c411e47788
This release fixes an issue where AdvertiseRefsHook was not called for git-upload-pack in protocol v0 stateless transports, meaning that wants aren't validated and a user can fetch anything that is pointed to by any ref (using fetch-by-sha1), as long as they can guess the object name. Bug: Issue 10262 Change-Id: I1018c6fcb5cd4e34d2b106929db3a8238f45cda0