Prevent crafted URL containing new lines, empty host or lacks a scheme
2020-11008

Crafted URL containing new lines can cause credential leak
Resolves: CVE-2020-5260

Fix CVE-2019-1387: remote code execution in recursive clones with nested
2019-1387

Fix CVE-2018-17456: arbitrary code execution via .gitmodules

Fix httpd modules path to be independent from system architecture.

Use the correct apache module directory in instaweb.
Apply the docs fixes to instaweb as well.

Correctly return an error from fsck on encountering a .gitmodules symlink.
Correct a typo in changelog.

Remove EL-5 settings and old Fedora conditionals.
Fix builds using '--without docs'
Change git-instaweb default from lighttpd(not available in rhel7) to
Add requires for git-{instaweb,gnome-keyring} to pull them, when
all.

move instaweb to separate git-instaweb subpackage.
move gnome-keyring to a separate git-gnome-keyring subpackage.

Backport fix for CVE-2018-11235
Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x

fall back to Basic auth if Negotiate fails
handle request-pull when multiple tags point to the same commit

prevent command injection via malicious ssh URLs
2017-1000117

dissalow repo names beginning with dash
2017-8386

do not put unsanitized branch names in $PS1
2014-9938

add control of GSSAPI credential delegation to enable HTTP(S)-SSO

remove needles check of xmalloc from previous patch