Mmastodon TechnologyCybersecurity first seen 15 h ago, last 15 h ago, peak #1

Git ambiguity flaw leaves dependency pinning unsafe

Original: git checkout does not pin a commit. If a branch has that exact name, checkout switches to the branch, while git rev-pars

Developers are warning that 'git checkout' does not actually pin a commit. If a branch shares the exact name of a commit hash, checkout switches to the branch instead of the commit, while 'git rev-parse' on the same string returns the commit itself. The issue matters for tools like Claude Code, Codex and GitHub Copilot, which install pinned plugins using clone, potentially resolving to unexpected code.

Why now: A Git command ambiguity can silently break commit pinning in AI coding assistants, creating a supply chain security risk.

GitClaude CodeCodexGitHub CopilotAIR Security

Open on mastodon →

Evidence

• git checkout does not pin a commit. If a branch has that exact name, checkout switches to the branch, while git rev-parse on the same string returns the commit. Plugin4Shell (AIR Security, Sep 17): Claude Code, Codex and GitHub Copilot installed pinned plugins with clone, then… · shellonline · 2

API: https://socialmediatrends-api.osmike.com/v1/trends/1129365