v9.18.2 (2026-09-07)

[sisp]

Fix

• allow overwriting destination symlinks when preserve_symlinks: false
• cache: resolve submodules from the current checkout's .gitmodules (fix: resolve submodules from the current checkout's .gitmodules #2767)

Security

• prevent trust bypass via ambiguous URL characters

  To prevent URL confusion attacks, trusted prefix matching is now restricted to repository URL paths containing only RFC 3986 §2.3 "unreserved" characters (letters, digits, -, ., _, ~) and /. URL paths containing other characters now require an exact, verbatim match.

---

This discussion was created from the release v9.18.1 (2026-09-07).