GCM 2.9.1

Announcements:

Note

This is planned to be the last release major release (2.x) that supports Windows 7 and 8.x. We will be moving off of .NET Framework to .NET (Core) on Windows this year with version 3.0.

Changes:

• Use AbsoluteUri to open URIs in the system browser to avoid double encoded URLs on macOS (90884de)

GCM 2.9.0

Announcements:

Note

This is planned to be the last release major release (2.x) that supports Windows 7 and 8.x. We will be moving off of .NET Framework to .NET (Core) on Windows this year with version 3.0.

Changes:

• Update MSAL.NET libraries to 4.82.2 (a4743f9)
• Use default native redirect URL for embedded webview and device flows with Microsoft authentication (2774321)
• Add support for form_post and fragment OAuth2 response modes to the generic provider (194ba29)

GCM 2.8.0

Announcements:

Note

This is planned to be the last release major release that supports Windows 7 and 8.x. We will be moving off of .NET Framework to .NET (Core) on Windows this year.

Changes:

• Workload Identity Federation for Azure Repos (#2297)
• Git config caching to reduce git process calls
  • #2268
  • #2296
  • #2298
• Dark theme support for OAuth authentication response pages (#2325)
• Allow installing on Azure Linux (#2269)
• Fix GPG ID lookup for .gpg-id in subdirectories (#2274)
• Fix CS0121 string.Split call ambiguity with .NET 8.0 (#2287)
• Fix SYSLIB0057 warning for X509Certificate2Collection.Import (#2326)
• Fix several small bugs (#2303)
• Migrate to .NET 10 (Mac/Linux) and adopt Central Package Management (#2313)
• Bump Tmds.DBus.Protocol from 0.16.0 to 0.21.3 (#2316)
• Azure Pipelines: specify pool.hostArchitecture correctly (#2323)
• Documentation updates
  • #2283
  • #2299
• Actions dependency updates
  • #2242
  • #2271
  • #2272
  • #2282
  • #2301
  • #2315

GCM 2.7.3

Announcements:

Note

This is planned to be the last release major release that supports Windows 7 and 8.x. We will be moving off of .NET Framework to .NET (Core) on Windows this year.

Changes:

• Emit new warning when Git has built-in NTLM support disabled.

  As part of the fix for CVE-2025-66413, Git for Windows now disables built-in NTLM support by default.
  Only if http.allowNTLMAuth is explicitly enabled will Git use NTLM authentication.

  GCM will now display a warning message when it detects this scenario and presents options for re-enabling NTLM.

GCM 2.7.2

Announcements:

Note

This is planned to be the last release major release that supports Windows 7 and 8.x. We will be moving off of .NET Framework to .NET (Core) on Windows this year.

Changes:

• Make Linux browser detection more robust (support VSCode remote connections over SSH)
  • #2256
  • #2258
  • #2257

GCM 2.7.1

Announcements:

Note

This is planned to be the last release major release that supports Windows 7 and 8.x. We will be moving off of .NET Framework to .NET (Core) on Windows this year.

Changes:

• Added support for Linux enterprise defaults
  • #1814
  • #2259
• Various build and release pipeline fixes
  • #2239
  • #2241
  • #2248

GCM 2.7.0

Announcements:

Note

Thanks to all our contributors who've been waiting for this release. It's been a year since the last release, which as many will note is highly unusual. Ownership issues of the project have meant that there was a freeze on releases and maintenance. This has now been resolved and we expect regular releases (approximately every 12 weeks; aligned with Git's release schedule), and engagement on our part with the community. Thank you for your patience.

Note

The code ownership/responsibility model of the Git Credential Manager project has changed. Microsoft will now maintain the core GCM platform (responsible for releases, and major architectural changes). The major Git host providers will be responsible for their plugins (e.g., GitHub for GitHub functionality, Azure DevOps for Azure Repos etc).

Note

This is planned to be the last release major release that supports Windows 7 and 8.x. We will be moving off of .NET Framework to .NET (Core) on Windows this year.

Changes:

• Fix Generic provider refresh token refresh logic (#1838)
• Allow unsafe remotes via config (#1721)
• Drop no longer needed GitLab OAuth params (#1538)
• No-op credential storage option (#1740)
• Fix TRACE2 logging (#1909)
• Linux ARM and ARM64 support
  • #1633
  • #2232
• Windows ARM64 and x64 support (#2230)
• Support Oracle Linux vis install-from-source (#2212)
• Linux install-from-source bug fixes
  • #1757
  • #2049
  • #2052
• macOS enterprise defaults (#1811)
• Documentation updates & fixes
  • #1713
  • #1722
  • #1884
  • #2123
  • #2154
• Fixes to CI & build
  • #1746
  • #1747
  • #1752
  • #2104
  • #2217
• Use Azure Pipelines for official builds
  • #2054
  • #2176
• Actions dependency updates
  • #1725
  • #1751
  • #1750
  • #1760
  • #1799
  • #2022
  • #2048
  • #1989
  • #2011
  • #2029
  • #2051
  • #2050
  • #2070
  • #2080
  • #2089
  • #2088
  • #2092
  • #2189
  • #2193

GCM 2.6.1

Security Fixes:

• CVE-2024-50338
  • Do not treat the lone carriage-return character (CR, \r) as a line terminator in the credential helper protocol

Changes:

• Fix Linux build scripts (#1752)
• Documentation fix for broken links (#1722)
• Permit use of HTTP (not-S) remotes for providers via config (#1721)
• Omit the client secret for GitLab (#1538)
• Various workflow action updates (#1725, #1738, #1751, #1750)
• Fix CentOS install from source workflow (#1746)
• Add Mariner and Arch Linux distribution validation builds (#1747)
• Add no-op credential storage option (#1740)

GCM 2.6.0

Changes:

• Drop no longer needed workflows (#1659)
• Documentation fixes (#1664, #1697)
• Configurable GPG store path via Git config (#1698)
• Fix Visual Studio build problems and update dependencies (#1711)
• Support sending X5C with certificate auth (#1666)

GCM 2.5.1

Changes:

• Update MSAL and Avalonia to latest versions (#1640).
• Changes to release workflow to publish NuGet signing certificate (#1594, #1644, #1647).
• Updates to Managed Identity and Service Principal docs.