# What changed in copier

> 12 changes in copier 9 from its official release notes, upgrade guides and advisories: 1 breaking, 6 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-31. HTML: https://unstale.sh/pypi/copier/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## copier 9

### Breaking changes

- Trusted prefix matching is restricted for URL paths containing characters outside the unreserved set; other paths require an exact, verbatim match. (9.18.2) — [release notes](https://github.com/copier-org/copier/releases/tag/v9.18.2)

### Security

- Argument injection via git subprocess calls is prevented. (9.19.0) — [release notes](https://github.com/copier-org/copier/releases/tag/v9.19.0)
- Copier has a trust-prefix bypass via path traversal that runs tasks unprompted (9.15.2) — [security advisory](https://github.com/advisories/GHSA-9GMC-JQMH-3RVM)
- Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode (9.14.1) — [security advisory](https://github.com/advisories/GHSA-HGJQ-P8CR-GG4H)
- Copier `_subdirectory` allows template root escape via parent-directory traversal (9.14.1) — [security advisory](https://github.com/advisories/GHSA-85V3-4M8G-HRH6)
- Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false (9.11.2) — [security advisory](https://github.com/advisories/GHSA-XJHM-GP88-8PFX)
- Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true (9.11.2) — [security advisory](https://github.com/advisories/GHSA-4FQP-R85R-HXQH)

### New APIs and options

- The ask setting enables opt-in questions. (9.19.0) — [release notes](https://github.com/copier-org/copier/releases/tag/v9.19.0)

### Behavior and default changes

- Destination symlinks can now be overwritten when preserve_symlinks is false. (9.18.2) — [release notes](https://github.com/copier-org/copier/releases/tag/v9.18.2)

### Fixes and other changes

- Restores support for Git older than 2.43.1. (9.19.1) — [release notes](https://github.com/copier-org/copier/releases/tag/v9.19.1)
- When a directory containing a symlink is renamed during updating, its symlink targets are kept. (9.19.0) — [release notes](https://github.com/copier-org/copier/releases/tag/v9.19.0)
- Submodules are resolved from the current checkout's .gitmodules. (9.18.2) — [release notes](https://github.com/copier-org/copier/releases/tag/v9.18.2)