[PATCH v2 0/7] Git 3.0: restrict hex object IDs to lowercase only

From: brian m. carlson <sandals@crustytoothpaste.net>
Date: Sep 7, 2026, 19:59 UTC
Message-ID: <20260907195941.1024289-1-sandals@crustytoothpaste.net>
In-Reply-To: <20260729233215.398654-1-sandals@crustytoothpaste.net>

As far as I can tell, Git has always emitted hex object IDs in lowercase, but our object ID parser accepts both uppercase and lowercase. This leads to much software relying on hex object IDs being broken because it doesn't handle uppercase object IDs and this can even lead to security problems when people assume that an object ID has a unique hex form.

This series removes the ability to use uppercase hex in object IDs in Git 3.0.

Changes from v1:

* Fix incorrect hex range in comment.
* Update commit messages.
* Move t5324 fixes to a separate commit and expand commit message.
* Restore lowercasing in parse_oid_prefix.
* Possibly other miscellaneous changes which I have forgotten.

brian m. carlson (7):
  hex: add functionality for lowercase-only hex
  hex: allow specifying hex type with hex2chr
  hex: make hex_to_bytes accept kind of hex to use
  hex: label usages of hex parsing for object IDs
  object-name: use hexval
  t5324: adjust tests for corrupt commit-graph
  hex: allow only lowercase object IDs in breaking changes mode

 Documentation/BreakingChanges.adoc |  5 ++++
 builtin/index-pack.c               |  2 +-
 color.c                            |  2 +-
 diagnose.c                         |  2 +-
 hex-ll.c                           | 39 ++++++++++++++++++++++++++++--
 hex-ll.h                           | 24 +++++++++++++-----
 hex.c                              |  2 +-
 http-push.c                        |  5 ++--
 mailinfo.c                         |  2 +-
 notes.c                            |  5 ++--
 object-file.c                      |  2 +-
 object-name.c                      | 15 +++---------
 pkt-line.c                         |  8 +++---
 ref-filter.c                       |  2 +-
 strbuf.c                           |  2 +-
 t/t1503-rev-parse-verify.sh        |  5 ++++
 t/t5324-split-commit-graph.sh      |  4 +--
 url.c                              |  2 +-
 urlmatch.c                         |  2 +-
 19 files changed, 91 insertions(+), 39 deletions(-)