You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
Git SafetyArea: what it touches
ImprovementsKind: in v2.1.242,
ImprovementsSection of the release
What
Every git subprocess Claude Code runs is now given GIT_NO_REPLACE_OBJECTS=1 and GIT_GRAFT_FILE=/dev/null, so a repository cannot use replace refs or a graft file to change what history Claude Code sees. This sits alongside the existing scrubbing of hook environment variables.
Details
Applied unconditionally on the git environment path, with no opt-out.
The shallow-repository probe gained a matching hardened path.
Evidence
GIT_NO_REPLACE_OBJECTS
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
