| 1 | Git v2.13.6 Release Notes |
| 2 | ========================= |
| 3 | |
| 4 | Fixes since v2.13.5 |
| 5 | ------------------- |
| 6 | |
| 7 | * "git cvsserver" no longer is invoked by "git daemon" by default, |
| 8 | as it is old and largely unmaintained. |
| 9 | |
| 10 | * Various Perl scripts did not use safe_pipe_capture() instead of |
| 11 | backticks, leaving them susceptible to end-user input. They have |
| 12 | been corrected. |
| 13 | |
| 14 | Credits go to joernchen <joernchen@phenoelit.de> for finding the |
| 15 | unsafe constructs in "git cvsserver", and to Jeff King at GitHub for |
| 16 | finding and fixing instances of the same issue in other scripts. |
| 17 |