Fix
- allow overwriting destination symlinks when
preserve_symlinks: false - cache: resolve submodules from the current checkout's .gitmodules (#2767)
Security
-
prevent trust bypass via ambiguous URL characters
To prevent URL confusion attacks, trusted prefix matching is now restricted to repository URL paths containing only RFC 3986 §2.3 "unreserved" characters (letters, digits,
-,.,_,~) and/. URL paths containing other characters now require an exact, verbatim match.