safe exec of 'git checkout'

[kurt-r2c]

Proposed Changes

Fix for variant of CVE-2021-26543 if user-supplied commit hash is untrusted

Types of changes

Put an x in the boxes that apply

• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation Update (if none of the other choices apply)

Test Plan and Documentation

same fix as CVE-2021-26543 - https://github.com/wayfair/git-parse/pull/18/files

Further comments

If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution you did and what alternatives you considered, etc...

[erj826]

Looks good to me! Can approve once you run prettier and add a note to the changelog mentioning this change.

[kurt-r2c]

I think all of the major boxes have now been checked - I did not check the commit message linter job before starting this patch and so that check is probably doomed to fail forever, but otherwise I think this is now good for a maintainer to merge - I can't do it myself

[kurt-r2c]

@erj826 @kv979w would you like me to wait for a release before publishing information about this patch

[finn-orsini]

@kurt-r2c I've prepped a PR with the version bump, should be able to release by EOD tomorrow