{"thread":{"id":"61572","subject":"[ANNOUNCE] Git v2.45.2 and friends to unbreak \"git lfs\" and others","startedAt":"2024-05-31T17:47:09Z","lastAt":"2024-05-31T17:47:09Z","messageCount":1,"participants":["Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"496025","messageId":"xmqqr0dheuw5.fsf@gitster.g","threadId":"61572","inReplyTo":null,"subject":"[ANNOUNCE] Git v2.45.2 and friends to unbreak \"git lfs\" and others","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2024-05-31T17:47:06Z","receivedAt":"2024-05-31T17:47:09Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"The latest maintenance release Git v2.45.2 and its siblings\n(v2.39.5, v2.40.3, v2.41.2, v2.42.3, v2.43.5, and v2.44.2) are now\navailable at the usual places.  They are to revert overly strict\nchecks, which were \"added while at it to help enhance security, even\nthough these changes alone would not solve any known security\nproblems\", in the recent security updates that addressed four CVEs.\n\nThey unfortunately broke valid setups of \"git lfs\" and \"git annex\"\n(among other unknown things), so we are first reverting them, with\nan intention to later reassess the situation and rebuild\nreplacements that are much less aggressive and more precise, if\nneeded.\n\nThe tarballs are found at:\n\n    https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of the 'v2.45.2'\nand other tags:\n\n  url = https://git.kernel.org/pub/scm/git/git\n  url = https://kernel.googlesource.com/pub/scm/git/git\n  url = git://repo.or.cz/alt-git.git\n  url = https://github.com/gitster/git\n\n----------------------------------------------------------------\n\nGit v2.45.2 Release Notes\n=========================\n\nIn preparing security fixes for four CVEs, we made overly aggressive\n\"defense in depth\" changes that broke legitimate use cases like 'git\nlfs' and 'git annex.'  This release is to revert these misguided, if\nwell-intentioned, changes that were shipped in 2.45.1 and were not\ndirect security fixes.\n\nJeff King (5):\n      send-email: drop FakeTerm hack\n      send-email: avoid creating more than one Term::ReadLine object\n      ci: drop mention of BREW_INSTALL_PACKAGES variable\n      ci: avoid bare \"gcc\" for osx-gcc job\n      ci: stop installing \"gcc-13\" for osx-gcc\n\nJohannes Schindelin (6):\n      hook: plug a new memory leak\n      init: use the correct path of the templates directory again\n      Revert \"core.hooksPath: add some protection while cloning\"\n      tests: verify that `clone -c core.hooksPath=/dev/null` works again\n      clone: drop the protections where hooks aren't run\n      Revert \"Add a helper function to compare file contents\"\n\nJunio C Hamano (1):\n      Revert \"fsck: warn about symlink pointing inside a gitdir\"\n\n----------------------------------------------------------------\n\nChanges since v2.45.1 are as follows:\n\nJeff King (5):\n      send-email: drop FakeTerm hack\n      send-email: avoid creating more than one Term::ReadLine object\n      ci: drop mention of BREW_INSTALL_PACKAGES variable\n      ci: avoid bare \"gcc\" for osx-gcc job\n      ci: stop installing \"gcc-13\" for osx-gcc\n\nJohannes Schindelin (6):\n      hook: plug a new memory leak\n      init: use the correct path of the templates directory again\n      Revert \"core.hooksPath: add some protection while cloning\"\n      tests: verify that `clone -c core.hooksPath=/dev/null` works again\n      clone: drop the protections where hooks aren't run\n      Revert \"Add a helper function to compare file contents\"\n\nJunio C Hamano (2):\n      Revert \"fsck: warn about symlink pointing inside a gitdir\"\n      Git 2.39.5\n\n"}]}