git-lfs version history

- Security fixes for CVE-2025-26625 addressing symbolic link vulnerabilities - Improved `git lfs checkout` and `git lfs pull` commands to handle links safely - Fixed potential file writing issues in bare repositories - Upgraded to Go 1.25

This release is a feature release which introduces several new options for fetching Git LFS objects, such as the ability to force objects to be re-downloaded and the capacity to output object URLs and HTTP metadata in JSON for external tools to consume. This release also adds a configurable in-memory cache of file path pattern matches, which along with other changes can help reduce the time required to migrate large repositories to Git LFS. Git LFS now supports the same `.netrc` files on Windows as Git and curl, retries appropriately after all 429 status code HTTP responses, permits the use of symbolic links to Git's object storage during Git LFS migrations, and avoids spurious TLS verification errors when custom CA certificates are configured on macOS. Note that the v3.7.x series of Git LFS releases are the first for which we provide packages and support for versions of Linux distributions based on Red Hat Enterprise Linux (RHEL) 10, such as Rocky Linux 10. Note also that beginning with this release, we no longer provide packages or support for versions of any Linux distribution based on Debian 10 ("buster"), RHEL/CentOS 7, or SUSE Linux Enterprise Server (

This release introduces a security fix for all platforms, which has been assigned [CVE-2024-53263](https://github.com/git-lfs/git-lfs/security/advisories/GHSA-q6r2-x2cc-vrp7). When requesting credentials from Git for a remote host, prior versions of Git LFS passed portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sent any credentials received back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker might have been able to retrieve a user's Git credentials. Git LFS now prevents bare line feed (LF) characters from being included in the values sent to the `git-credential(1)` command, and also prevents bare carriage return (CR) characters from being included unless the `credential.protectProtocol` configuration option is set to a value equivalent to `false`. We would like to extend a special thanks to the following open-source contributors: * @Ry0taK for reporting this to us responsibly ### Bugs * Reject bare line-ending control characters in Git credential req

This release is a feature release which includes support for multi-stage authentication with Git credential helpers (requires Git 2.46.0) and relative worktree paths (requires Git 2.48.0), a new object transfer batch size configuration option, better path handling when installing on Windows, more POSIX-compliant hook scripts, and improved performance with sparse checkouts, partial clones, and Git remotes with large numbers of tags. Note that the 3.6.x series of Git LFS releases will be the last releases for which we provide packages or support for versions of any Linux distribution based on either Red Hat Enterprise Linux 7 (RHEL 7) or SUSE Linux Enterprise Server 12 (SLES 12). Note also that the 3.6.x series of Git LFS releases may be the last releases for which we provide packages or support for versions of any Linux distribution based on Debian 10 ("buster"). This release is built using Go v1.23 and therefore on macOS systems requires macOS 11 (Big Sur) or later, and on Windows systems requires at least Windows 10 or Windows Server 2016 (although Windows 8.1 may suffice). We would like to extend a special thanks to the following open-source contributors

This release is a patch release which includes some fixes to the release process to properly build assets. It should have no user-visible changes from v3.5.0. ### Misc * Build release assets with Go 1.21 #5668 (@bk2204) * script/packagecloud: instantiate distro map properly #5662 (@bk2204) * Install msgfmt on Windows in CI and release workflows #5666 (@chrisd8088) ## Packages Up to date packages are available on [PackageCloud](https://packagecloud.io/github/git-lfs) and [Homebrew](http://brew.sh/). [RPM RHEL 7/CentOS 7](https://packagecloud.io/github/git-lfs/packages/el/7/git-lfs-3.5.1-1.el7.x86_64.rpm/download) [RPM RHEL 8/Rocky Linux 8](https://packagecloud.io/github/git-lfs/packages/el/8/git-lfs-3.5.1-1.el8.x86_64.rpm/download) [RPM RHEL 9/Rocky Linux 9](https://packagecloud.io/github/git-lfs/packages/el/9/git-lfs-3.5.1-1.el9.x86_64.rpm/download) [Debian 10](https://packagecloud.io/github/git-lfs/packages/debian/buster/git-lfs_3.5.1_amd64.deb/download) [Debian 11](https://packagecloud.io/github/git-lfs/packages/debian/bullseye/git-lfs_3.5.1_amd64.deb/download) [Debian 12](https://packagecloud.io/github/git-lfs/packages/debian/bookworm/git-lfs_3.5.1_amd64.d

This is a bugfix release which resolves a bug introduced in the v3.4.0 release, where Git LFS may crash if the Git credential manager returns credentials containing one or more empty fields. ### Bugs * Fix a panic in the credential code #5490 (@bk2204) ## Packages Up to date packages are available on [PackageCloud](https://packagecloud.io/github/git-lfs) and [Homebrew](http://brew.sh/). [RPM RHEL 7/CentOS 7](https://packagecloud.io/github/git-lfs/packages/el/7/git-lfs-3.4.1-1.el7.x86_64.rpm/download) [RPM RHEL 8/Rocky Linux 8](https://packagecloud.io/github/git-lfs/packages/el/8/git-lfs-3.4.1-1.el8.x86_64.rpm/download) [RPM RHEL 9/Rocky Linux 9](https://packagecloud.io/github/git-lfs/packages/el/9/git-lfs-3.4.1-1.el9.x86_64.rpm/download) [Debian 10](https://packagecloud.io/github/git-lfs/packages/debian/buster/git-lfs_3.4.1_amd64.deb/download) [Debian 11](https://packagecloud.io/github/git-lfs/packages/debian/bullseye/git-lfs_3.4.1_amd64.deb/download) [Debian 12](https://packagecloud.io/github/git-lfs/packages/debian/bookworm/git-lfs_3.4.1_amd64.deb/download) ## SHA-256 hashes: **git-lfs-darwin-amd64-v3.4.1.zip** da94d8f63e126638561c4d3ab1a7e8e5d80ae4129732

This release is a feature release which includes support for generating shell scripts for command-line tab-completion of Git LFS commands with the new `git-lfs-completion(1)` command, providing multiple headers to Git credential helpers (a new feature as of Git 2.41), and installing Git LFS with a Git configuration file stored under the XDG configuration path. Note that this release will be made by a different member of the core team than the person who performed many of the past releases, and thus this release will be signed with a different OpenPGP key. Please follow [the steps in the README to download all of the keys for the core team](https://github.com/git-lfs/git-lfs#verifying-releases) to verify this release. We would like to extend a special thanks to the following open-source contributors: * @anihm136 for implementing shell completion script generation * @aymanbagabas for multiple fixes to our SSH and transfer queue code * @dscho for ensuring our Windows installer works on 32-bit systems * @dyrone for correcting an erroneous file name in our documentation * @jlosito for making sure our CI job actions are up to date * @nfgferreira for speeding up th

This release is a feature release which includes package support for Red Hat Enterprise Linux 9 and compatible OSes, experimental support for multiple remotes, and some command-line helpers for `git lfs push`. In this release, we no longer include vendored versions of our dependencies in the repository or the tarballs. These were a source of noise and bloat, and users can easily download the required dependencies with Go itself. Users who need to continue to vendor the dependencies can use the `make vendor` target. In addition, we've also switched the documentation to AsciiDoc from ronn-flavoured Markdown and included the FAQ in the repository. This means that the manual pages now render properly in the GitHub web interface and it's also much easier to create additional formats, such as PDF, by leveraging the ability of Asciidoctor to convert to DocBook. It should also be noted that `git lfs migrate import --everything` now processes all refs that aren't special to Git instead of just branches and tags. This is what it was documented to do, but didn't, so we've fixed it. Finally, please note that future releases may be done by a different member of the c

This release is a feature release which includes support for machine-readable formats for a couple more commands, plus the ability to automatically merge LFS-based text files from the command-line. It's likely that the merge driver will see future improvements, but if you have feedback on the design, please use the discussions feature. Note that our binary release archives no longer unpack into the current directory, and now contain a top-level directory just like the source archives do. We would like to extend a special thanks to the following open-source contributors: * @bbodenmiller for fixing the formatting in our manual pages * @breyed for fixing a typo in our manual pages * @btoll for improving our README * @rcoup for fixing our Accept header syntax * @vtbassmatt for documenting our deprecation of NTLM ### Features * ls-files: add a --json option #5007 (@bk2204) * Add --json output for git lfs track #5006 (@bk2204) * Add a merge driver #4970 (@bk2204) * lfs: don't write hooks when they haven't changed #4935 (@bk2204) * Tarballs, not tarbombs #4980 (@bk2204) ### Bugs * Apply several Makefile fixes for Windows #5016 (@bk2204) * git: don't p

This release is a bugfix release to fix some problems during the build of v3.1.3. There are otherwise no substantial changes from v3.1.3. ### Misc * Use only Windows Server 2019 runners for CI in GitHub Actions #4883 (@chrisd8088) * remove unused `Pipe[Media]Command()` functions #4942 (@chrisd8088) ## Packages Up to date packages are available on [PackageCloud](https://packagecloud.io/github/git-lfs) and [Homebrew](http://brew.sh/). [RPM RHEL 7/CentOS 7](https://packagecloud.io/github/git-lfs/packages/el/7/git-lfs-3.1.4-1.el7.x86_64.rpm/download) [RPM RHEL 8/CentOS 8](https://packagecloud.io/github/git-lfs/packages/el/8/git-lfs-3.1.4-1.el8.x86_64.rpm/download) [Debian 9](https://packagecloud.io/github/git-lfs/packages/debian/stretch/git-lfs_3.1.4_amd64.deb/download) [Debian 10](https://packagecloud.io/github/git-lfs/packages/debian/buster/git-lfs_3.1.4_amd64.deb/download) [Debian 11](https://packagecloud.io/github/git-lfs/packages/debian/bullseye/git-lfs_3.1.4_amd64.deb/download) ## SHA-256 hashes: **git-lfs-darwin-amd64-v3.1.4.zip** c273f08aec1e47df88597396f6216dc103f57c6357b02f1fae3692904b666671 **git-lfs-darwin-arm64-v3.1.4.zip** 1b6e1c20ac02b0a11d6a