This release is a feature release which introduces several new options for fetching Git LFS objects; such as the ability to force objects to be re-downloaded and the capacity to output object URLs and HTTP metadata in JSON for external tools to consume. This release also adds$$$a configurable in-memory cache of file path pattern matches; which along with other changes can help reduce the time required to migrate large repositories to Git LFS.$$$$$$Git LFS now supports the same .netrc files on Windows as Git and$$$curl; retries appropriately after all 429 status code HTTP responses;$$$permits the use of symbolic links to Gits object storage during$$$Git LFS migrations; and avoids spurious TLS verification errors when$$$custom CA certificates are configured on macOS.$$$$$$Features$$$Cache a file path filter match result #6047 (@alexkad0)$$$Add --refetch option to fetch #5975 (@redsun82)$$$Add --json option to fetch #5974 (@redsun82)$$$Add --dry-run option to fetch #5973 (@redsun82)$$$Bugs$$$Verify TLS/SSL certificates using default Go support for macOS system root CAs #6049 (@chrisd8088)$$$Prefer .netrc on windows if present #6055 (@johanvdw)$$$Fix migrations where .git/objects is a symlink #6042 (@bk2204)$$$Honour 429 object transfer response Retry-After headers #6014 (@chrisd8088)$$$Misc$$$Update Linux distribution package list for v3.7.0 release (@chrisd8088)$$$Report missing objects consistently when pushing #6027 (@chrisd8088)$$$Use a git-update-ref script to update references #6048 (@alexkad0)$$$Drop unused generic stub function for cloning files #6050 (@chrisd8088)$$$Prevent conflicting curl macros in early Git version CI jobs #6040 (@chrisd8088)$$$pull: improve error message on failing checkout #5629 (@bk2204)$$$Fix language in code snippets in API docs #6035 (@slonopotamus)$$$build(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 #6034 (@dependabot[bot])$$$Use single-target Makefile patterns for manual pages #6032 (@chrisd8088)$$$use direct value nil for error #6024 (@alingse)$$$Update minimum required Git version checks #6028 (@chrisd8088)$$$build(deps): bump golang.org/x/net from 0.33.0 to 0.36.0 #6012 (@dependabot[bot])$$$Upgrading x/crypto to v0.35.0 to solve CVE-2025-22869 #5997 (@gergelyfabian)$$$Upgrade to Go 1.24 #6013 (@chrisd8088)$$$Use constant format strings and fix HTTP error messages #5998 (@chrisd8088)$$$Remove command name prefixes from progress messages #5995 (@chrisd8088)$$$doc: Add missing --to argument in git-lfs-checkout example #6005 (@DarkDefender)$$$Replace min/max helpers with built-in min/max #5999 (@Juneezee)$$$Add security patch release process documentation #5987 (@chrisd8088)$$$Replace unused debug mode with trace logging #5989 (@chrisd8088)$$$Use default Ruby provided by Actions runners #5984 (@chrisd8088)$$$build(deps): bump azure/trusted-signing-action from 0.5.0 to 0.5.1 #5981 (@dependabot[bot])$$$Update workflows to use ARM runners and new Apple signing certificate #5977 (@chrisd8088)$$$docs/man/git-lfs-prune.adoc: fix --(no-)verify-unreachable description #5959 (@m3ka24)$$$docs/man/git-lfs-migrate.adoc: remove duplicate flag #5944 (@fedirz)$$$Upgrade golang.org/x/net from 0.23.0 to 0.33.0 #5940 (@gergelyfabian)$$$build(deps): bump golang.org/x/crypto from 0.21.0 to 0.31.0 #5935 (@dependabot[bot])$$$Simplify macOS CI jobs and specify Go toolchain version #5931 (@chrisd8088)$$$Tighten security of Actions workflows #5930 (@bk2204)$$$Corrected Pop!_OS naming #5929 (@LucasDondo)$$$Update release process documentation and scripts #5920 (@chrisd8088)$$$Update license copyright dates and minimum supported Git version #5921 (@chrisd8088)

This release introduces a security fix for all platforms; which has been assigned CVE-2024-53263.$$$$$$When requesting credentials from Git for a remote host; prior versions of Git LFS passed portions of the hosts URL to the git-credential(1) command without checking for embedded line-ending control characters; and then sent any credentials received back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL; an attacker might have been able to retrieve a users Git credentials.$$$$$$Git LFS now prevents bare line feed (LF) characters from being included in the values sent to the git-credential(1) command; and also prevents bare carriage return (CR) characters from being included unless the credential.protectProtocol configuration option is set to a value equivalent to false.$$$$$$We would like to extend a special thanks to the following open-source contributors:$$$$$$@Ry0taK for reporting this to us responsibly$$$Bugs$$$Reject bare line-ending control characters in Git credential requests (@chrisd8088)$$$Packages

This release introduces a security fix for all platforms; which has been assigned CVE-2024-53263.$$$$$$When requesting credentials from Git for a remote host; prior versions of Git LFS passed portions of the hosts URL to the git-credential(1) command without checking for embedded line-ending control characters; and then sent any credentials received back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL; an attacker might have been able to retrieve a users Git credentials.$$$$$$Git LFS now prevents bare line feed (LF) characters from being included in the values sent to the git-credential(1) command; and also prevents bare carriage return (CR) characters from being included unless the credential.protectProtocol configuration option is set to a value equivalent to false.$$$$$$We would like to extend a special thanks to the following open-source contributors:$$$$$$@Ry0taK for reporting this to us responsibly$$$Bugs$$$Reject bare line-ending control characters in Git credential requests (@chrisd8088)$$$Packages

Features$$$git: improve sparse checkout support #5796 (@bk2204)$$$hook: fix newlines in command missing message #5886 (@xdavidwu)$$$Add batch size config value and use it everywhere #5876 (@bogomolets-owl)$$$Support relative paths to linked working trees #5898 (@chrisd8088)$$$git-lfs: omit tags in ls-remote; optimize pre-push #5863 (@pastelsky)$$$Support multistage authentication with a Git credential helper #5803 (@bk2204)$$$Support arbitrary HTTP credential schemes for authentication #5779 (@bk2204)$$$Optimize performance for scanning trees in partial clones #5699 (@bk2204)$$$Use lower-case file extensions in Windows installer path checks #5688 (@chrisd8088)$$$Match PATH case insensitively in Windows installer #5680 (@bk2204)$$$Bugs$$$Fix crash during pure SSH object transfer with multiple objects #5905 (@chrisd8088)$$$ssh: fix connection creation leaking connections #5816 (@ConcurrentCrab)$$$fix: fix slice init length #5874 (@rusttech)$$$Fix panic caused by accessing non-existent header #5804 (@blanet)

This release is a patch release which includes some fixes to the release$$$process to properly build assets. It should have no user-visible changes from$$$v3.5.0.$$$$$$Misc$$$Build release assets with Go 1.21 #5668 (@bk2204)$$$script/packagecloud: instantiate distro map properly #5662 (@bk2204)$$$Install msgfmt on Windows in CI and release workflows #5666 (@chrisd8088)

This is a bugfix release which resolves a bug introduced in the$$$v3.4.0 release; where Git LFS may crash if the Git credential manager$$$returns credentials containing one or more empty fields.$$$$$$Bugs$$$Fix a panic in the credential code #5490 (@bk2204)

This release is a feature release which includes support for generating$$$shell scripts for command-line tab-completion of Git LFS commands with$$$the new git-lfs-completion(1) command; providing multiple headers to Git$$$credential helpers (a new feature as of Git 2.41); and installing Git LFS$$$with a Git configuration file stored under the XDG configuration path.$$$$$$Note that this release will be made by a different member of the core$$$team than the person who performed many of the past releases; and thus$$$this release will be signed with a different OpenPGP key. Please follow$$$the steps in the README to download all of the keys for the core$$$team to verify this release.$$$$$$We would like to extend a special thanks to the following open-source$$$contributors:$$$$$$@anihm136 for implementing shell completion script generation$$$@aymanbagabas for multiple fixes to our SSH and transfer queue code$$$@dscho for ensuring our Windows installer works on 32-bit systems$$$@dyrone for correcting an erroneous file name in our documentation$$$@jlosito for making sure our CI job actions are up to date$$$@nfgferreira for speeding up the track command on Windows$$$@ry167 for improving our Ubuntu installation instructions$$$@salvorizza for fixing a JSON bug in our unlock command$$$@slonopotamus for cleaning up accommodations for legacy Go versions$$$@steffen for improving our installation documentation$$$Features$$$Add support for wwwauth[] to credential helpers #5381 (@bk2204)$$$Add a --file option to install and uninstall #5355 (@bk2204)$$$Add shell completion generation #5311 (@anihm136)$$$Bugs$$$Handle local paths with trailing slashes #5402 (@bk2204)$$$Unlock by ID with JSON Flag returns empty array #5385 (@salvorizza)$$$Refactor macro attribute handling to prevent crashes with --fixup migration option #5382 (@chrisd8088)$$$locks: print warning about locking API to standard error #5350 (@bk2204)$$$Avoid needlessly spawning SSH connections with git archive #5309 (@bk2204)$$$standalone: print an error if the destination isnt a Git repository #5283 (@bk2204)$$$locks: ensure local locks are synced on error #5284 (@bk2204)$$$installer: let it work on 32-bit Windows again #5266 (@dscho)$$$fix(ssh): use /tmp to place control dir on darwin #5223 (@aymanbagabas)$$$commands: avoid remote connections in checkout #5226 (@bk2204)$$$fix(tq): stop adding transfers to queue after abort #5230 (@aymanbagabas)$$$fix: pure SSH list lock command name #5219 (@aymanbagabas)$$$git: match patterns; not file names; for tracked files #5423 (@bk2204)$$$Resolve git-lfs track slowness on Windows due to unneeded user lookup #5431 (@nfgferreira)$$$Misc$$$Update distributions #5392 (@bk2204)$$$workflows: remove refreshenv #5393 (@bk2204)$$$Refactor GitScanner and simplify implementation #5389 (@chrisd8088)$$$Ensure all logging tasks are closed and simplify log task dispatching #5375 (@chrisd8088)$$$FAQ: add entry on archiving subdirectories #5349 (@bk2204)$$$Drop pre-1.13 Go compatibility code #5364 (@slonopotamus)$$$Fix CI by enabling Git protocol v2 #5353 (@bk2204)$$$Clarify git lfs migrate handling of local and remote references #5327 (@chrisd8088)$$$Update to Go version 1.20 #5326 (@chrisd8088)$$$Remove stale video link #5325 (@chrisd8088)$$$Fix Windows CI with Go 1.20 #5317 (@bk2204)$$$Update Windows signing certificate hash #5300 (@chrisd8088)$$$t: avoid incorrect negated commands #5282 (@bk2204)$$$Update golang.org/x/text #5290 (@bk2204)$$$Improve error handling for pure SSH protocol #5063 (@bk2204)$$$workflow: use choco install #5281 (@bk2204)$$$Update Linux releases in Packagecloud publication script #5276 (@chrisd8088)$$$Simplify and deduplicate installation instructions #5260 (@steffen)$$$Make hooks refer to core.hookspath #5245 (@bk2204)$$$Update INSTALLING.md to fix ubuntu derivative command and allow easy install for some distros #5014 (@ry167)$$$Check for github action updates monthly #5228 (@jlosito)$$$Upgrade workflows to latest Ubuntu and Actions versions #5243 (@chrisd8088)$$$Upgrade GitHub Actions workflo

Features$$$Add the FAQ in the repository #5167 (@bk2204)$$$Add support for Rocky Linux 9 #5144 (@bk2204)$$$push: add ability to read refs/oids from stdin #5086 (@rcoup)$$$Allow alternative remotes to be handled by LFS #5066 (@srohmen)$$$Switch documentation to AsciiDoc #5054 (@bk2204)$$$Bugs$$$Handle macro attribute references with unspecified flag #5168 (@chrisd8088)$$$Fixed broken link for git-lfs-migrate #5153 (@dhiwakarK)$$$ssh: disable concurrent transfers if no multiplexing #5136 (@bk2204)$$$Fix setting commit & vendor variables via make #5141 (@rcoup)$$$ssh: dont leak resources when falling back to legacy protocol #5137 (@bk2204)$$$Bump gitobj to v2.1.1 #5130 (@bk2204)$$$tools: dont match MINGW as Cygwin #5106 (@bk2204)$$$installer: handle BashOnly Git for Windows gracefully #5048 (@dscho)$$$Change git-lfs migrate import --everything to migrate everything except for special git refs #5045 (@wuhaochen)$$$Misc$$$Use --sparse parameter for ls-files for performance optimization #5187 (@Leo1690)$$$Add information to ambiguous error message. #5172 (@WhatTheFuzz)$$$Distro update for v3.3.0 #5169 (@bk2204)$$$docs/man: clarify Git LFS setup instructions #5166 (@larsxschneider)$$$Update more stale comments relating to object scanning #5164 (@chrisd8088)$$$Update stale comments relating to object scanning and uploading #5163 (@chrisd8088)$$$script/cibuild: exclude icons from whitespace check #5142 (@bk2204)$$$Update to Go version 1.19 #5126 (@chrisd8088)$$$Drop vendoring #4903 (@bk2204)$$$Adding locking_notes.md #5079 (@pratap043)$$$t: set init.defaultBranch #5082 (@bk2204)$$$go.mod: require gopkg.in/yaml.v3 v3.0.1 #5033 (@bk2204)$$$script/upload: improve readability of asset verification #5032 (@bk2204)

Features$$$ls-files: add a --json option #5007 (@bk2204)$$$Add --json output for git lfs track #5006 (@bk2204)$$$Add a merge driver #4970 (@bk2204)$$$lfs: dont write hooks when they havent changed #4935 (@bk2204)$$$Tarballs; not tarbombs #4980 (@bk2204)$$$Bugs$$$Apply several Makefile fixes for Windows #5016 (@bk2204)$$$git: dont panic on pkt-line without equals #4982 (@bk2204)$$$lfshttp: fix invalid Accept header syntax #4996 (@rcoup)$$$Grammar fix #4981 (@breyed)$$$Use gitignore-style path matching for additional commands #4951 (@chrisd8088)$$$Avoid pruning when identical files both match and do not match lfs.fetchexclude #4973 (@chrisd8088)$$$Apply lfs.fetchexclude filter to previous commits when pruning #4968 (@chrisd8088)$$$Update and correct several error message strings #4943 (@chrisd8088)$$$script/upload: correct RHEL 8 package repo #4936 (@bk2204)$$$lfs: add old hook content to the list of old hooks #4878 (@bk2204)$$$.github/workflows: install packagecloud gem #4873 (@bk2204)$$$Misc$$$Update distros for packagecloud.io #5010 (@bk2204)$$$lfshttp: log the Negotiate error on failure #5000 (@bk2204)$$$Build CI on Windows 2022 #4997 (@chrisd8088)$$$workflows: use ronn-ng #4992 (@bk2204)$$$Multiple hash support #4971 (@bk2204)$$$note deprecation of NTLM #4987 (@vtbassmatt)$$$Update to Go 1.18; drop older Go version support; and update modules and dependencies #4963 (@chrisd8088)$$$Update tests to check prune command excludes lfs.fetchexclude paths #4964 (@chrisd8088)$$$Add test to check prune command retains tagged unpushed objects #4962 (@chrisd8088)$$$Adjust test helpers and tests related to path filtering #4960 (@chrisd8088)$$$Include shell path in restricted PATH in credential helper path test #4959 (@chrisd8088)$$$Build test helper commands with file extension on Windows #4954 (@chrisd8088)$$$Update Windows signing certificate SHA hash in Makefile #4946 (@chrisd8088)$$$remove unused Pipe[Media]Command() functions #4942 (@chrisd8088)$$$Makefile: remove legacy trimpath code #4938 (@bk2204)$$$add Inno Setup check of Git install paths and remove old uninstaller checks #4925 (@chrisd8088)$$$note git lfs push --all only pushes local refs in man page #4898 (@chrisd8088)$$$Build man pages into per-section subdirectories #4890 (@chrisd8088)$$$Call out destructive command in README #4880 (@btoll)$$$Improve formatting #4863 (@bbodenmiller)$$$docs/howto: remind core team member to check Actions workflows #4868 (@bk2204)$$$.github: fix syntax error in release workflow #4866 (@bk2204)

This release is a bugfix release to fix some problems during the build of$$$v3.1.3. There are otherwise no substantial changes from v3.1.3.$$$$$$Misc$$$Use only Windows Server 2019 runners for CI in GitHub Actions #4883 (@chrisd8088)$$$remove unused Pipe[Media]Command() functions #4942 (@chrisd8088)