{"version":"2.1.222","anchor":"git-invocations-hardened-with-sanitized-args-and-environment","canonical_anchor":"git-invocations-hardened-with-sanitized-args-and-environment","heading":"Git invocations hardened with sanitized args and environment","tier":"notice","area":"Git Integration","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.222\/e\/git-invocations-hardened-with-sanitized-args-and-environment","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.222","markdown":"### Git invocations hardened with sanitized args and environment\n\nMany more git commands now run with a scrubbed environment so stray variables can't redirect them.\n\n**What**\n\nMany more git call sites now prepend the frozen safety arguments and run with an environment scrubbed of git overrides, closing off paths where inherited env vars could redirect a git command.\n\n**Details**\n\n- Newly covered call sites include rev-list, ls-files --others --ignored, worktree remove --force, and config core.hooksPath.\n- Sanitized environment strips GIT_DIR, GIT_WORK_TREE, GIT_INDEX_FILE, and the GIT_CONFIG_KEY_n \/ GIT_CONFIG_VALUE_n family, among others.\n- Two additional `git diff` call sites now also pass --no-ext-diff and --no-textconv.\n\n**Evidence**\n\n`core.hooksPath=\/dev\/null`\n\n- Area: Git Integration\n- Names: `GIT_DIR`, `GIT_WORK_TREE`, `GIT_INDEX_FILE`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 0\/5"}