From 9ad2c169fb974ec8b8e7758407bdbb1555300950 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Wed, 26 Aug 2026 06:52:53 +0000
Subject: [PATCH 1/2] Fix cargo-audit findings by upgrading h2 and git2

Bump the transitive h2 crate to 0.4.19 to close RUSTSEC-2026-0258
(unbounded empty DATA frames). Upgrade git2 to 0.21 so the unsound
Remote::list and BlameHunk Signature APIs are patched, and adapt
callers to the 0.21 string-accessor Result types.

Co-authored-by: Ibrahim Rahhal <ibrahim.rahhal3636@gmail.com>
---
 Cargo.lock           | 13 ++++++-------
 Cargo.toml           |  2 +-
 src/targets.rs       |  2 +-
 src/utils/generic.rs |  4 ++--
 4 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 01cfc31..56f8f42 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -741,15 +741,14 @@ checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
 
 [[package]]
 name = "git2"
-version = "0.20.4"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b88256088d75a56f8ecfa070513a775dd9107f6530ef14919dac831af9cfe2b"
+checksum = "ddddbf932745a6be37109b6112d3ee09696106f848449069d3a57bba937ab82e"
 dependencies = [
  "bitflags",
  "libc",
  "libgit2-sys",
  "log",
- "url",
 ]
 
 [[package]]
@@ -767,9 +766,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.12"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c0b69cfcb4e1b9f1bf2f53f95f766e4661169728ec61cd3fe5a0166f2d1386"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1201,9 +1200,9 @@ checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
 
 [[package]]
 name = "libgit2-sys"
-version = "0.18.3+1.9.2"
+version = "0.18.8+1.9.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9b3acc4b91781bb0b3386669d325163746af5f6e4f73e6d2d630e09a35f3487"
+checksum = "7f7c568b25d7489bc3fb2988ed69ab111d2944d2f5fec3d5c987fe545ea97b50"
 dependencies = [
  "cc",
  "libc",
diff --git a/Cargo.toml b/Cargo.toml
index 9c74641..432b1e0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -45,7 +45,7 @@ quick-xml = "0.41"
 ignore = "0.4"
 globset = "0.4"
 termcolor = "1.1"
-git2 = { version = "0.20.4", default-features = false }
+git2 = { version = "0.21", default-features = false }
 regex = "1"
 chrono = "0.4"
 tokio = { version = "1.0", features = ["full"] }
diff --git a/src/targets.rs b/src/targets.rs
index 09dc283..1380722 100644
--- a/src/targets.rs
+++ b/src/targets.rs
@@ -342,7 +342,7 @@ fn get_git_untracked_files(repo_root: &Path) -> Result<Vec<PathBuf>, String> {
     for entry in statuses.iter() {
         let status = entry.status();
         if status.is_wt_new() && !status.is_ignored() {
-            if let Some(path) = entry.path() {
+            if let Ok(path) = entry.path() {
                 files.push(PathBuf::from(path));
             }
         }
diff --git a/src/utils/generic.rs b/src/utils/generic.rs
index 82ab212..62f599e 100644
--- a/src/utils/generic.rs
+++ b/src/utils/generic.rs
@@ -341,7 +341,7 @@ fn get_repo_info_inner(dir: &str, sample_dirty: bool) -> Result<Option<RepoInfo>
 
     let branch = repo.head().ok().and_then(|head| {
         if head.is_branch() {
-            head.shorthand().map(|s| s.to_string())
+            head.shorthand().ok().map(|s| s.to_string())
         } else {
             None
         }
@@ -432,7 +432,7 @@ pub fn reconcile_repo_info_for_upload(
 fn origin_url(repo: &Repository) -> Option<String> {
     repo.find_remote("origin")
         .ok()
-        .and_then(|remote| remote.url().map(|url| url.to_string()))
+        .and_then(|remote| remote.url().ok().map(|url| url.to_string()))
 }
 
 /// The enclosing repository's `origin` remote URL, searched upward from the

From 7c66a7351b8f41fb827560ca55aee1ed558b618f Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Wed, 26 Aug 2026 06:57:28 +0000
Subject: [PATCH 2/2] Add a git:untracked unit test covering git2 0.21
 StatusEntry::path

git2 0.21 changed StatusEntry::path from Option to Result. Exercise the
untracked-file listing path so that API change stays covered.

Co-authored-by: Ibrahim Rahhal <ibrahim.rahhal3636@gmail.com>
---
 src/targets.rs | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/targets.rs b/src/targets.rs
index 1380722..9c05f3b 100644
--- a/src/targets.rs
+++ b/src/targets.rs
@@ -570,6 +570,17 @@ mod tests {
         dir
     }
 
+    #[test]
+    fn git_untracked_files_lists_worktree_paths() {
+        let dir = setup_test_dir();
+        let files = get_git_untracked_files(dir.path()).expect("untracked listing");
+        let names: Vec<_> = files
+            .iter()
+            .filter_map(|p| p.file_name().and_then(|n| n.to_str()))
+            .collect();
+        assert!(names.contains(&"config.toml"), "{names:?}");
+    }
+
     #[test]
     fn build_exclude_glob_set_returns_none_for_none() {
         let result = build_exclude_glob_set(None).unwrap();