Merge branch 'js/coverity-fixes-null-safety'

Various code paths have been hardened against potential NULL-pointer dereferences and invalid file descriptor accesses flagged by Coverity. * js/coverity-fixes-null-safety: shallow: give write_one_shallow() its own hex buffer shallow: fix NULL dereference bisect: ensure non-NULL `head` before using it pack-bitmap: handle missing bitmap for base MIDX revision: avoid dereferencing NULL in `add_parents_only()` replay: die when --onto does not peel to a commit bisect: handle NULL commit in `bisect_successful()` mailsplit: move NULL check before first use of file handle reftable/stack: guard against NULL list_file in stack_destroy remote: guard `remote_tracking()` against NULL remote diff: handle NULL return from repo_get_commit_tree() diffcore-break: guard against NULLed queue entries in merge loop