@nobodyinperson @mih @chrysn it's interesting that the CVE that triggered this change has to do with symlinks in .git/, not symlinks TO .git/.