Update to libgit2 1.5.1

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "git2"
-version = "0.16.0"
+version = "0.16.1"
 authors = ["Josh Triplett <[email protected]>", "Alex Crichton <[email protected]>"]
 license = "MIT OR Apache-2.0"
 readme = "README.md"
@@ -20,7 +20,7 @@ url = "2.0"
 bitflags = "1.1.0"
 libc = "0.2"
 log = "0.4.8"
-libgit2-sys = { path = "libgit2-sys", version = "0.14.1" }
+libgit2-sys = { path = "libgit2-sys", version = "0.14.2" }
 
 [target."cfg(all(unix, not(target_os = \"macos\")))".dependencies]
 openssl-sys = { version = "0.9.0", optional = true }

README.md

@@ -6,7 +6,7 @@ libgit2 bindings for Rust.
 
 ```toml
 [dependencies]
-git2 = "0.16"
+git2 = "0.16.1"
 ```
 
 ## Rust version requirements

libgit2-sys/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "libgit2-sys"
-version = "0.14.1+1.5.0"
+version = "0.14.2+1.5.1"
 authors = ["Josh Triplett <[email protected]>", "Alex Crichton <[email protected]>"]
 links = "git2"
 build = "build.rs"

libgit2-sys/build.rs

@@ -14,7 +14,13 @@ fn main() {
     let try_to_use_system_libgit2 = !vendored && !zlib_ng_compat;
     if try_to_use_system_libgit2 {
         let mut cfg = pkg_config::Config::new();
-        if let Ok(lib) = cfg.range_version("1.4.4".."1.6.0").probe("libgit2") {
+        // These version ranges specifically request a version that includes
+        // the SSH fixes for CVE-2023-22742 (1.5.1+ or 1.4.5+).
+        if let Ok(lib) = cfg
+            .range_version("1.5.1".."1.6.0")
+            .probe("libgit2")
+            .or_else(|_| cfg.range_version("1.4.5".."1.5.0").probe("libgit2"))
+        {
             for include in &lib.include_paths {
                 println!("cargo:root={}", include.display());
             }