Git has 3 new Remote Code Execution vulnerabilities.
It's said in the blog that Git was already patched by version 2.39.1. But, I don't think they explicitly said that GitHub Desktop has upgraded its embedded Git to 2.39.1.
GitHub Desktop Release Notes: https://desktop.github.com/release-notes
As per January 18th release comes with upgraded git version 2.35.6. The latest January 25th release does not include the new embedded git version 2.39.1. Am I right to assume that GitHub Desktop still has unpatched version of Git?
And lastly, GitHub Blog said that they scanned all repositories in GitHub.com and found no evidence concerning the site being used as an attack vector. But, do we also have sources that GitLab did the same on their side?