Under the hood
Git subprocesses now block graft files as an extra hardening measure
Every git invocation on this path now passes -c advice.graftFileDeprecated=false and sets GIT_GRAFT_FILE to /dev/null, effectively neutralizing git graft files. This joins the existing environment hardening on the same path: GIT_ALLOW_PROTOCOL=none, GIT_NO_LAZY_FETCH, and GIT_NO_REPLACE_OBJECTS.