Require explicit opt-in for filesystem diffs

[Byron]

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

• refackiew

---

Everything below this line was generated by Codex GPT-5.

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Advisory

GHSA-whh4-5q6c-9v3x

GHSA-whh4-5q6c-9v3x reports a repository-boundary bypass in the high-level diff API. This change requires callers to explicitly opt in before diff paths may use filesystem-wide semantics. Reproduction mechanics are intentionally omitted while the advisory is unpublished.

Advisory summary

• Severity: medium
• Package: GitPython (pip)
• Affected range: = 3.1.59
• Patched versions: none published
• CVE: none assigned

Changes

• Classify --no-index as an unsafe diff option.
• Cover keyword and raw-option spellings through commit and index APIs.
• Clarify the existing explicit opt-in documentation.

Validation

• Focused diff security tests: 2 passed.
• Complete test/test_diff.py: 25 passed, 1 unrelated local-environment failure in staged conflict reporting.
• Ruff check and format checks passed.
• git diff --check passed.
• Git baseline: Git 2.50.1 documents filesystem operand behavior in Documentation/git-diff.adoc and implements it in builtin/diff.c.
• Post-commit Codex review was attempted once for 14200584 but the CLI usage allowance was exhausted before review began.

[Copilot]

Pull request overview

This PR hardens GitPython’s high-level diff APIs against repository-boundary bypass by requiring explicit caller opt-in before enabling filesystem-wide diff semantics (--no-index).

Changes:

• Mark --no-index as an unsafe diff option (requires allow_unsafe_options=True).
• Add regression tests ensuring both keyword (no_index=True) and raw-option ("--no-index") spellings are rejected by default.
• Update Diffable.diff documentation to include --no-index in the unsafe-options description.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
test/test_diff.py	Adds tests that --no-index/no_index are blocked unless explicitly allowed.
git/repo/base.py	Adds --no-index to the repo’s unsafe diff option allowlist/denylist used by high-level diff APIs.
git/diff.py	Updates the allow_unsafe_options docstring to document --no-index as unsafe.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Byron]

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

• refackiew

---

Everything below this line was generated by Codex GPT-5.

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Advisory

GHSA-whh4-5q6c-9v3x

GHSA-whh4-5q6c-9v3x reports a repository-boundary bypass in the high-level diff API. This change requires callers to explicitly opt in before diff paths may use filesystem-wide semantics. Reproduction mechanics are intentionally omitted while the advisory is unpublished.

Advisory summary

• Severity: medium
• Package: GitPython (pip)
• Affected range: = 3.1.59
• Patched versions: none published
• CVE: none assigned

Changes

• Classify --no-index as an unsafe diff option.
• Cover keyword and raw-option spellings through commit and index APIs.
• Clarify the existing explicit opt-in documentation.

Validation

• Focused diff security tests: 2 passed.
• Complete test/test_diff.py: 25 passed, 1 unrelated local-environment failure in staged conflict reporting.
• Ruff check and format checks passed.
• git diff --check passed.
• Git baseline: Git 2.50.1 documents filesystem operand behavior in Documentation/git-diff.adoc and implements it in builtin/diff.c.
• Post-commit Codex review was attempted once for 14200584 but the CLI usage allowance was exhausted before review began.

[Copilot]

Pull request overview

This PR hardens GitPython’s high-level diff APIs against repository-boundary bypass by requiring explicit caller opt-in before enabling filesystem-wide diff semantics (--no-index).

Changes:

• Mark --no-index as an unsafe diff option (requires allow_unsafe_options=True).
• Add regression tests ensuring both keyword (no_index=True) and raw-option ("--no-index") spellings are rejected by default.
• Update Diffable.diff documentation to include --no-index in the unsafe-options description.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
test/test_diff.py	Adds tests that --no-index/no_index are blocked unless explicitly allowed.
git/repo/base.py	Adds --no-index to the repo’s unsafe diff option allowlist/denylist used by high-level diff APIs.
git/diff.py	Updates the allow_unsafe_options docstring to document --no-index as unsafe.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Byron]

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

• refackiew

---

Everything below this line was generated by Codex GPT-5.

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Advisory

GHSA-whh4-5q6c-9v3x

GHSA-whh4-5q6c-9v3x reports a repository-boundary bypass in the high-level diff API. This change requires callers to explicitly opt in before diff paths may use filesystem-wide semantics. Reproduction mechanics are intentionally omitted while the advisory is unpublished.

Advisory summary

• Severity: medium
• Package: GitPython (pip)
• Affected range: = 3.1.59
• Patched versions: none published
• CVE: none assigned

Changes

• Classify --no-index as an unsafe diff option.
• Cover keyword and raw-option spellings through commit and index APIs.
• Clarify the existing explicit opt-in documentation.

Validation

• Focused diff security tests: 2 passed.
• Complete test/test_diff.py: 25 passed, 1 unrelated local-environment failure in staged conflict reporting.
• Ruff check and format checks passed.
• git diff --check passed.
• Git baseline: Git 2.50.1 documents filesystem operand behavior in Documentation/git-diff.adoc and implements it in builtin/diff.c.
• Post-commit Codex review was attempted once for 14200584 but the CLI usage allowance was exhausted before review began.

[Copilot]

Pull request overview

This PR hardens GitPython’s high-level diff APIs against repository-boundary bypass by requiring explicit caller opt-in before enabling filesystem-wide diff semantics (--no-index).

Changes:

• Mark --no-index as an unsafe diff option (requires allow_unsafe_options=True).
• Add regression tests ensuring both keyword (no_index=True) and raw-option ("--no-index") spellings are rejected by default.
• Update Diffable.diff documentation to include --no-index in the unsafe-options description.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
test/test_diff.py	Adds tests that --no-index/no_index are blocked unless explicitly allowed.
git/repo/base.py	Adds --no-index to the repo’s unsafe diff option allowlist/denylist used by high-level diff APIs.
git/diff.py	Updates the allow_unsafe_options docstring to document --no-index as unsafe.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Byron]

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

• refackiew

---

Everything below this line was generated by Codex GPT-5.

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Advisory

GHSA-whh4-5q6c-9v3x

GHSA-whh4-5q6c-9v3x reports a repository-boundary bypass in the high-level diff API. This change requires callers to explicitly opt in before diff paths may use filesystem-wide semantics. Reproduction mechanics are intentionally omitted while the advisory is unpublished.

Advisory summary

• Severity: medium
• Package: GitPython (pip)
• Affected range: = 3.1.59
• Patched versions: none published
• CVE: none assigned

Changes

• Classify --no-index as an unsafe diff option.
• Cover keyword and raw-option spellings through commit and index APIs.
• Clarify the existing explicit opt-in documentation.

Validation

• Focused diff security tests: 2 passed.
• Complete test/test_diff.py: 25 passed, 1 unrelated local-environment failure in staged conflict reporting.
• Ruff check and format checks passed.
• git diff --check passed.
• Git baseline: Git 2.50.1 documents filesystem operand behavior in Documentation/git-diff.adoc and implements it in builtin/diff.c.
• Post-commit Codex review was attempted once for 14200584 but the CLI usage allowance was exhausted before review began.

[Copilot]

Pull request overview

This PR hardens GitPython’s high-level diff APIs against repository-boundary bypass by requiring explicit caller opt-in before enabling filesystem-wide diff semantics (--no-index).

Changes:

• Mark --no-index as an unsafe diff option (requires allow_unsafe_options=True).
• Add regression tests ensuring both keyword (no_index=True) and raw-option ("--no-index") spellings are rejected by default.
• Update Diffable.diff documentation to include --no-index in the unsafe-options description.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
test/test_diff.py	Adds tests that --no-index/no_index are blocked unless explicitly allowed.
git/repo/base.py	Adds --no-index to the repo’s unsafe diff option allowlist/denylist used by high-level diff APIs.
git/diff.py	Updates the allow_unsafe_options docstring to document --no-index as unsafe.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Byron]

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

• refackiew

---

Everything below this line was generated by Codex GPT-5.

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Advisory

GHSA-whh4-5q6c-9v3x

GHSA-whh4-5q6c-9v3x reports a repository-boundary bypass in the high-level diff API. This change requires callers to explicitly opt in before diff paths may use filesystem-wide semantics. Reproduction mechanics are intentionally omitted while the advisory is unpublished.

Advisory summary

• Severity: medium
• Package: GitPython (pip)
• Affected range: = 3.1.59
• Patched versions: none published
• CVE: none assigned

Changes

• Classify --no-index as an unsafe diff option.
• Cover keyword and raw-option spellings through commit and index APIs.
• Clarify the existing explicit opt-in documentation.

Validation

• Focused diff security tests: 2 passed.
• Complete test/test_diff.py: 25 passed, 1 unrelated local-environment failure in staged conflict reporting.
• Ruff check and format checks passed.
• git diff --check passed.
• Git baseline: Git 2.50.1 documents filesystem operand behavior in Documentation/git-diff.adoc and implements it in builtin/diff.c.
• Post-commit Codex review was attempted once for 14200584 but the CLI usage allowance was exhausted before review began.

[Copilot]

Pull request overview

This PR hardens GitPython’s high-level diff APIs against repository-boundary bypass by requiring explicit caller opt-in before enabling filesystem-wide diff semantics (--no-index).

Changes:

• Mark --no-index as an unsafe diff option (requires allow_unsafe_options=True).
• Add regression tests ensuring both keyword (no_index=True) and raw-option ("--no-index") spellings are rejected by default.
• Update Diffable.diff documentation to include --no-index in the unsafe-options description.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
test/test_diff.py	Adds tests that --no-index/no_index are blocked unless explicitly allowed.
git/repo/base.py	Adds --no-index to the repo’s unsafe diff option allowlist/denylist used by high-level diff APIs.
git/diff.py	Updates the allow_unsafe_options docstring to document --no-index as unsafe.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Byron]

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

• refackiew

---

Everything below this line was generated by Codex GPT-5.

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Advisory

GHSA-whh4-5q6c-9v3x

GHSA-whh4-5q6c-9v3x reports a repository-boundary bypass in the high-level diff API. This change requires callers to explicitly opt in before diff paths may use filesystem-wide semantics. Reproduction mechanics are intentionally omitted while the advisory is unpublished.

Advisory summary

• Severity: medium
• Package: GitPython (pip)
• Affected range: = 3.1.59
• Patched versions: none published
• CVE: none assigned

Changes

• Classify --no-index as an unsafe diff option.
• Cover keyword and raw-option spellings through commit and index APIs.
• Clarify the existing explicit opt-in documentation.

Validation

• Focused diff security tests: 2 passed.
• Complete test/test_diff.py: 25 passed, 1 unrelated local-environment failure in staged conflict reporting.
• Ruff check and format checks passed.
• git diff --check passed.
• Git baseline: Git 2.50.1 documents filesystem operand behavior in Documentation/git-diff.adoc and implements it in builtin/diff.c.
• Post-commit Codex review was attempted once for 14200584 but the CLI usage allowance was exhausted before review began.

[Copilot]

Pull request overview

This PR hardens GitPython’s high-level diff APIs against repository-boundary bypass by requiring explicit caller opt-in before enabling filesystem-wide diff semantics (--no-index).

Changes:

• Mark --no-index as an unsafe diff option (requires allow_unsafe_options=True).
• Add regression tests ensuring both keyword (no_index=True) and raw-option ("--no-index") spellings are rejected by default.
• Update Diffable.diff documentation to include --no-index in the unsafe-options description.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
test/test_diff.py	Adds tests that --no-index/no_index are blocked unless explicitly allowed.
git/repo/base.py	Adds --no-index to the repo’s unsafe diff option allowlist/denylist used by high-level diff APIs.
git/diff.py	Updates the allow_unsafe_options docstring to document --no-index as unsafe.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Byron]

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

• refackiew

---

Everything below this line was generated by Codex GPT-5.

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Advisory

GHSA-whh4-5q6c-9v3x

GHSA-whh4-5q6c-9v3x reports a repository-boundary bypass in the high-level diff API. This change requires callers to explicitly opt in before diff paths may use filesystem-wide semantics. Reproduction mechanics are intentionally omitted while the advisory is unpublished.

Advisory summary

• Severity: medium
• Package: GitPython (pip)
• Affected range: = 3.1.59
• Patched versions: none published
• CVE: none assigned

Changes

• Classify --no-index as an unsafe diff option.
• Cover keyword and raw-option spellings through commit and index APIs.
• Clarify the existing explicit opt-in documentation.

Validation

• Focused diff security tests: 2 passed.
• Complete test/test_diff.py: 25 passed, 1 unrelated local-environment failure in staged conflict reporting.
• Ruff check and format checks passed.
• git diff --check passed.
• Git baseline: Git 2.50.1 documents filesystem operand behavior in Documentation/git-diff.adoc and implements it in builtin/diff.c.
• Post-commit Codex review was attempted once for 14200584 but the CLI usage allowance was exhausted before review began.

[Copilot]

Pull request overview

This PR hardens GitPython’s high-level diff APIs against repository-boundary bypass by requiring explicit caller opt-in before enabling filesystem-wide diff semantics (--no-index).

Changes:

• Mark --no-index as an unsafe diff option (requires allow_unsafe_options=True).
• Add regression tests ensuring both keyword (no_index=True) and raw-option ("--no-index") spellings are rejected by default.
• Update Diffable.diff documentation to include --no-index in the unsafe-options description.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
test/test_diff.py	Adds tests that --no-index/no_index are blocked unless explicitly allowed.
git/repo/base.py	Adds --no-index to the repo’s unsafe diff option allowlist/denylist used by high-level diff APIs.
git/diff.py	Updates the allow_unsafe_options docstring to document --no-index as unsafe.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Byron]

Tasks

This section is for Byron only. Models continuing this PR must not add, remove, check, uncheck, rename, or reorder checkboxes here.

• refackiew

---

Everything below this line was generated by Codex GPT-5.

Created by Codex on behalf of Byron. Byron will review before this is ready to merge.

Advisory

GHSA-whh4-5q6c-9v3x

GHSA-whh4-5q6c-9v3x reports a repository-boundary bypass in the high-level diff API. This change requires callers to explicitly opt in before diff paths may use filesystem-wide semantics. Reproduction mechanics are intentionally omitted while the advisory is unpublished.

Advisory summary

• Severity: medium
• Package: GitPython (pip)
• Affected range: = 3.1.59
• Patched versions: none published
• CVE: none assigned

Changes

• Classify --no-index as an unsafe diff option.
• Cover keyword and raw-option spellings through commit and index APIs.
• Clarify the existing explicit opt-in documentation.

Validation

• Focused diff security tests: 2 passed.
• Complete test/test_diff.py: 25 passed, 1 unrelated local-environment failure in staged conflict reporting.
• Ruff check and format checks passed.
• git diff --check passed.
• Git baseline: Git 2.50.1 documents filesystem operand behavior in Documentation/git-diff.adoc and implements it in builtin/diff.c.
• Post-commit Codex review was attempted once for 14200584 but the CLI usage allowance was exhausted before review began.

[Copilot]

Pull request overview

This PR hardens GitPython’s high-level diff APIs against repository-boundary bypass by requiring explicit caller opt-in before enabling filesystem-wide diff semantics (--no-index).

Changes:

• Mark --no-index as an unsafe diff option (requires allow_unsafe_options=True).
• Add regression tests ensuring both keyword (no_index=True) and raw-option ("--no-index") spellings are rejected by default.
• Update Diffable.diff documentation to include --no-index in the unsafe-options description.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
test/test_diff.py	Adds tests that --no-index/no_index are blocked unless explicitly allowed.
git/repo/base.py	Adds --no-index to the repo’s unsafe diff option allowlist/denylist used by high-level diff APIs.
git/diff.py	Updates the allow_unsafe_options docstring to document --no-index as unsafe.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.