[Bug] Fetch publishes a remote-tracking ref for a missing commit

Runtime and usage

• Runtime: Node.js
• Package usage: npm package, loaded as an ES module
• Filesystem: Node filesystem adapter
• Transport: isomorphic-git/http/node over a local smart-HTTP peer
• Bundler or script tag: none

What happened?

isomorphic-git 1.42.2 accepts a checksum-valid Git v2 empty pack in response to a fetch, returns success, and publishes the advertised commit to refs/remotes/origin/main even though the object is absent from the resulting object database. A fresh git fsck --full then reports invalid pointers for the new remote-tracking refs, and no pack is installed.

Git's control fetch rejects the same advertisement and preserves the previous remote-tracking ref.

Steps to reproduce

docker build -t isomorphic-git-empty-pack:1.42.2 attachments
./attachments/reproduce.sh result

The runner creates a valid one-commit repository, starts a local smart-HTTP peer, advertises a new commit that is absent from the client, and returns a valid zero-object pack. The target operation runs in the pinned Docker image; the Git executable is used only for fixture construction and the independent control.

Expected behavior

Fetch should fail, or leave the previous remote-tracking state unchanged, when the advertised ref cannot be resolved from the received object closure. A successful fetch should not publish a ref whose target object is unavailable.

Version

isomorphic-git 1.42.2, tag v1.42.2, running on Node.js 24 in the attached image.

Observed error/output

CONTROL fetch_rc=1 remote_main=<old-oid> new_object=absent fsck_rc=0 invalid_pointers=0
OBSERVED fetch_rc=0 remote_main=<new-oid> new_object=absent fsck_rc=2 invalid_pointers=2 pack_files=0

The complete source analysis and sanitized replay are in report.md and attachments.zip.

Attachments

report.md

attachments.zip