Adding debian version 1:2.45.2-1.debian/1%2.45.2-1debian

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

11 files changed, 181 insertions, 824 deletions

diff --git a/debian/changelog b/debian/changelog
index 17cb1e7..51ad072 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+git (1:2.45.2-1) unstable; urgency=low
+
+  * new upstream point release (see RelNotes/2.45.2.txt).
+  * debian/patches/*: remove; applied upstream.
+
+ -- Jonathan Nieder <jrnieder@gmail.com>  Sun, 16 Jun 2024 15:40:09 +0000
+
 git (1:2.45.1-1) unstable; urgency=medium
 
   * new upstream release (see RelNotes/2.44.0.txt, RelNotes/2.45.0.txt).
diff --git a/debian/changelog.upstream b/debian/changelog.upstream
index 2342f06..d8b1659 100644
--- a/debian/changelog.upstream
+++ b/debian/changelog.upstream
@@ -1,3 +1,26 @@
+Version v2.45.2; changes since v2.45.1:
+---------------------------------------
+
+Jeff King (5):
+      send-email: drop FakeTerm hack
+      send-email: avoid creating more than one Term::ReadLine object
+      ci: drop mention of BREW_INSTALL_PACKAGES variable
+      ci: avoid bare "gcc" for osx-gcc job
+      ci: stop installing "gcc-13" for osx-gcc
+
+Johannes Schindelin (6):
+      hook: plug a new memory leak
+      init: use the correct path of the templates directory again
+      Revert "core.hooksPath: add some protection while cloning"
+      tests: verify that `clone -c core.hooksPath=/dev/null` works again
+      clone: drop the protections where hooks aren't run
+      Revert "Add a helper function to compare file contents"
+
+Junio C Hamano (2):
+      Revert "fsck: warn about symlink pointing inside a gitdir"
+      Git 2.39.5
+
+
 Version v2.45.1; changes since v2.45.0:
 ---------------------------------------
 
@@ -175,7 +198,7 @@ Yehezkel Bernat (1):
       t9604: Fix test for musl libc and new Debian
 
 
-Version v2.45.0-rc0; changes since v2.44.1:
+Version v2.45.0-rc0; changes since v2.44.2:
 -------------------------------------------
 
 Ahelenia Ziemiańska (1):
@@ -772,6 +795,29 @@ shejialuo (1):
       t9117: prefer test_path_* helper functions
 
 
+Version v2.44.2; changes since v2.44.1:
+---------------------------------------
+
+Jeff King (5):
+      send-email: drop FakeTerm hack
+      send-email: avoid creating more than one Term::ReadLine object
+      ci: drop mention of BREW_INSTALL_PACKAGES variable
+      ci: avoid bare "gcc" for osx-gcc job
+      ci: stop installing "gcc-13" for osx-gcc
+
+Johannes Schindelin (6):
+      hook: plug a new memory leak
+      init: use the correct path of the templates directory again
+      Revert "core.hooksPath: add some protection while cloning"
+      tests: verify that `clone -c core.hooksPath=/dev/null` works again
+      clone: drop the protections where hooks aren't run
+      Revert "Add a helper function to compare file contents"
+
+Junio C Hamano (2):
+      Revert "fsck: warn about symlink pointing inside a gitdir"
+      Git 2.39.5
+
+
 Version v2.44.1; changes since v2.44.0:
 ---------------------------------------
 
@@ -966,7 +1012,7 @@ Victoria Dye (1):
       ref-filter.c: sort formatted dates by byte value
 
 
-Version v2.44.0-rc0; changes since v2.43.4:
+Version v2.44.0-rc0; changes since v2.43.5:
 -------------------------------------------
 
 Achu Luma (2):
@@ -1315,6 +1361,29 @@ Zach FettersMoore (1):
       subtree: fix split processing with multiple subtrees present
 
 
+Version v2.43.5; changes since v2.43.4:
+---------------------------------------
+
+Jeff King (5):
+      send-email: drop FakeTerm hack
+      send-email: avoid creating more than one Term::ReadLine object
+      ci: drop mention of BREW_INSTALL_PACKAGES variable
+      ci: avoid bare "gcc" for osx-gcc job
+      ci: stop installing "gcc-13" for osx-gcc
+
+Johannes Schindelin (6):
+      hook: plug a new memory leak
+      init: use the correct path of the templates directory again
+      Revert "core.hooksPath: add some protection while cloning"
+      tests: verify that `clone -c core.hooksPath=/dev/null` works again
+      clone: drop the protections where hooks aren't run
+      Revert "Add a helper function to compare file contents"
+
+Junio C Hamano (2):
+      Revert "fsck: warn about symlink pointing inside a gitdir"
+      Git 2.39.5
+
+
 Version v2.43.4; changes since v2.43.3:
 ---------------------------------------
 
@@ -1763,7 +1832,7 @@ brian m. carlson (1):
       merge-file: add an option to process object IDs
 
 
-Version v2.43.0-rc0; changes since v2.42.2:
+Version v2.43.0-rc0; changes since v2.42.3:
 -------------------------------------------
 
 Alyssa Ross (1):
@@ -2159,6 +2228,29 @@ brian m. carlson (1):
       doc: correct the 50 characters soft limit (+)
 
 
+Version v2.42.3; changes since v2.42.2:
+---------------------------------------
+
+Jeff King (5):
+      send-email: drop FakeTerm hack
+      send-email: avoid creating more than one Term::ReadLine object
+      ci: drop mention of BREW_INSTALL_PACKAGES variable
+      ci: avoid bare "gcc" for osx-gcc job
+      ci: stop installing "gcc-13" for osx-gcc
+
+Johannes Schindelin (6):
+      hook: plug a new memory leak
+      init: use the correct path of the templates directory again
+      Revert "core.hooksPath: add some protection while cloning"
+      tests: verify that `clone -c core.hooksPath=/dev/null` works again
+      clone: drop the protections where hooks aren't run
+      Revert "Add a helper function to compare file contents"
+
+Junio C Hamano (2):
+      Revert "fsck: warn about symlink pointing inside a gitdir"
+      Git 2.39.5
+
+
 Version v2.42.2; changes since v2.42.1:
 ---------------------------------------
 
@@ -2477,7 +2569,7 @@ brian m. carlson (2):
       gitignore: ignore clangd .cache directory
 
 
-Version v2.42.0-rc0; changes since v2.41.1:
+Version v2.42.0-rc0; changes since v2.41.2:
 -------------------------------------------
 
 Alejandro R. Sedeño (1):
@@ -2965,6 +3057,29 @@ brian m. carlson (7):
       var: add config file locations
 
 
+Version v2.41.2; changes since v2.41.1:
+---------------------------------------
+
+Jeff King (5):
+      send-email: drop FakeTerm hack
+      send-email: avoid creating more than one Term::ReadLine object
+      ci: drop mention of BREW_INSTALL_PACKAGES variable
+      ci: avoid bare "gcc" for osx-gcc job
+      ci: stop installing "gcc-13" for osx-gcc
+
+Johannes Schindelin (6):
+      hook: plug a new memory leak
+      init: use the correct path of the templates directory again
+      Revert "core.hooksPath: add some protection while cloning"
+      tests: verify that `clone -c core.hooksPath=/dev/null` works again
+      clone: drop the protections where hooks aren't run
+      Revert "Add a helper function to compare file contents"
+
+Junio C Hamano (2):
+      Revert "fsck: warn about symlink pointing inside a gitdir"
+      Git 2.39.5
+
+
 Version v2.41.1; changes since v2.41.0:
 ---------------------------------------
 
@@ -3113,7 +3228,7 @@ brian m. carlson (1):
       upload-pack: advertise capabilities when cloning empty repos
 
 
-Version v2.41.0-rc0; changes since v2.40.2:
+Version v2.41.0-rc0; changes since v2.40.3:
 -------------------------------------------
 
 Adam Johnson (1):
@@ -3700,6 +3815,29 @@ ZheNing Hu (2):
       branch, for-each-ref, tag: add option to omit empty lines
 
 
+Version v2.40.3; changes since v2.40.2:
+---------------------------------------
+
+Jeff King (5):
+      send-email: drop FakeTerm hack
+      send-email: avoid creating more than one Term::ReadLine object
+      ci: drop mention of BREW_INSTALL_PACKAGES variable
+      ci: avoid bare "gcc" for osx-gcc job
+      ci: stop installing "gcc-13" for osx-gcc
+
+Johannes Schindelin (6):
+      hook: plug a new memory leak
+      init: use the correct path of the templates directory again
+      Revert "core.hooksPath: add some protection while cloning"
+      tests: verify that `clone -c core.hooksPath=/dev/null` works again
+      clone: drop the protections where hooks aren't run
+      Revert "Add a helper function to compare file contents"
+
+Junio C Hamano (2):
+      Revert "fsck: warn about symlink pointing inside a gitdir"
+      Git 2.39.5
+
+
 Version v2.40.2; changes since v2.40.1:
 ---------------------------------------
 
@@ -3929,7 +4067,7 @@ idriss fekir (1):
       trace.c, git.c: remove unnecessary parameter to trace_repo_setup()
 
 
-Version v2.40.0-rc0; changes since v2.39.4:
+Version v2.40.0-rc0; changes since v2.39.5:
 -------------------------------------------
 
 Adam Szkoda (1):
@@ -4337,6 +4475,29 @@ ZheNing Hu (1):
       date.c: allow ISO 8601 reduced precision times
 
 
+Version v2.39.5; changes since v2.39.4:
+---------------------------------------
+
+Jeff King (5):
+      send-email: drop FakeTerm hack
+      send-email: avoid creating more than one Term::ReadLine object
+      ci: drop mention of BREW_INSTALL_PACKAGES variable
+      ci: avoid bare "gcc" for osx-gcc job
+      ci: stop installing "gcc-13" for osx-gcc
+
+Johannes Schindelin (6):
+      hook: plug a new memory leak
+      init: use the correct path of the templates directory again
+      Revert "core.hooksPath: add some protection while cloning"
+      tests: verify that `clone -c core.hooksPath=/dev/null` works again
+      clone: drop the protections where hooks aren't run
+      Revert "Add a helper function to compare file contents"
+
+Junio C Hamano (2):
+      Revert "fsck: warn about symlink pointing inside a gitdir"
+      Git 2.39.5
+
+
 Version v2.39.4; changes since v2.39.3:
 ---------------------------------------
 
diff --git a/debian/patches/0001-hook-plug-a-new-memory-leak.diff b/debian/patches/0001-hook-plug-a-new-memory-leak.diff
deleted file mode 100644
index ab74831..0000000
--- a/debian/patches/0001-hook-plug-a-new-memory-leak.diff
+++ /dev/null
@@ -1,34 +0,0 @@
-From 94f95a123b10f3837e181ad93b81f1a4f53bb8fc Mon Sep 17 00:00:00 2001
-From: Johannes Schindelin <johannes.schindelin@gmx.de>
-Date: Sat, 18 May 2024 10:32:39 +0000
-Subject: hook: plug a new memory leak
-
-commit 2811ce3a79dc8a0105a6defb59718b35f5b397aa upstream.
-
-In 8db1e8743c0 (clone: prevent hooks from running during a clone,
-2024-03-28), I introduced an inadvertent memory leak that was
-unfortunately not caught before v2.45.1 was released. Here is a fix.
-
-Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
-Signed-off-by: Junio C Hamano <gitster@pobox.com>
-Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
----
- hook.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/hook.c b/hook.c
-index eebc4d44734..8de469b134a 100644
---- a/hook.c
-+++ b/hook.c
-@@ -26,8 +26,10 @@ static int identical_to_template_hook(const char *name, const char *path)
- 		found_template_hook = access(template_path.buf, X_OK) >= 0;
- 	}
- #endif
--	if (!found_template_hook)
-+	if (!found_template_hook) {
-+		strbuf_release(&template_path);
- 		return 0;
-+	}
- 
- 	ret = do_files_match(template_path.buf, path);
- 
diff --git a/debian/patches/0002-Revert-core.hooksPath-add-some-protection-while-cloni.diff b/debian/patches/0002-Revert-core.hooksPath-add-some-protection-while-cloni.diff
deleted file mode 100644
index 8e1c975..0000000
--- a/debian/patches/0002-Revert-core.hooksPath-add-some-protection-while-cloni.diff
+++ /dev/null
@@ -1,82 +0,0 @@
-From 7db946419c29e185f1cc6e544cfb47b442019ac7 Mon Sep 17 00:00:00 2001
-From: Johannes Schindelin <johannes.schindelin@gmx.de>
-Date: Sat, 18 May 2024 10:32:41 +0000
-Subject: Revert "core.hooksPath: add some protection while cloning"
-
-commit f13e8e2ea56ceef593311b3cff1ba7ba1a493682 upstream.
-
-This defense-in-depth was intended to protect the clone operation
-against future escalations where bugs in `git clone` would allow
-attackers to write arbitrary files in the `.git/` directory would allow
-for Remote Code Execution attacks via maliciously-placed hooks.
-
-However, it turns out that the `core.hooksPath` protection has
-unintentional side effects so severe that they do not justify the
-benefit of the protections. For example, it has been reported in
-https://lore.kernel.org/git/FAFA34CB-9732-4A0A-87FB-BDB272E6AEE8@alchemists.io/
-that the following invocation, which is intended to make `git clone`
-safer, is itself broken by that protective measure:
-
-	git clone --config core.hooksPath=/dev/null <url>
-
-Since it turns out that the benefit does not justify the cost, let's revert
-20f3588efc6 (core.hooksPath: add some protection while cloning,
-2024-03-30).
-
-Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
-Signed-off-by: Junio C Hamano <gitster@pobox.com>
-Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
----
- config.c        | 13 +------------
- t/t1800-hook.sh | 15 ---------------
- 2 files changed, 1 insertion(+), 27 deletions(-)
-
-diff --git a/config.c b/config.c
-index 77a0fd2d80e..ae3652b08fa 100644
---- a/config.c
-+++ b/config.c
-@@ -1416,19 +1416,8 @@ static int git_default_core_config(const char *var, const char *value,
- 	if (!strcmp(var, "core.attributesfile"))
- 		return git_config_pathname(&git_attributes_file, var, value);
- 
--	if (!strcmp(var, "core.hookspath")) {
--		if (ctx->kvi && ctx->kvi->scope == CONFIG_SCOPE_LOCAL &&
--		    git_env_bool("GIT_CLONE_PROTECTION_ACTIVE", 0))
--			die(_("active `core.hooksPath` found in the local "
--			      "repository config:\n\t%s\nFor security "
--			      "reasons, this is disallowed by default.\nIf "
--			      "this is intentional and the hook should "
--			      "actually be run, please\nrun the command "
--			      "again with "
--			      "`GIT_CLONE_PROTECTION_ACTIVE=false`"),
--			    value);
-+	if (!strcmp(var, "core.hookspath"))
- 		return git_config_pathname(&git_hooks_path, var, value);
--	}
- 
- 	if (!strcmp(var, "core.bare")) {
- 		is_bare_repository_cfg = git_config_bool(var, value);
-diff --git a/t/t1800-hook.sh b/t/t1800-hook.sh
-index 1894ebeb0e8..8b0234cf2d5 100755
---- a/t/t1800-hook.sh
-+++ b/t/t1800-hook.sh
-@@ -185,19 +185,4 @@ test_expect_success 'stdin to hooks' '
- 	test_cmp expect actual
- '
- 
--test_expect_success 'clone protections' '
--	test_config core.hooksPath "$(pwd)/my-hooks" &&
--	mkdir -p my-hooks &&
--	write_script my-hooks/test-hook <<-\EOF &&
--	echo Hook ran $1
--	EOF
--
--	git hook run test-hook 2>err &&
--	test_grep "Hook ran" err &&
--	test_must_fail env GIT_CLONE_PROTECTION_ACTIVE=true \
--		git hook run test-hook 2>err &&
--	test_grep "active .core.hooksPath" err &&
--	test_grep ! "Hook ran" err
--'
--
- test_done
diff --git a/debian/patches/0003-tests-verify-that-clone-c-core.hooksPath-dev-null-wor.diff b/debian/patches/0003-tests-verify-that-clone-c-core.hooksPath-dev-null-wor.diff
deleted file mode 100644
index 9a494d9..0000000
--- a/debian/patches/0003-tests-verify-that-clone-c-core.hooksPath-dev-null-wor.diff
+++ /dev/null
@@ -1,48 +0,0 @@
-From ce34e1b7a072db221190446e79cb373c7f6010a5 Mon Sep 17 00:00:00 2001
-From: Johannes Schindelin <johannes.schindelin@gmx.de>
-Date: Sat, 18 May 2024 10:32:42 +0000
-Subject: tests: verify that `clone -c core.hooksPath=/dev/null` works again
-
-commit a25a15726f4d1bf1c8362f1b3146096d6a87f965 upstream.
-
-As part of the protections added in Git v2.45.1 and friends,
-repository-local `core.hooksPath` settings are no longer allowed, as a
-defense-in-depth mechanism to prevent future Git vulnerabilities to
-raise to critical level if those vulnerabilities inadvertently allow the
-repository-local config to be written.
-
-What the added protection did not anticipate is that such a
-repository-local `core.hooksPath` can not only be used to point to
-maliciously-placed scripts in the current worktree, but also to
-_prevent_ hooks from being called altogether.
-
-We just reverted the `core.hooksPath` protections, based on the Git
-maintainer's recommendation in
-https://lore.kernel.org/git/xmqq4jaxvm8z.fsf@gitster.g/ to address this
-concern as well as related ones. Let's make sure that we won't regress
-while trying to protect the clone operation further.
-
-Reported-by: Brooke Kuhlmann <brooke@alchemists.io>
-Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
-Signed-off-by: Junio C Hamano <gitster@pobox.com>
-Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
----
- t/t1350-config-hooks-path.sh | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/t/t1350-config-hooks-path.sh b/t/t1350-config-hooks-path.sh
-index f6dc83e2aab..45a04929170 100755
---- a/t/t1350-config-hooks-path.sh
-+++ b/t/t1350-config-hooks-path.sh
-@@ -41,4 +41,11 @@ test_expect_success 'git rev-parse --git-path hooks' '
- 	test .git/custom-hooks/abc = "$(cat actual)"
- '
- 
-+test_expect_success 'core.hooksPath=/dev/null' '
-+	git clone -c core.hooksPath=/dev/null . no-templates &&
-+	value="$(git -C no-templates config --local core.hooksPath)" &&
-+	# The Bash used by Git for Windows rewrites `/dev/null` to `nul`
-+	{ test /dev/null = "$value" || test nul = "$value"; }
-+'
-+
- test_done
diff --git a/debian/patches/0004-hook-clone-protections-add-escape-hatch.diff b/debian/patches/0004-hook-clone-protections-add-escape-hatch.diff
deleted file mode 100644
index b2aa135..0000000
--- a/debian/patches/0004-hook-clone-protections-add-escape-hatch.diff
+++ /dev/null
@@ -1,182 +0,0 @@
-From 1f34eea689413fa10a664f4c154b097be7796b0a Mon Sep 17 00:00:00 2001
-From: Johannes Schindelin <johannes.schindelin@gmx.de>
-Date: Sat, 18 May 2024 10:32:43 +0000
-Subject: hook(clone protections): add escape hatch
-
-commit 85811d32aca9f0ba324a04bd8709c315d472efbe upstream.
-
-As defense-in-depth measures, v2.39.4 and friends leading up to v2.45.1
-introduced code that detects when hooks have been installed during a
-`git clone`, which is indicative of a common attack vector with critical
-severity that allows Remote Code Execution.
-
-There are legitimate use cases for such behavior, though, for example
-when those hooks stem from Git's own templates, which system
-administrators are at liberty to modify to enforce, say, commit message
-conventions. The git clone protections specifically add exceptions to
-allow for that.
-
-Another legitimate use case that has been identified too late to be
-handled in these security bug-fix versions is Git LFS: It behaves
-somewhat similar to common attack vectors by writing a few hooks while
-running the `smudge` filter during a regular clone, which means that Git
-has no chance to know that the hooks are benign and e.g. the
-`post-checkout` hook can be safely executed as part of the clone
-operation.
-
-To help Git LFS, and other tools behaving similarly (if there are any),
-let's add a new, multi-valued `safe.hook.sha256` config setting. Like
-the already-existing `safe.*` settings, it is ignored in
-repository-local configs, and it is interpreted as a list of SHA-256
-checksums of hooks' contents that are safe to execute during a clone
-operation. Future Git LFS versions will need to write those entries at
-the same time they install the `smudge`/`clean` filters.
-
-Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
-Signed-off-by: Junio C Hamano <gitster@pobox.com>
-Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
----
- Documentation/config/safe.txt |  6 +++
- hook.c                        | 69 ++++++++++++++++++++++++++++++++---
- t/t1800-hook.sh               | 15 ++++++++
- 3 files changed, 85 insertions(+), 5 deletions(-)
-
-diff --git a/Documentation/config/safe.txt b/Documentation/config/safe.txt
-index 577df40223a..e2eb4992bef 100644
---- a/Documentation/config/safe.txt
-+++ b/Documentation/config/safe.txt
-@@ -59,3 +59,9 @@ which id the original user has.
- If that is not what you would prefer and want git to only trust
- repositories that are owned by root instead, then you can remove
- the `SUDO_UID` variable from root's environment before invoking git.
-+
-+safe.hook.sha256::
-+	The value is the SHA-256 of hooks that are considered to be safe
-+	to run during a clone operation.
-++
-+Multiple values can be added via `git config --global --add`.
-diff --git a/hook.c b/hook.c
-index 8de469b134a..9eca6c0103a 100644
---- a/hook.c
-+++ b/hook.c
-@@ -10,6 +10,9 @@
- #include "environment.h"
- #include "setup.h"
- #include "copy.h"
-+#include "strmap.h"
-+#include "hash-ll.h"
-+#include "hex.h"
- 
- static int identical_to_template_hook(const char *name, const char *path)
- {
-@@ -37,11 +40,66 @@ static int identical_to_template_hook(const char *name, const char *path)
- 	return ret;
- }
- 
-+static struct strset safe_hook_sha256s = STRSET_INIT;
-+static int safe_hook_sha256s_initialized;
-+
-+static int get_sha256_of_file_contents(const char *path, char *sha256)
-+{
-+	struct strbuf sb = STRBUF_INIT;
-+	int fd;
-+	ssize_t res;
-+
-+	git_hash_ctx ctx;
-+	const struct git_hash_algo *algo = &hash_algos[GIT_HASH_SHA256];
-+	unsigned char hash[GIT_MAX_RAWSZ];
-+
-+	if ((fd = open(path, O_RDONLY)) < 0)
-+		return -1;
-+	res = strbuf_read(&sb, fd, 400);
-+	close(fd);
-+	if (res < 0)
-+		return -1;
-+
-+	algo->init_fn(&ctx);
-+	algo->update_fn(&ctx, sb.buf, sb.len);
-+	strbuf_release(&sb);
-+	algo->final_fn(hash, &ctx);
-+
-+	hash_to_hex_algop_r(sha256, hash, algo);
-+
-+	return 0;
-+}
-+
-+static int safe_hook_cb(const char *key, const char *value,
-+			const struct config_context *ctx UNUSED, void *d)
-+{
-+	struct strset *set = d;
-+
-+	if (value && !strcmp(key, "safe.hook.sha256"))
-+		strset_add(set, value);
-+
-+	return 0;
-+}
-+
-+static int is_hook_safe_during_clone(const char *name, const char *path, char *sha256)
-+{
-+	if (get_sha256_of_file_contents(path, sha256) < 0)
-+		return 0;
-+
-+	if (!safe_hook_sha256s_initialized) {
-+		safe_hook_sha256s_initialized = 1;
-+		git_protected_config(safe_hook_cb, &safe_hook_sha256s);
-+	}
-+
-+	return strset_contains(&safe_hook_sha256s, sha256);
-+}
-+
- const char *find_hook(const char *name)
- {
- 	static struct strbuf path = STRBUF_INIT;
- 
- 	int found_hook;
-+	char sha256[GIT_SHA256_HEXSZ + 1] = { '\0' };
- 
- 	strbuf_reset(&path);
- 	strbuf_git_path(&path, "hooks/%s", name);
-@@ -73,13 +131,14 @@ const char *find_hook(const char *name)
- 		return NULL;
- 	}
- 	if (!git_hooks_path && git_env_bool("GIT_CLONE_PROTECTION_ACTIVE", 0) &&
--	    !identical_to_template_hook(name, path.buf))
-+	    !identical_to_template_hook(name, path.buf) &&
-+	    !is_hook_safe_during_clone(name, path.buf, sha256))
- 		die(_("active `%s` hook found during `git clone`:\n\t%s\n"
- 		      "For security reasons, this is disallowed by default.\n"
--		      "If this is intentional and the hook should actually "
--		      "be run, please\nrun the command again with "
--		      "`GIT_CLONE_PROTECTION_ACTIVE=false`"),
--		    name, path.buf);
-+		      "If this is intentional and the hook is safe to run, "
-+		      "please run the following command and try again:\n\n"
-+		      "  git config --global --add safe.hook.sha256 %s"),
-+		    name, path.buf, sha256);
- 	return path.buf;
- }
- 
-diff --git a/t/t1800-hook.sh b/t/t1800-hook.sh
-index 8b0234cf2d5..cbdf60c451a 100755
---- a/t/t1800-hook.sh
-+++ b/t/t1800-hook.sh
-@@ -185,4 +185,19 @@ test_expect_success 'stdin to hooks' '
- 	test_cmp expect actual
- '
- 
-+test_expect_success '`safe.hook.sha256` and clone protections' '
-+	git init safe-hook &&
-+	write_script safe-hook/.git/hooks/pre-push <<-\EOF &&
-+	echo "called hook" >safe-hook.log
-+	EOF
-+
-+	test_must_fail env GIT_CLONE_PROTECTION_ACTIVE=true \
-+		git -C safe-hook hook run pre-push 2>err &&
-+	cmd="$(grep "git config --global --add safe.hook.sha256 [0-9a-f]" err)" &&
-+	eval "$cmd" &&
-+	GIT_CLONE_PROTECTION_ACTIVE=true \
-+		git -C safe-hook hook run pre-push &&
-+	test "called hook" = "$(cat safe-hook/safe-hook.log)"
-+'
-+
- test_done
diff --git a/debian/patches/0005-hooks-clone-protections-special-case-current-Git-LFS-.diff b/debian/patches/0005-hooks-clone-protections-special-case-current-Git-LFS-.diff
deleted file mode 100644
index bad67cd..0000000
--- a/debian/patches/0005-hooks-clone-protections-special-case-current-Git-LFS-.diff
+++ /dev/null
@@ -1,82 +0,0 @@
-From 09595d6984b41cbb6f653643f826fe009c56b493 Mon Sep 17 00:00:00 2001
-From: Johannes Schindelin <johannes.schindelin@gmx.de>
-Date: Sat, 18 May 2024 10:32:44 +0000
-Subject: hooks(clone protections): special-case current Git LFS hooks
-
-commit c65d0f9ee6894cdf7feeb51639870bfaf826c905 upstream.
-
-A notable regression in v2.45.1 and friends (all the way down to
-v2.39.4) has been that Git LFS-enabled clones error out with a message
-indicating that the `post-checkout` hook has been tampered with while
-cloning, and as a safety measure it is not executed.
-
-A generic fix for benign third-party applications wishing to write hooks
-during clone operations has been implemented in the parent of this
-commit: said applications are expected to add `safe.hook.sha256` values
-to a protected config.
-
-However, the current version of Git LFS, v3.5.1, cannot be adapted
-retroactively; Therefore, let's just hard-code the SHA-256 values for
-this version. That way, Git LFS usage will no longer be broken, and the
-next Git LFS version can be taught to add those `safe.hook.sha256`
-entries.
-
-Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
-Signed-off-by: Junio C Hamano <gitster@pobox.com>
-Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
----
- hook.c          | 11 +++++++++++
- t/t1800-hook.sh | 20 ++++++++++++++++++++
- 2 files changed, 31 insertions(+)
-
-diff --git a/hook.c b/hook.c
-index 9eca6c0103a..fc0548edb66 100644
---- a/hook.c
-+++ b/hook.c
-@@ -88,6 +88,17 @@ static int is_hook_safe_during_clone(const char *name, const char *path, char *s
- 
- 	if (!safe_hook_sha256s_initialized) {
- 		safe_hook_sha256s_initialized = 1;
-+
-+		/* Hard-code known-safe values for Git LFS v3.4.0..v3.5.1 */
-+		/* pre-push */
-+		strset_add(&safe_hook_sha256s, "df5417b2daa3aa144c19681d1e997df7ebfe144fb7e3e05138bd80ae998008e4");
-+		/* post-checkout */
-+		strset_add(&safe_hook_sha256s, "791471b4ff472aab844a4fceaa48bbb0a12193616f971e8e940625498b4938a6");
-+		/* post-commit */
-+		strset_add(&safe_hook_sha256s, "21e961572bb3f43a5f2fbafc1cc764d86046cc2e5f0bbecebfe9684a0b73b664");
-+		/* post-merge */
-+		strset_add(&safe_hook_sha256s, "75da0da66a803b4b030ad50801ba57062c6196105eb1d2251590d100edb9390b");
-+
- 		git_protected_config(safe_hook_cb, &safe_hook_sha256s);
- 	}
- 
-diff --git a/t/t1800-hook.sh b/t/t1800-hook.sh
-index cbdf60c451a..c51be5f7a06 100755
---- a/t/t1800-hook.sh
-+++ b/t/t1800-hook.sh
-@@ -200,4 +200,24 @@ test_expect_success '`safe.hook.sha256` and clone protections' '
- 	test "called hook" = "$(cat safe-hook/safe-hook.log)"
- '
- 
-+write_lfs_pre_push_hook () {
-+	write_script "$1" <<-\EOF
-+	command -v git-lfs >/dev/null 2>&1 || { echo >&2 "\nThis repository is configured for Git LFS but 'git-lfs' was not found on your path. If you no longer wish to use Git LFS, remove this hook by deleting the 'pre-push' file in the hooks directory (set by 'core.hookspath'; usually '.git/hooks').\n"; exit 2; }
-+	git lfs pre-push "$@"
-+	EOF
-+}
-+
-+test_expect_success 'Git LFS special-handling in clone protections' '
-+	git init lfs-hooks &&
-+	write_lfs_pre_push_hook lfs-hooks/.git/hooks/pre-push &&
-+	write_script git-lfs <<-\EOF &&
-+	echo "called $*" >fake-git-lfs.log
-+	EOF
-+
-+	PATH="$PWD:$PATH" GIT_CLONE_PROTECTION_ACTIVE=true \
-+		git -C lfs-hooks hook run pre-push &&
-+	test_write_lines "called pre-push" >expect &&
-+	test_cmp lfs-hooks/fake-git-lfs.log expect
-+'
-+
- test_done
diff --git a/debian/patches/0006-hooks-clone-protections-simplify-templates-hooks-vali.diff b/debian/patches/0006-hooks-clone-protections-simplify-templates-hooks-vali.diff
deleted file mode 100644
index a0642e3..0000000
--- a/debian/patches/0006-hooks-clone-protections-simplify-templates-hooks-vali.diff
+++ /dev/null
@@ -1,198 +0,0 @@
-From 8813bb5f4109991b88c98584a4abbb2d06cfbc28 Mon Sep 17 00:00:00 2001
-From: Johannes Schindelin <johannes.schindelin@gmx.de>
-Date: Sat, 18 May 2024 10:32:45 +0000
-Subject: hooks(clone protections): simplify templates hooks validation
-
-commit eff37e9b1dec25a3e1297eb89a36d8e68fe01b40 upstream.
-
-When an active hook is encountered during a clone operation, to protect
-against Remote Code Execution attack vectors, Git checks whether the
-hook was copied over from the templates directory.
-
-When that logic was introduced, there was no other way to check this
-than to add a function to compare files.
-
-In the meantime, we've added code to compute the SHA-256 checksum of a
-given hook and compare that checksum against a list of known-safe ones.
-
-Let's simplify the logic by adding to said list when copying the
-templates' hooks.
-
-We need to be careful to support multi-process operations such as
-recursive submodule clones: In such a scenario, the list of SHA-256
-checksums that is kept in memory is not enough, we also have to pass the
-information down to child processes via `GIT_CONFIG_PARAMETERS`.
-
-Extend the regression test in t5601 to ensure that recursive clones are
-handled as expected.
-
-Note: Technically there is no way that the checksums computed while
-initializing the submodules' gitdirs can be passed to the process that
-performs the checkout: For historical reasons, these operations are
-performed in processes spawned in separate loops from the
-super-project's `git clone` process. But since the templates from which
-the submodules are initialized are the very same as the ones from which
-the super-project is initialized, we can get away with using the list of
-SHA-256 checksums that is computed when initializing the super-project
-and passing that down to the `submodule--helper` processes that perform
-the recursive checkout.
-
-Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
-Signed-off-by: Junio C Hamano <gitster@pobox.com>
-Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
----
- hook.c           | 43 ++++++++++++++++---------------------------
- hook.h           | 10 ++++++++++
- setup.c          |  7 +++++++
- t/t5601-clone.sh | 19 +++++++++++++++++++
- 4 files changed, 52 insertions(+), 27 deletions(-)
-
-diff --git a/hook.c b/hook.c
-index fc0548edb66..8ac51c9912b 100644
---- a/hook.c
-+++ b/hook.c
-@@ -14,32 +14,6 @@
- #include "hash-ll.h"
- #include "hex.h"
- 
--static int identical_to_template_hook(const char *name, const char *path)
--{
--	const char *env = getenv("GIT_CLONE_TEMPLATE_DIR");
--	const char *template_dir = get_template_dir(env && *env ? env : NULL);
--	struct strbuf template_path = STRBUF_INIT;
--	int found_template_hook, ret;
--
--	strbuf_addf(&template_path, "%s/hooks/%s", template_dir, name);
--	found_template_hook = access(template_path.buf, X_OK) >= 0;
--#ifdef STRIP_EXTENSION
--	if (!found_template_hook) {
--		strbuf_addstr(&template_path, STRIP_EXTENSION);
--		found_template_hook = access(template_path.buf, X_OK) >= 0;
--	}
--#endif
--	if (!found_template_hook) {
--		strbuf_release(&template_path);
--		return 0;
--	}
--
--	ret = do_files_match(template_path.buf, path);
--
--	strbuf_release(&template_path);
--	return ret;
--}
--
- static struct strset safe_hook_sha256s = STRSET_INIT;
- static int safe_hook_sha256s_initialized;
- 
-@@ -70,6 +44,22 @@ static int get_sha256_of_file_contents(const char *path, char *sha256)
- 	return 0;
- }
- 
-+void add_safe_hook(const char *path)
-+{
-+	char sha256[GIT_SHA256_HEXSZ + 1] = { '\0' };
-+
-+	if (!get_sha256_of_file_contents(path, sha256)) {
-+		char *p;
-+
-+		strset_add(&safe_hook_sha256s, sha256);
-+
-+		/* support multi-process operations e.g. recursive clones */
-+		p = xstrfmt("safe.hook.sha256=%s", sha256);
-+		git_config_push_parameter(p);
-+		free(p);
-+	}
-+}
-+
- static int safe_hook_cb(const char *key, const char *value,
- 			const struct config_context *ctx UNUSED, void *d)
- {
-@@ -142,7 +132,6 @@ const char *find_hook(const char *name)
- 		return NULL;
- 	}
- 	if (!git_hooks_path && git_env_bool("GIT_CLONE_PROTECTION_ACTIVE", 0) &&
--	    !identical_to_template_hook(name, path.buf) &&
- 	    !is_hook_safe_during_clone(name, path.buf, sha256))
- 		die(_("active `%s` hook found during `git clone`:\n\t%s\n"
- 		      "For security reasons, this is disallowed by default.\n"
-diff --git a/hook.h b/hook.h
-index 19ab9a5806e..b4770d9bd88 100644
---- a/hook.h
-+++ b/hook.h
-@@ -87,4 +87,14 @@ int run_hooks(const char *hook_name);
-  * hook. This function behaves like the old run_hook_le() API.
-  */
- int run_hooks_l(const char *hook_name, ...);
-+
-+/**
-+ * Mark the contents of the provided path as safe to run during a clone
-+ * operation.
-+ *
-+ * This function is mainly used when copying templates to mark the
-+ * just-copied hooks as benign.
-+ */
-+void add_safe_hook(const char *path);
-+
- #endif
-diff --git a/setup.c b/setup.c
-index 30f243fc32d..25828a85ec3 100644
---- a/setup.c
-+++ b/setup.c
-@@ -17,6 +17,8 @@
- #include "trace2.h"
- #include "worktree.h"
- #include "exec-cmd.h"
-+#include "run-command.h"
-+#include "hook.h"
- 
- static int inside_git_dir = -1;
- static int inside_work_tree = -1;
-@@ -1868,6 +1870,7 @@ static void copy_templates_1(struct strbuf *path, struct strbuf *template_path,
- 	size_t path_baselen = path->len;
- 	size_t template_baselen = template_path->len;
- 	struct dirent *de;
-+	int is_hooks_dir = ends_with(template_path->buf, "/hooks/");
- 
- 	/* Note: if ".git/hooks" file exists in the repository being
- 	 * re-initialized, /etc/core-git/templates/hooks/update would
-@@ -1920,6 +1923,10 @@ static void copy_templates_1(struct strbuf *path, struct strbuf *template_path,
- 			strbuf_release(&lnk);
- 		}
- 		else if (S_ISREG(st_template.st_mode)) {
-+			if (is_hooks_dir &&
-+			    is_executable(template_path->buf))
-+				add_safe_hook(template_path->buf);
-+
- 			if (copy_file(path->buf, template_path->buf, st_template.st_mode))
- 				die_errno(_("cannot copy '%s' to '%s'"),
- 					  template_path->buf, path->buf);
-diff --git a/t/t5601-clone.sh b/t/t5601-clone.sh
-index deb1c282c71..ca3a8d1ebed 100755
---- a/t/t5601-clone.sh
-+++ b/t/t5601-clone.sh
-@@ -836,6 +836,25 @@ test_expect_success 'clone with init.templatedir runs hooks' '
- 		git config --unset init.templateDir &&
- 		test_grep ! "active .* hook found" err &&
- 		test_path_is_missing hook-run-local-config/hook.run
-+	) &&
-+
-+	test_config_global protocol.file.allow always &&
-+	git -C tmpl/hooks submodule add "$(pwd)/tmpl/hooks" sub &&
-+	test_tick &&
-+	git -C tmpl/hooks add .gitmodules sub &&
-+	git -C tmpl/hooks commit -m submodule &&
-+
-+	(
-+		sane_unset GIT_TEMPLATE_DIR &&
-+		NO_SET_GIT_TEMPLATE_DIR=t &&
-+		export NO_SET_GIT_TEMPLATE_DIR &&
-+
-+		git -c init.templateDir="$(pwd)/tmpl" \
-+			clone --recurse-submodules \
-+			tmpl/hooks hook-run-submodule 2>err &&
-+		test_grep ! "active .* hook found" err &&
-+		test_path_is_file hook-run-submodule/hook.run &&
-+		test_path_is_file hook-run-submodule/sub/hook.run
- 	)
- '
- 
diff --git a/debian/patches/0007-Revert-Add-a-helper-function-to-compare-file-contents.diff b/debian/patches/0007-Revert-Add-a-helper-function-to-compare-file-contents.diff
deleted file mode 100644
index 6cf2874..0000000
--- a/debian/patches/0007-Revert-Add-a-helper-function-to-compare-file-contents.diff
+++ /dev/null
@@ -1,185 +0,0 @@
-From 13b17dea6c851b21ceb9ce163cdd7338f1ec4ecf Mon Sep 17 00:00:00 2001
-From: Johannes Schindelin <johannes.schindelin@gmx.de>
-Date: Sat, 18 May 2024 10:32:46 +0000
-Subject: Revert "Add a helper function to compare file contents"
-
-commit 851218a8af645b0abd64882d2b88bc984aa762e9 upstream.
-
-Now that during a `git clone`, the hooks' contents are no longer
-compared to the templates' files', the caller for which the
-`do_files_match()` function was introduced is gone, and therefore this
-function can be retired, too.
-
-This reverts commit 584de0b4c23 (Add a helper function to compare file
-contents, 2024-03-30).
-
-Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
-Signed-off-by: Junio C Hamano <gitster@pobox.com>
-Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
----
- copy.c                     | 58 --------------------------------------
- copy.h                     | 14 ---------
- t/helper/test-path-utils.c | 10 -------
- t/t0060-path-utils.sh      | 41 ---------------------------
- 4 files changed, 123 deletions(-)
-
-diff --git a/copy.c b/copy.c
-index 3df156f6cea..d9d20920126 100644
---- a/copy.c
-+++ b/copy.c
-@@ -70,61 +70,3 @@ int copy_file_with_time(const char *dst, const char *src, int mode)
- 		return copy_times(dst, src);
- 	return status;
- }
--
--static int do_symlinks_match(const char *path1, const char *path2)
--{
--	struct strbuf buf1 = STRBUF_INIT, buf2 = STRBUF_INIT;
--	int ret = 0;
--
--	if (!strbuf_readlink(&buf1, path1, 0) &&
--	    !strbuf_readlink(&buf2, path2, 0))
--		ret = !strcmp(buf1.buf, buf2.buf);
--
--	strbuf_release(&buf1);
--	strbuf_release(&buf2);
--	return ret;
--}
--
--int do_files_match(const char *path1, const char *path2)
--{
--	struct stat st1, st2;
--	int fd1 = -1, fd2 = -1, ret = 1;
--	char buf1[8192], buf2[8192];
--
--	if ((fd1 = open_nofollow(path1, O_RDONLY)) < 0 ||
--	    fstat(fd1, &st1) || !S_ISREG(st1.st_mode)) {
--		if (fd1 < 0 && errno == ELOOP)
--			/* maybe this is a symbolic link? */
--			return do_symlinks_match(path1, path2);
--		ret = 0;
--	} else if ((fd2 = open_nofollow(path2, O_RDONLY)) < 0 ||
--		   fstat(fd2, &st2) || !S_ISREG(st2.st_mode)) {
--		ret = 0;
--	}
--
--	if (ret)
--		/* to match, neither must be executable, or both */
--		ret = !(st1.st_mode & 0111) == !(st2.st_mode & 0111);
--
--	if (ret)
--		ret = st1.st_size == st2.st_size;
--
--	while (ret) {
--		ssize_t len1 = read_in_full(fd1, buf1, sizeof(buf1));
--		ssize_t len2 = read_in_full(fd2, buf2, sizeof(buf2));
--
--		if (len1 < 0 || len2 < 0 || len1 != len2)
--			ret = 0; /* read error or different file size */
--		else if (!len1) /* len2 is also 0; hit EOF on both */
--			break; /* ret is still true */
--		else
--			ret = !memcmp(buf1, buf2, len1);
--	}
--
--	if (fd1 >= 0)
--		close(fd1);
--	if (fd2 >= 0)
--		close(fd2);
--
--	return ret;
--}
-diff --git a/copy.h b/copy.h
-index 057259a3a7a..2af77cba864 100644
---- a/copy.h
-+++ b/copy.h
-@@ -7,18 +7,4 @@ int copy_fd(int ifd, int ofd);
- int copy_file(const char *dst, const char *src, int mode);
- int copy_file_with_time(const char *dst, const char *src, int mode);
- 
--/*
-- * Compare the file mode and contents of two given files.
-- *
-- * If both files are actually symbolic links, the function returns 1 if the link
-- * targets are identical or 0 if they are not.
-- *
-- * If any of the two files cannot be accessed or in case of read failures, this
-- * function returns 0.
-- *
-- * If the file modes and contents are identical, the function returns 1,
-- * otherwise it returns 0.
-- */
--int do_files_match(const char *path1, const char *path2);
--
- #endif /* COPY_H */
-diff --git a/t/helper/test-path-utils.c b/t/helper/test-path-utils.c
-index 023ed2e1a78..bf0e23ed505 100644
---- a/t/helper/test-path-utils.c
-+++ b/t/helper/test-path-utils.c
-@@ -501,16 +501,6 @@ int cmd__path_utils(int argc, const char **argv)
- 		return !!res;
- 	}
- 
--	if (argc == 4 && !strcmp(argv[1], "do_files_match")) {
--		int ret = do_files_match(argv[2], argv[3]);
--
--		if (ret)
--			printf("equal\n");
--		else
--			printf("different\n");
--		return !ret;
--	}
--
- 	fprintf(stderr, "%s: unknown function name: %s\n", argv[0],
- 		argv[1] ? argv[1] : "(there was none)");
- 	return 1;
-diff --git a/t/t0060-path-utils.sh b/t/t0060-path-utils.sh
-index 85686ee15da..0afa3d0d312 100755
---- a/t/t0060-path-utils.sh
-+++ b/t/t0060-path-utils.sh
-@@ -610,45 +610,4 @@ test_expect_success !VALGRIND,RUNTIME_PREFIX,CAN_EXEC_IN_PWD '%(prefix)/ works'
- 	test_cmp expect actual
- '
- 
--test_expect_success 'do_files_match()' '
--	test_seq 0 10 >0-10.txt &&
--	test_seq -1 10 >-1-10.txt &&
--	test_seq 1 10 >1-10.txt &&
--	test_seq 1 9 >1-9.txt &&
--	test_seq 0 8 >0-8.txt &&
--
--	test-tool path-utils do_files_match 0-10.txt 0-10.txt >out &&
--
--	assert_fails() {
--		test_must_fail \
--		test-tool path-utils do_files_match "$1" "$2" >out &&
--		grep different out
--	} &&
--
--	assert_fails 0-8.txt 1-9.txt &&
--	assert_fails -1-10.txt 0-10.txt &&
--	assert_fails 1-10.txt 1-9.txt &&
--	assert_fails 1-10.txt .git &&
--	assert_fails does-not-exist 1-10.txt &&
--
--	if test_have_prereq FILEMODE
--	then
--		cp 0-10.txt 0-10.x &&
--		chmod a+x 0-10.x &&
--		assert_fails 0-10.txt 0-10.x
--	fi &&
--
--	if test_have_prereq SYMLINKS
--	then
--		ln -sf 0-10.txt symlink &&
--		ln -s 0-10.txt another-symlink &&
--		ln -s over-the-ocean yet-another-symlink &&
--		ln -s "$PWD/0-10.txt" absolute-symlink &&
--		assert_fails 0-10.txt symlink &&
--		test-tool path-utils do_files_match symlink another-symlink &&
--		assert_fails symlink yet-another-symlink &&
--		assert_fails symlink absolute-symlink
--	fi
--'
--
- test_done
diff --git a/debian/patches/series b/debian/patches/series
deleted file mode 100644
index 7ff1f37..0000000
--- a/debian/patches/series
+++ /dev/null
@@ -1,7 +0,0 @@
-0001-hook-plug-a-new-memory-leak.diff
-0002-Revert-core.hooksPath-add-some-protection-while-cloni.diff
-0003-tests-verify-that-clone-c-core.hooksPath-dev-null-wor.diff
-0004-hook-clone-protections-add-escape-hatch.diff
-0005-hooks-clone-protections-special-case-current-Git-LFS-.diff
-0006-hooks-clone-protections-simplify-templates-hooks-vali.diff
-0007-Revert-Add-a-helper-function-to-compare-file-contents.diff
diff --git a/debian/versions.upstream b/debian/versions.upstream
index 7af7478..6375aef 100644
--- a/debian/versions.upstream
+++ b/debian/versions.upstream
@@ -832,23 +832,27 @@ v2.39.1
 v2.39.2
 v2.39.3
 v2.39.4
+v2.39.5
 v2.40.0-rc0
 v2.40.0-rc1
 v2.40.0-rc2
 v2.40.0
 v2.40.1
 v2.40.2
+v2.40.3
 v2.41.0-rc0
 v2.41.0-rc1
 v2.41.0-rc2
 v2.41.0
 v2.41.1
+v2.41.2
 v2.42.0-rc0
 v2.42.0-rc1
 v2.42.0-rc2
 v2.42.0
 v2.42.1
 v2.42.2
+v2.42.3
 v2.43.0-rc0
 v2.43.0-rc1
 v2.43.0-rc2
@@ -857,12 +861,15 @@ v2.43.1
 v2.43.2
 v2.43.3
 v2.43.4
+v2.43.5
 v2.44.0-rc0
 v2.44.0-rc1
 v2.44.0-rc2
 v2.44.0
 v2.44.1
+v2.44.2
 v2.45.0-rc0
 v2.45.0-rc1
 v2.45.0
 v2.45.1
+v2.45.2