git-credential-manager version history

- Added Workload Identity Federation for Azure Repos and Git config caching. - Introduced dark theme support for OAuth authentication response pages. - Fixed GPG ID lookup, CS0121 ambiguity, SYSLIB0057 warning, and other small bugs. - Migrated to .NET 10 (Mac/Linux) and updated dependencies.

**Announcements:** > [!NOTE] > This is planned to be the last release major release that supports Windows 7 and 8.x. We will be moving off of .NET Framework to .NET (Core) on Windows this year. **Changes:** - Emit new warning when Git has built-in NTLM support disabled. As part of the fix for CVE-2025-66413, Git for Windows now disables built-in NTLM support by default. Only if `http.allowNTLMAuth` is explicitly enabled will Git use NTLM authentication. GCM will now display a warning message when it detects this scenario and presents options for re-enabling NTLM.

**Announcements:** > [!NOTE] > This is planned to be the last release major release that supports Windows 7 and 8.x. We will be moving off of .NET Framework to .NET (Core) on Windows this year. **Changes:** - Make Linux browser detection more robust (support VSCode remote connections over SSH) - #2256 - #2258 - #2257

**Announcements:** > [!NOTE] > This is planned to be the last release major release that supports Windows 7 and 8.x. We will be moving off of .NET Framework to .NET (Core) on Windows this year. **Changes:** - Added support for Linux enterprise defaults - #1814 - #2259 - Various build and release pipeline fixes - #2239 - #2241 - #2248

**Announcements:** > [!NOTE] > Thanks to all our contributors who've been waiting for this release. It's been a year since the last release, which as many will note is highly unusual. Ownership issues of the project have meant that there was a freeze on releases and maintenance. This has now been resolved and we expect regular releases (approximately every 12 weeks; aligned with Git's release schedule), and engagement on our part with the community. Thank you for your patience. > [!NOTE] > The code ownership/responsibility model of the Git Credential Manager project has changed. Microsoft will now maintain the core GCM platform (responsible for releases, and major architectural changes). The major Git host providers will be responsible for their plugins (e.g., GitHub for GitHub functionality, Azure DevOps for Azure Repos etc). > [!NOTE] > This is planned to be the last release major release that supports Windows 7 and 8.x. We will be moving off of .NET Framework to .NET (Core) on Windows this year. **Changes:** - Fix Generic provider refresh token refresh logic (#1838) - Allow unsafe remotes via config (#1721) - Drop no longer needed GitLab OAuth params (#1538)

**Security Fixes:** - [CVE-2024-50338](https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g) - Do not treat the lone carriage-return character (CR, `\r`) as a line terminator in the credential helper protocol **Changes:** - Fix Linux build scripts (#1752) - Documentation fix for broken links (#1722) - Permit use of HTTP (not-S) remotes for providers via config (#1721) - Omit the client secret for GitLab (#1538) - Various workflow action updates (#1725, #1738, #1751, #1750) - Fix CentOS install from source workflow (#1746) - Add Mariner and Arch Linux distribution validation builds (#1747) - Add no-op credential storage option (#1740)

**Changes:** - Drop no longer needed workflows (#1659) - Documentation fixes (#1664, #1697) - Configurable GPG store path via Git config (#1698) - Fix Visual Studio build problems and update dependencies (#1711) - Support sending X5C with certificate auth (#1666)

**Changes:** - Update MSAL and Avalonia to latest versions (#1640). - Changes to release workflow to publish NuGet signing certificate (#1594, #1644, #1647). - Updates to Managed Identity and Service Principal docs.

**Important Note:** The NuGet package/.NET Tool for this release was not generated correctly, and as such is not published to nuget.org. The artifact remains attached to this GitHub release for prosperity, but should not be used. **Changes:** - Fixes to install from source script (#1469) - Use Avalonia generated view code (#1479) - Various GitHub Actions updates (#1473, #1483, #1487, #1486, #1488, #1528, #1547) - Fix bug in Azure Repos URL handling (#1522) - Add Azure Managed Identity and SP docs (#1548) - Fix error messages when using GCM outside of repo (#1561, #1583) - Remove ESRP (#1571) - Update to .NET 8 for Mac and Linux (#1579, #1580) - Fix Alpine install from source script (#1582) - Update MSAL and Avalonia (#1591) - Fix issue with diagnostic messages (#1590) - Address CVE-2024-32478 (this issue only affected the Linux Debian package)

**Changes:** _Since 2.4.0:_ - Fix macOS ARM64 tarball contents (#1458) _Since 2.3.x:_ - Add support for managed identity and service principals in Azure Repos (#1372) - Support universal Gitea OAuth app configuration (#1442) - Set default generic OAuth redirect URI value (#1444) - Drop WPF helpers on Windows (#1417) - Add software rendering override for Windows (#1445, #1453) - Recognise GitLab hosts via WWW-Authenticate header (#1428) - Recognise Bitbucket hosts via WWW-Authenticate header (#1441) - Support GitHub Gist remote URLs (#1402) - Update to Avalonia 11.x (#1383) - Documentation updates (#1416) - Drop unnecessary .NET Framework-specific code (#1447) - Updates to release process (#1386, #1381) - Update code signing certificates (#1431)