Skip to content

Overgit v0.2.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Aug 16:37
v0.2.0
6685bf6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Clone straight from your forges, plus an identity fix and a security hardening pass.

Clone from GitHub, GitLab, or Bitbucket

The clone sheet now has source tabs. Paste URL works exactly as before; the forge tabs list the repos your existing local credentials can already reach, with a filter box (Enter takes the top hit), an https / ssh toggle that persists, and a Refresh. Pick a repo and the URL and folder name fill themselves in.

Auth reuses what is already on your machine — overgit never asks for, stores, or transmits a token of its own, and no credential is exposed to the renderer:

Forge Source
GitHub your gh login, including org and collaborator repos
GitLab glab when installed, otherwise your git credential helper for gitlab.com
Bitbucket your git credential helper for bitbucket.org

If a forge has no usable credential, the tab tells you exactly which command fixes it.

Note: GitHub and Bitbucket were verified end to end against live accounts. GitLab shipped verified only against recorded API responses — no live GitLab account was available to test it. If it misbehaves, open an issue and paste the error the tab shows.

Fixed

  • The Changes-tab Committing as banner updates as soon as the identity changes. Saving a per-repo override used to leave it showing the previous author until you reselected the repo — the app was naming an author it wasn't going to commit as.

Security

  • Branch, tag, and remote names beginning with - are now refused everywhere they reach a positional git argument. git update-ref will create a ref literally named --upload-pack=<path>, so a hostile repo could seed a branch list with one and have a later git fetch / git ls-remote execute the referenced binary. Confirmed reachable before the fix; covered by regression tests now.

This release also had a broader review pass — Electron hardening, the filesystem IPC boundary, the persisted store, and dependencies. Runtime dependencies report no advisories.

Install

macOS builds are not code-signed or notarized. First launch: right-click the app → Open, then confirm. Windows SmartScreen will want "More info → Run anyway".

Full changelog: v0.1.0...v0.2.0

Assets 21
Loading