10 files changed, 135 insertions, 14 deletions
diff --git a/Documentation/RelNotes/2.30.5.txt b/Documentation/RelNotes/2.30.5.txt
new file mode 100644
index 0000000000..5191cab3ae
--- /dev/null
+++ b/Documentation/RelNotes/2.30.5.txt
@@ -0,0 +1,12 @@
+Git v2.30.5 Release Notes
+=========================
+
+This release contains minor fix-ups for the changes that went into
+Git 2.30.3 and 2.30.4, addressing CVE-2022-29187.
+
+ * The safety check that verifies a safe ownership of the Git
+   worktree is now extended to also cover the ownership of the Git
+   directory (and the `.git` file, if there is any).
+
+Carlo Marcelo Arenas Belón (1):
+      setup: tighten ownership checks post CVE-2022-24765
diff --git a/Documentation/RelNotes/2.31.4.txt b/Documentation/RelNotes/2.31.4.txt
new file mode 100644
index 0000000000..97a91fd07a
--- /dev/null
+++ b/Documentation/RelNotes/2.31.4.txt
@@ -0,0 +1,6 @@
+Git v2.31.4 Release Notes
+=========================
+
+This release merges up the fixes that appear in v2.30.5 to address
+the security issue CVE-2022-29187; see the release notes for that
+version for details.
diff --git a/Documentation/RelNotes/2.32.3.txt b/Documentation/RelNotes/2.32.3.txt
new file mode 100644
index 0000000000..583fabe684
--- /dev/null
+++ b/Documentation/RelNotes/2.32.3.txt
@@ -0,0 +1,6 @@
+Git v2.32.3 Release Notes
+=========================
+
+This release merges up the fixes that appear in v2.30.5 and
+v2.31.4 to address the security issue CVE-2022-29187; see the
+release notes for these versions for details.
diff --git a/Documentation/RelNotes/2.33.4.txt b/Documentation/RelNotes/2.33.4.txt
new file mode 100644
index 0000000000..a145cc25de
--- /dev/null
+++ b/Documentation/RelNotes/2.33.4.txt
@@ -0,0 +1,6 @@
+Git v2.33.4 Release Notes
+=========================
+
+This release merges up the fixes that appear in v2.30.5, v2.31.4
+and v2.32.3 to address the security issue CVE-2022-29187; see
+the release notes for these versions for details.
diff --git a/Documentation/RelNotes/2.34.4.txt b/Documentation/RelNotes/2.34.4.txt
new file mode 100644
index 0000000000..2a6b223403
--- /dev/null
+++ b/Documentation/RelNotes/2.34.4.txt
@@ -0,0 +1,6 @@
+Git v2.34.4 Release Notes
+=========================
+
+This release merges up the fixes that appear in v2.30.5, v2.31.4,
+v2.32.3 and v2.33.4 to address the security issue CVE-2022-29187;
+see the release notes for these versions for details.
diff --git a/Documentation/RelNotes/2.35.4.txt b/Documentation/RelNotes/2.35.4.txt
new file mode 100644
index 0000000000..47abd5ad45
--- /dev/null
+++ b/Documentation/RelNotes/2.35.4.txt
@@ -0,0 +1,7 @@
+Git v2.35.4 Release Notes
+=========================
+
+This release merges up the fixes that appear in v2.30.5,
+v2.31.4, v2.32.3, v2.33.4 and v2.34.4 to address the security
+issue CVE-2022-29187; see the release notes for these versions
+for details.
diff --git a/Documentation/RelNotes/2.36.2.txt b/Documentation/RelNotes/2.36.2.txt
index ba5d5acd07..958f5b4102 100644
--- a/Documentation/RelNotes/2.36.2.txt
+++ b/Documentation/RelNotes/2.36.2.txt
@@ -1,10 +1,16 @@
 Git v2.36.2 Release Notes
 =========================
 
-This maintenance release is primarily to merge down updates to the
-build and CI procedures from the 'master' front, in order to ensure
-that we can cut healthy maintenance releases in the future.  It also
-contains a handful of small and trivially-correct bugfixes.
+This release merges up the fixes that appear in v2.30.5, v2.31.4,
+v2.32.3, v2.33.4, v2.34.4 and v2.35.4 to address the security
+issue CVE-2022-29187; see the release notes for these versions
+for details.
+
+Apart from that, this maintenance release is primarily to merge down
+updates to the build and CI procedures from the 'master' front, in
+order to ensure that we can cut healthy maintenance releases in the
+future.  It also contains a handful of small and trivially-correct
+bugfixes.
 
 Fixes since v2.36.1
 -------------------
diff --git a/Documentation/RelNotes/2.37.0.txt b/Documentation/RelNotes/2.37.0.txt
index 8f1ff3a596..99dc7e32f8 100644
--- a/Documentation/RelNotes/2.37.0.txt
+++ b/Documentation/RelNotes/2.37.0.txt
@@ -54,8 +54,19 @@ UI, Workflows & Features
 
  * Update the doctype written in gitweb output to xhtml5.
 
- * The "fetch.credentialsInUrl" configuration variable controls what
-   happens when a URL with embedded login credential is used.
+ * The "transfer.credentialsInURL" configuration variable controls what
+   happens when a URL with embedded login credential is used on either
+   "fetch" or "push". Credentials are currently only detected in
+   `remote.<name>.url` config, not `remote.<name>.pushurl`.
+
+ * "git revert" learns "--reference" option to use more human-readable
+   reference to the commit it reverts in the message template it
+   prepares for the user.
+
+ * Various error messages that talk about the removal of
+   "--preserve-merges" in "rebase" have been strengthened, and "rebase
+   --abort" learned to get out of a state that was left by an earlier
+   use of the option.
 
 
 Performance, Internal Implementation, Development Support etc.
@@ -80,14 +91,15 @@ Performance, Internal Implementation, Development Support etc.
 
  * A workflow change for translators are being proposed.  git.pot is
    no longer version controlled and it is local responsibility of
-   translaters to generate it.
+   translators to generate it.
 
  * Plug the memory leaks from the trickiest API of all, the revision
    walker.
 
  * Rename .env_array member to .env in the child_process structure.
 
- * More fsmonitor--daemon.
+  * The fsmonitor--daemon handles even more corner cases when
+    watching filesystem events.
 
  * A new bug() and BUG_if_bug() API is introduced to make it easier to
    uniformly log "detect multiple bugs and abort in the end" pattern.
@@ -133,7 +145,7 @@ Fixes since v2.36
    (merge 08bdd3a185 jc/cocci-xstrdup-or-null-fix later to maint).
 
  * The path taken by "git multi-pack-index" command from the end user
-   was compared with path internally prepared by the tool withut first
+   was compared with path internally prepared by the tool without first
    normalizing, which lead to duplicated paths not being noticed,
    which has been corrected.
    (merge 11f9e8de3d ds/midx-normalize-pathname-before-comparison later to maint).
@@ -163,7 +175,7 @@ Fixes since v2.36
    is given in "git status" not to use the break-rewrite heuristics.
    (merge 84792322ed rs/commit-summary-wo-break-rewrite later to maint).
 
- * Update a few end-user facing messages around eol conversion.
+ * Update a few end-user facing messages around EOL conversion.
    (merge c970d30c2c ah/convert-warning-message later to maint).
 
  * Trace2 documentation updates.
@@ -222,9 +234,8 @@ Fixes since v2.36
 
  * With a recent update to refuse access to repositories of other
    people by default, "sudo make install" and "sudo git describe"
-   stopped working.  This series intends to loosen it while keeping
-   the safety.
-   (merge b9063afda1 cb/path-owner-check-with-sudo later to maint).
+   stopped working, which has been corrected.
+   (merge 6b11e3d52e cb/path-owner-check-with-sudo-plus later to maint).
 
  * The tests that ensured merges stop when interfering local changes
    are present did not make sure that local changes are preserved; now
@@ -256,7 +267,7 @@ Fixes since v2.36
    has been corrected.
    (merge b02fdbc80a jc/all-negative-pathspec later to maint).
 
- * With a more targetted workaround in http.c in another topic, we may
+ * With a more targeted workaround in http.c in another topic, we may
    be able to lift this blanket "GCC12 dangling-pointer warning is
    broken and unsalvageable" workaround.
    (merge 419141e495 cb/buggy-gcc-12-workaround later to maint).
@@ -297,6 +308,9 @@ Fixes since v2.36
  * Use-after-free (with another forget-to-free) fix.
    (merge 323822c72b ab/remote-free-fix later to maint).
 
+ * Remove a coccinelle rule that is no longer relevant.
+   (merge b1299de4a1 jc/cocci-cleanup later to maint).
+
  * Other code cleanup, docfix, build fix, etc.
    (merge e6b2582da3 cm/reftable-0-length-memset later to maint).
    (merge 0b75e5bf22 ab/misc-cleanup later to maint).
@@ -320,3 +334,4 @@ Fixes since v2.36
    (merge 8c49d704ef fh/transport-push-leakfix later to maint).
    (merge 1d232d38bd tl/ls-tree-oid-only later to maint).
    (merge db7961e6a6 gc/document-config-worktree-scope later to maint).
+   (merge ce18a30bb7 fs/ssh-default-key-command-doc later to maint).
diff --git a/Documentation/RelNotes/2.37.1.txt b/Documentation/RelNotes/2.37.1.txt
new file mode 100644
index 0000000000..84609327d1
--- /dev/null
+++ b/Documentation/RelNotes/2.37.1.txt
@@ -0,0 +1,17 @@
+Git 2.37.1 Release Notes
+========================
+
+This release merges up the fixes that appear in v2.30.5, v2.31.4,
+v2.32.3, v2.33.4, v2.34.4, v2.35.4, and v2.36.2 to address the
+security issue CVE-2022-29187; see the release notes for these
+versions for details.
+
+Fixes since Git 2.37
+--------------------
+
+ * Rewrite of "git add -i" in C that appeared in Git 2.25 didn't
+   correctly record a removed file to the index, which is an old
+   regression but has become widely known because the C version has
+   become the default in the latest release.
+
+ * Fix for CVS-2022-29187.
diff --git a/Documentation/RelNotes/2.38.0.txt b/Documentation/RelNotes/2.38.0.txt
new file mode 100644
index 0000000000..f3e36b12fe
--- /dev/null
+++ b/Documentation/RelNotes/2.38.0.txt
@@ -0,0 +1,40 @@
+Git v2.38 Release Notes
+=======================
+
+Performance, Internal Implementation, Development Support etc.
+
+ * Collection of what is referenced by objects in promisor packs have
+   been optimized to inspect these objects in the in-pack order.
+   (merge 18c08abc82 jk/optim-promisor-object-enumeration later to maint).
+
+ * Introduce a helper to see if a branch is already being worked on
+   (hence should not be newly checked out in a working tree), which
+   performs much better than the existing find_shared_symref() to
+   replace many uses of the latter.
+
+ * Teach "git archive" to (optionally and then by default) avoid
+   spawning an external "gzip" process when creating ".tar.gz" (and
+   ".tgz") archives.
+   (merge 4f4be00d30 rs/archive-with-internal-gzip later to maint).
+
+
+Fixes since v2.37
+-----------------
+
+ * Rewrite of "git add -i" in C that appeared in Git 2.25 didn't
+   correctly record a removed file to the index, which was fixed.
+   (merge 4788e8b256 js/add-i-delete later to maint).
+
+ * Certain diff options are currently ignored when combined-diff is
+   shown; mark them as incompatible with the feature.
+   (merge cfb19ae05f rs/combine-diff-with-incompatible-options later to maint).
+
+ * Adjust technical/bitmap-format to be formatted by AsciiDoc, and
+   add some missing information to the documentation.
+   (merge ac7667bd44 ac/bitmap-format-doc later to maint).
+
+ * Other code cleanup, docfix, build fix, etc.
+   (merge 5fd9d1738e jk/revisions-doc-markup-fix later to maint).
+   (merge 1971510c35 pb/diff-doc-raw-format later to maint).
+   (merge a3ba4fa715 cr/setup-bug-typo later to maint).
+   (merge 85845580d9 ds/vscode-settings later to maint).