prepare changelog for upcoming release

<!-- agent -->
Reject file-reading options passed to blame, diff, and tag APIs. Inspect
positional values after resolving aliases, recognize unsafe options
behind command-specific short-flag clusters, and retain the explicit
allow_unsafe_options escape hatch. This closes GHSA-5xxx-qhh7-9287 and
GHSA-3wxw-xv34-2frg and covers the adjacent diff order-file sink.

Regression tests cover long, short, and clustered options, incremental blame,
tag path/reference positionals, the ref keyword alias, both diff entry points,
and preservation of diff pickaxe behavior.

Git baseline: cf5497b14c; git-blame, git-diff, and git-tag document the relevant file-input options.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

Block file-reading Git options

This is done by calling into `git hash-object` for correctness, instead
of using a mostly incorrect custom implementation for this (lacks filters).

<!-- agent -->
GitCmdObjectDB inherited LooseObjectDB.store(), so despite its name, object
writes bypassed Git and used gitdb's loose-object implementation. That path
creates and chmods object files itself, which can fail during Index.add() on
filesystems where those permission changes are unsupported.

Override store() to stream new objects through `git hash-object -w --stdin`.
This lets Git manage object creation and permissions consistently with the
repository configuration. Retain the inherited implementation for pre-hashed
objects and custom output streams, whose existing semantics hash-object cannot
provide.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

<!-- agent -->
Repo.clone() and Repo.clone_from() did not reject the clone option that
redirects repository metadata to a caller-controlled path (GHSA-8mcc-hrx5-hvxc).
Regression coverage exercises both keyword and multi-option input through both
public clone APIs.

Add the option to the existing clone denylist, matching Repo.init()
and the documented allow_unsafe_options contract. Git itself registers

The Python package and Alpine test workflows failed across the submodule suite
because GitPython internally supplies --separate-git-dir when creating modern
submodule layouts. The new public clone guard correctly rejected that option,
but could not distinguish the library-generated path from caller input.

Validate caller-provided keyword and multi-options before adding the
library-controlled metadata path, then explicitly allow the resulting trusted
clone invocation. This preserves rejection of unsafe clone_multi_options while
restoring normal submodule creation. Update the one test that intentionally
invokes Repo.clone_from() with its own separate git directory to opt in
explicitly.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>
Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

index: write blobs via git hash-object, not gitdb's odb.store

…ption

Block separate git directories during clone

<!-- agent -->
GitConfigParser decoded valid multiline values into embedded newlines, but
_write() serialized those newlines as indented physical lines. Rewriting an
otherwise unchanged config could therefore change its meaning to Git.

Serialize resident multiline values with Git-compatible escapes inside a
quoted continuation, preserving GitPython read compatibility while keeping
each option structurally intact. This addresses GHSA-284h-m62q-gf8w.

The regression starts with an inert multiline value, performs an unrelated
write, and verifies with both GitPython and git config that it remains one
value and does not create another option.

Git baseline: config.c parse_value() and write_pair() at cf5497b14c5a escape
embedded LF as \\n rather than emitting it as a physical config line.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

<!-- agent -->
Submodule configuration is read from .gitmodules, whose contents may come
from an untrusted repository. Its parser inherited merge_includes=True and
could therefore open files named by include directives during ordinary
submodule enumeration.

Disable include merging at the SubmoduleConfigParser construction site. This
matches Repo.config_writer() hardening from 41ecc6a and addresses
GHSA-7833-fr7j-v32q without changing include behavior for trusted config
parsers.

The regression points .gitmodules at a non-config file and verifies the
submodule entry remains readable without opening the included path.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

fix: harden config parsing boundaries

prepare changelog prior to release

<!-- agent -->
Decode Git-supported quoted value escapes directly instead of routing UTF-8 text
through Python unicode_escape. This preserves newlines, quotes, backslashes, and
non-ASCII text when an unrelated config update rewrites existing values.

Quote values containing Git comment delimiters (# and ;) or leading/trailing
whitespace so Git does not truncate or trim their data. Escape LF, tab,
backspace, quote, and backslash, while rejecting carriage returns and NULs
before opening the destination.

Regression coverage round-trips these values through both GitPython and git
config and verifies unsafe control characters cannot alter the original file.
Behavior follows Git config.c parse_value() and write_pair().

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

<!-- agent -->
GHSA-v6xg-m7rh-r365 (closed) reports that quoted patch paths can crash or
silently change when an escaped literal backslash precedes digits.

Add regression coverage distinguishing literal backslashes from real
octal byte escapes, then decode Git's C-style quoting sequentially so
one escape cannot be reinterpreted by a later pass. Match Git baseline
cf5497b14c5a24f10c13f7e0ee85cb95af13ea6a quote.c::unquote_c_style by
accepting octal bytes only when all three digits are valid and the first
is 0 through 3.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

…ollow-up

Preserve Git config escape semantics

<!-- agent -->
GHSA-g5vv-9gxw-82hx reports quadratic backtracking when an actor
identity contains a long unterminated email delimiter.

Add a regression that exercises a 20,000-character malformed identity,
then replace both actor regexes with direct delimiter scans following
Git's first-opening, first-closing delimiter behavior. Keep GitPython's
whole-string fallback when either delimiter is absent.

Reference Git baseline cf5497b14c5a24f10c13f7e0ee85cb95
ident.c::split_ident_line and its invalid-committer cases in
t/t9300-fast-import.sh. Also reference gix-actor's signature decoder and
lenient identity tests.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

Harden diff path and actor identity parsing

<!-- agent -->
Treat --no-index as an unsafe diff option because it changes path operands
from repository pathspecs to arbitrary filesystem paths. This addresses
GHSA-whh4-5q6c-9v3x without exposing advisory reproduction details.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

Require explicit opt-in for filesystem diffs