#pragma section-numbers 2

= Mercurial 4.9 release =

This is an overview of [[WhatsNew#Mercurial_4.9_.282019-02-01.29|4.9 release]].

== Security Fixes ==

It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository. This has been fixed. Users on older versions can either disable subrepositories with
{{{
[subrepos]
allowed = false
}}}
in their configuration or by ensuring any cloned repositories don't contain malicious symlinks.

== New Features ==

 * 'hg histedit' will now present a curses UI if curses is available and 'ui.interface' or 'ui.interface.histedit' is set to 'curses'.
 * The 'sparse-revlog' delta strategy is enabled by default for new repositories.
 See `hg help config.format.sparse-revlog` for details.


== New Experimental Features ==


== Other Notable Features ==

 * New `rewrite.update-timestamp=True` option to update the commit timestamp on history editing (e.g. amend.)
 * New `ui.message-output=stderr` option for scripting, which prevents status messages from interleaved.
 * New `rootglob:` filename pattern for a glob that is rooted at the root of the repository.
 See `hg help patterns` and `hg help hgignore` for details.
 * Some more reimplementation of ancestry algorithms in Rust for better performance.

== Bug Fixes ==


== Backwards Compatibility Changes ==

 * Boolean options passed to the logtoprocess extension are now formatted as "0" or "1" instead of "None", "False", or "True".

 * The logtoprocess extension no longer supports invalid "ui.log()" arguments. A log message is always formatted and passed in to the "$MSG1" environment variable.


== Internal API Changes ==

 * Status messages may be sent to a dedicated stream depending on configuration. Don't use "ui.status()", etc. as a shorthand for conditional writes. Use "ui.write()" for data output.

 * Add 'exthelper' class to simplify extension writing by allowing functions, commands, and configitems to be registered via annotations.  The previous APIs are still available for use.

 * The extension hook "extsetup" without a 'ui' argument has been deprecated, and will be removed in the next version.  Add a 'ui' argument to avoid the deprecation warning.