git/Documentation/config, branch next

Merge branch 'js/adjust-tests-to-explicitly-access-bare-repo' into next

2026-05-13T03:21:27Z

Some tests assume that bare repository accesses are by default allowed; rewrite some of them to avoid the assumption, rewrite others to explicitly set safe.bareRepository to allow them. * js/adjust-tests-to-explicitly-access-bare-repo: safe.bareRepository: default to "explicit" with WITH_BREAKING_CHANGES status tests: filter `.gitconfig` from status output ls-files tests: filter `.gitconfig` from `--others` output t5601: restore `.gitconfig` after includeIf test t1305: use `--git-dir=.` for bare repo in include cycle test t1300: remove global config settings injected by test-lib.sh t7900: do not let `$HOME/.gitconfig` interfere with XDG tests test-lib: allow bare repository access when breaking changes are enabled

Merge branch 'mc/http-emptyauth-negotiate-fix' into next

2026-05-12T02:07:46Z

The 'http.emptyAuth=auto' configuration now correctly attempts Negotiate authentication before falling back to manual credentials. This allows seamless Kerberos ticket-based authentication without requiring users to explicitly set 'http.emptyAuth=true'. * mc/http-emptyauth-negotiate-fix: doc: clarify http.emptyAuth values

Merge branch 'mf/format-patch-cover-letter-format-docfix' into next

2026-05-11T01:08:25Z

Docfix. * mf/format-patch-cover-letter-format-docfix: Fix docs for format.commitListFormat

doc: clarify http.emptyAuth values

2026-05-01T05:01:57Z

The existing description of http.emptyAuth explains the purpose of the setting but never says what values it accepts. Readers have to infer from context (or read the source) that it takes 'true', 'false', or 'auto', and what each one means. Document the three accepted values explicitly: * 'auto' (the default) only sends empty credentials when the server's 401 response advertises a mechanism that requires them, such as GSS-Negotiate. This matches the long-standing auto-detection behaviour added in 40a18fc77c (http: add an "auto" mode for http.emptyauth, 2017-02-25). * 'true' unconditionally sends empty credentials on the very first request, before any 401 response, for callers that know they want this behaviour up front. * 'false' disables the feature entirely; mechanisms that depend on empty credentials, such as GSS-Negotiate, will not work in this mode. Signed-off-by: Matthew John Cheetham Signed-off-by: Junio C Hamano

safe.bareRepository: default to "explicit" with WITH_BREAKING_CHANGES

2026-04-27T05:50:54Z

When an attacker can convince a user to clone a crafted repository that contains an embedded bare repository with malicious hooks, any Git command the user runs after entering that subdirectory will discover the bare repository and execute the hooks. The user does not even need to run a Git command explicitly: many shell prompts run `git status` in the background to display branch and dirty state information, and `git status` in turn may invoke the fsmonitor hook if so configured, making the user vulnerable the moment they `cd` into the directory. The `safe.bareRepository` configuration variable (introduced in 8959555cee7e (setup_git_directory(): add an owner check for the top-level directory, 2022-03-02)) already provides protection against this attack vector by allowing users to set it to "explicit", but the default remained "all" for backwards compatibility. Since Git 3.0 is the natural point to change defaults to safer values, flip the default from "all" to "explicit" when built with `WITH_BREAKING_CHANGES`. This means Git will refuse to work with bare repositories that are discovered implicitly by walking up the directory tree. Bare repositories specified via `--git-dir` or `GIT_DIR` continue to work, and directories that look like `.git`, worktrees, or submodule directories are unaffected (the existing `is_implicit_bare_repo()` whitelist handles those cases). Users who rely on implicit bare repository discovery can restore the previous behavior by setting `safe.bareRepository=all` in their global or system configuration. The test for the "safe.bareRepository in the repository" scenario needed a more involved fix: it writes a `safe.bareRepository=all` entry into the bare repository's own config to verify that repo-local config does not override the protected (global) setting. Previously, `test_config -C` was used to write that entry, but its cleanup runs `git -C config --unset`, which itself fails when the default is "explicit" and the global config has already been cleaned up. Switching to direct git config --file access avoids going through repository discovery entirely. Signed-off-by: Johannes Schindelin Signed-off-by: Junio C Hamano

Fix docs for format.commitListFormat

2026-04-22T23:16:24Z

When renaming the option --cover-letter-format to --commit-list-format we forgot to rename the opton in the section too. Fix it. Signed-off-by: Mirko Faina Signed-off-by: Junio C Hamano

Sync with 'master'

2026-04-17T04:28:09Z

doc: fix grammar errors in submodule description

2026-04-17T04:22:01Z

6cc6d1b4c699 (Documentation: update add --force option + ignore=all config, 2026-02-06) added text describing both the ignore=none and ignore=all behaviors. The former had minor formatting and grammatical errors, while the latter was a bit garbled. I have tried to tweak the wording on the latter to make it read as I think was intended, and fixed the minor grammatical issues with both as well. Signed-off-by: Elijah Newren Signed-off-by: Junio C Hamano

doc: fix plural agreement in pack.preferBitmapTips

2026-04-17T04:22:01Z

hierarchies -> hierarchy Signed-off-by: Elijah Newren Signed-off-by: Junio C Hamano

doc: fix self-referential config in sendemail.smtpSSLClientKey

2026-04-17T04:22:01Z

a8215a205141 (send-email: add client certificate options, 2026-03-02) added documentation for sendemail.smtpSSLClientKey that says it works "in conjunction with `sendemail.smtpSSLClientKey`" -- referring to itself. It appears that `sendemail.smtpSSLClientCert` was the intended reference; fix it. Signed-off-by: Elijah Newren Signed-off-by: Junio C Hamano