From c4a08102a4f3edf01cc56bc012f05c5194dd10ef Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Fri, 29 May 2026 11:45:13 +0200 Subject: [PATCH] package/libgit2: add CPE vendor The CPE "cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:*" is valid for this package. The previous CPE hasn't been used since 2016 while the new one has 10 new CVEs assigned to it. See the GHSA [1] and the associated CVE [2]. [1] https://github.com/libgit2/libgit2/security/advisories/GHSA-j2v7-4f6v-gpg8 [2] https://nvd.nist.gov/vuln/detail/cve-2024-24577 Signed-off-by: Thomas Perale Signed-off-by: Peter Korsgaard (cherry picked from commit e166708e1e686491d5555578380a2923e21f6c28) Signed-off-by: Thomas Perale --- package/libgit2/libgit2.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package/libgit2/libgit2.mk b/package/libgit2/libgit2.mk index 34cb67929e..02af500a65 100644 --- a/package/libgit2/libgit2.mk +++ b/package/libgit2/libgit2.mk @@ -15,7 +15,7 @@ LIBGIT2_LICENSE = \ BSD-2-Clause (basename_r), \ LGPL-2.1+ (libxdiff) LIBGIT2_LICENSE_FILES = COPYING -LIBGIT2_CPE_ID_VALID = YES +LIBGIT2_CPE_ID_VENDOR = libgit2 LIBGIT2_INSTALL_STAGING = YES LIBGIT2_CONF_OPTS = \