What
Claude Code sometimes runs a git fetch to get commits that are missing from a local repository. It already switched off some git settings for this fetch, such as stored credential helpers. It now also:
- Switches off bundle URIs, so a remote cannot point git at a separate download address
- Refuses all HTTP redirects. Before, a redirect on the first request was followed.
- Looks up proxy settings without using the remote's address
Why
This fetch can run against remotes you may not fully trust. A remote can no longer send git to a third-party download address or redirect it to another host.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
It is not clear which feature runs this fetch or how often it runs.