Re: [ANNOUNCE] Git v2.29.0-rc0

From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Date: Oct 7, 2020, 09:54 UTC
Message-ID: <87k0w2gy4j.fsf@evledraar.gmail.com>
In-Reply-To: <xmqqa6x070tn.fsf@gitster.c.googlers.com>

On Tue, Oct 06 2020, Junio C Hamano wrote:

Show 10 quoted lines

> An early preview release Git v2.29.0-rc0 is now available for
> testing at the usual places.  It is comprised of 588 non-merge
> commits since v2.28.0, contributed by 76 people, 22 of which are
> new faces.
> [...]
> Ævar Arnfjörð Bjarmason (17):
> [...]
>       remote-mediawiki: convert to quoted run_git() invocation
>       remote-mediawiki: annotate unquoted uses of run_git()
>       remote-mediawiki: use "sh" to eliminate unquoted commands

We didn't do a point release for this security fix, but I think we should still credit it in the same way we've done for security point releases, e.g. in the notes for v2.7.6 and v2.10.5.

It's still an RCE, and even if we considered it minor due to the obscurity of the exposed component every little thing we can do to encourage responsible security research & reporting helps.