import CS git-lfs-3.7.1-6.el9

SOURCES/0001-commands-fix-format-string-type-mismatch-in-lockveri.patch

@@ -0,0 +1,29 @@
+From b1620879b0e615e03c1e89aeafc33940a0ed4ba3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Poho=C5=99elsk=C3=BD?= <opohorel@redhat.com>
+Date: Thu, 9 Apr 2026 11:03:37 +0200
+Subject: [PATCH] commands: fix format string type mismatch in lockverifier
+
+The addLocks() method passes a *git.Ref value to a %q format verb in
+a tr.Tr.Get() call, but %q expects a string. Newer versions of Go
+recognize tr.Tr.Get() as a printf-like function and flag this as an
+error during go vet.
+
+Pass ref.Refspec() instead, which returns the reference name as a
+string.
+---
+ commands/lockverifier.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/commands/lockverifier.go b/commands/lockverifier.go
+index d7d2d38682..96301937cc 100644
+--- a/commands/lockverifier.go
++++ b/commands/lockverifier.go
+@@ -90,7 +90,7 @@ func (lv *lockVerifier) addLocks(ref *git.Ref, locks []locking.Lock, set map[str
+ 	for _, l := range locks {
+ 		if rl, ok := set[l.Path]; ok {
+ 			if err := rl.Add(ref, l); err != nil {
+-				Error(tr.Tr.Get("warning: error adding %q lock for ref %q: %+v", l.Path, ref, err))
++				Error(tr.Tr.Get("warning: error adding %q lock for ref %q: %+v", l.Path, ref.Refspec(), err))
+ 			}
+ 		} else {
+ 			set[l.Path] = lv.newRefLocks(ref, l)

SPECS/git-lfs.spec

@@ -9,7 +9,7 @@ Version:                3.7.1
 %global gobuilddir %{_builddir}/%{name}-%{version}/_build
 
 Name:           git-lfs
-Release:        3%{?dist}
+Release:        6%{?dist}
 Summary:        Git extension for versioning large files
 
 License:        MIT
@@ -17,6 +17,12 @@ URL:            https://git-lfs.github.io/
 Source0:        https://github.com/%{name}/%{name}/releases/download/v%{version}/%{name}-v%{version}.tar.gz
 Source1:        README.Fedora
 
+# https://github.com/git-lfs/git-lfs/pull/6237
+Patch0:         0001-commands-fix-format-string-type-mismatch-in-lockveri.patch
+
+# https://github.com/golang/net/commit/8c4c965e028475082408749b50ed7a686df0d265
+Patch1:         git-lfs-3.7.1-CVE-2026-39821.patch
+
 # Generated provides by vendor2provides.py
 # https://src.fedoraproject.org/rpms/syncthing/blob/603e4e03a92a7d704d199629dd85304018e8279d/f/vendor2provides.py
 Provides:       bundled(golang(github.com/alexbrainman/sspi)) = 909beea
@@ -156,6 +162,14 @@ PATH=%{buildroot}%{_bindir}:%{gobuilddir}/bin:$PATH \
 
 
 %changelog
+* Tue Jul 14 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.7.1-6
+- Fix CVE-2026-39821 in vendored golang.org/x/net/idna
+- Resolves: RHEL-183843, RHEL-187313
+
+* Mon May 19 2026 Ondřej Pohořelský <opohorel@redhat.com> - 3.7.1-5
+- Rebuild with new Golang
+- Resolves: RHEL-156656, RHEL-166700, RHEL-167695, RHEL-167389, RHEL-166345, RHEL-177321
+
 * Mon Feb 16 2026 Ondřej Pohořelský <opohorel@redhat.com> - 3.7.1-3
 - Rebuild with new Golang
 - Resolves: RHEL-146102, RHEL-149638