Git for Windows v2.41.0-rc0.windows.1

Changes since Git for Windows v2.40.1 (April 25th 2023)

As announced previously, Git for Windows will drop support for Windows 7 and for Windows 8 in one of the next versions, following Cygwin's and MSYS2's lead (Git for Windows relies on MSYS2 for components such as Bash and Perl).

Following the footsteps of the MSYS2 and Cygwin projects on which Git for Windows depends, the 32-bit variant of Git for Windows is being phased out. As of Git for Windows v2.41.0, the 32-bit variant of the POSIX emulation layer (known as "MSYS2 runtime", powering Git Bash among other components shipped with Git for Windows) is in maintenance mode and will only see security bug fixes (if any). Users relying on 32-bit Git for Windows are highly encouraged to switch to the 64-bit version whenever possible.

Please also note that the code-signing certificate used to sign Git for Windows' executables was renewed and may cause Smart Screen to show a warning until the certificate has gained a certain minimum reputation.

New Features

• Comes with Git v2.41.0-rc0.
• Comes with OpenSSH v9.3p1
• Comes with cURL v8.0.1.
• Comes with MinTTY v3.6.4.
• The Git for Windows installer now also includes the Git LFS documentation (i.e. git help git-lfs now works).
• Comes with Perl v5.36.1.
• Comes with GNU Privacy Guard v2.2.41.
• Comes with Git Credential Manager v2.1.2.
• Comes with MSYS2 runtime (Git for Windows flavor) based on Cygwin 3.4.6. (This does not extend to 32-bit Git for Windows, which is stuck with v3.3.* of the MSYS2 runtime forever.)
• To help with Git for Windows' release mechanics, Git for Windows now ships with two variants of libcurl.

Bug Fixes

• Git GUI's Repository>Explore Working Copy was broken since v2.39.1, which has been fixed.

Filename	SHA-256
Git-2.41.0-rc0-64-bit.exe	7b0bfa1e1e059f7bc5e5a5a172f3da0fac8e1f5b6011366527ed6afcc50a82aa
Git-2.41.0-rc0-32-bit.exe	2048117413bdda01eaa358f9451973876e0e06b7011fe0636f8df794b6b5ad8f
PortableGit-2.41.0-rc0-64-bit.7z.exe	09085f5414f97e406b13a023482684d2728bb9788eca687dbf19434ab157ef96
PortableGit-2.41.0-rc0-32-bit.7z.exe	cff7a350d6b312112b1cf4eb33344f37a6c85bdca8dc07ce90a23752b01abd47
MinGit-2.41.0-rc0-64-bit.zip	7b45fc53600f19008d322848305551fbc5600136caae0769ee6d10774c3688a4
MinGit-2.41.0-rc0-32-bit.zip	c49966732c4ba4b8c76057c2ebc13981f39be728c454aaf5849db3833ce049a9
MinGit-2.41.0-rc0-busybox-64-bit.zip	8792014287b6327bccec16f1ad7d970b10f0566b667f40c57462e6e27b98e0fd
MinGit-2.41.0-rc0-busybox-32-bit.zip	67030d81d36caf0febab51d0fd1e3f20d2441197b3ca306d41f5f7658c3399a1
Git-2.41.0-rc0-64-bit.tar.bz2	e741dc0cc7211e974d588f624fa566a4b92e50317e3f735894b443583c8e5d0e
Git-2.41.0-rc0-32-bit.tar.bz2	0c0a97258b36b1054c97379b59ad5fe674e539d366618e7df1bc2e20e5666c5d

Git for Windows 2.40.1

Changes since Git for Windows v2.40.0 (March 14th 2023)

This is a security release, addressing CVE-2023-29012, CVE-2023-29011, CVE-2023-29007, CVE-2023-25815 and CVE-2023-25652.

As announced previously, Git for Windows will drop support for Windows 7 and for Windows 8 in one of the next versions, following Cygwin's and MSYS2's lead (Git for Windows relies on MSYS2 for components such as Bash and Perl).

Also following the footsteps of the MSYS2 and Cygwin projects on which Git for Windows depends, the 32-bit variant of Git for Windows is nearing its end of support.

New Features

• Comes with Git v2.40.1.

Bug Fixes

• Addresses CVE-2023-29012, a vulnerability where starting Git CMD would execute doskey.exe in the current directory, if it exists.
• Addresses CVE-2023-29011, a vulnerability where the SOCKS5 proxy called connect.exe is susceptible to picking up an untrusted configuration on multi-user machines.
• Addresses CVE-2023-29007, a vulnerability where git submodule deinit can inadvertently introduce malicious changes into the Git config file.
• Addresses CVE-2023-25815, a vulnerability where Git can unexpectedly show crafted "localized" messages written by another user on a multi-user machine.
• Addresses CVE-2023-25652, a vulnerability where git apply --reject could follow symbolic links to write files outside the worktree.

Filename	SHA-256
Git-2.40.1-64-bit.exe	d2f0fbf9d84622b2aa4aed401daf6dedb8ac89bb388af02078ba375496a873dc
Git-2.40.1-32-bit.exe	3ee2289a4f6e9917f702bd032a67874c11aa05bf2d28d967986e40d4f7f50636
PortableGit-2.40.1-64-bit.7z.exe	9e1d819aef3284420adf6d923b0d4865254bd403641d915975e49ddea1e7cdf9
PortableGit-2.40.1-32-bit.7z.exe	e1360e94cb292862fb023018578a1029022a09278b160f7264c6dc444f65c9ca
MinGit-2.40.1-64-bit.zip	36498716572394918625476ca207df3d5f8b535a669e9aad7a99919d0179848c
MinGit-2.40.1-32-bit.zip	8bfc48e5211cc209768297e0b71c253b2d8393875d7b3daef8c54909634daa16
MinGit-2.40.1-busybox-64-bit.zip	8c829d6f3ae0d48e5939b7ddccbaea44b8ef2a38f9e28c3afa691e0451432b14
MinGit-2.40.1-busybox-32-bit.zip	e31c73c0b7d3546fba54e9416bf4ce850ea7e528eb6c8b059fdd941ad78749c7
Git-2.40.1-64-bit.tar.bz2	249b3f31b14b802c26e64f082131fe3346af7de204a897438a0027b67fdcd0b7
Git-2.40.1-32-bit.tar.bz2	be7c1b51bc30187a28d77e5f71e5bbcd768b2d0021ba11ad26178f08920533fb

MinGit v2.39.3.windows.1

MinGit for Windows v2.39.3

Changes since Git for Windows v2.39.2 (February 14th 2023):

Bug Fixes

* CVE-2023-25652:

  By feeding specially crafted input to `git apply --reject`, a
  path outside the working tree can be overwritten with partially
  controlled contents (corresponding to the rejected hunk(s) from
  the given patch).

* CVE-2023-25815:

  When Git is compiled with runtime prefix support and runs without
  translated messages, it still used the gettext machinery to
  display messages, which subsequently potentially looked for
  translated messages in unexpected places. This allowed for
  malicious placement of crafted messages.

* CVE-2023-29007:

  When renaming or deleting a section from a configuration file,
  certain malicious configuration values may be misinterpreted as
  the beginning of a new configuration section, leading to arbitrary
  configuration injection.

Git for Windows v2.40.0.windows.1

Changes since Git for Windows v2.39.2 (February 14th 2023)

As announced previously, Git for Windows will drop support for Windows 7 and for Windows 8 in one of the next versions, following Cygwin's and MSYS2's lead (Git for Windows relies on MSYS2 for components such as Bash and Perl).

Also following the footsteps of the MSYS2 and Cygwin projects on which Git for Windows depends, the 32-bit variant of Git for Windows is nearing its end of support.

New Features

• Comes with Git v2.40.0.
• In the olden Git days, there were "dashed" Git commands (e.g. git-commit instead of git commit). These haven't been supported for interactive use in a really, really long time. But they still worked in Git aliases and hooks ("scripts"). Since Git v1.5.4 (released on February 2nd, 2008), it was discouraged/deprecated to use dashed Git commands even in scripts. As of this version, Git for Windows no longer supports these dashed commands.
• Comes with tig v2.5.8.
• Comes with Bash v5.2 patchlevel 15.
• Comes with OpenSSL v1.1.1t.
• Comes with GNU TLS v3.8.0.
• Comes with cURL v7.88.1.
• Comes with libfido2 v1.13.0.
• Comes with Git Credential Manager v2.0.935.

Bug Fixes

• Some commands mishandled absolute paths near the drive root (e.g. scalar unregister C:/foo), which has been fixed.
• When trying to call Cygwin (or for that matter, MSYS2) programs from Git Bash, users would frequently be greeted with cryptic error messages about a "cygheap" or even just an even more puzzling exit code 127. Many of these calls now succeed, allowing basic interactions. While it is still not possible for, say, Cygwin's vim.exe to interact with the Git Bash's terminal window, it is now possible for Cygwin's zstd.exe in conjuction with Git for Windows' tar.exe to handle .tar.zst archives.

Filename	SHA-256
Git-2.40.0-64-bit.exe	ff8954afb29814821e9e3759a761bdac49186085e916fa354bf8706e3c7fe7a2
Git-2.40.0-32-bit.exe	9b14e05c3ea00c51dc38838db23fccc6ccb21bfd42ed078bf406857fb47688d6
PortableGit-2.40.0-64-bit.7z.exe	9031c171fccbf30113b8a9b93b9580b4aca8502dcf2b22c5cd3205212e895b13
PortableGit-2.40.0-32-bit.7z.exe	dc4b824412ee814fb310511921f3748631f3e6cd64c44866e38b3811e8e6dd01
MinGit-2.40.0-64-bit.zip	f3e898f8856e80c66b367c80396c6debc46ae0b258ab9fd00ee08b4812c8f987
MinGit-2.40.0-32-bit.zip	51f40ccffc08485c80bbe9d54a4ad08e1ef47c6198dc0801039569a8468a6d02
MinGit-2.40.0-busybox-64-bit.zip	2051be40681824f0e582b2fab362cbd7d3cc510fca9997582d8baf6fa30f3fbc
MinGit-2.40.0-busybox-32-bit.zip	1a1799effcc53c83bf9c57783ae3ef761dfe61bceaeaa179d205456f541931b0
Git-2.40.0-64-bit.tar.bz2	d39c1d419479480fc7c1944e19a91b0ca331a4942cdb7c156cf226bba34d2af8
Git-2.40.0-32-bit.tar.bz2	9f33238ed9c75f7a61fbcb7f449eaa40f871e0f59816178c0fca95d16d6827d3

Git for Windows v2.40.0-rc2.windows.1

Changes since Git for Windows v2.39.2 (February 14th 2023)

As announced previously, Git for Windows will drop support for Windows 7 and for Windows 8 in one of the next versions, following Cygwin's and MSYS2's lead (Git for Windows relies on MSYS2 for components such as Bash and Perl).

Also following the footsteps of the MSYS2 and Cygwin projects on which Git for Windows depends, the 32-bit variant of Git for Windows is nearing its end of support.

New Features

• Comes with Git v2.40.0-rc2.
• In the olden Git days, there were "dashed" Git commands (e.g. git-commit instead of git commit). These haven't been supported for interactive use in a really, really long time. But they still worked in Git aliases and hooks ("scripts"). Since Git v1.5.4 (released on February 2nd, 2008), it was discouraged/deprecated to use dashed Git commands even in scripts. As of this version, Git for Windows no longer supports these dashed commands.
• Comes with tig v2.5.8.
• Comes with Bash v5.2 patchlevel 15.
• Comes with OpenSSL v1.1.1t.
• Comes with GNU TLS v3.8.0.
• Comes with cURL v7.88.1.
• Comes with libfido2 v1.13.0.
• Comes with Git Credential Manager v2.0.935.

Bug Fixes

• Some commands mishandled absolute paths near the drive root (e.g. scalar unregister C:/foo), which has been fixed.
• When trying to call Cygwin (or for that matter, MSYS2) programs from Git Bash, users would frequently be greeted with cryptic error messages about a "cygheap" or even just an even more puzzling exit code 127. Many of these calls now succeed, allowing basic interactions. While it is still not possible for, say, Cygwin's vim.exe to interact with the Git Bash's terminal window, it is now possible for Cygwin's zstd.exe in conjuction with Git for Windows' tar.exe to handle .tar.zst archives.

Filename	SHA-256
Git-2.40.0-rc2-64-bit.exe	a9854cbbb47c826f5d0aec45d96c113dcf88c94ce70a9bf0749a2b04f1fb6b09
Git-2.40.0-rc2-32-bit.exe	2a4b040f7aa20d9ec996159dfc7cb566e783d4fc6722c3916b0fd61e869e8f60
PortableGit-2.40.0-rc2-64-bit.7z.exe	0c40e61a96ddd624b8125e3b542b8a26b6d86ff2204f8645d43782190e2f74ae
PortableGit-2.40.0-rc2-32-bit.7z.exe	d771f24ffc9f4d960986a132bef2045af406ffc4abf78d54e3f8ac56c19668ff
MinGit-2.40.0-rc2-64-bit.zip	de257f4ac5872a5864eca7476201a00f5b827a329933f7a7339bc67026d0bd5c
MinGit-2.40.0-rc2-32-bit.zip	fc02caeb1502a27575ff1bbd8dcae49a76793944be451e639821b4c8bd25f954
MinGit-2.40.0-rc2-busybox-64-bit.zip	9cb55ff1fbb03ce81acf69408db00a103b32c54009fd4b9515d70b50bb56cc51
MinGit-2.40.0-rc2-busybox-32-bit.zip	af2fb84fc9f0104f02bb310a44a448da9b0a85b42cd0daba67e1641d0a85bba0
Git-2.40.0-rc2-64-bit.tar.bz2	ee3f3a9a79eb862eeedcc06a35c2ca5e4f0903a476d0ae2d0c55add4b20065be
Git-2.40.0-rc2-32-bit.tar.bz2	ddd8d7654b394cc7cc2ff825f73ab086bb3e43bea38ec5996e9ab4a7405ae58a

Git for Windows v2.40.0-rc1.windows.1

Changes since Git for Windows v2.39.2 (February 14th 2023)

As announced previously, Git for Windows will drop support for Windows 7 and for Windows 8 in one of the next versions, following Cygwin's and MSYS2's lead (Git for Windows relies on MSYS2 for components such as Bash and Perl).

Also following the footsteps of the MSYS2 and Cygwin projects on which Git for Windows depends, the 32-bit variant of Git for Windows is nearing its end of support.

New Features

• Comes with Git v2.40.0-rc1.
• In the olden Git days, there were "dashed" Git commands (e.g. git-commit instead of git commit). These haven't been supported for interactive use in a really, really long time. But they still worked in Git aliases and hooks ("scripts"). Since Git v1.5.4 (released on February 2nd, 2008), it was discouraged/deprecated to use dashed Git commands even in scripts. As of this version, Git for Windows no longer supports these dashed commands.
• Comes with tig v2.5.8.
• Comes with Bash v5.2 patchlevel 15.
• Comes with OpenSSL v1.1.1t.
• Comes with GNU TLS v3.8.0.
• Comes with cURL v7.88.1.
• Comes with libfido2 v1.13.0.
• Comes with Git Credential Manager v2.0.935.

Bug Fixes

• Some commands mishandled absolute paths near the drive root (e.g. scalar unregister C:/foo), which has been fixed.
• When trying to call Cygwin (or for that matter, MSYS2) programs from Git Bash, users would frequently be greeted with cryptic error messages about a "cygheap" or even just an even more puzzling exit code 127. Many of these calls now succeed, allowing basic interactions. While it is still not possible for, say, Cygwin's vim.exe to interact with the Git Bash's terminal window, it is now possible for Cygwin's zstd.exe in conjuction with Git for Windows' tar.exe to handle .tar.zst archives.

Filename	SHA-256
Git-2.40.0-rc1-64-bit.exe	69dfa0bfbec9e5836561968421adb60133ce3aaba6acc01ddb45e2e042a59d5f
Git-2.40.0-rc1-32-bit.exe	6cd10560bdf090d920e4a15c23070b469a5a9e35b277a0a6e6fd69e8e7be9efe
PortableGit-2.40.0-rc1-64-bit.7z.exe	37233d2e767c43b0d3b65bb3fb2151dd600fdf5d61db83db048bd5f6d1d6aade
PortableGit-2.40.0-rc1-32-bit.7z.exe	fb40cfff8e435843b0fff724c03a89cac973cf5f1844b322a75718ee23d01a65
MinGit-2.40.0-rc1-64-bit.zip	96977c7cca2278878f155c7f50ba1b3e46102442606beab8a15d5aa813dbe762
MinGit-2.40.0-rc1-32-bit.zip	3ab0bee7839a1e2228c09b31229ea1da74971e76207973c1ee6151037d723207
MinGit-2.40.0-rc1-busybox-64-bit.zip	0f2c7622658ceda02012e0c038a762fd46135a60cef4f823b7b0ae2fc66cb58c
MinGit-2.40.0-rc1-busybox-32-bit.zip	f98139fff494e405a125702dd6c4a3127246ecafce4db7dc85325dc0a668d8f8
Git-2.40.0-rc1-64-bit.tar.bz2	d22ab790bf89228e25fbd661076cd40a1ac59109f9ab7d2eb9d25eaf883a3ab5
Git-2.40.0-rc1-32-bit.tar.bz2	6117a414bc1e24f3b0b995c695cbb795eb431ed40648474eef77dc83ba374eeb

Git for Windows 2.40.0-rc0

Changes since Git for Windows v2.39.2 (February 14th 2023)

New Features

• Comes with Git v2.40.0-rc0.

Filename	SHA-256
Git-2.40.0-rc0-64-bit.exe	79fbddbb371a35dcd9b9ff1c2e5e6cae02ee70850b61c177a77c55e3aebfb142
Git-2.40.0-rc0-32-bit.exe	74856e12f4e9c4812dc7399d107f6a6cc08e808d101d8855de47312a9fec58fa
PortableGit-2.40.0-rc0-64-bit.7z.exe	c15f18be2418ac4c7958c3c78323163735e4c841a0077ed027f439b1e6e994de
PortableGit-2.40.0-rc0-32-bit.7z.exe	ef37a588ceef15f72281f7fee255273005b75b73febb798860ca0639f1e72411
MinGit-2.40.0-rc0-64-bit.zip	1a746ae0fff8e44f6dc05f0062c031d4d84ca4d7d4425cc061eaa83c199ff236
MinGit-2.40.0-rc0-32-bit.zip	bb8eafa4488ddfcc12d7586824030d890da8ed8e008eb8d9628c834c762b750c
MinGit-2.40.0-rc0-busybox-64-bit.zip	1226f4af12e834422d5edcde5d35ba71f05dc24ab7e2e99d09d2107d596f6239
MinGit-2.40.0-rc0-busybox-32-bit.zip	0f98017a8d2178f198e37883175385fa7f307f9ba2a9a1c60f52603f776d033c
Git-2.40.0-rc0-64-bit.tar.bz2	41083788a8a3b207deddb777143e4a9f56f777050cf775c59da87735a0fb1f26
Git-2.40.0-rc0-32-bit.tar.bz2	637256ea38e2402b77e719c700b61c93ec61574abc9d0acf603b0fe0caaeb389

Git for Windows 2.39.2

Changes since Git for Windows v2.39.1 (January 17th 2023)

This is a security release, addressing CVE-2023-22490, CVE-2023-22743, CVE-2023-23618 and CVE-2023-23946.

New Features

• Comes with Git v2.39.2.

Bug Fixes

• Addresses CVE-2023-22743, a vulnerability rated "high" making the Git for Windows' installer susceptible to DLL side-loading attacks.
• Addresses CVE-2023-23618, a vulnerability rated "high" where gitk would inadvertently execute programs placed in the worktree.
• Addresses CVE-2023-22490, a moderate vulnerability allowing for data exfiltration in local clones.
• Addresses CVE-2023-23946, a moderate vulnerability that would allow crafted patches to trick git apply into writing into files outside the current directory.

Filename	SHA-256
Git-2.39.2-64-bit.exe	d7608fbd854b3689102ff48b03c8cc77b35138f9f7350d134306da0ba5751464
Git-2.39.2-32-bit.exe	addf55b0a57f38a7950b3ad37ce5c76752202e6818d9f8995b477496b71fb757
PortableGit-2.39.2-64-bit.7z.exe	20e3959d4e310a79b5cf4138797aa247d473d1f7b077a6c433cbfc4ddc5486f1
PortableGit-2.39.2-32-bit.7z.exe	84ea6be01df896f6d50192ba4cda85c38ab995154f7aa9d3849492a15f21b500
MinGit-2.39.2-64-bit.zip	a53b90a42d9a5e3ac992f525b5805c4dbb8a013b09a32edfdcf9a551fd8cfe2d
MinGit-2.39.2-32-bit.zip	f2027f51f8b12e5bd3c94782edddcfe277e26a3fc7c014707a72b04714f3b90f
MinGit-2.39.2-busybox-64-bit.zip	ee36c33719ad2f4b23f00e40469045ac4d3ad30e4321fe6d2adbcf3176b747b2
MinGit-2.39.2-busybox-32-bit.zip	c6c0b7fd055a968bb89bff1af6d8cad846f996664ef2aa1b5fdbab6b77c77679
Git-2.39.2-64-bit.tar.bz2	14012aba35914970ace948a11b8749847f0e180d4e47eaa72dd091d56dbc7586
Git-2.39.2-32-bit.tar.bz2	fc0a304f933a7690e45187261ae9132d6586a62a79f540234ce836c000df3f56

MinGit v2.35.7.windows.1

MinGit for Windows v2.35.7

Changes since Git for Windows v2.35.6 (January 17 2023):

Bug Fixes

* CVE-2023-22490:

  Using a specially-crafted repository, Git can be tricked into using
  its local clone optimization even when using a non-local transport.
  Though Git will abort local clones whose source $GIT_DIR/objects
  directory contains symbolic links (c.f., CVE-2022-39253), the objects
  directory itself may still be a symbolic link.

  These two may be combined to include arbitrary files based on known
  paths on the victim's filesystem within the malicious repository's
  working copy, allowing for data exfiltration in a similar manner as
  CVE-2022-39253.

* CVE-2023-23946:

  By feeding a crafted input to "git apply", a path outside the
  working tree can be overwritten as the user who is running "git
  apply".

* A mismatched type in `attr.c::read_attr_from_index()` which could
  cause Git to errantly reject attributes on Windows and 32-bit Linux
  has been corrected.

Git for Windows 2.39.1

Changes since Git for Windows v2.39.0(2) (December 21st 2022)

This is a security release, addressing CVE-2022-41903, CVE-2022-23521 and CVE-2022-41953.

New Features

• Comes with Git v2.39.1.

Bug Fixes

• Addresses CVE-2022-23521, a critical vulnerability in the .gitattributes parsing that potentially allows malicious code to be executed while cloning.
• Addresses CVE-2022-41953, a vulnerability that makes Git GUI's Clone function susceptible to Remote Code Execution attacks.
• Addresses CVE-2022-41903, a vulnerability that may allow heap overflows and code to be executed inadvertently during a git archive invocation.
• A regression introduced in Git for Windows v2.39.0(2) that prevented cloning from Bitbucket was fixed.

Filename	SHA-256
Git-2.39.1-64-bit.exe	82d088233144054d14d8cc890870544f1ac6ac73aebade87c4d96c97b55d8508
Git-2.39.1-32-bit.exe	b9ac2863b42eb60ee6cbb0663378bb119cb976a52985d4bbe92ad00b073ffed2
PortableGit-2.39.1-64-bit.7z.exe	b898306a44084b5fa13b9a52e06408d97234389d07ae41d9409bdf58cad3d227
PortableGit-2.39.1-32-bit.7z.exe	2cb1a83f30f0c2948c97d3dc683c8b058c808f89b51bfb813de67253d17caa15
MinGit-2.39.1-64-bit.zip	000649846ec6e28e8f76d4a0d02f02b3dd1ba19914385f7dead1c5cde25b3bad
MinGit-2.39.1-32-bit.zip	e36dc71d97359f584d25efbdabb4122fb71514bcba5a99df1b82a83cee9472e3
MinGit-2.39.1-busybox-64-bit.zip	c2b54edf2f5b3c7a7bb65640d49f8d7a953145b989125c8749e673d03e2a80f1
MinGit-2.39.1-busybox-32-bit.zip	4a28a9bd4e49d260ae3c35bf9a2cdb91f12d4a4cf081f21b3df278e76f401262
Git-2.39.1-64-bit.tar.bz2	2a33c6fef5ed9d2794013fe965066b80c24b556168aca28c0252c1e11859f4ad
Git-2.39.1-32-bit.tar.bz2	fdbbd5bcbe00f8981df11cdff87f74440b1a64f40898740559f68e4565555a44