What's Changed

• docs: highlight untrusted git-arg interpolation as a warning callout by @EndBug in #781
• fix: Remove GH var interpolation in action.yml docstring by @dzcode in #783
• fix: validate denylisted git args on every token by @EndBug in #784

New Contributors

• @dzcode made their first contribution in #783

Full Changelog: v11.1.0...v11.1.1

What's Changed

• feat: add push_attempts to retry failed pushes by @EndBug in #764
• test: add integration tests for the shipped action by @EndBug in #766
• feat: add dry_run input by @EndBug in #765
• docs: add nmattia as a contributor for ideas by @allcontributors[bot] in #767
• docs: add jcbhmr as a contributor for ideas by @allcontributors[bot] in #768
• fix: reject remote-helper overrides skipped by -u by @EndBug in #770
• fix: block scheme:: remote helpers and restrict git transports by @EndBug in #771
• fix: resolve absolute cwd without dumping the minified bundle (#495) by @EndBug in #772
• feat: treat pull: true as a default git pull by @EndBug in #773
• docs: add ross-spencer as a contributor for bug by @allcontributors[bot] in #774
• docs: add louisabraham as a contributor for ideas by @allcontributors[bot] in #775
• fix: reject --pathspec-from-file to prevent log disclosure by @EndBug in #777
• fix: neutralize workflow-command injection in info logs by @EndBug in #776
• fix: reject glued quotes that string-argv would split into extra git flags by @EndBug in #778
• chore(deps): bump js-yaml from 5.2.3 to 5.3.0 by @dependabot[bot] in #780
• chore(deps-dev): bump @vercel/ncc from 0.44.1 to 0.45.0 by @dependabot[bot] in #779

Full Changelog: v11.0.0...v11.1.0

What's Changed

• chore(deps): bump picomatch by @dependabot[bot] in #724
• chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by @dependabot[bot] in #725
• chore(deps): bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in #728
• chore(deps-dev): bump ts-jest from 29.4.6 to 29.4.9 by @dependabot[bot] in #727
• chore(deps): bump @actions/github from 9.0.0 to 9.1.0 by @dependabot[bot] in #729
• chore(deps): bump @actions/github from 9.1.0 to 9.1.1 by @dependabot[bot] in #732
• chore(deps): bump @actions/core from 3.0.0 to 3.0.1 by @dependabot[bot] in #733
• ci(deps): bump actions/dependency-review-action from 4 to 5 by @dependabot[bot] in #734
• chore(deps-dev): bump ts-jest from 29.4.9 to 29.4.11 by @dependabot[bot] in #736
• chore(deps-dev): bump jest from 30.3.0 to 30.4.2 by @dependabot[bot] in #735
• chore(deps-dev): bump eslint-plugin-prettier from 5.5.5 to 5.5.6 by @dependabot[bot] in #738
• chore(deps): bump js-yaml from 4.1.1 to 4.2.0 by @dependabot[bot] in #739
• ci(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #741
• chore(deps): bump undici from 6.24.1 to 6.27.0 by @dependabot[bot] in #744
• ci(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in #749
• chore(deps-dev): bump @vercel/ncc from 0.38.4 to 0.44.1 by @dependabot[bot] in #746
• chore(deps): bump js-yaml from 4.2.0 to 5.2.1 by @dependabot[bot] in #747
• chore(deps-dev): bump ts-jest from 29.4.11 to 29.4.12 by @dependabot[bot] in #750
• chore(deps): bump js-yaml from 5.2.1 to 5.2.2 by @dependabot[bot] in #751
• chore(deps): bump undici from 6.27.0 to 6.28.0 by @dependabot[bot] in #753
• fix: reject remote-helper git flags that enable RCE by @EndBug in #754
• fix: prevent git option injection via new_branch by @EndBug in #755
• fix: verify committed lib/ matches source in CI by @EndBug in #756
• fix: stop logging full git config (credential leak) by @EndBug in #758
• fix: reject -F/--file git args that can exfiltrate runner files by @EndBug in #759
• fix: reject unmatched quotes in matchGitArgs to prevent flag injection by @EndBug in #760
• fix: refuse unexpected gitlinks staged by git add by @EndBug in #761
• fix: do not report committed=true for empty commit SHA by @EndBug in #757
• ci: pin actions-tagger and restrict release workflow permissions by @EndBug in #762
• fix: neutralize bidi and control chars in action logs by @EndBug in #763

Full Changelog: v10.0.0...v11.0.0

What's Changed

• chore(deps-dev): bump husky from 8.0.3 to 9.0.6 by @dependabot[bot] in #617
• chore(deps-dev): bump @typescript-eslint/parser from 6.19.0 to 6.19.1 by @dependabot[bot] in #618
• chore(deps-dev): bump prettier from 3.2.4 to 3.2.5 by @dependabot[bot] in #619
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.19.1 to 6.21.0 by @dependabot[bot] in #623
• chore(deps-dev): bump @typescript-eslint/parser from 6.19.1 to 6.21.0 by @dependabot[bot] in #624
• chore(deps-dev): bump husky from 9.0.6 to 9.0.11 by @dependabot[bot] in #626
• chore: switch to GTS for linting by @EndBug in #636
• chore(deps-dev): bump gts from 5.2.0 to 5.3.0 by @dependabot[bot] in #637
• chore(deps-dev): bump typescript from 5.2.2 to 5.4.5 by @dependabot[bot] in #639
• chore(deps-dev): bump gts from 5.3.0 to 5.3.1 by @dependabot[bot] in #642
• chore(deps-dev): bump braces from 3.0.2 to 3.0.3 by @dependabot[bot] in #641
• chore(deps-dev): bump typescript from 5.4.5 to 5.5.2 by @dependabot[bot] in #644
• Adds examples of input arrays. by @tommie in #645
• chore(deps-dev): bump typescript from 5.5.2 to 5.5.3 by @dependabot[bot] in #649
• docs: add tommie as a contributor for doc by @allcontributors[bot] in #647
• chore(deps-dev): bump husky from 9.0.11 to 9.1.1 by @dependabot[bot] in #650
• chore(deps-dev): bump typescript from 5.5.3 to 5.5.4 by @dependabot[bot] in #653
• chore(deps-dev): bump husky from 9.1.1 to 9.1.4 by @dependabot[bot] in #655
• chore(deps-dev): bump husky from 9.1.4 to 9.1.5 by @dependabot[bot] in #659
• chore(deps-dev): bump husky from 9.1.5 to 9.1.6 by @dependabot[bot] in #660
• chore(deps-dev): bump typescript from 5.5.4 to 5.6.2 by @dependabot[bot] in #661
• chore(deps-dev): bump @vercel/ncc from 0.38.1 to 0.38.2 by @dependabot[bot] in #662
• chore(deps): bump @actions/core from 1.10.1 to 1.11.1 by @dependabot[bot] in #663
• chore(deps-dev): bump typescript from 5.6.2 to 5.6.3 by @dependabot[bot] in #664
• chore(deps-dev): bump gts from 5.3.1 to 6.0.0 by @dependabot[bot] in #665
• chore(deps-dev): bump gts from 6.0.0 to 6.0.2 by @dependabot[bot] in #666
• chore(deps-dev): bump @vercel/ncc from 0.38.2 to 0.38.3 by @dependabot[bot] in #669
• chore(deps): bump cross-spawn by @dependabot[bot] in #670
• docs: add icemac as a contributor for doc by @allcontributors[bot] in #674
• chore(deps-dev): bump husky from 9.1.6 to 9.1.7 by @dependabot[bot] in #672
• chore(deps-dev): bump typescript from 5.6.3 to 5.7.2 by @dependabot[bot] in #671
• chore(deps-dev): bump typescript from 5.7.2 to 5.7.3 by @dependabot[bot] in #676
• chore(deps-dev): bump eslint-config-prettier from 9.1.0 to 10.0.1 by @dependabot[bot] in #677
• chore(deps-dev): bump eslint-config-prettier from 10.0.1 to 10.0.2 by @dependabot[bot] in #678
• chore(deps-dev): bump typescript from 5.7.3 to 5.8.2 by @dependabot[bot] in #679
• chore(deps-dev): bump eslint-config-prettier from 10.0.2 to 10.1.1 by @dependabot[bot] in #680
• chore(deps-dev): bump typescript from 5.8.2 to 5.8.3 by @dependabot[bot] in #681
• chore(deps-dev): bump eslint-config-prettier from 10.1.1 to 10.1.2 by @dependabot[bot] in #682
• chore(deps-dev): bump eslint-config-prettier from 10.1.2 to 10.1.5 by @dependabot[bot] in #683
• chore(deps-dev): bump eslint-config-prettier from 10.1.5 to 10.1.8 by @dependabot[bot] in #686
• ci(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #688
• ci(deps): bump actions/setup-node from 4 to 5 by @dependabot[bot] in #690
• chore(deps-dev): bump @vercel/ncc from 0.38.3 to 0.38.4 by @dependabot[bot] in #691
• chore(deps-dev): bump typescript from 5.8.3 to 5.9.3 by @dependabot[bot] in #694
• ci(deps): bump actions/setup-node from 5 to 6 by @dependabot[bot] in #697
• ci(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #696
• Removes the redundant JSON array parsing. by @tommie in #652
• docs: add tommie as a contributor for code, and test by @allcontributors[bot] in #699
• chore(deps): bump js-yaml from 4.1.0 to 4.1.1 by @dependabot[bot] in #700
• ci(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #703
• chore(deps-dev): bump jest and @types/jest by @dependabot[bot] in #701
• ci(deps): bump actions/setup-node from 4 to 6 by @dependabot[bot] in #702
• ci(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in #704
• Improve documentation around pathspec error behavior by @tomas-kovanda in #706
• docs: add tomas-kovanda as a contributor for doc by @allcontributors[bot] in #707
• chore(deps-dev): bump ts-jest from 29.4.5 to 29.4.6 by @dependabot[bot] in #708
• chore(deps): bump @actions/core from 1.11.1 to 2.0.1 by @dependabot[bot] in #709
• chore(deps): bump @actions/core from 2.0.1 to 2.0.2 by @dependabot[bot] in #711
• chore(deps): bump lodash from 4.17.21 to 4.17.23 by @dependabot[bot] in #715
• chore(deps-dev): bump eslint-plugin-prettier from 5.5.4 to 5.5.5 by @dependabot[bot] in #712
• chore(deps): bump minimatch by @dependabot[bot] in #718
• chore(deps): bump @actions/core from 2.0.2 to 3.0.0 by @dependabot[bot] in #716
• chore(deps-dev): bump jest from 30.2.0 to 30.3.0 by @dependabot[bot] in #721
• feat!: use node version 24 by @CodeReaper in #720
• chore(deps-dev): bump flatted from 3.3.3 to 3.4.2 by @dependabot[bot] in #722
• docs: add CodeReaper as a contributor for maintenance by @allcontributors[bot] in #723

New Contributors

• @tommie made their first contribution in #645
• @tomas-kovanda made their first contribution in #706
• @CodeReaper made their first contribution in #720

Full Changelog: v9.1.4...v10.0.0

What's Changed

• chore(deps): bump string-argv from 0.3.1 to 0.3.2 by @dependabot in #506
• chore(deps-dev): bump all-contributors-cli from 6.25.0 to 6.25.1 by @dependabot in #507
• chore(deps-dev): bump all-contributors-cli from 6.25.1 to 6.26.0 by @dependabot in #509
• chore(deps-dev): bump typescript from 5.0.4 to 5.1.3 by @dependabot in #512
• chore(deps-dev): bump typescript from 5.1.3 to 5.1.6 by @dependabot in #515
• docs: add justanotheranonymoususer as a contributor for bug by @allcontributors in #517
• chore(deps-dev): bump all-contributors-cli from 6.26.0 to 6.26.1 by @dependabot in #518
• chore(deps): bump semver from 5.7.1 to 5.7.2 by @dependabot in #520
• chore(deps-dev): bump @typescript-eslint/parser from 6.0.0 to 6.1.0 by @dependabot in #522
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.0.0 to 6.2.0 by @dependabot in #524
• chore(deps-dev): bump eslint-config-prettier from 8.8.0 to 8.9.0 by @dependabot in #525
• chore(deps-dev): bump @typescript-eslint/parser from 6.1.0 to 6.2.0 by @dependabot in #526
• chore(deps-dev): bump prettier from 3.0.0 to 3.0.1 by @dependabot in #527
• chore(deps-dev): bump @typescript-eslint/parser from 6.2.0 to 6.2.1 by @dependabot in #528
• chore(deps-dev): bump @typescript-eslint/parser from 6.2.1 to 6.3.0 by @dependabot in #532
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.2.0 to 6.4.0 by @dependabot in #534
• chore(deps-dev): bump prettier from 3.0.1 to 3.0.2 by @dependabot in #536
• chore(deps-dev): bump @typescript-eslint/parser from 6.3.0 to 6.4.1 by @dependabot in #537
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.4.0 to 6.4.1 by @dependabot in #539
• chore(deps-dev): bump typescript from 5.1.6 to 5.2.2 by @dependabot in #538
• chore(deps-dev): bump eslint-config-prettier from 8.9.0 to 9.0.0 by @dependabot in #530
• chore(deps-dev): bump prettier from 3.0.2 to 3.0.3 by @dependabot in #541
• chore(deps-dev): bump @typescript-eslint/parser from 6.4.1 to 6.5.0 by @dependabot in #540
• ci(deps): bump actions/checkout from 3 to 4 by @dependabot in #544
• chore(deps-dev): bump @vercel/ncc from 0.36.1 to 0.38.0 by @dependabot in #545
• chore(deps-dev): bump @typescript-eslint/parser from 6.5.0 to 6.6.0 by @dependabot in #546
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.4.1 to 6.7.0 by @dependabot in #547
• chore(deps-dev): bump @types/js-yaml from 4.0.5 to 4.0.6 by @dependabot in #549
• chore(deps-dev): bump @typescript-eslint/parser from 6.6.0 to 6.7.0 by @dependabot in #548
• chore(deps): bump @actions/core from 1.10.0 to 1.10.1 by @dependabot in #550
• chore(deps-dev): bump @typescript-eslint/parser from 6.7.0 to 6.7.2 by @dependabot in #551
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.7.0 to 6.7.2 by @dependabot in #552
• chore(deps-dev): bump @typescript-eslint/parser from 6.7.2 to 6.7.3 by @dependabot in #553
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.7.2 to 6.7.4 by @dependabot in #555
• chore(deps-dev): bump @typescript-eslint/parser from 6.7.3 to 6.7.4 by @dependabot in #557
• chore(deps-dev): bump eslint-plugin-prettier from 5.0.0 to 5.0.1 by @dependabot in #558
• chore(deps-dev): bump @typescript-eslint/parser from 6.7.4 to 6.7.5 by @dependabot in #559
• chore(deps-dev): bump @types/js-yaml from 4.0.6 to 4.0.7 by @dependabot in #560
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.7.4 to 6.8.0 by @dependabot in #562
• chore(deps-dev): bump @types/js-yaml from 4.0.7 to 4.0.8 by @dependabot in #563
• chore(deps-dev): bump @vercel/ncc from 0.38.0 to 0.38.1 by @dependabot in #565
• chore(deps-dev): bump @typescript-eslint/parser from 6.7.5 to 6.9.0 by @dependabot in #566
• ci(deps): bump actions/setup-node from 3 to 4 by @dependabot in #567
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.8.0 to 6.9.0 by @dependabot in #568
• chore(deps-dev): bump @typescript-eslint/parser from 6.9.0 to 6.9.1 by @dependabot in #569
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.9.0 to 6.10.0 by @dependabot in #571
• typo in README git add -> git tag by @cderv in #572
• docs: add cderv as a contributor for doc by @allcontributors in #573
• READMEmd: use latest versions of GitHub actions by @deining in #574
• docs: add deining as a contributor for doc by @allcontributors in #575
• chore(deps-dev): bump @types/js-yaml from 4.0.8 to 4.0.9 by @dependabot in #576
• chore(deps-dev): bump prettier from 3.0.3 to 3.1.0 by @dependabot in #578
• chore(deps-dev): bump @typescript-eslint/parser from 6.9.1 to 6.10.0 by @dependabot in #577
• chore(deps-dev): bump @typescript-eslint/parser from 6.10.0 to 6.11.0 by @dependabot in #579
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.10.0 to 6.12.0 by @dependabot in #581
• chore(deps-dev): bump @typescript-eslint/parser from 6.11.0 to 6.12.0 by @dependabot in #584
• chore(deps-dev): bump typescript from 5.2.2 to 5.3.2 by @dependabot in #585
• chore(deps-dev): bump eslint-config-prettier from 9.0.0 to 9.1.0 by @dependabot in #587
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.12.0 to 6.13.1 by @dependabot in #588
• chore(deps-dev): bump @typescript-eslint/parser from 6.12.0 to 6.13.2 by @dependabot in #590
• chore(deps-dev): bump prettier from 3.1.0 to 3.1.1 by @dependabot in #593
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.13.1 to 6.14.0 by @dependabot in #594
• chore(deps-dev): bump typescript from 5.3.2 to 5.3.3 by @dependabot in #592
• ci(deps): bump github/codeql-action from 2 to 3 by @dependabot in #595
• chore(deps-dev): bump @typescript-eslint/parser from 6.13.2 to 6.14.0 by @dependabot in #596
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.14.0 to 6.15.0 by @dependabot in #598
• chore(deps-dev): bump eslint-plugin-prettier from 5.0.1 to 5.1.2 by @dependabot in #599
• chore(deps-dev): bump @typescript-eslint/parser from 6.14.0 to 6.16.0 by @dependabot in #601
• chore(deps-dev): bump @typescript-eslint/parser from 6.16.0 to 6.18.0 by @dependabot in #604
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.15.0 to 6.18.1 by @dependabot in #605
• chore(deps-dev): bump eslint-plugin-prettier from 5.1.2 to 5.1.3 by @dependabot in #606
• chore(deps-dev): bump prettier from 3.1.1 to 3.2.2 by @dependabot in #607
• chore(deps-dev): bump @typescript-eslint/parser from 6.18.0 to 6.18.1 by @dependabot in #608
• chore(deps-dev): bump @typescript-eslint/parser from 6.18.1 to 6.19.0 by @dependabot in #609
• chore(deps-dev): bump prettier from 3.2.2 to 3.2.4 by @dependabo...

What's Changed

• chore(deps-dev): bump all-contributors-cli from 6.24.0 to 6.25.0 by @dependabot in #504
• chore(deps): bump simple-git by @EndBug in #505

Full Changelog: v9.1.2...v9.1.3

What's Changed

• Update io.ts by @ggreif in #443
• docs: add ggreif as a contributor for maintenance by @allcontributors in #444
• chore(deps-dev): bump all-contributors-cli from 6.23.1 to 6.24.0 by @dependabot in #445
• fix(io): add warning for pull input by @EndBug in #453
• Fix a few typos in README.md by @ggreif in #454
• docs: add ggreif as a contributor for doc by @allcontributors in #456
• Typo in io.ts debug output by @ggreif in #455
• chore(deps-dev): bump husky from 8.0.1 to 8.0.2 by @dependabot in #457
• chore(deps): bump minimatch from 3.0.4 to 3.1.2 by @dependabot in #458
• chore(deps-dev): bump typescript from 4.8.4 to 4.9.3 by @dependabot in #460
• chore(deps-dev): bump prettier from 2.7.1 to 2.8.0 by @dependabot in #461
• chore(deps-dev): bump @vercel/ncc from 0.34.0 to 0.36.0 by @dependabot in #462
• chore(deps-dev): bump prettier from 2.8.0 to 2.8.1 by @dependabot in #463
• chore(deps-dev): bump typescript from 4.9.3 to 4.9.4 by @dependabot in #464
• chore(deps-dev): bump prettier from 2.8.1 to 2.8.2 by @dependabot in #470
• chore(deps-dev): bump eslint-config-prettier from 8.5.0 to 8.6.0 by @dependabot in #471
• chore(deps-dev): bump husky from 8.0.2 to 8.0.3 by @dependabot in #472
• chore(deps-dev): bump prettier from 2.8.2 to 2.8.3 by @dependabot in #474
• Add how to autodetect deleted files by @azeemba in #468
• chore(deps-dev): bump @vercel/ncc from 0.36.0 to 0.36.1 by @dependabot in #475
• chore(deps-dev): bump typescript from 4.9.4 to 4.9.5 by @dependabot in #477
• chore(deps-dev): bump prettier from 2.8.3 to 2.8.4 by @dependabot in #480
• docs: add keithrfung as a contributor for doc by @allcontributors in #482
• chore(deps-dev): bump eslint-config-prettier from 8.6.0 to 8.7.0 by @dependabot in #484
• chore(deps-dev): bump prettier from 2.8.4 to 2.8.5 by @dependabot in #487
• chore(deps-dev): bump typescript from 4.9.5 to 5.0.2 by @dependabot in #488
• chore(deps-dev): bump prettier from 2.8.5 to 2.8.7 by @dependabot in #490
• chore(deps-dev): bump eslint-config-prettier from 8.7.0 to 8.8.0 by @dependabot in #489
• chore(deps-dev): bump typescript from 5.0.2 to 5.0.3 by @dependabot in #493
• chore(deps-dev): bump typescript from 5.0.3 to 5.0.4 by @dependabot in #494
• chore(deps-dev): bump prettier from 2.8.7 to 2.8.8 by @dependabot in #500
• fix: Abbreviate commit_sha to be back to being the short SHA by @DenverCoder1 in #502
• docs: add DenverCoder1 as a contributor for bug, and code by @allcontributors in #503

New Contributors

• @ggreif made their first contribution in #443
• @azeemba made their first contribution in #468
• @DenverCoder1 made their first contribution in #502

Full Changelog: v9.1.1...v9.1.2

What's Changed

• chore(deps-dev): bump typescript from 4.7.4 to 4.8.2 by @dependabot in #427
• chore(deps-dev): bump typescript from 4.8.2 to 4.8.3 by @dependabot in #431
• chore(deps-dev): bump all-contributors-cli from 6.20.0 to 6.20.4 by @dependabot in #432
• chore(deps-dev): bump all-contributors-cli from 6.20.4 to 6.20.5 by @dependabot in #435
• chore(deps-dev): bump all-contributors-cli from 6.20.5 to 6.22.0 by @dependabot in #436
• chore(deps-dev): bump typescript from 4.8.3 to 4.8.4 by @dependabot in #437
• chore(deps): bump @actions/core from 1.9.1 to 1.10.0 by @dependabot in #438
• chore(deps-dev): bump all-contributors-cli from 6.22.0 to 6.23.1 by @dependabot in #439
• Update action to run on Node 16 by @ManuelRauber in #440
• docs: add ManuelRauber as a contributor for code by @allcontributors in #441

New Contributors

• @ManuelRauber made their first contribution in #440

Full Changelog: v9.1.0...v9.1.1

Added:

• The fetch input allows you to customize the git fetch command, or to prevent the action from fetching at all.

Full Changelog: v9.0.1...v9.1.0

Fixed:

• Now files are re-staged after pulling, so that the action works as intended when using options such as pull: --rebase --autostash

New Contributors

• @akimon658 made their first contribution in #378
• @revolunet made their first contribution in #401

Full Changelog: v9.0.0...v9.0.1