🚨 [security] Update git: 1.3.0 → 1.11.0 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ git (indirect, 1.3.0 → 1.11.0) · Repo · Changelog

Security Advisories 🚨

🚨 Command injection in ruby-git

The package git before 1.11.0 are vulnerable to Command Injection via
git argument injection. When calling the fetch(remote = 'origin', opts = {}) function,
the remote parameter is passed to the git fetch subcommand in a way that additional
flags can be set. The additional flags can be used to perform a command injection.

Release Notes

1.11.0

Full Changelog

• 292087e Supress unneeded test output (#570)
• 19dfe5e Add support for fetch options "--force/-f" and "--prune-tags/-P". (#563)
• 018d919 Fix bug when grepping lines that contain numbers surrounded by colons (#566)
• c04d16e remove from maintainer (#567)
• 291ca09 Address command line injection in Git::Lib#fetch
• 521b8e7 Release v1.10.2 (#561)

1.10.2

Full Changelog

• 57f941c Release v1.10.2
• c987a74 Add create-release, setup, and console dev scripts (#560)
• 12e3d03 Store tempfile objects to prevent deletion during tests (#555)

1.10.1

Full Changelog

• c7b12af Release v1.10.1
• ea28118 Properly escape double quotes in shell commands on Windows (#552)
• db060fc Properly unescape diff paths (#504)
• ea47044 Add Ruby 3.0 to CI build (#547)
• cb01d2b Create a Docker image to run the changelog (#546)

1.10.0

Full Changelog

• 8acec7d Release v1.10.0 (#545)
• 8feb4ff Refactor directory initialization (#544)
• 3884314 Add -ff option to git clean (#529)
• 984ff7f #533 Add --depth options for fetch call (#534)
• 6cba37e Add support for git init --initial-branch=main argument (#539)
• ff98c42 Add support for the git merge --no-commit argument (#538)
• 1023f85 Require pathname module (#536)

1.9.1

Full Changelog

• 58100b0 Release v1.9.1 (#527)
• 45aeac9 Fix the gpg_sign commit option (#525)

1.9.0

Full Changelog

• 07a1167 Release v1.9.0 (#524)
• 8fe479b Fix worktree test when git dir includes symlinks (#522)
• 0cef8ac feat: add --gpg-sign option on commits (#518)
• 765df7c Adds file option to config_set to allow adding to specific git-config files (#458)
• 8cd523a Add "g.current_branch" to Readme.md (#519)
• 98270b6 use spaces instead of tab (#517)
• e2fd4af test: git show should not chomp results (#513)
• bd026d3 Remove JRuby on Windows workaround (#511)
• d1b1711 Add gem build, install, and sanity test to CI build (#509)

1.8.1

Full Changelog

• 3c66e2b Release v1.8.1 (#508)
• 53a03c4 Add all appropriate files (excluding tests) to the gem (#507)

1.8.0

Full Changelog

• 352f688 Release v1.8.0 (#505)
• 12f908c Add YARD documentation to ruby-git (#502)
• a25eb1a Add cherry support to Git::Log (#97)
• 181ace3 Fix Git module config method (#399)
• a1202eb Allow a logger to be passed to Git.clone (#501)
• 246af64 Update index before fetching modified files (#409)
• 8345fec Fix issues with a HEREDOC entry in git.status (#385)
• 0593e4f Add no-ff merge option. (#471)
• b2f8845 Support arbitrary object name lengths (set with core.abbrev)
• 8b3bd25 Do not call chomp! on an IO object (#500)
• c81cc03 Calculate the default for index relative to git_dir instead of work_tree (#499)
• d31709b Clean Code Examples in README (#456)
• dbcd8e0 Switch CI from Travis to GitHub Actions (#498)
• f9abb18 Allow users to provide '--refs' to 'ls-remote' (#494)
• 55424e5 Fix keyword arg deprecation warning introduced in PR #368 (#493)
• 7afaeab Do not always chomp output (#368)
• 1b5256c Windows/JRuby fixes/tests/refactorings/travis-ci (#480)
• d1908f6 Add worktree functionality (#479)
• 896e31d Add commit --allow-empty-message option and fix empty message parsing in process_commit_log_data (#482)
• 8766dca Added ruby-2.7 to .travis.yml (#483)

1.7.0

Full Changelog

• 2302673 Release v1.7.0
• b8c6320 Disable GPG Signing in Test Config (#467)
• 861eb71 Add no verify for commit with documentation (#454)
• f3b439d Fix hash keys in #describe (#415)
• 9f8e1c8 README: Use SVG Badge (#457)
• 5391aef Git::Lib#normalize_encoding early return fix (#461)
• 2b9629d Remove extraneous '--' from git stash save -- message
• af4902b Fix Ruby 2.7 Deprecation Warning About Keyword Args (#453)
• c10ca28 Fix issue with color escape codes after recent update of git binaries (#427)
• c85dd82 Fix describe command's dirty, abbrev, candidates, and match options (#447)
• e0a385f Fix broken link in a PR template (#444, #446)

1.6.0

Full Changelog

• 49db88b Release v1.6.0 (#443)
• 7e5bdc9 Add James Couball to the maintainers list. (#437)
• 5fadba8 Update instructions for making contributions (#438)
• e44c18e Removed blank after method name to fix warning (#439)
• e40e074 Include version.rb, providing Git::VERSION (#436)

1.5.0

Full Changelog

• fd2642a Release v1.5.0
• 6d5bacd removing un-needed file as we are now using Git::VERSION from inside the lib/git (#379)
• 9341416 using File as a block so that it tears down once everything has completed, adding a API directly in stashes, and adding testing around it. (#378)
• 7ff5d78 Support 'push --delete' (#325)
• f911c26 commit with custom author date (#374)
• 3bbf612 Check if branch contains commit (#174)
• 27715e9 .travis.yml: Update supported Ruby versions (#371)
• d5b0ec0 process_full_diff: Don't reencode diffs which are already UTF-8 (#369)
• 4435e08 config_get: Fix incorrect block name (#373)
• e7f1880 Allow fetch operation to receive a ref param (#362)
• d1ab2c7 Fix space prefix in tag message (#316)
• 4aa6d1f Creates CONTRIBUTOR and MAINTAINERS files (#353)

1.4.0

Full Changelog

• c8d1012 Release 1.4.0
• 64c6fa0 Update gemspec (#366)
• b48231e Enable set url on remotes (#338)
• 819d0d8 Enable mirror option for git clone and push (#342)
• fe680f8 Fix UTF-8 message errors (#327)
• 667de5a Added probot stale config (#354)
• a6288fc Tweaking yaml build to reveal git version (#356)
• 5507d98 Fix ls-files for git 2.16 (#350)
• 4686675 Added boolean functions for git status (#348)
• 47e3f07 Travis: Fixed unit tests to run again (#344)
• 7dde1c7 Whitespace fixes.
• 37b38b5 Update README.md

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 rchardet (added, 1.8.0)

---

👉 No CI detected

You don't seem to have any Continuous Integration service set up!

Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.

This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:

• Circle CI, Semaphore and Travis-CI are all excellent options.
• If you use something like Jenkins, make sure that you're using the Github integration correctly so that it reports status data back to Github.
• If you have already set up a CI for this repository, you might need to check your configuration. Make sure it will run on all new branches. If you don’t want it to run on every branch, you can whitelist branches starting with depfu/.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)