencies aren't locked: a release of one of them may break the tests of an unchanged main.
+    - cron: '23 5 * * 1'
 
 permissions:
   contents: read
@@ -14,7 +17,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Verify fixture bundle integrity, refs and size
         run: tests/fixtures/verify-bundle.sh
@@ -24,7 +27,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup PHP
         uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
@@ -42,7 +45,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Ship only the code, the docs and the license
         run: diff <(git archive HEAD | tar -t | cut -d/ -f1 | sort -u) <(printf '%s\n' CHANGELOG.md LICENSE README.md UPGRADE-2.0.md composer.json doc src | sort)
@@ -52,7 +55,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup PHP
         uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
@@ -71,6 +74,8 @@ jobs:
   tests:
     name: Test PHP ${{ matrix.php }} ${{ matrix.name }}
     runs-on: ubuntu-24.04
+    # The next version of PHP may fail, without failing the workflow.
+    continue-on-error: ${{ matrix.php == 'nightly' }}
     strategy:
       fail-fast: false
       matrix:
@@ -81,10 +86,18 @@ jobs:
           - php: '8.4'
             composer-flags: '--prefer-lowest'
             name: '(prefer lowest dependencies)'
+          # Between 6.4, of the lowest dependencies, and 8.x, of the other jobs.
+          - php: '8.4'
+            composer-flags: '--with=symfony/process:^7.4.5'
+            name: '(symfony/process 7.4)'
+          - php: 'nightly'
+            # The dependencies may not allow this version of PHP yet.
+            composer-flags: '--ignore-platform-req=php+'
+            name: '(allowed to fail)'
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup PHP
         uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
@@ -116,25 +129,28 @@ jobs:
             sha256: '5e0efe7cd30e258bc3be9ae023790743974e76eb1b24ecac24de6fc2af2b2786'
           - git: '2.25.1'
             sha256: 'aaef0cd609a7730cfbae530d7c91214a941d7e26054d2314cc99794880156b33'
+    env:
+      GIT_CFLAGS: '-std=gnu17 -O2'
+      GIT_MAKE_FLAGS: 'NO_OPENSSL=1 NO_CURL=1 NO_EXPAT=1 NO_GETTEXT=1 NO_PERL=1 NO_PYTHON=1 NO_TCLTK=1'
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Cache git
         id: cache-git
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/git
-          key: git-${{ matrix.git }}-ubuntu-24.04
+          key: git-${{ matrix.git }}-${{ env.GIT_CFLAGS }}-${{ env.GIT_MAKE_FLAGS }}-ubuntu-24.04
 
       - name: Build git
         if: steps.cache-git.outputs.cache-hit != 'true'
         run: |
           curl -fsSL "https://github.com/git/git/archive/refs/tags/v${{ matrix.git }}.tar.gz" -o git.tar.gz
           echo "${{ matrix.sha256 }}  git.tar.gz" | sha256sum --check
           tar xzf git.tar.gz
-          make -C "git-${{ matrix.git }}" prefix="$HOME/git" CFLAGS='-std=gnu17 -O2' NO_OPENSSL=1 NO_CURL=1 NO_EXPAT=1 NO_GETTEXT=1 NO_PERL=1 NO_PYTHON=1 NO_TCLTK=1 --jobs="$(nproc)" install
+          make -C "git-${{ matrix.git }}" prefix="$HOME/git" CFLAGS="$GIT_CFLAGS" $GIT_MAKE_FLAGS --jobs="$(nproc)" install
 
       - name: Setup PHP
         uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
@@ -151,12 +167,18 @@ jobs:
         run: GIT_COMMAND="$HOME/git/bin/git" vendor/bin/phpunit
 
   tests-ffi:
-    name: Test PHP ${{ matrix.php }} (LibGit2Driver)
+    name: Test PHP ${{ matrix.php }} (LibGit2Driver${{ matrix.name }})
     runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
         php: ['8.4', '8.5']
+        composer-flags: ['']
+        name: ['']
+        include:
+          - php: '8.4'
+            composer-flags: '--prefer-lowest'
+            name: ', prefer lowest dependencies'
     env:
       # LibGit2Driver only supports libgit2 1.9, which Ubuntu 24.04 doesn't ship.
       LIBGIT2_VERSION: '1.9.1'
@@ -165,11 +187,11 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Cache libgit2
         id: cache-libgit2
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/libgit2
           key: libgit2-${{ env.LIBGIT2_VERSION }}-${{ env.LIBGIT2_CMAKE_FLAGS }}-ubuntu-24.04
@@ -194,9 +216,40 @@ jobs:
         run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
 
       - name: Install Composer dependencies
-        run: composer update --prefer-dist --no-interaction
+        run: composer update --prefer-dist --no-interaction ${{ matrix.composer-flags }}
 
       - name: Execute PHPUnit
         run: LD_LIBRARY_PATH="$HOME/libgit2/lib" vendor/bin/phpunit
         env:
           GITLIB_DRIVER: ffi
+
+  tests-os:
+    name: Test ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ['macos-latest', 'windows-latest']
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
+        with:
+          php-version: '8.4'
+          # Not all enabled by default on Windows.
+          extensions: fileinfo, zlib
+
+      - name: Setup Problem Matchers
+        run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
+
+      - name: Install Composer dependencies
+        run: composer update --prefer-dist --no-interaction
+
+      - name: Execute PHPUnit
+        run: php vendor/bin/phpunit

CHANGELOG.md

@@ -22,8 +22,9 @@ the deprecations of 1.7 first, then see [UPGRADE-2.0.md](UPGRADE-2.0.md).
 -   Return the dates of commits and tags at the UTC offset of their author, committer or tagger,
     like `git log` shows them, instead of in UTC: the instant doesn't change, but `format()`
     returns their local time. ([#254](https://github.com/gitonomy/gitlib/pull/254))
--   Require PHP 8.4 or later, Symfony 7.4/8.1+: most classes are `final` (some `readonly`),
-    and every method has native types. ([#238](https://github.com/gitonomy/gitlib/pull/238))
+-   Require PHP 8.4 or later, and `symfony/process` `^6.4.33`, `^7.4.5` or `^8.1`: most classes
+    are `final` (some `readonly`), and every method has native types.
+    ([#238](https://github.com/gitonomy/gitlib/pull/238))
 -   Remove `Gitonomy\Git\Util\StringHelper`, replaced by `symfony/string`, and its configurable
     encoding: gitlib reads everything in UTF-8. ([#252](https://github.com/gitonomy/gitlib/pull/252))
 -   Require git 1.8.4 or later, the oldest version the test suite passes with: it simplifies the
@@ -53,7 +54,8 @@ the deprecations of 1.7 first, then see [UPGRADE-2.0.md](UPGRADE-2.0.md).
     with both drivers: the name of a remote branch alone, like `feature` for `origin/feature`,
     created the local branch. Use `checkoutNewBranch()`.
     ([#254](https://github.com/gitonomy/gitlib/pull/254))
--   Remove the API that 1.7 deprecates; see [UPGRADE-2.0.md](UPGRADE-2.0.md):
+-   Remove the API that 1.7 deprecates
+    ([#271](https://github.com/gitonomy/gitlib/pull/271)); see [UPGRADE-2.0.md](UPGRADE-2.0.md):
     -   `Admin`, replaced by the static methods of `Repository`, and `Repository::cloneTo()`,
         replaced by `cloneFrom()` and `cloneBareFrom()`.
     -   The array of options of `Repository` (`working_dir`, `logger`, `command`,
@@ -79,6 +81,15 @@ the deprecations of 1.7 first, then see [UPGRADE-2.0.md](UPGRADE-2.0.md).
     -   `Commit::getShortMessage()` and `getFixedShortHash()`, `Repository::shell()`,
         `PushReference::getReference()`, `getRevision()`, `isCreate()` and `isDelete()`.
     -   `Repository::getSize()`, in kilobytes: use `getSizeInBytes()`.
+-   Make `Parser\DiffParser` and `Parser\ParserBase` internal, like the other parsers: parse a
+    diff with `Diff::parse()`.
+    ([#274](https://github.com/gitonomy/gitlib/pull/274))
+-   `Log::getIterator()` returns a `\Traversable` instead of an `\ArrayIterator`: iterate the
+    log, or use `getCommits()`.
+    ([#274](https://github.com/gitonomy/gitlib/pull/274))
+-   Run git in English with `CliDriver` (`LANGUAGE=C`), unless its `environmentVariables` set
+    `LANGUAGE`: gitlib reads messages of git, see the bug fixes.
+    ([#274](https://github.com/gitonomy/gitlib/pull/274))
 
 ### Features
 
@@ -132,7 +143,7 @@ the deprecations of 1.7 first, then see [UPGRADE-2.0.md](UPGRADE-2.0.md).
 
 ### Security
 
-1.7.1 has those that break nothing of 1.x: see
+1.7.2 has those that break nothing of 1.x: see
 [its changelog](https://github.com/gitonomy/gitlib/blob/1.x/CHANGELOG.md).
 
 -   Refuse a revision, a reference, a hash or a URL starting with a dash, which git read as an
@@ -149,13 +160,16 @@ the deprecations of 1.7 first, then see [UPGRADE-2.0.md](UPGRADE-2.0.md).
     ([#254](https://github.com/gitonomy/gitlib/pull/254), [#263](https://github.com/gitonomy/gitlib/pull/263))
 -   Refuse an ssh URL whose host or user starts with a dash, even encoded (`%2D`), like
     `ssh://-oProxyCommand=.../repository`: git before 2.14.1 passes it to ssh, which reads it as an
-    option and runs the command (CVE-2017-1000117). A `git://` URL whose host starts with a dash
-    is refused too: git passes it to the command of `core.gitProxy`.
-    ([#254](https://github.com/gitonomy/gitlib/pull/254))
+    option and runs the command (CVE-2017-1000117). A `git://` URL whose host or port starts with
+    a dash is refused too: git passes them to the command of `core.gitProxy`.
+    ([#254](https://github.com/gitonomy/gitlib/pull/254),
+    [#274](https://github.com/gitonomy/gitlib/pull/274))
 -   Hide the credentials of URLs (`https://user:token@host`), a password holding a `#` or a `?`
     included, in the messages of exceptions, in their traces (`#[\SensitiveParameter]`), and in
-    the logs. The exceptions of Symfony Process, which hold the command line, no longer leak, not
-    even as the previous exception. ([#254](https://github.com/gitonomy/gitlib/pull/254))
+    the logs, and those git prints without their scheme (`user:token@host`). The exceptions of
+    Symfony Process, which hold the command line, no longer leak, not even as the previous
+    exception. ([#254](https://github.com/gitonomy/gitlib/pull/254),
+    [#272](https://github.com/gitonomy/gitlib/pull/272))
 -   Refuse a hook name that isn't the one of a file of the hooks directory:
     `Hooks::set('../config', ...)` and `remove('../config')` wrote and deleted the
     configuration of the repository. ([#254](https://github.com/gitonomy/gitlib/pull/254))
@@ -183,6 +197,26 @@ the deprecations of 1.7 first, then see [UPGRADE-2.0.md](UPGRADE-2.0.md).
 
 ### Bug fixes
 
+-   Fix a translated git adding a branch to `Commit::getIncludingBranches()` on a detached HEAD,
+    in Chinese, and hiding the error of git from the message of a `ProcessException`, in French,
+    German and others: `CliDriver` runs git with `LANGUAGE=C`.
+    ([#274](https://github.com/gitonomy/gitlib/pull/274))
+-   Fix the parents of the commits a shallow clone cuts the history at: `Commit::getParents()`
+    returned commits the repository doesn't have, and `Commit::getDiff()` threw. They have no
+    parent, like in `git log`.
+    ([#274](https://github.com/gitonomy/gitlib/pull/274))
+-   Fix a missing git binary taken for a failure of git on Windows: `isValidRepository()`
+    returned `false`, instead of throwing a `DriverException`.
+    ([#274](https://github.com/gitonomy/gitlib/pull/274))
+-   Fix `WorkingCopy::getUntrackedFiles()` returning the former name of a staged rename.
+    ([#274](https://github.com/gitonomy/gitlib/pull/274))
+-   Fix a hash followed by a new line read as a hash by `Repository::getCommit()`, `getTree()`,
+    `getBlob()` and `ReferenceBag::resolve()`.
+    ([#274](https://github.com/gitonomy/gitlib/pull/274))
+-   Fix the tags of other tools throwing, with headers after their tagger, or without the empty
+    line before their message, and the mode of a file in a tree old versions of git wrote, like
+    `100664`: it is `100644` or `100755`, like `git ls-tree` prints it.
+    ([#274](https://github.com/gitonomy/gitlib/pull/274))
 -   Fix `Commit::getIncludingBranches()` and `Repository::getHead()` throwing for a branch another
     process created or checked out since gitlib read the references, and
     `getIncludingBranches()` throwing for a regular `refs/remotes/origin/HEAD`, as a mirror leaves
@@ -272,6 +306,14 @@ the deprecations of 1.7 first, then see [UPGRADE-2.0.md](UPGRADE-2.0.md).
 
 ### Minor
 
+-   `GitExceptionInterface` extends `\Throwable`. `ReferenceBag::resolve()`, `resolveBranches()`
+    and `resolveTags()` take any revision, a branch for instance. `Blob::getMimetype()` throws a
+    `RuntimeException` without the fileinfo extension, instead of an `Error`.
+    ([#274](https://github.com/gitonomy/gitlib/pull/274))
+-   CI also runs every week, with `symfony/process` 7.4, with the lowest dependencies and
+    libgit2, on the next version of PHP, which may fail, and on macOS and Windows. The tests call
+    every method of the drivers with the arguments they must refuse.
+    ([#274](https://github.com/gitonomy/gitlib/pull/274))
 -   CI tests git 1.8.4 and 2.25.1, analyses the tests and the libgit2 driver with PHPStan,
     without baseline, checks the archive Composer installs, pins the third-party actions by
     commit, and the suite deletes what it creates, in any order.