{"thread":{"id":"40491","subject":"[ANNOUNCE] Git v2.6.1, v2.5.4, v2.4.10 and v2.3.10","startedAt":"2015-10-05T20:43:54Z","lastAt":"2015-10-05T20:43:54Z","messageCount":1,"participants":["Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"271175","messageId":"xmqqmvvxxcz9.fsf@gitster.mtv.corp.google.com","threadId":"40491","inReplyTo":null,"subject":"[ANNOUNCE] Git v2.6.1, v2.5.4, v2.4.10 and v2.3.10","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2015-10-05T20:43:54Z","receivedAt":"2015-10-05T20:43:54Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"The latest maintenance release Git v2.6.1, together with releases\nfor older maintenance tracks, are now available at the usual places.\n\nThe tarballs are found at:\n\n    https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of the\nabovementioned tags:\n\n  url = https://kernel.googlesource.com/pub/scm/git/git\n  url = git://repo.or.cz/alt-git.git\n  url = git://git.sourceforge.jp/gitroot/git-core/git.git\n  url = git://git-core.git.sourceforge.net/gitroot/git-core/git-core\n  url = https://github.com/gitster/git\n\nFixes contained in these releases are as follows:\n\n * xdiff code we use to generate diffs is not prepared to handle\n   extremely large files.  It uses \"int\" in many places, which can\n   overflow if we have a very large number of lines or even bytes in\n   our input files, for example.  Cap the input size to somewhere\n   around 1GB for now.\n\n * Some protocols (like git-remote-ext) can execute arbitrary code\n   found in the URL.  The URLs that submodules use may come from\n   arbitrary sources (e.g., .gitmodules files in a remote\n   repository), and can hurt those who blindly enable recursive\n   fetch.  Restrict the allowed protocols to well known and safe\n   ones.\n\nKudos to Blake Burkhart and Jeff King for working on these fixes.\n\nThanks.\n"}]}