Shipping 2.55 with stricter "neuter sideband" topic

From: Junio C Hamano <gitster@pobox.com>
Date: Jun 11, 2026, 15:48 UTC
Message-ID: <xmqqzf11oz7a.fsf@gitster.g>
In-Reply-To: <20260305233452.3727126-8-gitster@pobox.com>

Junio C Hamano <gitster@pobox.com> writes:

Was: Re: [PATCH v5 7/7] sideband: delay sanitizing by default to Git v3.0

Show 22 quoted lines

> From: Johannes Schindelin <johannes.schindelin@gmx.de>
>
> The sideband sanitization patches allow ANSI color sequences through
> by default, preserving compatibility with pre-receive hooks that
> provide colored output during `git push`.
>
> Even so, there is concern that changing any default behavior in a
> minor release may have unforeseen consequences. To accommodate this,
> defer the secure-by-default behavior to Git v3.0, where breaking
> changes are expected.
>
> This gives users and tooling time to prepare, while committing to
> address CVE-2024-52005 in Git v3.0.
>
> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
> [jc: adjusted for the removal of 'default' value]
> Signed-off-by: Junio C Hamano <gitster@pobox.com>
> ---
>  Documentation/config/sideband.adoc  | 12 ++++++++++--
>  sideband.c                          |  6 +++++-
>  t/t5409-colorize-remote-messages.sh | 18 +++++++++++++-----
>  3 files changed, 28 insertions(+), 8 deletions(-)

As some of you may have noticed, Dscho's "be more strict about control code sequences used in sideband output and pass only the ANSI color sequences by default" series originally had this "but until Git 3.0, be loose as before" as the last step. I kept this step outside 'next' while the remainder graduated to 'master' for upcoming v2.55.0, hoping that it would give us a chance to measure how this limiting negatively affects real-world users.

The merge of the stricter version happend about a month ago at 7760f83b (Merge branch 'jc/neuter-sideband-fixup', 2026-05-11). Luckily, it seems that we haven't heard any complaints after it happened.

So I plan to hold this step back indefinitely (aka "retract this step"), which means that the "neuter sideband" topic will ship in its stricter form in Git 2.55.

Thoughts?