Upgrading Git/Mercurial in SourceTree for Windows
[Security vulnerability CVE-2014-9390] If you are running SourceTree version 1.6.11 or earlier here's how fix your Git/Hg versions until an update is available:
- Download MsysGit version 1.9.5 or later from http://git-scm.com/
- Close SourceTree
- Run the Git installer
- Open a fresh console and run 'git --version' from the command line and check that it says version 1.9.5. If not, check your PATH in Control Panel > System > Advanced system settings > Environment Variables. Make sure the Git install path is before any others (such as TortoiseGit which at the time of writing isn't up to date)
- Open SourceTree press Ctrl+, to open Options
- Select the Git tab, then click the 'Use System Git' button
- The Git Version box should now report 'System Git version 1.9.5'
- Download Mercurial version 3.2.3+ for your OS from http://mercurial.selenic.com/downloads. If you use TortoiseHg, install that update too.
- Close SourceTree
- Run the installer
- Open a fresh terminal and run 'hg --version', check that it is 3.2.3 or later. If not, check your PATH in Control Panel > System > Advanced system settings > Environment Variables. Make sure the Hg install path you updated is before any others
- Open SourceTree, then press Ctrl+, to open Options
- Select the Mercurial tab, then click the 'Use System Mercurial' button
- The Git Version box should now report 'System Mercurial version 3.2.3'
You now have versions of Git & Hg on the command line and in SourceTree that are not vulnerable to this issue.
To upgrade the version of Git/Mercurial used in SourceTree you can go to your SourceTree options by hitting via Tools > Options and going to either the Git and Mercurial tabs. From here you can then go to the 'Git Version' or 'Mercurial Version' boxes respectively and selecting either 'Reset to embedded Git/Hg' or 'Use System Git/Hg'. When selecting 'Use System Git/Hg' you are then prompted to select the location on your system.