{"version":"2.1.235","anchor":"git-subprocesses-hardened-against-graft-files","canonical_anchor":"git-subprocesses-hardened-against-graft-files","heading":"Git subprocesses hardened against graft files","tier":"internal","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.235\/e\/git-subprocesses-hardened-against-graft-files","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.235","markdown":"### Git subprocesses hardened against graft files\n\nGit subprocesses now block graft files as an extra hardening measure\n\nEvery git invocation on this path now passes `-c advice.graftFileDeprecated=false` and sets `GIT_GRAFT_FILE` to `\/dev\/null`, effectively neutralizing git graft files. This joins the existing environment hardening on the same path: `GIT_ALLOW_PROTOCOL=none`, `GIT_NO_LAZY_FETCH`, and `GIT_NO_REPLACE_OBJECTS`.\n\n- Area: Elsewhere\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 1\/5"}