git/git-gui/lib, branch v2.45.4

Merge branch 'js/fix-open-exec'

2025-05-23T21:04:31Z

This addresses CVE-2025-46835, Git GUI can create and overwrite a user's files: When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permission. Signed-off-by: Johannes Sixt

Merge branch 'ml/replace-auto-execok'

2025-05-23T21:04:30Z

This addresses CVE-2025-46334, Git GUI malicious command injection on Windows. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable always includes the current directory. The mentioned programs are invoked when the user selects "Git Bash" or "Browse Files" from the menu. Signed-off-by: Johannes Sixt

doc: switch links to https

2023-11-26T01:07:05Z

These sites offer https versions of their content. Using the https versions provides some protection for users. Signed-off-by: Josh Soref Signed-off-by: Junio C Hamano

Merge https://github.com/prati0100/git-gui

2023-08-24T16:57:43Z

* https://github.com/prati0100/git-gui: git-gui - use mkshortcut on Cygwin git-gui - use cygstart to browse on Cygwin git-gui - remove obsolete Cygwin specific code git gui Makefile - remove Cygwin modifications Makefiles: change search through $(MAKEFLAGS) for GNU make 4.4 Work around Tcl's default `PATH` lookup Move the `_which` function (almost) to the top Move is_ functions to the beginning is_Cygwin: avoid `exec`ing anything windows: ignore empty `PATH` elements git-gui: Fix a typo in README

Merge https://github.com/prati0100/git-gui

2021-03-04T20:38:50Z

* https://github.com/prati0100/git-gui: Revert "git-gui: remove lines starting with the comment character"

Merge https://github.com/prati0100/git-gui

2021-03-01T17:22:18Z

* https://github.com/prati0100/git-gui: git-gui: remove lines starting with the comment character git-gui: fix typo in russian locale

Merge https://github.com/prati0100/git-gui

2020-12-18T23:07:10Z

* https://github.com/prati0100/git-gui: git-gui: use gray background for inactive text widgets git-gui: Fix selected text colors Makefile: conditionally include GIT-VERSION-FILE git-gui: fix colored label backgrounds when using themed widgets git-gui: ssh-askpass: add a checkbox to show the input text git-gui: update Russian translation git-gui: use commit message template git-gui: Only touch GITGUI_MSG when needed

Merge https://github.com/prati0100/git-gui

2020-10-17T20:10:58Z

* https://github.com/prati0100/git-gui: git-gui: blame: prevent tool tips from sticking around after Command-Tab git-gui: improve dark mode support git-gui: fix mixed tabs and spaces; prefer tabs

Merge https://github.com/prati0100/git-gui into master

2020-07-20T19:04:06Z

* https://github.com/prati0100/git-gui: git-gui: allow opening work trees from the startup dialog

Merge https://github.com/prati0100/git-gui

2020-05-21T18:15:04Z

* https://github.com/prati0100/git-gui: git-gui: Handle Ctrl + BS/Del in the commit msg Subject: git-gui: fix syntax error because of missing semicolon