Close what a production audit found in the released tag - #355

Merged

MongLong0214 merged 5 commits into

devfrom

sec-npx-fallback

Aug 1, 2026

Commits on Aug 1, 2026

Close two ways this shipped code hands control to somebody else
MongLong0214
committed
a6fbb4b
Stop a configured refspec from passing as a completed fetch
MongLong0214
committed
936d206
Show the output this tool prints, not one I wrote for it
MongLong0214
committed
f9efea0
Say the same thing about guard on every surface that exposes it
MongLong0214
committed
8a4d0c7
Say the fetch is still owed, instead of widening what unfetched means
MongLong0214
committed
11f04b4