Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: gitpython-developers/GitPython
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 3.1.53
Choose a base ref
...
head repository: gitpython-developers/GitPython
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 3.1.54
Choose a head ref
  • 5 commits
  • 9 files changed
  • 2 contributors

Commits on Jul 22, 2026

  1. fix: validate split short-option values 

    <!-- agent -->

Single-character keyword arguments are transformed into an option token and
a separate value token. The unsafe-option candidate builder only checked the
keyword name, allowing an option-like value to bypass guards shared by clone,
remote, revision, blame, and archive operations.

Include dash-prefixed values only when short options are actually split,
including sequence values, while preserving bare values and the non-splitting
compatibility path.

Git baseline a23bace9 defines clone -n and --upload-pack as distinct options,
matching the argv boundary this validation now preserves.

Refs GHSA-r9mr-m37c-5fr3.

Co-authored-by: Sebastian Thiel <[email protected]>
    @codex @Byron
    codex and Byron committed Jul 22, 2026
    Configuration menu
    Copy the full SHA
    e8d0fbf View commit details
    Browse the repository at this point in the history

  2. fix: reject unsafe clone templates 

    <!-- agent -->

Treat git clone --template as unsafe because caller-controlled
templates can install hooks that execute during clone.

Add regression coverage for both direct option and keyword forms.

References GHSA-6p8h-3wgx-97gf.
Validated against Git baseline a23bace9.

Co-authored-by: Sebastian Thiel <[email protected]>
    @codex @Byron
    codex and Byron committed Jul 22, 2026
    Configuration menu
    Copy the full SHA
    ffcb535 View commit details
    Browse the repository at this point in the history

  3. fix: guard diff output options 

    <!-- agent -->

Reject unsafe diff options before revision parsing or Git invocation so
callers cannot write command output to arbitrary filesystem paths.

Cover commit and index diffs, including option-like revisions, and
preserve an explicit allow_unsafe_options escape hatch.

References GHSA-fjr4-x663-mwxc.
Validated against Git baseline a23bace9.

Co-authored-by: Sebastian Thiel <[email protected]>
    @codex @Byron
    codex and Byron committed Jul 22, 2026
    Configuration menu
    Copy the full SHA
    1d51b89 View commit details
    Browse the repository at this point in the history

  4. Merge pull request #2180 from gitpython-developers/single-char-kwarg 

    Harden unsafe Git option validation
    @Byron
    Byron authored Jul 22, 2026
    Configuration menu
    Copy the full SHA
    a4dc70d View commit details
    Browse the repository at this point in the history

  5. prepare next release

    @Byron
    Byron committed Jul 22, 2026
    Configuration menu
    Copy the full SHA
    e59d9ba View commit details
    Browse the repository at this point in the history
Loading