• Validate object ids in LFS server batch requests, so a client can no longer probe for arbitrary files on the server via an absolute path or .. in the oid.
• Refuse ref names outside refs/ (such as HEAD) or malformed ones in receive-pack.
• Only pass successfully updated refs to the post-receive hook.
• Refuse to check out .gitmodules as a symlink.
• Parse repeated or misplaced commit and tag headers the same way git does, and reject commits and tags git refuses to parse.
• Verify commit signatures against the raw commit, and support SHA-256 commit signatures (gpgsig-sha256).
• Split a tag's signature from its message at the last signature marker, and recognise PGP message and X.509 signatures.
• Add PySequoiaSignatureVendor for signing and verifying with pysequoia and explicitly provided keys.
• Fix fetching into a shallow clone over protocol v2, which could drop the pack while still updating the remote ref.
• Report the remote's stderr when an ssh connection closes before the server sends anything.
• Apply zero-context insertion hunks (diff -U0) at the right line.
• Accept max_input_size in MemoryObjectStore.add_thin_pack.
• Speed up indexing of received thin packs in DiskObjectStore.add_thin_pack.