GeezerVison

Git for Windows v2.56.1

Changes since Git for Windows v2.56.0(4) (October 26th 2026):

This addresses the security issues CVE-2026-111760, CVE-2026-113408,
CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437.

Security bug fixes

  * CVE-2026-111760:

    Recursive clones are susceptible to Remote Code Execution: an
    attacker-controlled repository can be crafted in a way that
    exploits a bug in Git whereby Git can be fooled into overwriting a
    gitfile (used for submodules) with a symbolic link that then points
    to a directory with malicious config or hooks. The config or hooks
    may have attacker-specified code.

  * CVE-2026-113408:

    It is possible for a server to advertise an unborn HEAD that
    contains path-traversal characters (e.g., refs/heads/../../../
    TARGET). With the files ref backend that can lead to ref-updating
    actions to write to unwanted files.

  * CVE-2026-114467:

    When Git strips the GPG signatures from a commit message, it only
    accounts for two signatures. A commit message containing more than
    two signatures therefore causes a stack memory corruption.

    This can be triggered when using git merge with a tag which
    contains more than two signatures. As such, this makes way for a
    DoS attack which can potentially also affect forges when such a tag
    is pushed to a remote and a merge action is initiated.

  * CVE-2026-114469:

    Git rejects patches larger than ~1 GiB, because its patch
    application code does not work well with large files. That check,
    however, only considered the size of the patch as it appears in the
    input, which for binary patches is much smaller than the size of
    the file the patch describes, as binary patches are compressed and
    encoded. A binary patch that inflates to a very large size
    therefore slipped past the check and crashed Git with an
    out-of-bounds read.

  * CVE-2026-105437:

    When merging, Git computes the size of the buffer holding the merge
    result in a way that can overflow for very large merges, which can
    be triggered by a large number of conflicts combined with a large
    conflict-marker-size. The resulting buffer can then be too small,
    and Git writes past its end (and, before and after that, before its
    start), corrupting the heap.

  * CVE-2026-114466:

    In response to CVE-2019-1348, fast-import disallows the
    export-marks feature by default. The features rewrite-submodules-to
    and rewrite-submodules-from as well as the option export-pack-edges
    that were introduced in the meantime also allow reading from
    arbitrary paths, and are therefore now also disallowed by default.

New Features

  * Comes with Git v2.56.1.

Git for Windows v2.56.0(4)

Changes since Git for Windows v2.56.0(3) (October 22nd 2026)

This is another urgent security bug fix release, addressing
CVE-2026-111497.

Bug Fixes

  * The executables included in the 32-bit MinGit had corrupt
    code-signatures, which has been fixed.
  * Upgrades the included brotli component to v1.2.1 to address
    CVE-2026-111497.

Git for Windows v2.56.0(3)

Changes since Git for Windows v2.56.0(2) (October 5th 2026):

This is a security fix release, addressing the eMudhra Intermediate CA
Compromise. It also addresses Git LFS' CVE-2026-105803 by upgrading to
v3.8.1.

New Features

  * Comes with OpenSSH v10.6.P1.
  * Comes with cURL v8.23.0.
  * Comes with Git LFS v3.8.1.

Git for Windows v2.56.0(2)

Changes since Git for Windows v2.56.0 (September 28th 2026)

New Features

  * Comes with OpenSSL v3.5.9.
  * To help with fixing stale references to the Git Credential Manager
    after Git for Windows v2.56.0's MINGW64 -> UCRT64 migration, a
    compatibility shim is now installed.

Bug Fixes

  * Suppressing the user-wide Git config via GIT_CONFIG_GLOBAL=NUL was
    broken in v2.56.0 (surprisingly, as a consequence of the MINGW64 ->
    UCRT64 migration), which was fixed.
  * Fixed a bug in Git for Windows, v2.56.0, where the x64 Git
    executables lost their Authenticode signatures by mistake.
  * An assertion was fixed that caused pushes to fail when the server
    requires a client certificate.

Git for Windows v2.56.0

Changes since Git for Windows v2.55.0(5) (August 20th 2026)

Following the MSYS2 project, on which Git for Windows is based, Windows
8.1 support was dropped; In doing so, internal paths changed (/mingw64/
bin/git.exe does not exist anymore, /ucrt64/bin/git.exe takes its role;
if this breaks your setups, consider switching to /cmd/git.exe instead,
which is guaranteed to stay stable).

An issue with the installer for the previous version
(v2.55.0.windows.5) caused the "Use external OpenSSH" option to be
disabled for some users. This caused the bundled version of OpenSSH to
be installed and overwrote any previously-saved choice of external
OpenSSH. If you rely on an external OpenSSH installation, and you
updated to v2.55.0(5), you should consider re-running the latest
installer with "Only show new options" unchecked so that you can
re-enable the external OpenSSH option. The bundled version of OpenSSH
will be uninstalled automatically. If you do not rely on an external
OpenSSH installation, or you did not install v2.55.0(5) specifically,
you can safely ignore this notice.

New Features

  * Comes with Git v2.56.0.
  * Comes with Git LFS v3.8.0.
  * Comes with cURL v8.22.0.
  * Comes with OpenSSL v3.5.8.

Bug Fixes

  * The installer is now actually a 64-bit one, which fixes the problem
    that the external OpenSSH option was broken in Git for Windows
    v2.55.0(5) (see notice above).
  * It is now finally possible to commit 4GB objects or larger in Git
    for Windows.
  * Fixes a bug where parallel checkouts could abort with "* stack
    smashing detected *: terminated".
  * A bug introduced in Git for Windows v2.55.0(5), which caused vim to
    often open existing files with the first line missing, was fixed.
  * git difftool will no longer crash upon encountering filenames that
    are illegal on Windows.

Git for Windows v2.56.0-rc2

Changes since Git for Windows v2.55.0(5) (August 20th 2026)

Following the MSYS2 project, on which Git for Windows is based, Windows
8.1 support was dropped; In doing so, internal paths changed (/mingw64/
bin/git.exe does not exist anymore, /ucrt64/bin/git.exe takes its role;
if this breaks your setups, consider switching to /cmd/git.exe instead,
which is guaranteed to stay stable).

An issue with the installer for the previous version
(v2.55.0.windows.5) caused the "Use external OpenSSH" option to be
disabled for some users. This caused the bundled version of OpenSSH to
be installed and overwrote any previously-saved choice of external
OpenSSH. If you rely on an external OpenSSH installation, and you
updated to v2.55.0(5), you should consider re-running the latest
installer with "Only show new options" unchecked so that you can
re-enable the external OpenSSH option. The bundled version of OpenSSH
will be uninstalled automatically. If you do not rely on an external
OpenSSH installation, or you did not install v2.55.0(5) specifically,
you can safely ignore this notice.

New Features

  * Comes with Git v2.56.0-rc2.
  * Comes with Git LFS v3.8.0.
  * Comes with cURL v8.22.0.
  * Comes with OpenSSL v3.5.8.

Bug Fixes

  * The installer is now actually a 64-bit one, which fixes the problem
    that the external OpenSSH option was broken in Git for Windows
    v2.55.0(5) (see notice above).
  * It is now finally possible to commit 4GB objects or larger in Git
    for Windows.
  * Fixes a bug where parallel checkouts could abort with "* stack
    smashing detected *: terminated".
  * A bug introduced in Git for Windows v2.55.0(5), which caused vim to
    often open existing files with the first line missing, was fixed.

Git for Windows v2.56.0-rc1

Changes since Git for Windows v2.55.0(5) (August 20th 2026)

Following the MSYS2 project, on which Git for Windows is based, Windows
8.1 support was dropped; In doing so, internal paths changed (/mingw64/
bin/git.exe does not exist anymore, /ucrt64/bin/git.exe takes its role;
if this breaks your setups, consider switching to /cmd/git.exe instead,
which is guaranteed to stay stable).

An issue with the installer for the previous version
(v2.55.0.windows.5) caused the "Use external OpenSSH" option to be
disabled for some users. This caused the bundled version of OpenSSH to
be installed and overwrote any previously-saved choice of external
OpenSSH. If you rely on an external OpenSSH installation, and you
updated to v2.55.0(5), you should consider re-running the latest
installer with "Only show new options" unchecked so that you can
re-enable the external OpenSSH option. The bundled version of OpenSSH
will be uninstalled automatically. If you do not rely on an external
OpenSSH installation, or you did not install v2.55.0(5) specifically,
you can safely ignore this notice.

New Features

  * Comes with Git v2.56.0-rc1.
  * Comes with Git LFS v3.8.0.
  * Comes with cURL v8.22.0.
  * Comes with OpenSSL v3.5.8.

Bug Fixes

  * The installer is now actually a 64-bit one, which fixes the problem
    that the external OpenSSH option was broken in Git for Windows
    v2.55.0(5) (see notice above).
  * It is now finally possible to commit 4GB objects or larger in Git
    for Windows.
  * Fixes a bug where parallel checkouts could abort with "* stack
    smashing detected *: terminated".
  * A bug introduced in Git for Windows v2.55.0(5), which caused vim to
    often open existing files with the first line missing, was fixed.

Git for Windows v2.56.0-rc0

Changes since Git for Windows v2.55.0(5) (August 20th 2026)

Following the MSYS2 project, on which Git for Windows is based, Windows
8.1 support was dropped; In doing so, internal paths changed (/mingw64/
bin/git.exe does not exist anymore, /ucrt64/bin/git.exe takes its role;
if this breaks your setups, consider switching to /cmd/git.exe instead,
which is guaranteed to stay stable).

An issue with the installer for the previous version
(v2.55.0.windows.5) caused the "Use external OpenSSH" option to be
disabled for some users. This caused the bundled version of OpenSSH to
be installed and overwrote any previously-saved choice of external
OpenSSH. If you rely on an external OpenSSH installation, and you
updated to v2.55.0(5), you should consider re-running the latest
installer with "Only show new options" unchecked so that you can
re-enable the external OpenSSH option. The bundled version of OpenSSH
will be uninstalled automatically. If you do not rely on an external
OpenSSH installation, or you did not install v2.55.0(5) specifically,
you can safely ignore this notice.

New Features

  * Comes with Git v2.56.0-rc0.
  * Comes with Git LFS v3.8.0.
  * Comes with cURL v8.22.0.
  * Comes with OpenSSL v3.5.8.

Bug Fixes

  * The installer is now actually a 64-bit one, which fixes the problem
    that the external OpenSSH option was broken in Git for Windows
    v2.55.0(5) (see notice above).
  * It is now finally possible to commit 4GB objects or larger in Git
    for Windows.
  * Fixes a bug where parallel checkouts could abort with "* stack
    smashing detected *: terminated".
  * A bug introduced in Git for Windows v2.55.0(5), which caused vim to
    often open existing files with the first line missing, was fixed.

Git for Windows v2.55.0(5)

Changes since Git for Windows v2.55.0(4) (August 11th 2026)

Following the MSYS2 project, on which Git for Windows is based, Windows
8.1 support will be dropped after Git for Windows v2.55.

New Features

  * The experimental git survey command (which was never upstreamed to
    the core Git project) was deprecated and converted into a small
    shim on top of git repo structure. In the future, git repo
    structure should be used instead, as the git survey command will be
    retired eventually.
  * Git for Windows' installer is now a 64-bit executable (x64 instead
    of 86).
  * Comes with the MSYS2 runtime (Git for Windows flavor) based on
    Cygwin v3.6.10.
  * Comes with OpenSSH v10.5.P1.

Bug Fixes

  * The long-standing bug where Git Bash's screen was cleared after
    git.exe called vim (e.g. to edit a commit message) was fixed.
  * The Bash executables in the 64-bit and ARM64 distributions no
    longer carry an invalid Authenticode signature.

MinGit for Windows v2.53.0(4)

Changes since Git for Windows v2.53.0(3) (April 14th 2026):

Due to persistent maintenance challenges, git svn is no longer included
in Git for Windows. Users who still need this command are highly
encouraged to use a Linux version of git svn via the Windows Subsystem
for Linux instead, or switch to a regular MSYS2 setup: install MSYS2,
then run the following command in the MSYS2 UCRT64 Bash: pacman -Sy
mingw-w64-ucrt-x86_64-git-svn. After that, the git svn command will be
available in that Bash. On Windows/ARM64, you will want to use the
CLANGARM64 variant instead (and install
mingw-w64-clang-aarch64-git-svn).

New Features

  * Comes with Bash v5.3.9.
  * Comes with Git Credential Manager v2.7.2.
  * Comes with MinTTY v3.8.2.
  * The shell aliases in Git Bash that ensured that interpreters such
    as Python and Node.JS are executed via winpty are no longer
    necessary, and have therefore been dropped.
  * Comes with the MSYS2 runtime (Git for Windows flavor) based on
    Cygwin v3.6.7.
  * Comes with cURL v8.19.0.
  * Comes with OpenSSH v10.3.P1.
  * Comes with OpenSSL v3.5.6.

Bug Fixes

  * The iconv executable, which was inadvertently dropped from Git for
    Windows v2.53.0's installer, is now included again.
  * In some circumstances, when typing while a still-running program is
    about to terminate, the typed characters could arrive out of order
    in Git Bash. This bug was fixed.
  * Similar to how git clean already avoids traversing NTFS junctions,
    git worktree remove now does the same.
  * The number of CPU cores is now detected correctly on multi-socket
    systems.
  * When fetching/pushing via Secure Channel (the default TLS/SSL
    method), the timeout to renegotiate (e.g. using client
    certificates) was recently reduced to 7 seconds, which was too
    short. It has been extended to 60 seconds.
  * The recent security bug fix that disables NTLM by default missed
    the NTLM fallback in the Kerberos protocol. This fallback is now
    disabled, following the cURL project's guidance.
  * A really old bug which prevented Kerberos authentication from
    working with the default http.emptyAuth ("auto"), was fixed.