Subject: Re: [bug#61583] [PATCH] gnu: git: Update to 2.39.2 [fixes CVE-2023-22490 & CVE-2023-23946].

From: Leo Famulari <[email-masked]>
Date: Fri, 3 Mar 2023 16:56:58 -0500

On Mon, Feb 20, 2023 at 12:44:23PM +0100, Simon Tournier wrote:
> On ven., 17 févr. 2023 at 18:04, Greg Hogan <[email-masked]> wrote:
> > * gnu/packages/version-control.scm (git): Update to 2.39.2.
> 
> As noticed previously for an update of Git, this implies a lot of
> rebuilds because git-minimal inherits from git.

------
$ guix refresh -l git-minimal
Building the following 43 packages would ensure 69 dependent packages are rebuilt: [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked]
------

That's not a significant number of packages.

Overall, git and git-minimal will cause more than 300 rebuilds, but not
too many for the current state of the build farm.

Concretely, why can't we push this to master immediately?