⬆️ Update 4 vendored dependencies

[github-actions]

📦 Automatically updated 4 dependencies

Name	Old Version	New Version	Build Status
🚀 git-for-windows	2.52.0.windows.1	2.55.0.windows.5
⬆️ clink	1.9.5	1.9.32	—
🚀 windows-terminal	1.23.12811.0	1.24.11911.0
⬆️ clink-completions	0.6.7	0.6.9

Release notes for updated vendors

git-for-windows

Release notes · Compare changes

Minor changelog

Git for Windows v2.55.0.windows.5

Changes since Git for Windows v2.55.0(4) (August 11th 2026)

Following the MSYS2 project, on which Git for Windows is based, Windows 8.1 support will be dropped after Git for Windows v2.55.

New Features

• The experimental git survey command (which was never upstreamed to the core Git project) was deprecated and converted into a small shim on top of git repo structure. In the future, git repo structure should be used instead, as the git survey command will be retired eventually.
• Git for Windows' installer is now a 64-bit executable (x64 instead of 86).
• Comes with the MSYS2 runtime (Git for Windows flavor) based on Cygwin v3.6.10.
• Comes with OpenSSH v10.5.P1.

Bug Fixes

• The long-standing bug where Git Bash's screen was cleared after git.exe called `vi...

Release notes truncated; open the release link for the full text.

MinGit for Windows 2.53.0(4)

Changes since Git for Windows v2.53.0(3) (April 14th 2026)

This is a security fix release, addressing CVE-2026-62960.

• CVE-2026-62960, Git for Windows: Attacker-controlled servers may advertise bundle URIs that point to network shares, causing Windows to transparently perform NTLM authentication and disclose the user's NTLMv2 hash. Since NTLM hashing is weak, the captured hash can potentially be brute-forced to recover the user's credentials. This is addressed by limiting the bundle URIs that git clone respects by the same protocol.<name>.allow rules as usual, which excludes file:// URIs by default.

Filename	SHA-256
MinGit-2.54.0.3-64-bit.zip	abf956f9e8d7f393c8d9a1d974402e55a0682e45fc8340acf1d668ccd4933896
MinGit-2.54.0.3-arm64.zip	3b64234cb3dc22500856e2f5cbeb9c733e64e4a1bd91925d8d74bf09981df968
MinGit-2.54.0.3-32-bit.zip	928ceca1b0ea6367b48e2e9b74489a66edafa123a83f94f4dd0ff08696c10928
MinGit-2.54.0.3-busybox-64-bit.zip	4a6519f7d6e4751e33255f5b7b440801c09f8fd55f2ef7ee...

Release notes truncated; open the release link for the full text.

Git for Windows 2.55.0(4)

Changes since Git for Windows v2.55.0(3) (July 14th 2026)

Following the MSYS2 project, on which Git for Windows is based, Windows 8.1 support will be dropped after Git for Windows v2.55.

This is a security fix release, addressing CVE-2026-62960.

• CVE-2026-62960, Git for Windows: Attacker-controlled servers may advertise bundle URIs that point to network shares, causing Windows to transparently perform NTLM authentication and disclose the user's NTLMv2 hash. Since NTLM hashing is weak, the captured hash can potentially be brute-forced to recover the user's credentials. This is addressed by limiting the bundle URIs that git clone respects by the same protocol.<name>.allow rules as usual, which excludes file:// URIs by default.

Filename	SHA-256
Git-2.55.0.4-64-bit.exe	0cbc0b34a74b3aff3ace0910328549155a770e228331b19cb1498218a120e7ff
Git-2.55.0.4-arm64.exe	8d358f4d53a5a475570edca3124dc0d4f1a020321594984...

Release notes truncated; open the release link for the full text.

MinGit for Windows 2.54.0(3)

Changes since Git for Windows v2.54.0(2) (July 14th 2026)

This is a security fix release, addressing CVE-2026-62960.

• CVE-2026-62960, Git for Windows: Attacker-controlled servers may advertise bundle URIs that point to network shares, causing Windows to transparently perform NTLM authentication and disclose the user's NTLMv2 hash. Since NTLM hashing is weak, the captured hash can potentially be brute-forced to recover the user's credentials. This is addressed by limiting the bundle URIs that git clone respects by the same protocol.<name>.allow rules as usual, which excludes file:// URIs by default.

Filename	SHA-256
MinGit-2.54.0.3-64-bit.zip	abf956f9e8d7f393c8d9a1d974402e55a0682e45fc8340acf1d668ccd4933896
MinGit-2.54.0.3-arm64.zip	3b64234cb3dc22500856e2f5cbeb9c733e64e4a1bd91925d8d74bf09981df968
MinGit-2.54.0.3-32-bit.zip	928ceca1b0ea6367b48e2e9b74489a66edafa123a83f94f4dd0ff08696c10928
MinGit-2.54.0.3-busybox-64-bit.zip	4a6519f7d6e4751e33255f5b7b440801c09f8fd55f2ef7eee...

Release notes truncated; open the release link for the full text.

Git for Windows 2.55.0(3)

Changes since Git for Windows v2.55.0(2) (July 2nd 2026)

New Features

• Comes with Git Credential Manager v2.9.0.

Bug Fixes

• Fixes heap overflows in the credential helper wincred, see [GHSA-rxqw-wxqg-g7hw](https://github.com/git-for-windows/git/se...

Release notes truncated; open the release links for the full text.

clink

Release notes · Compare changes

Patch changelog

v1.9.32

Recent Breaking Change

• Breaking Change: the "gray text" auto-suggestions display is now off by default, due to too many complaints and frustration and support cost.
  • The Suggestions List since v1.8.0 is friendlier and more powerful; toggle it by pressing F2 or enable it by default via clink set suggestionlist.default true.
  • The "gray text" or "inline" auto-suggestions display can be turned on again via clink set autosuggest.inline true if preferred.

v1.9.32

• Fixed agnoster, Headline, and pure custom prompts to show just the base directory name for the Python virtual env.
• Fixed rl.gethistoryindex() during the onbeginedit callback and the first prompt filter per input line.
• Fixed width calculation for combining marks such as diacritics; there's no fully reliable way to predict how a terminal will render combining marks, but Clink tries to accommodate different OS versions and console configuration modes and grapheme combinations to predict as closely as possible.

v1.9.31

Recent Breaking Change

• Breaking Change: the "gray text" auto-suggestions display is now off by default, due to too many complaints and frustration and support cost.
  • The Suggestions List since v1.8.0 is friendlier and more powerful; toggle it by pressing F2 or enable it by default via clink set suggestionlist.default true.
  • The "gray text" or "inline" auto-suggestions display can be turned on again via clink set autosuggest.inline true if preferred.

v1.9.31

• Added new Lua API rl.gethistoryindex() which returns the current interactive history index, if any.
• Fixed git.isgitdir() and git.getgitdir() to not get confused by the empty .git directories that the Codex app leaves scattered around (due to a bug in Codex that's currently tracked by a large number of open issues).
• Fixed :chaincommand("doskey") to be able to expand doskey aliases (regression introduced in v1.6.18).
• Fixed an undo list memory management bug in clink-reset-line that could leak memory (regression introduced in v1.8.0)...

Release notes truncated; open the release link for the full text.

v1.9.30

Recent Breaking Change

• Breaking Change: the "gray text" auto-suggestions display is now off by default, due to too many complaints and frustration and support cost.
  • The Suggestions List since v1.8.0 is friendlier and more powerful; toggle it by pressing F2 or enable it by default via clink set suggestionlist.default true.
  • The "gray text" or "inline" auto-suggestions display can be turned on again via clink set autosuggest.inline true if preferred.

v1.9.30

• Added new Lua API rl.issuggestionlistactive() which returns whether the suggestion list is currently active.
• Fixed to not show suggestions if the input line contains only space characters.
• Fixed clink.onfiltermatches() events (regression introduced in v1.9.26).

v1.9.29

Recent Breaking Change

• Breaking Change: the "gray text" auto-suggestions display is now off by default, due to too many complaints and frustration and support cost.
  • The Suggestions List since v1.8.0 is friendlier and more powerful; toggle it by pressing F2 or enable it by default via clink set suggestionlist.default true.
  • The "gray text" or "inline" auto-suggestions display can be turned on again via clink set autosuggest.inline true if preferred.

v1.9.29

• Added new Lua APIs to query Readline's kill-ring (see rl.getkillringcount() and etc).
• Changed oh-my-posh.clinkprompt to work around an issue where in error cases oh-my-posh can accidentally emit a bash script instead of a Lua script.
• Fixed how popup lists distributed column widths when fitting them into the terminal width; they were meant to be distributed evenly but were accidentally skewed.
• Fixed macro text limit in rl.getkeybindings(); it was being limited as though the clink-help command was invoked, but the Lua function shou...

Release notes truncated; open the release link for the full text.

v1.9.28

Recent Breaking Change

• Breaking Change: the "gray text" auto-suggestions display is now off by default, due to too many complaints and frustration and support cost.
  • The Suggestions List since v1.8.0 is friendlier and more powerful; toggle it by pressing F2 or enable it by default via clink set suggestionlist.default true.
  • The "gray text" or "inline" auto-suggestions display can be turned on again via clink set autosuggest.inline true if preferred.

v1.9.28

• Fixed a case where clink-select-complete could accidentally wrap long matches with descriptions instead of truncating them.
• Fixed a case where clink-select-complete could get confused about how many matches it meant to print per line when showing descriptions inline (especially when using a wide terminal window).

v1.9.27

Recent Breaking Change

• Breaking Change: the "...

Release notes truncated; open the release links for the full text.

windows-terminal

Release notes · Compare changes

Minor changelog

Windows Terminal Preview v1.25.1912.0

Since we decided to push Terminal 1.26 out a little bit, please enjoy these bug fixes instead.

Bug Fixes

• Terminal should no longer crash when you drag a small tab into a larger window (which never crashed for some people, and always crashed for others) (#20366) (thanks @yuu61!)
• Terminal will now make a screen reader-audible announcement when you interact with the expand/collapse option in the Settings page (#20275)
• Pressing Enter in the Export Text dialog will no longer send Enter to the connected application (#20358)
• Scrolling the screen should no longer result in us failing to detect URLs in it before the next refresh (#20357)
• The compatibility.reloadEnvironmentVariables setting will no longer be ignored when you use wt.exe <command> (#20321)
• The actions editor should now update the action name more consistently (#20381)
• We have fixed a memory corruption issue in DRCS font handling (#20409)
• We have speculatively moved some initialization earlier to prevent a deadlock caused by the NVIDIA graphics driver (#20351)
• We no longer reset your font size if you zoom and we reload settings (for whatever reason) (#20230)

---...

Release notes truncated; open the release link for the full text.

Windows Terminal v1.24.11911.0

The stable channel just keeps getting stabler! We decided to push Terminal 1.26 out a little bit, so hopefully this set of fixes helps fill the void where it would be.

Bug Fixes

• Terminal should no longer crash when you drag a small tab into a larger window (which never crashed for some people, and always crashed for others) (#20366) (thanks @yuu61!)
• Terminal will now make a screen reader-audible announcement when you interact with the expand/collapse option in the Settings page (#20275)
• Pressing Enter in the Export Text dialog will no longer send Enter to the connected application (#20358)
• Scrolling the screen should no longer result in us failing to detect URLs in it before the next refresh (#20357)
• We have fixed a memory corruption issue in DRCS font handling (#20409)
• We have speculatively moved some initialization earlier to prevent a deadlock caused by the NVIDIA graphics driver (#20351)
• We no longer reset your font size if you zoom and we reload settings (for whatever reason) (#20230)

---

Binary files inside the unpackaged distribution archive bear the version number 1.24.260710001.

Windows Terminal Preview v1.25.1322.0

This is the fourth servicing release for Terminal! We've fixed a couple of our more annoying issues, and added a new feature thanks to @ltrzesniewski for configuring the new URL warning dialog.

These release notes include changes from v1.25.1241.0 so that you don't need to go read those separately.

Changes

• You can now change the behavior of the URL warning dialog with the new safeUriSchemes setting (JSON safeUriSchemes, array of strings, default []) (#20207) (thanks @ltrzesniewski!)
• We have disabled store licensing checks on startup, which should improve launch performance and reliability and prevent the store from deciding that nobody is allowed to run Terminal (#20163)

Bug Fixes

• We will no longer attempt to allocate too much memory or crash with an access violation on certain specially-crafted Sixel images (#20213)
• Overridden tab titles should no longer spontaneously reset to Default or Windows PowerShell or the default for any given profile (#20214) (thanks @imsh!)
• Terminal windows should no longer shrink by one row or column at a time every time you exit neovim (#20183)
• Terminal's WM_COPYDATA handler will no longer accept outra...

Release notes truncated; open the release link for the full text.

Windows Terminal v1.24.11321.0

Finally! Terminal Stable is getting all of the fun bug fixes that landed in preview over the past couple releases.

Changes

• Terminal will now display a warning dialog if you attempt to open a URL that might harm your computer (as voted by a bunch of security researchers) (#20065) (#20096)
  • ... and you can change its behavior with the new safeUriSchemes setting (JSON safeUriSchemes, array of strings, default []) (#20207) (thanks @ltrzesniewski!)
• We have disabled store licensing checks on startup, which should improve launch performance and reliability and prevent the store from deciding that nobody is allowed to run Terminal (#20163)
• We've reworked how text selection is handled when an application requests mouse mode; Shift clicks will no longer extend an existing selection and positioning will use absolute coordinates rather than selecting the nearest half cell (#19973)
• Terminal will now assert focus when you drag and drop a file on it (#20003) (thanks @etbala!)

Bug Fixes

• IME composition will no longer blindly overwrite text to the right of the cursor, but "intelligently" push it further to the right to ensure that it stays vis...

Release notes truncated; open the release link for the full text.

Windows Terminal Preview v1.25.1241.0

This was a short-term bridge release for Windows Terminal Preview that was intended to test our licensing changes before we rolled them out to stable.

Changes

• We have disabled store licensing checks on startup, which should improve launch performance and reliability and prevent the store from deciding that nobody is allowed to run Terminal (#20163)

Bug Fixes

• Wordwise selection that starts at a word boundary will no longer selec...

Release notes truncated; open the release links for the full text.

clink-completions

Release notes · Compare changes

Patch changelog

v0.6.9

• Added docker and dockerd completions (Bug within the version of msysgit 1.8.5.2 cmderdev/cmder#206).
  • Updated bat completions.
  • [git] Improvements to git config completions (Bump versions cmderdev/cmder#208).
  • [git] Clarified input hints for certain git completions.
  • Fixed certain modules to gracefully handle when a newer version of Clink is required.

v0.6.8

• [git] Added support for git reftables.
  • Added completions for ast-grep.
  • Added completions for httpie (F7 support for command history? cmderdev/cmder#204).
  • [ssh] Changed ssh completions to follow include directives when collecting host completions (Add an option to have cmder start in the current directory cmderdev/cmder#203).
  • Updated gsudo completions (per v2.6.1).
  • [git] Removed git_prompt.lua; it was really part of Cmder, and has been moved into Cmder itself.
  • Added quotes around window titles in PID completions (process ID completions for various apps).
  • (internal) Added arghelper.make_exflags() helper function that argmatchers can use.

v0.6.7

• [git] Always complete local files for git log and git diff.
  • [git] Clean up file and directory completions to properly support Clink enhancements (e.g. match coloring, the mark-directories var in .inputrc, and so on).
  • [git] Be more clear that git branch -d accepts multiple arguments.
  • [git] Tuned the git color used in git.lua to exactly match the official git color.
  • [git] Fixed "chery" typos in git.lua.
  • [git] Fixed [Bug] cmd_commands.lua:256: attempt to call method 'setcmdcommand' (a nil value) cmderdev/cmder#3050; cmd_commands.lua could encounter a Lua error when using Clink versions older than v1.3.45 (Oct 2022).

v0.6.6

• [git] Adjust completions for git diff and git log so that e.g. git log ./TAB or git log -- TAB list file completions instead of branches or tags.

v0.6.4

• Fixed script error when completing procdump due to missing pid_complete module.

v0.6.3

• Speeded up the initial load time of clink-completions by around 35 milliseconds (maybe more or less, depending on the CPU speed). This also speeds up loading Clink in a new command window.
  • Added completions for Rust: cargo, rustc, and rustup.
  • Added completions for the new Windows sudo command.
  • Added completions for procdump from sysinternals.net.
  • [git] Fixed a freeze in git completion when an aliased command starts with the alias name (include zsh and tmux from cygwin cmderdev/cmder#194).
  • Updated dirx completions.
  • Updated reg completions for *.hiv and *.reg files.
  • Updated where completions to handle its $envvar:pattern and path:pattern syntaxes, and to accept / flags in addition to - flags.
  • Fixed script error in npm.lua if package.json file contains percent signs in certain fields (Open cmder as Tab from the file explorer cmderdev/cmder#197).

v0.6.2

• [.net] Fixed edge case in dotnet add [PROJECT] package completions.

v0.6.1

• Updated eza completions.
  • [.net] Updated dotnet add [PROJECT] package completions (Git Not working cmderdev/cmder#192).
  • [git] Fixed git status -uno completion.
  • Turned off debug logging in gh completions by default.

...and 30 more releases. Open the compare link for the full range.

---

Legend

🚀 Minor version update.
⬆️ Patch version update.

Review note: This update only contains minor or patch changes.

Please verify and then Merge the pull request to apply the updates.

[sourcery-ai]

Reviewer's Guide by Sourcery

This pull request updates 2 vendored dependencies: git-for-windows from 2.47.0.windows.1 to 2.48.0-rc0.windows.1 and clink from 1.7.3 to 1.7.6. The changes are implemented by modifying the sources.json file.

No diagrams generated as the changes look simple and do not need a visual representation.

File-Level Changes

Change	Details	Files
Updated git-for-windows dependency	Updated version from 2.47.0.windows.1 to 2.48.0-rc0.windows.1	vendor/sources.json
Updated clink dependency	Updated version from 1.7.3 to 1.7.6	vendor/sources.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time. You can also use
  this command to specify where the summary should be inserted.

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

We have skipped reviewing this pull request. It seems to have been created by a bot (hey, github-actions[bot]!). We assume it knows what it's doing!