You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
Git SafetyArea: what it touches
Bug FixesKind: in v2.1.268,
Bug FixesSection of the release
What
The validator for SSH git URLs was reworked so that, when it rejects an invalid URL, it builds a masked copy of that URL before putting it in the error message: any embedded username/password (userinfo) is replaced with ***, and query or fragment content is replaced with ***. Errors about a mismatched protocol now also distinguish between a scheme that's simply spelled wrong and other kinds of malformed input, with more specific messages for each.
Why
This stops credentials that were accidentally embedded in a git URL from being echoed back in plain text inside an error message, while giving clearer feedback about why a URL was rejected.
