I am pleased to announce that version 2.7 of GNU patch has been released. The following significant changes have happened since the last stable release in December 2009:
* Support for most features of the "diff --git" format, including renames and copies, permission changes, and symlink diffs. Binary diffs are not supported yet; patch will complain and skip them.
* Support for double-quoted filenames: when a filename starts with a double quote, it is interpreted as a C string literal. The escape sequences \\, \", \a, \b, \f, \n, \r, \t, \v, and \ooo (a three-digit octal number between 0 and 255) are recognized.
* Ignore destination file names that are absolute or that contain a component of "..". This addresses CVE-2010-4651.
* Refuse to apply a normal patch to a symlink. (Previous versions of patch were replacing the symlink with a regular file.)
* When trying to modify a read-only file, warn about the potential problem by default. The --read-only command line option allows to change this behavior.
* Files to be deleted are deleted once the entire input has been processed, not immediately. This fixes a bug with numbered backup files.
* When a timestamp specifies a time zone, honor that instead of assuming the local time zone (--set-date) or Universal Coordinated Time (--set-utc).
* Support for nanosecond precision timestamps.
* Patch no longer gets a failed assertion for certain mangled patches.
* Many portability and bug fixes.
Release tarballs are available at:
ftp://ftp.gnu.org/gnu/patch/
Please report bugs or suggestions on the <bug-patch@gnu.org> mailing list, or in the project's bug tracker on Savannah:
http://savannah.gnu.org/projects/patch
Thanks, Andreas