Git patches six flaws, including code execution on recursive clones
Fixes ship in Git 2.56.1 and six older series; GitHub Enterprise Server should move to listed builds.
Stories per day · 30 days
3 RSS
Relatedgithub7supply-chain5code-execution4openai4pando3ai-agents2azure2coding-agents2infrastructure2acquisition1agentic-development1agentic-engineering1agents1ai-coding1ai-tools1anthropic1apache-commons-codec1api-keys1
40 stories, newest first · one card per story
Stories tagged #git
Pharo browser Git traffic can pass through a CORS proxy
Iceberg and Metacello requests, including push tokens, are visible to the proxy the user selects.
Claude Code approvals leak passwords and API keys to GitHub
Apiiro found 2,539 secrets in 1,994 public repositories from routine Claude approvals.
Apache Commons Codec GitIdentifiers collide on NUL entry names
Apache rates the flaw low; Codec 1.22.0 before 1.23.0 and one earlier commit range are affected.
GitHub rebuilds Git storage for thousands of concurrent agent writes
Internal tests reached 5,000 concurrent agents and 7,200 pushes per second on one repository.
OpenAI acquires Pierre Computer Company for Git tooling with AI coding agents
OpenAI buys Pierre Computer Company to improve Git workflows for developers and AI agents handling parallel code tasks.
OpenAI Builds Pando Git Backend After Codex Agents Overload Monorepo
OpenAI's Pando stores per-branch packfiles as immutable blobs to cut median push latency by 5x for AI agent workloads.
OpenAI builds Pando Git backend with AI agents
OpenAI deployed Pando, a new Git infrastructure built using Codex agents, supporting its monorepo with continuous security testing.
OpenAI builds Pando for scaling Git monorepo
OpenAI's Pando backend cuts median push latency by 5x while serving petabytes of Git data daily for Codex-driven development.
OmniDiff Rust Git difftool released
OmniDiff is a super fast content-aware Git difftool written in Rust and open sourced.
macOS git still trusts compromised eMudhra certificates after 10 days
macOS 27.2, released October 26, left git, curl, and python3 trusting the certificates and undid manual workarounds.
Entire launches a Git forge for agent-human collaboration
Trails score every push with agent evals, and gates can block merges until findings, human approval, and CI pass.
git-remote-https also hit by Brotli flaw CVE-2026-111497
The warning applies when libcurl is built with Brotli, and scans should include the older CURLOPT_ENCODING name.
GitHub puts nearly all repositories in Azure amid agent traffic
Per-reference quorums target the last 0.00001% of repos; tests saw 3–4x write throughput.
Redesigning source control at Anthropic
Anthropic built custom source control after daily merges jumped from 2,500 to over 30,000.
Quoting Geoffrey Huntley
Geoffrey Huntley fails commits that bypass his diagnostics library and prompts coding agents to comply.
CVE-2026-103412: Apache Camel Karavan: project file name path traversal when committing a project to Git
Apache Camel Karavan before 4.22.1 has high-severity path traversal CVE-2026-103412 via project file names written to Git.
Two AI-assisted research repos leave incomplete Git provenance
Co-Authored-By marked 66 of 121 AI-related commits in one repo and 1 of 39 agent-note commits in the other.
I got targeted: Trying to get your credentials via a git post-checkout hook
A fake client shared a Dropbox git repo whose post-checkout hook fetched and executed a remote binary.
1
Git 3.0's upcoming SHA-256 default will be a costly mistake
A GitButler post argues Git 3.0's SHA-1 to SHA-256 default will be costly with little security gain.
We want you to build the next Git platform on Cloudflare
Cloudflare asks developers to build an agent-native Git platform on Artifacts, now in open beta.
5
Gitea 28.0
Gitea 28.0 adds audit logs and bot accounts, withholding security-fix details for about a week.
commit-rewriter 0.2
commit-rewriter 0.2 adds support for rewriting commits on non-default git branches.
Radicle: Disclosure of Vulnerability in the Network Protocol
Radicle disclosed unencrypted node traffic and broken peer authentication affecting every released version.