commit 289816b5bd432d6fa0fc65c2ca686ea6f3ae0258
author David Ostrovsky <david@ostrovsky.org> Thu Dec 27 21:14:28 2018 +0100
committer David Pursehouse <dpursehouse@collab.net> Fri Jan 11 09:12:27 2019 +0900
tree c89c1c38c009f0893b8b1a58f80b75b8935dda49
parent c3a647653b9520cbc819c7760bb684d22c968a53

Upgrade JGit to 4.9.8.201812241815-r

This release fixes an issue where AdvertiseRefsHook was not called for
git-upload-pack in protocol v0 bidirectional transports, meaning that
wants aren't validated and a user can fetch anything that is pointed
to by any ref (using fetch-by-sha1), as long as they can guess the
object name.

Bug: Issue 10262
Change-Id: I169fbc742a4edffdf52e6b8ef71b7cd618affa95

lib/jgit/jgit.bzl

diff --git a/lib/jgit/jgit.bzl b/lib/jgit/jgit.bzl
index 0bef327..4597fd7 100644
--- a/lib/jgit/jgit.bzl
+++ b/lib/jgit/jgit.bzl
@@ -1,12 +1,12 @@
-load("//tools/bzl:maven_jar.bzl", "MAVEN_CENTRAL", "maven_jar")
+load("//tools/bzl:maven_jar.bzl", "ECLIPSE", "maven_jar")
 
-_JGIT_VERS = "4.9.7.201810191756-r"
+_JGIT_VERS = "4.9.8.201812241815-r"
 
 _DOC_VERS = _JGIT_VERS  # Set to _JGIT_VERS unless using a snapshot
 
 JGIT_DOC_URL = "http://download.eclipse.org/jgit/site/" + _DOC_VERS + "/apidocs"
 
-_JGIT_REPO = MAVEN_CENTRAL  # Leave here even if set to MAVEN_CENTRAL.
+_JGIT_REPO = ECLIPSE  # Leave here even if set to MAVEN_CENTRAL.
 
 # set this to use a local version.
 # "/home/<user>/projects/jgit"
@@ -35,28 +35,28 @@
         name = "jgit-lib",
         artifact = "org.eclipse.jgit:org.eclipse.jgit:" + _JGIT_VERS,
         repository = _JGIT_REPO,
-        sha1 = "fdb6c03608e701970338c0a659cffc6772642708",
-        src_sha1 = "00923a3e9302d659fa7887cc8a019e1fa11b5dd2",
+        sha1 = "dedb5d05a952551dc465611ebde3819d86bb22fc",
+        src_sha1 = "dbbc82bb6b1f7733a3d03a5af67eb5b8cf30e2d4",
         unsign = True,
     )
     maven_jar(
         name = "jgit-servlet",
         artifact = "org.eclipse.jgit:org.eclipse.jgit.http.server:" + _JGIT_VERS,
         repository = _JGIT_REPO,
-        sha1 = "8385c02bee53a8e189817bae2ea2529631ccc7a8",
+        sha1 = "76fc4dab1d3b0c05768d7d5424e003e4dbfa5222",
         unsign = True,
     )
     maven_jar(
         name = "jgit-archive",
         artifact = "org.eclipse.jgit:org.eclipse.jgit.archive:" + _JGIT_VERS,
         repository = _JGIT_REPO,
-        sha1 = "b8224b08c5c403ee635b8fa8378c27fbe6329620",
+        sha1 = "dfebb3889afcd4f335e9becf4bb58a06bb84b72f",
     )
     maven_jar(
         name = "jgit-junit",
         artifact = "org.eclipse.jgit:org.eclipse.jgit.junit:" + _JGIT_VERS,
         repository = _JGIT_REPO,
-        sha1 = "4084467ad58438bc819daf99de7244cfaa5a6fa1",
+        sha1 = "3e34e327979c8c263765be63abc89dda1b4b4d94",
         unsign = True,
     )