How-To: Check Your Git Version and Stop Cloning Submodules Blindly

After this week’s Git fixes, I went through my machines and changed how I clone repos I don’t know. It takes about five minutes.

1. Check your version

git --version

The fixed releases are 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. Anything older in those series needs an update from your distro. On Omarchy or Arch that’s just sudo pacman -Syu.

2. Check every box at once

I manage my servers with Ansible, so I check them all at once instead of SSHing into each one:

ansible all -m command -a "git --version"

3. Make sure nothing recurses automatically

git config --show-origin --get-all submodule.recurse

If it prints true anywhere, turn it off:

git config --global submodule.recurse false

4. Clone strangers’ repos in two steps

git clone https://example.com/someone/repo.git
cd repo
cat .gitmodules
git submodule update --init   # only once you trust what's listed

Don’t use --recurse-submodules on anything you haven’t looked at first.

5. Remember the bundled copies

IDEs, desktop Git clients and some AI coding tools ship their own Git. Run which -a git to see what’s on your PATH, and update those apps separately when their fixes land.

God Bless, and May the Source Be with You!

References & Further Reading

• Git patches flaw that lets malicious repositories execute code during recursive clones (The Hacker News)
• gitsubmodules documentation (git-scm.com)
• git-config documentation (git-scm.com)