<!-- Byron -->
rubber-stamp, after checking diff quickly.

<!-- agent -->
The pure-Python `GitDB` backend has performance and security issues in
object reading and resolution, including unbounded delta processing and
incorrect object selection or reconstruction. `GitCmdObjectDB` is already
the default and delegates these operations to Git.

Emit `DeprecationWarning` from `Repo.__init__` when `odbt` selects `GitDB`
or a subclass, directing callers to `GitCmdObjectDB`. Repository opening,
initialization, and cloning all construct a `Repo` through this path.
Keep the existing backend behavior available for compatibility and retain
the `gitdb` dependency needed for shared types and utilities. Deprecation
does not repair or disable the legacy parsers.

Update backend-selection docstrings, the tutorial, and the changelog with
migration guidance. Add regression checks that the deprecated backend and
its subclasses warn at the direct caller's location while continuing to
read objects, and that default, explicit, and subclassed `GitCmdObjectDB`
use remains free of deprecation warnings.

CI follow-up: the new deprecation test exposed that backend annotations
accepted only `LooseObjectDB` descendants, excluding the supported legacy
`GitDB`. Include both types in construction, initialization, and clone
helpers. `basedpyright --warnings` and `mypy --python-version=3.12` pass;
16 focused deprecation/database tests and Ruff checks pass.

<!-- Byron -->
rubber-stamp, after checking diff quickly.

<!-- agent -->
Python evaluated user-supplied `:/pattern` and `^{/pattern}` searches
with a backtracking regex engine and walked/deserialized history itself.
A short expression could occupy a worker indefinitely on an ordinary
repository (finding 21500).

Delegate matching and traversal to `git rev-parse`, using its extended
regular expressions, and delete the Python regex/history implementation.
Construct fixed-prefix operands so they cannot become options, preserving
support for Git versions without `--end-of-options`. Invalid expressions
now raise `BadName`, like searches without a match.

Resolve revisions before peeling objects in `Repo.commit()` and
`Repo.tree()`; appending a peel suffix previously changed top-level search
patterns. Add bounded subprocess regressions, native-Git parity cases,
and checks that history is not deserialized in Python.

Validation: 27 focused/related tests and Ruff checks passed. A 56-case
comparison preserved previously successful ordinary revision resolutions.
Native behavior was checked against Git and its local source at
`d38352cd43`.

<!-- Byron -->
rubber-stamp, after checking diff quickly.

<!-- agent -->
Cyclic loose symbolic refs could keep `dereference_recursive()` reading
forever. Related updates and construction of custom symbolic refs could
recurse without a useful limit (finding 21496).

Bound reads and preflight updates to five references, including the
terminal reference, matching Git's `SYMREF_MAXDEPTH`. Determine detachment
from the current ref's contents without recursively constructing targets.
Reuse validated ref paths for reads to reject escaping symlinks.

Preserve public update signatures and subclass dispatch, including HEAD
reflog updates and creation of unborn terminal references. The write
preflight handles static chains; it does not introduce a transaction for
concurrent external repository changes.

<!-- Byron -->
rubber-stamp, after checking diff quickly.

<!-- agent -->
The shared unsafe-protocol check rejected forced `<helper>::` selectors,
but Git also selects `git-remote-ext` for `ext://` URLs. That helper treats
the URL as a command path, leaving a second spelling outside the guard.
This is a sibling of finding 21492, whose original missing `ls_remote`
check was already fixed by `9ad28cc4`.

Extend the existing anchored classifier to reject `ext://` too. Preserve
native case sensitivity, ordinary IPv6 URLs, forced-helper checks, and
the explicit `allow_unsafe_protocols` opt-in across all callers.

<!-- Byron -->
rubber-stamp, after checking diff quickly.

<!-- agent -->
`Repo.archive()` checked only the original `remote` keyword. Git accepts
abbreviated long options, while GitPython renders sequence values as
repeated options and permits a value embedded in the keyword name.
Those spellings could bypass unsafe-protocol validation (finding 21492's
broader URL-validation class).

Inspect the arguments produced by the existing `Git.transform_kwargs()`
and validate every emitted `--remote` value, including its abbreviations,
with the shared protocol checker. Preserve safe repeated IPv6 URLs and
keep unsafe-option and unsafe-protocol opt-ins independent.

<!-- Byron -->
rubber-stamp, after checking diff quickly.

<!-- agent -->
Native tree merging and index serialization could install paths that Git's
own index writers reject. A subsequent checkout trusts that index and can
write outside the working tree or into Git metadata (finding 21506 and
the shared write-side cause of finding 21501).

Validate complete paths when importing tree entries, reading or writing
index entries, and building trees from the index. Reject traversal,
absolute/drive paths, embedded NULs, and Git metadata aliases on NTFS/HFS
while retaining ordinary POSIX filename characters. Validate before
creating trees, and preserve index writer rollback on failure.

Refresh the on-disk index before checkout, including when entries were
cached. Parse full sentinel-length names and check their terminators and
padding so validation sees the same paths as Git. Reject unsupported
mandatory extensions such as split indexes: validating only their inline
entries would overlook paths from external shared indexes.

QA review follow-up: reject unsupported index versions with an explicit
exception, preserving `AssertionError` for compatibility. Python's `-O`
mode removed the former assertion, allowing version 4 prefix-compressed
paths to be parsed with version 2/3 rules before native checkout.
Validation must never accept a format whose paths Git interprets
differently. Optimized subprocess regressions for unsupported versions
fail before this fix and pass afterward. All 76 selected index tests
pass, with two platform skips; locked Basedpyright, mypy, Codespell, and
Ruff checks pass.

<!-- Byron -->
rubber-stamp, after checking diff quickly.

<!-- agent -->
`TreeModifier.add()` checked only for slashes in names. Embedded NULs
could change serialized record boundaries, while dot components and Git
metadata aliases produced unsafe tree paths (finding 21507).

Reuse the repository path validator for single-component tree names and
check both the public modifier and shared serializer. Validate object ID
lengths and object modes at serialization, including entries inserted
through unchecked or direct-cache APIs.

Validate incoming records in `tree_entries_from_data()` as well: use
bounded delimiter searches, require octal modes and complete 20-byte
object IDs, and reject invalid names before exposing entries. Preserve
`bytearray` inputs, immutable returned object IDs, undecodable filenames,
and valid whitespace, Unicode, and POSIX backslash and colon names. Check
drive/root restrictions on complete paths, not isolated tree components.
Update the existing decoding fixture to contain a complete object ID.

<!-- Byron -->
rubber-stamp, after checking diff quickly.

<!-- agent -->
`IndexFile.add()` could read through intermediate directory symlinks and
store files outside the working tree. Null-SHA `Blob` and
`BaseIndexEntry` inputs reached the same reader, while unsafe entry and
rewritten paths could enter the in-memory index with `write=False`
(finding 21501).

Validate supplied object paths and all final entry paths with the shared
repository path checker. Confine filesystem inputs in `_store_path()`
and reject intermediate symlinks or redirected directories before
opening files. Preserve final symlinks as links, including when rewriting
paths, and reject special files. Use `O_NOFOLLOW` and `O_NONBLOCK` where
available and check the opened regular file with `fstat()`.

Skip Git metadata during directory expansion and stage directory
symlinks themselves. Validate complete relative directory paths so nested
POSIX colon names are not mistaken for drive-prefixed paths.

Parent-directory checks handle the existing filesystem layout; they do
not make staging atomic against concurrent directory replacement. The
open flags protect final-component substitution on supporting platforms.

Tests cover path/glob/object inputs, inside and outside symlink targets,
rewriters, in-memory index validation, metadata exclusion, directory
symlinks, special files, and nested colon names. Validation: 129 combined
tree/index tests passed, with two platform skips; Ruff checks and
formatting checks passed.

<!-- Byron -->
Reason: it triggered quite often, is an external dependency
that isn't crucial, and... spelling issues aren't a problem
that GitPython really needs to solve.

rubber-stamp, after checking diff quickly.

<!-- agent -->
Remove `codespell` from the project's pre-commit checks so it no longer
runs locally or in the shared CI lint workflow. This also removes the
need to maintain spelling exceptions for intentional test inputs.

Delete its hook-specific `tomli` dependency, the entire `[tool.codespell]`
configuration and word exception list, and the obsolete inline suppression
on the `remot` archive-option regression case.

<!-- Byron -->

Rubber-stamp, checked diff

<!-- agent -->
`Remote.fetch()`, `pull()`, and `push()` checked only their refspecs for
unsafe protocols. A split short-option value such as `q="ext::helper"`
was rendered as `-q ext::helper`, making it Git's repository operand before
the intended remote. This bypassed `allow_unsafe_protocols=False` wherever
Git's own protocol policy permitted the helper.

Share protocol validation with `Git.ls_remote()` using flattened operands
and the existing `transform_kwargs()` renderer. Check the remote name as
well as refspecs and standalone option values. Repeated values now receive
the same checks, while joined short values and ordinary long-option values
retain their existing treatment. Keep the unsafe-option and unsafe-protocol
opt-ins independent.

Render fetch's documented boolean `verbose` parameter as a boolean flag.
Its previous unchecked `v=verbose` conversion could introduce another URL
or an unsafe option outside either guard.

Add public-API regressions for all three transports, repeated values,
unsafe remote names, safe argument forms, and the independent opt-ins.
The split-value and `verbose` regressions failed before their fixes. Git
execution is intercepted in these tests.

Copilot AI left a comment