Release1 min read
GitLane v2.3.7
Git transport ignores tokens from the launching shell, agent-run git commands get stricter checks, and rustls is updated for a security advisory.
What's changed
Security hardening (#430):
- Changed: Git operations (fetch, pull, push) no longer pick up
GH_TOKEN,GITHUB_TOKEN,GITLAB_TOKENor similar tokens from the environment GitLane was launched from; they authenticate as the account bound to the remote. If pushes only worked because your shell exported a token, bind the account in the Remotes panel. - Fixed: Stricter checks on the git commands an AI agent may run without asking: commands that point git at another repository or directory, or write files, are no longer approved automatically.
- Fixed: A stray request to the local sign-in callback can no longer cancel a Bitbucket sign-in in progress.
- Fixed: Tokens from native GitLab/Bitbucket sign-in are kept separate from pasted access tokens, so one can no longer overwrite the other.
Dependencies (#427, #431):
- Fixed: Updated rustls to address security advisory RUSTSEC-2026-0285.
Full changelog: https://github.com/Siomkin/GitLane/compare/v2.3.6...v2.3.7
Installers: Download GitLane.