unstale

pypi / copier

copier

What changed in copier 9, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-31.

1 breaking6 security1 new APIs and options1 behavior and defaults3 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.9 on npm

copier 912 changes

Breaking changes 1

  • Trusted prefix matching is restricted for URL paths containing characters outside the unreserved set; other paths require an exact, verbatim match.

    9.18.2release notes

Security 6

  • Argument injection via git subprocess calls is prevented.

    9.19.0release notes

  • Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

    9.15.2security advisory

  • Copier _external_data allows path traversal and absolute-path local file read without unsafe mode

    9.14.1security advisory

  • Copier _subdirectory allows template root escape via parent-directory traversal

    9.14.1security advisory

  • Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false

    9.11.2security advisory

  • Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true

    9.11.2security advisory

New APIs and options 1

Behavior and default changes 1

  • Destination symlinks can now be overwritten when preserve_symlinks is false.

    9.18.2release notes

Fixes and other changes 3

  • Restores support for Git older than 2.43.1.

    9.19.1release notes

  • When a directory containing a symlink is renamed during updating, its symlink targets are kept.

    9.19.0release notes

  • Submodules are resolved from the current checkout's .gitmodules.

    9.18.2release notes