[AUTO-CHERRYPICK] Fix CVE-2024-53263 in git-lfs - branch 3.0-dev (#12118)

Co-authored-by: Rohit Rawat <rohitrawat@microsoft.com>

Author: CBL-Mariner-Bot

SPECS/git-lfs/git-lfs.signatures.json

@@ -1,6 +1,6 @@
 {
- "Signatures": {
-  "git-lfs-3.4.1-vendor.tar.gz": "a7b525a15b71a92ab789853a172345a4e4815de71ebe3486d5b843651b74cf1e",
-  "git-lfs-3.4.1.tar.gz": "2a36239d7968ae18e1ba2820dc664c4ef753f10bf424f98bccaf44d527f19a17"
- }
+  "Signatures": {
+    "git-lfs-3.6.1-vendor.tar.gz": "6cb4c1deda8ef0b2014c559e06808b58a4fd04f2b487ad30566e0d683889cd65",
+    "git-lfs-3.6.1.tar.gz": "062603dbef8f221d867e542314e9a6ea1970cae536b4495de2e915529b0fef8e"
+  }
 }

SPECS/git-lfs/git-lfs.spec

@@ -1,7 +1,7 @@
 %global debug_package %{nil}
 Summary:       Git extension for versioning large files
 Name:          git-lfs
-Version:       3.4.1
+Version:       3.6.1
 Release:       1%{?dist}
 Group:         System Environment/Programming
 Vendor:        Microsoft Corporation
@@ -77,6 +77,9 @@ git lfs uninstall
 %{_mandir}/man5/*
 
 %changelog
+* Thu Jan 23 2025 Rohit Rawat <rohitrawat@microsoft.com> - 3.6.1-1
+- Bump version to 3.6.1 to fix CVE-2024-53263
+
 * Fri Jan 05 2024 Muhammad Falak <mwani@microsoft.com> - 3.4.1-1
 - Bump version to 3.4.1
 - Add BR on asciidoctor & drop un-needed BR

cgmanifest.json

@@ -4310,8 +4310,8 @@
         "type": "other",
         "other": {
           "name": "git-lfs",
-          "version": "3.4.1",
-          "downloadUrl": "https://github.com/git-lfs/git-lfs/archive/v3.4.1.tar.gz"
+          "version": "3.6.1",
+          "downloadUrl": "https://github.com/git-lfs/git-lfs/archive/v3.6.1.tar.gz"
         }
       }
     },