* maint-2.47:
Git 2.47.3
Git 2.46.4
Git 2.45.4
Git 2.44.4
Git 2.43.7
wincred: avoid buffer overflow in wcsncat()
bundle-uri: fix arbitrary file writes via parameter injection
config: quote values containing CR character
git-gui: sanitize 'exec' arguments: convert new 'cygpath' calls
git-gui: do not mistake command arguments as redirection operators
git-gui: introduce function git_redir for git calls with redirections
git-gui: pass redirections as separate argument to git_read
git-gui: pass redirections as separate argument to _open_stdout_stderr
git-gui: convert git_read*, git_write to be non-variadic
git-gui: override exec and open only on Windows
gitk: sanitize 'open' arguments: revisit recently updated 'open' calls
git-gui: use git_read in githook_read
git-gui: sanitize $PATH on all platforms
git-gui: break out a separate function git_read_nice
git-gui: assure PATH has only absolute elements.
git-gui: remove option --stderr from git_read
git-gui: cleanup git-bash menu item
git-gui: sanitize 'exec' arguments: background
git-gui: avoid auto_execok in do_windows_shortcut
git-gui: sanitize 'exec' arguments: simple cases
git-gui: avoid auto_execok for git-bash menu item
git-gui: treat file names beginning with "|" as relative paths
git-gui: remove unused proc is_shellscript
git-gui: remove git config --list handling for git < 1.5.3
git-gui: remove special treatment of Windows from open_cmd_pipe
git-gui: remove HEAD detachment implementation for git < 1.5.3
git-gui: use only the configured shell
git-gui: remove Tcl 8.4 workaround on 2>@1 redirection
git-gui: make _shellpath usable on startup
git-gui: use [is_Windows], not bad _shellpath
git-gui: _which, only add .exe suffix if not present
gitk: encode arguments correctly with "open"
gitk: sanitize 'open' arguments: command pipeline
gitk: collect construction of blameargs into a single conditional
gitk: sanitize 'open' arguments: simple commands, readable and writable
gitk: sanitize 'open' arguments: simple commands with redirections
gitk: sanitize 'open' arguments: simple commands
gitk: sanitize 'exec' arguments: redirect to process
gitk: sanitize 'exec' arguments: redirections and background
gitk: sanitize 'exec' arguments: redirections
gitk: sanitize 'exec' arguments: 'eval exec'
gitk: sanitize 'exec' arguments: simple cases
gitk: have callers of diffcmd supply pipe symbol when necessary
gitk: treat file names beginning with "|" as relative paths
This addresses CVE-2025-46835, Git GUI can create and overwrite a
user's files:
When a user clones an untrusted repository and is tricked into editing
a file located in a maliciously named directory in the repository, then
Git GUI can create and overwrite files for which the user has write
permission.
Signed-off-by: Johannes Sixt <j6t@kdbg.org>
This addresses CVE-2025-46334, Git GUI malicious command injection on
Windows.
A malicious repository can ship versions of sh.exe or typical textconv
filter programs such as astextplain. Due to the unfortunate design of
Tcl on Windows, the search path when looking for an executable always
includes the current directory. The mentioned programs are invoked when
the user selects "Git Bash" or "Browse Files" from the menu.
Signed-off-by: Johannes Sixt <j6t@kdbg.org>
These sites offer https versions of their content.
Using the https versions provides some protection for users.
Signed-off-by: Josh Soref <jsoref@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
* https://github.com/prati0100/git-gui:
git-gui - use mkshortcut on Cygwin
git-gui - use cygstart to browse on Cygwin
git-gui - remove obsolete Cygwin specific code
git gui Makefile - remove Cygwin modifications
Makefiles: change search through $(MAKEFLAGS) for GNU make 4.4
Work around Tcl's default `PATH` lookup
Move the `_which` function (almost) to the top
Move is_<platform> functions to the beginning
is_Cygwin: avoid `exec`ing anything
windows: ignore empty `PATH` elements
git-gui: Fix a typo in README
* https://github.com/prati0100/git-gui:
git-gui: use gray background for inactive text widgets
git-gui: Fix selected text colors
Makefile: conditionally include GIT-VERSION-FILE
git-gui: fix colored label backgrounds when using themed widgets
git-gui: ssh-askpass: add a checkbox to show the input text
git-gui: update Russian translation
git-gui: use commit message template
git-gui: Only touch GITGUI_MSG when needed
* https://github.com/prati0100/git-gui:
git-gui: blame: prevent tool tips from sticking around after Command-Tab
git-gui: improve dark mode support
git-gui: fix mixed tabs and spaces; prefer tabs
* https://github.com/prati0100/git-gui:
git-gui: Handle Ctrl + BS/Del in the commit msg
Subject: git-gui: fix syntax error because of missing semicolon
* 'master' of https://github.com/prati0100/git-gui:
git-gui: create a new namespace for chord script evaluation
git-gui: reduce Tcl version requirement from 8.6 to 8.5
git-gui--askpass: coerce answers to UTF-8 on Windows
git-gui: fix error popup when doing blame -> "Show History Context"
git-gui: add missing close bracket
git-gui: update German translation
git-gui: extend translation glossary template with more terms
git-gui: update pot template and German translation to current source code
* https://github.com/prati0100/git-gui:
git-gui: allow opening currently selected file in default app
git-gui: allow closing console window with Escape
git gui: fix branch name encoding error
git-gui: revert untracked files by deleting them
git-gui: update status bar to track operations
git-gui: consolidate naming conventions
* https://github.com/prati0100/git-gui:
git-gui: improve Japanese translation
git-gui: add a readme
git-gui: support for diff3 conflict style
git-gui: use existing interface to query a path's attribute
git-gui (Windows): use git-bash.exe if it is available
treewide: correct several "up-to-date" to "up to date"
Fix build with core.autocrlf=true
"git gui" has been taught to work with old versions of tk (like
8.5.7) that do not support "ttk::style theme use" as a way to query
the current theme.
* cb/git-gui-ttk-style:
git-gui: workaround ttk:style theme use
* 'js/misc-git-gui-stuff' of ../git-gui:
git-gui: allow Ctrl+T to toggle multiple paths
git-gui: fix exception when trying to stage with empty file list
git-gui: avoid exception upon Ctrl+T in an empty list
git gui: fix staging a second line to a 1-line file
* 'js/msgfmt-on-windows' of ../git-gui:
git-gui (MinGW): make use of MSys2's msgfmt
git gui: allow for a long recentrepo list
git gui: de-dup selected repo from recentrepo history
git gui: cope with duplicates in _get_recentrepo
git-gui: remove duplicate entries from .gitconfig's gui.recentrepo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABCAAGBQJYCJqmAAoJEDn3Aot9nM55uKQP/11BTzhOr9K3SLzwCr01ylGP
94AOA511vx3fIX5aWQ29S96tGbluo73RdbVsWFKKJcKSErpFPscFEiRkyjeMXE2T
yWWOPOg08tm28ppZNp0Kqjb8VykUUKuG6gVT59DNFUZUqHYQbiQy+t8nwT+Qow3U
dvo6lksovfSaW2FORWIi5KF5gD4v2F9qsbFgr725a8UoBrOmF0SWaCG4/ZYj0WxF
0rq8LjpvmMuQqd06DAoGMIsHa71R61En2QWfJ4YoE5+QRq8wQl37FmX+ojiA1rzY
CG/vJO2Tw4v54wHKK1TCXG7LR4JhTcQZOa6zd8HHsPRn+viGDCMVUG9uMewfxH+m
F47EVMxiKf0subm3fUhycqkvso0r6mOAddhz47RKT7tqU4XOnhPyGw0x6m7evawg
Sz2+fOK3wwX2Qec5o3vBZKaEcOftSrLuZmbi5/j43crvcf+OAs9s/jdq/Ulpkks2
JI2i0DLzHABTbDn6QsuysEZnituks8T8Fdm5NOldritgBNVY81ifatekFscxt6Ct
OrT9eGJk6iZiX1RvS+R7wykKJCBkxiyHqM8vSj5tPWjApgtnopPMudzNX41geaL9
ADeb8LVMTTNL/md8KED0deypilcPNnPbW035rAbyCpAsKbtgO3zdfzdzxsQ+dIvc
MQpCDP5QPPr3toRVdNmb
=VyhL
-----END PGP SIGNATURE-----
Merge tag 'gitgui-0.21.0' of git://repo.or.cz/git-gui
git-gui 0.21.0
* tag 'gitgui-0.21.0' of git://repo.or.cz/git-gui: (22 commits)
git-gui: set version 0.21
git-gui: Mark 'All' in remote.tcl for translation
git-gui i18n: Updated Bulgarian translation (565,0f,0u)
git-gui: avoid persisting modified author identity
git-gui: handle the encoding of Git's output correctly
git-gui: unicode file name support on windows
git-gui: Update Russian translation
git-gui: maintain backwards compatibility for merge syntax
git-gui i18n: mark string in lib/error.tcl for translation
git-gui: fix incorrect use of Tcl append command
git-gui i18n: mark "usage:" strings for translation
git-gui i18n: internationalize use of colon punctuation
git-gui: ensure the file in the diff pane is in the list of selected files
git-gui: support for $FILENAMES in tool definitions
git-gui: fix initial git gui message encoding
git-gui/po/glossary/txt-to-pot.sh: use the $( ... ) construct for command substitution
git-gui (Windows): use git-gui.exe in `Create Desktop Shortcut`
git-gui: fix detection of Cygwin
Amend tab ordering and text widget border and highlighting.
Allow keyboard control to work in the staging widgets.
...
The original command line syntax for "git merge", which was "git
merge <msg> HEAD <parent>...", has been deprecated for quite some
time, and "git gui" was the last in-tree user of the syntax. This
is finally fixed, so that we can move forward with the deprecation.
* rs/git-gui-use-modern-git-merge-syntax:
git-gui: stop using deprecated merge syntax
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQCVAwUAVTI85mB90JXwhOSJAQIAwAP+Lcm1TuAKXdiCMcYJFLPHhSvHJJRHPiN8
ydBIRP5UO6BJrmbo+w9tx3qAda4TS/crqRwSnRa5cXOWB+aDkuH8zm4IfkQKXIjI
qG4Q2t53q8vLBtRd6Y4uNlDQ04mh/J64E9tJoCaIzMj2m6W/Xizo2zslnOfo6F2Z
Z2rJhBMe1PY=
=4pD7
-----END PGP SIGNATURE-----
Merge tag 'gitgui-0.20.0' of http://repo.or.cz/r/git-gui
git-gui 0.20.0
* tag 'gitgui-0.20.0' of http://repo.or.cz/r/git-gui:
git-gui: set version 0.20
git-gui: sv.po: Update Swedish translation (547t0f0u)
git-gui i18n: Updated Bulgarian translation (547t,0f,0u)
git-gui: Makes chooser set 'gitdir' to the resolved path
git-gui: Fixes chooser not accepting gitfiles
git-gui: reinstate support for Tcl 8.4
git-gui: fix problem with gui.maxfilesdisplayed
git-gui: fix verbose loading when git path contains spaces.
git-gui/gitk: Do not depend on Cygwin's "kill" command on Windows
git-gui: add configurable tab size to the diff view
git-gui: Make git-gui lib dir configurable at runime
git-gui i18n: Updated Bulgarian translation (520t,0f,0u)
L10n: vi.po (543t): Init translation for Vietnamese
git-gui: align the new recursive checkbox with the radiobuttons.
git-gui: Add a 'recursive' checkbox in the clone menu.
* git://repo.or.cz/git-gui:
git-gui: tolerate major version changes when comparing the git version
git-gui: show staged submodules regardless of ignore config
* git://repo.or.cz/git-gui:
git-gui: correct spelling errors in comments
git-gui: add menu item to launch a bash shell on Windows.
git-gui: corrected setup of git worktree under cygwin.
git-gui: right half window is paned
git-gui: Add gui.displayuntracked option
git-gui: show the maxrecentrepo config option in the preferences dialog
git-gui: added gui.maxrecentrepo to extend the number of remembered repos
git-gui: Improve font rendering on retina macbooks
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (MingW32)
iQCVAwUAUbzwiGB90JXwhOSJAQKxtAP/TYTpKWzKiDwzu/2P6ecIWcS/4vaKlj1M
WSyvp4t4stTXhRXntId7psQO7nYTb+Pb3VlY+WPr9J3xL39IjU2qHLsrQJEqtsWI
FcE7SNxB0BvNreAqkdYNaKqSfGqQJPdV8K5WKaySZMpMkq/ZOT7WiOQq6wynDLuR
sDopx39hLDI=
=Az9M
-----END PGP SIGNATURE-----
Merge tag 'gitgui-0.18.0' of git://repo.or.cz/git-gui
git-gui 0.18.0
* tag 'gitgui-0.18.0' of git://repo.or.cz/git-gui:
git-gui 0.18
git-gui: avoid an error message when removing the last remote
git-gui: fix file name handling with non-empty prefix
git-gui: bring wish process to front on Mac
git-gui: change dialog button positions for Windows to suit platform.
git-gui: allow "\ No newline at end of file" for linewise staging
git-gui: fix the mergetool launcher for the Beyond Compare tool.
Makefile: replace "echo 1>..." with "echo >..."
French translation: copy -> copie.
git-gui: Fix parsing of <rev> <path-which-not-present-in-worktree>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
iQCVAwUAUH8cCGB90JXwhOSJAQI2ywP+PPdCYqxkpGzYYQkf/ZU3JFBqJqSxQE6i
V4ROiW+iHaS5EqWt7GvXc0G5M8b+7M0TMtCjwozSD1ne+Ced+ZOfxqSUOgGQL2XD
Vc4nHsITLNkhlSYlRP6VqXLsuW47iq+Hw/LQcSBvG79A3ooSC1QktfKV2JmtqIxr
i6lfGwM7yT4=
=zifn
-----END PGP SIGNATURE-----
Merge tag 'gitgui-0.17.0' of git://repo.or.cz/git-gui
git-gui 0.17.0
* tag 'gitgui-0.17.0' of git://repo.or.cz/git-gui:
git-gui 0.17
git-gui: Don't prepend the prefix if value looks like a full path
git-gui: Detect full path when parsing arguments
git-gui: remove .git/CHERRY_PICK_HEAD after committing
git-gui: Fix a loose/lose mistake
git-gui: Fix semi-working shortcuts for unstage and revert
git-gui: de.po: translate "remote" as "extern"
git-gui: de.po: translate "bare" as "bloß"
git-gui: de.po: consistently add untranslated hook names within braces
git-gui: preserve commit messages in utf-8
git-gui: open console when using --trace on windows
git-gui: fix a typo in po/ files
git-gui: Use PWD if it exists on Mac OS X
git-gui: fix git-gui crash due to uninitialized variable
* 'master' of git://repo.or.cz/git-gui: (28 commits)
git-gui 0.16
git-gui: handle shell script text filters when loading for blame.
git-gui: Set both 16x16 and 32x32 icons on X to pacify Xming.
git-gui: added config gui.gcwarning to disable the gc hint message
git-gui: set whitespace warnings appropriate to this project
git-gui: don't warn for detached head when rebasing
git-gui: make config gui.warndetachedcommit a boolean
git-gui: add config value gui.diffopts for passing additional diff options
git-gui: sort the numeric ansi codes
git-gui: support underline style when parsing diff output
git-gui: fix spelling error in sshkey.tcl
git-gui: include the file path in guitools confirmation dialog
git-gui: span widgets over the full file output area in the blame view
git-gui: use a tristate to control the case mode in the searchbar
git-gui: set suitable extended window manager hints.
git-gui: fix display of path in browser title
git-gui: enable the smart case sensitive search only if gui.search.smartcase is true
git-gui: catch invalid or complete regular expressions and treat as no match.
git-gui: theme the search and line-number entry fields on blame screen
git-gui: include the number of untracked files to stage when asking the user
...
* git://repo.or.cz/git-gui:
git-gui: incremental goto line in blame view
git-gui: clear the goto line input when hiding
git-gui: only accept numbers in the goto-line input
git-gui: search and linenumber input are mutual exclusive in the blame view
git-gui: deal with unknown files when pressing the "Stage Changed" button
git-gui: drop the 'n' and 'Shift-n' bindings from the last patch.
git-gui: Add keyboard shortcuts for search and goto commands in blame view.
git-gui: Enable jumping to a specific line number in blame view.
Fix tooltip display with multiple monitors on windows.
Fix typo: existant->existent
git-gui: updated translator README for current procedures.
git-gui: warn when trying to commit on a detached head
git-gui: Corrected a typo in the Swedish translation of 'Continue'
* 'master' of git://repo.or.cz/git-gui:
git-gui: apply color information from git diff output
git-gui: use wordprocessor tab style to ensure tabs work as expected
git-gui: correct assignment of work-tree
git-gui: use full dialog width for old name when renaming branch
git-gui: generic version trimming
git-gui: enable the Tk console when tracing/debugging on Windows
git-gui: show command-line errors in a messagebox on Windows
On Windows, avoid git-gui to call Cygwin's nice utility
* 'master' of git://repo.or.cz/git-gui:
git-gui 0.13
git-gui: avoid mis-encoding the copyright message on Windows.
git-gui: Update Swedish translation (521t).
git-gui: ensure correct application termination in git-gui--askpass
git-gui: handle textconv filter on Windows and in development
git-gui: use shell to launch textconv filter in "blame"
git-gui: display error launching blame as a message box.
git-gui: Make usage statement visible on Windows.
* git://repo.or.cz/git-gui:
git-gui: fix size and position of window panes on startup
git-gui: mc cannot be used before msgcat has been loaded
git-gui: use textconv filter for diff and blame
git-gui: Avoid using the <<Copy>> binding as a menu accelerator on win32
git-gui: fix shortcut creation on cygwin
git-gui: fix PATH environment for mingw development environment
git-gui: fix usage of _gitworktree when creating shortcut for windows
git-gui: fix "Explore Working Copy" for Windows again
git-gui: fix usage of themed widgets variable
git-gui: Handle failure of core.worktree to identify the working directory.
git-gui: check whether systems nice command works or disable it
* git://repo.or.cz/git-gui:
git-gui: update french translation
git-gui: update Japanese translation
git-gui: fix shortcut for menu "Commit/Revert Changes"
git-gui: Quote git path when starting another gui in a submodule
git-gui: update Italian translation
git-gui: Update Swedish translation (520t0f0u)
git-gui: use themed tk widgets with Tk 8.5
git-gui: Update German translation (12 new or changed strings).
git-gui: Update translation template
git-gui: Remove unused icon file_parttick
git-gui: use different icon for new and modified files in the index
git-gui: set GIT_DIR and GIT_WORK_TREE after setup
git-gui: update shortcut tools to use _gitworktree
git-gui: handle bare repos correctly
git-gui: handle non-standard worktree locations
git-gui: Support applying a range of changes at once
git-gui: Add a special diff popup menu for submodules
git-gui: Use git diff --submodule when available
* 'maint' of git://git.spearce.org/git-gui:
git-gui: work from the .git dir
git-gui: Fix applying a line when all following lines are deletions
git-gui: Correct file_states when unstaging partly staged entry
git-gui: Fix gitk for branch whose name matches local file
git-gui: Keep repo_config(gui.recentrepos) and .gitconfig in sync
git-gui: handle really long error messages in updateindex.
git-gui: Add hotkeys for "Unstage from commit" and "Revert changes"
git-gui: Makefile: consolidate .FORCE-* targets
* git://repo.or.cz/git-gui:
git-gui: suppress RenderBadPicture X error caused by Tk bug
git-gui: Increase blame viewer usability on MacOS.
git-gui: search 4 directories to improve statistic of gc hint
git gui: make current branch default in "remote delete branch" merge check
* git://repo.or.cz/git-gui:
git-gui: adjust the minimum height of diff pane for shorter screen height
git-gui: fix use of uninitialized variable
git-gui: store wm state and fix wm geometry
git-gui: Ensure submodule path is quoted properly
git-gui: fix diff for partially staged submodule changes
git-gui: Update russian translation
git-gui: Limit display to a maximum number of files
git-gui: remove warning when deleting correctly merged remote branch
git-gui: Added Greek translation & glossary
git-gui: display summary when showing diff of a submodule
* git://repo.or.cz/git-gui:
git-gui: Fixes for Mac OS X TkAqua
git-gui: Update Russian translation
git-gui: run post-checkout hook after clone
git-gui: Ensure consistent usage of mergetool.keepBackup
git-gui: fix use of undeclared variable diff_empty_count
git-gui (Win): make starting via "Git GUI Here" on .git/ possible
git-gui (Win): make "Explore Working Copy" more robust
git-gui: run post-checkout hook on checkout
git-gui: When calling post-commit hook wrong variable was cleared.
git-gui: use `git --html-path` to get the location of installed HTML docs
git-gui: fix deleting from the context menu with empty selection
git-gui: minor spelling fix and string factorisation.
git-gui: various French translation fixes
git-gui: Fix merge conflict display error when filename contains spaces
git-gui: don't hide the Browse button when resizing the repo chooser
Append ampersand to "Target" of lnk files created by do_cygwin_shortcut
git-gui: Support more git version notations.
git-gui: Avoid an infinite rescan loop in handle_empty_diff.
git-gui: Fix post-commit status with subject in non-locale encoding
* git://repo.or.cz/git-gui:
git-gui 0.12
git-gui: Get rid of the last remnants of GIT_CONFIG_LOCAL
git-gui: Update Hungarian translation for 0.12
git-gui: Fixed typos in Swedish translation.
git-gui: Updated Swedish translation (515t0f0u).
git gui: update Italian translation
git-gui: Update Japanese translation for 0.12
git-gui: Starting translation for Norwegian
git-gui: Update German (completed) translation.
git-gui: Update po template to include 'Mirroring %s' message
git-gui: Fix commit encoding handling.
git-gui: Fix handling of relative paths in blame.
* git://repo.or.cz/git-gui:
git-gui: Fix the search bar destruction handler.
Update the po template
git-gui: Implement automatic rescan after Tool execution.
git-gui: Allow Tools request arguments from the user.
git-gui: Add a Tools menu for arbitrary commands.
git-gui: Fix the after callback execution in rescan.
git-gui: Implement system-wide configuration handling.
git-gui: try to provide a window icon under X
* git://repo.or.cz/git-gui:
git-gui: Request blame metadata in utf-8.
git-gui: Add the Show SSH Key item to the clone dialog.
git-gui: Fix focus transition in the blame viewer.
* git://repo.or.cz/git-gui: (27 commits)
git-gui: Update German translation.
git-gui: Do not munge conflict marker lines in a normal diff
git-gui: Add a simple implementation of SSH_ASKPASS.
git-gui: Add a dialog that shows the OpenSSH public key.
git-gui: Mark-up strings in show_{other,unmerged}_diff() for localization
git-gui: Show a round number of bytes of large untracked text files
git-gui: Fix the blame viewer destroy handler.
git-gui: Add a search command to the blame viewer.
git-gui: Fix the blame window shape.
git-gui: Fix switch statement in lib/merge.tcl
git-gui: Fix fetching from remotes when adding them
git-gui: Fix removing non-pushable remotes
git-gui: Make input boxes in init/clone/open dialogs consistent
git-gui: Avoid using the term URL when specifying repositories
git-gui: gui.autoexplore makes explorer to pop up automatically after picking
git-gui: Add Explore Working Copy to the Repository menu
git-gui: Use git web--browser for web browsing
git-gui: mkdir -p when initializing new remote repository
git-gui: Add support for removing remotes
git-gui: Add support for adding remotes
...
Taylor Blau