Eclipse JGit: Java implementation of Git 5.13.4

Don't use this version. It's broken since it was compiled for Java source level 8 but against JDK 17 which doesn't work on a Java 8 runtime. This was fixed in 5.13.5.

Bug fixes

• jgit-48 AdvertisedRequestValidator: fix WantNotValidException caused by race in fetch protocol v2
• Fix "Comparison of narrow type with wide type in loop condition"

Security fixes

The following changes fix CVE-2025-4949:

• ManifestParser: Do not accept DOCTYPE and entities to harden XML parser
• AmazonS3: Do not accept DOCTYPE and entities to harden XML parser

Kudos to Simon Gerst for reporting this vulnerability.

Build and release engineering

• Fix packaging build