3.2.1

What's Changed

• prepare for next release, v3.2 by @Byron in #2260
• objects: decode a byte mode before reading its digits by @SashaMIT in #2261
• build(deps): bump http://github.com/astral-sh/ruff-pre-commit from v0.16.5 to 0.16.9 in the pre-commit group by @dependabot[bot] in #2263
• fix(submodule): validate destinations before mutation by @Byron in #2264
• fix(util): create lock files in one exclusive step by @radhika1314 in #2267
• fix(commit): accumulate gpgsig continuation lines in linear time by @Keerthana-64 in #2268
• fix(index): accept a single PathLike in checkout by @kokotatan in #2269
• fix(util): redact URL credentials without corrupting the host by @yunaremaia in #2270
• change line for changelogs by @CrowZhen in #2272
• fix(commit): reject identity fields that alter commit headers by @Keerthana-64 in #2271
• fix: stop stalled remote commands when their timeout expires by @Byron in #2277
• fix(util): reject symbolic links that alias .gitmodules by @Keerthana-64 in #2278
• fix: send one object name or path per git stdin record by @Keerthana-64 in #2279
• fix(stats): preserve whitespace in filenames by @v1shay in #2280
• fix(config): preserve exact large integer values by @xiehuanyi in #2281
• fix: resolve IterableList names independently of list attributes by @FanWu-ai in #2283
• fix relative blocking lock 20261011 by @Byron in #2284

New Contributors

• @SashaMIT made their first contribution in #2261
• @kokotatan made their first contribution in #2269
• @yunaremaia made their first contribution in #2270
• @CrowZhen made their first contribution in #2272
• @v1shay made their first contribution in #2280
• @xiehuanyi made their first contribution in #2281
• @FanWu-ai made their first contribution in #2283

Full Changelog: 3.2.0...3.2.1

3.2.0 - Security

What's Changed

• test: cover subdirectory discovery and pathspec commands in bare-repository worktrees by @christianvuerings in #2228
• Read git's yes/no and on/off booleans in get_value by @rawsun007 in #2229
• Clarify detached HEAD access and isolate test branch state by @Byron in #2231
• Reject submodule move destinations through intermediate symlinks by @Byron in #2232
• fix: validate checkout positional reference options by @Byron in #2233
• Fix timeout child-process lookup on non-GNU systems by @aprylewu in #2236
• Preserve implicit boolean config keys by @Byron in #2238
• Reject comments after implicit boolean config keys by @Byron in #2239
• Fix case-insensitive Git config name matching by @Byron in #2241
• Move project metadata to pyproject.toml by @mwtoews in #2242
• Move [doc] extra to a PEP 735 dependency group; add uv-sync CI check by @mwtoews in #2243
• fix: strip inline config comments the way git does by @rawsun007 in #2245
• Drop Python 3.7 by @mwtoews in #2246
• fix: preserve positional operands in high-level Git commands by @Byron in #2247
• submodule: option to update without fetching by @jeffro256 in #2244
• bump minor version to indicate drop of python 3.7 support by @Byron in #2248
• fix: skip a UTF-8 BOM when reading config files by @geek-alpha in #2249
• fix: complete safety checks in Git command wrappers by @Byron in #2251
• build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 by @dependabot[bot] in #2252
• fix: bound actor and date parsing by @Byron in #2253
• fix(repo): preserve literal separate Git directory paths by @Byron in #2255
• fix: validate object types when loading binary SHAs by @Byron in #2256
• fix(commit): bound co_authors trailer parsing by @Keerthana-64 in #2257
• various fixes by @Byron in #2258
• fix(config): bound option-line parsing by @radhika1314 in #2259

New Contributors

• @christianvuerings made their first contribution in #2228
• @rawsun007 made their first contribution in #2229
• @aprylewu made their first contribution in #2236
• @mwtoews made their first contribution in #2242
• @jeffro256 made their first contribution in #2244
• @geek-alpha made their first contribution in #2249
• @Keerthana-64 made their first contribution in #2257
• @radhika1314 made their first contribution in #2259

Full Changelog: 3.1.62...3.2.0

3.1.62

What's Changed

• prepare next release by @Byron in #2222
• Keep bare-repository worktrees non-bare by @Byron in #2224
• Reject unsafe submodule checkout paths by @Byron in #2225
• build(deps): bump http://github.com/astral-sh/ruff-pre-commit from v0.16.0 to 0.16.5 in the pre-commit group by @dependabot[bot] in #2226
• fix: join backslash line continuations when reading config values by @nkbeast in #2227

New Contributors

• @nkbeast made their first contribution in #2227

Full Changelog: 3.1.61...3.1.62

3.1.61

Fix accidental removal of exploitable regex in Actor by bringing it back, and deprecating it.

What's Changed

• Fix repository discovery precedence by @Byron in #2218
• fix: wait for git daemon to listen before connecting by @Vogtinator in #2219
• fix: restore Actor.name_email_regex by @Byron in #2221

New Contributors

• @Vogtinator made their first contribution in #2219

Full Changelog: 3.1.60...3.1.61

3.1.60 Security

What's Changed

• prepare changelog prior to release by @Byron in #2212
• Preserve Git config escape semantics by @Byron in #2213
• Harden diff path and actor identity parsing by @Byron in #2215
• Require explicit opt-in for filesystem diffs by @Byron in #2217

Full Changelog: 3.1.59...3.1.60

3.1.59 - Security

What's Changed

• prepare changelog for upcoming release by @Byron in #2207
• Block file-reading Git options by @Byron in #2208
• index: write blobs via git hash-object, not gitdb's odb.store by @caroescm in #2209
• Block separate git directories during clone by @Byron in #2210
• fix: harden config parsing boundaries by @Byron in #2211
• repo.index.add() now respects worktree filters #2209

Full Changelog: 3.1.58...3.1.59

3.1.58 - Security and Fixes

What's Changed

• test: allow Python startup before timeout by @Byron in #2195
• Resolve Windows hook Bash through PATH by @Byron in #2199
• Revert "Resolve Windows hook Bash through PATH" by @Byron in #2200
• test: focus pytest summary on unexpected failures by @raisulchowdhury in #2203
• Validate submodule names before filesystem operations by @Byron in #2202
• Handle invalid submodule names during recursive updates by @Byron in #2205
• Fix Windows path handling on Python 3.13+ by @Byron in #2196
• fixup 2202 by @Byron in #2206
• Correct Windows hook Bash precedence by @Byron in #2201
• Harden config and Git option validation by @Byron in #2204
• Skip tests that need symlink privileges instead of erroring by @Cyrus580529 in #2197

New Contributors

• @raisulchowdhury made their first contribution in #2203
• @Cyrus580529 made their first contribution in #2197

Full Changelog: 3.1.57...3.1.58

3.1.57 - Security and Fixes

What's Changed

• Merge gitdb and smmap into the GitPython repository by @Byron in #2179
• build(deps): bump actions/setup-python from 6 to 7 by @dependabot[bot] in #2185
• build(deps): bump the pre-commit group with 2 updates by @dependabot[bot] in #2186
• Bump Vampire/setup-wsl from 6.0.0 to 7.0.0 by @dependabot[bot] in #2124
• Render protected Traversable methods in the reference by @pick7 in #2192
• Use standard prefixes for parsed patch diffs by @pick7 in #2191
• Honor kill_after_timeout with output streams by @pick7 in #2189
• Redact Authorization extra headers from command errors by @pick7 in #2188
• Improve RemoteProgress parse return typing by @pick7 in #2187
• Adopt basedpyright with a legacy baseline by @Byron in #2194
• Block unsafe Git file and URL options by @Byron in #2193

New Contributors

• @pick7 made their first contribution in #2192

Full Changelog: 3.1.56...3.1.57

3.1.56 - SECURITY

What's Changed

• Add support for Python 3.15 by @hugovk in #2183
• fix: reject unsafe output options in Commit.count by @Byron in #2184

Full Changelog: 3.1.55...3.1.56

3.1.55 - Security

What's Changed

• fix: prevent environment expansion in remote URLs by @Byron in #2181

Full Changelog: 3.1.54...3.1.55