{"old": "/home/jenkins/agent/workspace/multiarch/src-openeuler/x86-64/python-dulwich/old_rpms/", "new": "/home/jenkins/agent/workspace/multiarch/src-openeuler/x86-64/python-dulwich/new_rpms/", "compare_result": "not pass", "compare_details": {"same": {"same_details": {"old": [], "new": []}, "same_num": 0}, "diff": {"diff_details": {"python3-dulwich": {"name": {"old": "python3-dulwich-1.2.7-1.oe1.x86_64.rpm", "new": "python3-dulwich-1.2.10-1.oe1.x86_64.rpm"}, "RPM Level": "level4", "rpm requires": {}, "rpm provides": {}, "rpm files": {}, "rpm cmd": {}}}, "diff_num": 1}, "less": {"less_details": {}, "less_num": 0}, "more": {"more_details": {}, "more_num": 0}}, "pr_link": "https://gitcode.com/src-openeuler/python-dulwich/pull/54", "pr_changelog": "* Tue Jul 07 2026 wanggang <wanggang1@kylinos.cn> - 1.2.10-1\n- update version to 1.2.10\n- Reject checkout paths whose leading component is a DOS drive-letter prefix on Windows (e.g. C:), which os.path.join would otherwise treat as absolute and let a crafted tree write outside the work tree. (reported by Luke Baton)\n- Bound zlib decompression of pack entries and loose objects against decompression-bomb DoS. read_zlib_chunks now caps the inflated size at the declared decomp_len, and loose-object parsing accepts max_size defaulting to git's core.bigFileThreshold (512 MiB). (reported by Luke Bento)\n- Reject OFS_DELTA pack entries whose delta_base_offset is zero. Such an entry references itself, so Pack.resolve_object would loop forever growing its delta stack until OOM. (reported by Luke Banto)\n- Bound Transfer-Encoding: chunked request bodies in dulwich.web: strip chunk extensions, reject negative sizes, enforce per-chunk and per-request size limits, and cap requests that omit Content-Length.\n- Bound the running length when decoding EWAH bitmaps so a corrupt or malformed .bitmap index raises ValueError instead of hanging in an unbounded loop that exhausts memory.\n- Enumerate the objects to push before the HTTP git-receive-pack request body starts streaming. `generate_pack_data` previously ran lazily inside the body generator, after the header pkt-lines were already on the wire, so on large repositories the request stalled mid-body while objects were counted and servers such as GitHub aborted the push with a timeout / broken pipe.\n- Replace a symlink left at the target path with a fresh regular file in build_file_from_blob instead of writing through it, matching git on checkout.\n- Raise GitProtocolError carrying the server's message when the fetch/send-pack tail loop sees a fatal side-band channel (\\x03), instead of crashing with `AssertionError: Invalid sideband channel 3` and swallowing the server's error text.\n- Use ThreadingHTTPServer and advertise HTTP/1.1 in lfs_server so urllib3's keep-alive pool doesn't race a torn-down connection into RemoteDisconnected.\n"}