Git LFS

Git LFS 3.8.1 fixes four CVEs: unsanitized SSH remote command arguments, Cookie headers leaking across hosts after HTTP redirects, arbitrary program execution via malformed submodule URLs, and arbitrary program execution via unfiltered .lfsconfig transfer adapter options. It also fixes an unrelated issue with encoding the HTTPS URL checked when an SSH remote host does not support Git LFS or return an HTTP URL during authentication.

Matters for: Teams cloning or fetching from untrusted or third-party Git repositories containing LFS-tracked assets, and those using SSH remotes or HTTP redirects with credential-bearing cookies.

Git LFS 3.8.0 adds support for zstd-compressed object downloads, fetching objects for references piped via standard input, and limiting how long it waits before retrying HTTP requests, alongside fixes for SSH session reuse, Windows file deletion conflicts, and remote-tracking branch resolution during downloads. This release requires macOS 13 (Ventura) or later since it is built with Go v1.27, and it adds official package support for Debian 13 (trixie).

Matters for: Relevant for teams versioning game assets or other large binaries in Git repositories hosted over bandwidth-constrained or authenticated HTTP/SSH connections, especially those on Debian 13 or macOS 13+ build environments.