From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752166AbbJEUn6 (ORCPT ); Mon, 5 Oct 2015 16:43:58 -0400 Received: from mail-pa0-f53.google.com ([209.85.220.53]:36470 "EHLO mail-pa0-f53.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751871AbbJEUn4 (ORCPT ); Mon, 5 Oct 2015 16:43:56 -0400 From: Junio C Hamano To: git@vger.kernel.org Cc: Linux Kernel Subject: [ANNOUNCE] Git v2.6.1, v2.5.4, v2.4.10 and v2.3.10 Date: Mon, 05 Oct 2015 13:43:54 -0700 Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The latest maintenance release Git v2.6.1, together with releases for older maintenance tracks, are now available at the usual places. The tarballs are found at: https://www.kernel.org/pub/software/scm/git/ The following public repositories all have a copy of the abovementioned tags: url = https://kernel.googlesource.com/pub/scm/git/git url = git://repo.or.cz/alt-git.git url = git://git.sourceforge.jp/gitroot/git-core/git.git url = git://git-core.git.sourceforge.net/gitroot/git-core/git-core url = https://github.com/gitster/git Fixes contained in these releases are as follows: * xdiff code we use to generate diffs is not prepared to handle extremely large files. It uses "int" in many places, which can overflow if we have a very large number of lines or even bytes in our input files, for example. Cap the input size to somewhere around 1GB for now. * Some protocols (like git-remote-ext) can execute arbitrary code found in the URL. The URLs that submodules use may come from arbitrary sources (e.g., .gitmodules files in a remote repository), and can hurt those who blindly enable recursive fetch. Restrict the allowed protocols to well known and safe ones. Kudos to Blake Burkhart and Jeff King for working on these fixes. Thanks.