Jeff King <peff@xxxxxxxx> writes: >> Moreover, this is in the webdav-based "dumb http" push code path, >> which I do not trust much at all. I wonder if we could retire it >> completely (or at least provide an option to turn it off). > > I would really like that, too. It has been the cause of a lot of pain > when working with the smart code, and I am not at all surprised to find > a bug of this magnitude lurking in it. I'd _hoped_ this could show that > the system has been unusably broken for years, which would give us > confidence to turn it off. :) But per your paragraph above, people could > very easily still have been happily using it in the meantime. Same here. Perhaps we should deliberately and silently break it and see who screams?