# chezmoi v2.72.0

- Product: chezmoi (https://whatsnew.fyi/product/chezmoi)
- Vendor: Tom Payne
- Date: 2026-08-02
- Version: v2.72.0
- Original notes: https://github.com/twpayne/chezmoi/releases/tag/v2.72.0
- Permalink: https://whatsnew.fyi/product/chezmoi/releases/v2.72.0
- Labels: Platforms: Desktop

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix multiple security vulnerabilities
- **added** — Add shellQuote and shellQuoteList template functions
- **added** — Add gopassCat template function
- **added** — Add debugf template function
- **security** — Tighten permissions on temporary files
- **security** — Ensure HTTP cache directory is private
- **security** — Disallow relative paths with /.. suffix
- **security** — Disallow .. in ignore and remove patterns
- **security** — Disallow .. paths in mackup files
- **security** — Disallow filenames that resolve to .
- **security** — Improve handling of untrusted relative paths
- **security** — Disallow .. paths in .chezmoiroot
- **fixed** — Reject negative format-indent-width template directives
- **security** — Ensure that secret keyring get command always writes a private file
- **security** — Ensure that age-keygen always writes a private file
- **security** — Make persistent state directory private by default
- **security** — Prevent directory escape in tar and rar archives
- **security** — Disallow file and directory names that resolve to ..

##### Changelog
###### Features
* f81cb321789aa3df62871248f5e4d361a59e7cc1 feat: Fix multiple security vulns thanks to secur0.com
* 1e51cc5d88e10ea04d7f74b78380693ce41cbb85 feat: Add shellQuote and shellQuoteList template funcs
* 4249f4f6c24954d3ce8bfd0d76673bb8c55869d3 feat: Add gopassCat template function
* a7d91a55f885d87be7089095c69705e499cd41a4 feat: Add debugf template function
###### Fixes
* 0ad679a834533d3f548c18f62ed7c97dc05a3250 fix: Tighten permissions on temporary files
* 4031be13eebd4a964242fade1b4b23688d6e4589 fix: Ensure HTTP cache dir is private
* ba5a19a2fd28e3a16d9f8d86c6c906acf229dd3e fix: Disallow relative paths with /.. suffix
* 1fe762752a243991df1a749cdf89fa3e4de7df04 fix: Disallow .. in ignore and remove patterns
* 3c9e70b5262856aee320dc68a3035ce2e344d6bf fix: Disallow .. paths in mackup files
* 01b60ddecfd021b83b174dd9ae6d54a9909bc769 fix: Disallow filenames that resolve to .
* 5cdaf4ea3613717756bece1083fde079f4e37978 fix: Improve handling of untrusted relative paths
* e8a57dc1b617068fd54cf4c998ac95bbc9150a70 fix: Disallow .. paths in .chezmoiroot
* 76e2ddf60a7b020fec4f06961ec8401e7a4c6ab9 fix: Reject negative format-indent-width template directives
* 840f68213525cdf7cdaa48a248fe751cb4361a9d fix: Ensure that secret keyring get command always writes a private file
* f7282b8127ad67d17b069ea8b4bfa1f66b8c43ef fix: Ensure that age-keygen always writes a private file
* e7cbe71abd5f51524196a45bb94c1d9b006cf577 fix: Make persistent state directory private by default
* 0d6fc2bf7ca5fd9b24fa93b09874170a0a16572b fix: Prevent directory escape in tar and rar archives
* 239cc6b9eea29698a003bf23eeb0bf112fe93006 fix: Disallow file and dir names that resolve to ..
###### Documentation
* a331111360f57705beb83385f2f5684514682a4c docs: Use more robust quoting functions in examples
* 80441a5fc79775e981f127e4a4c0d5575872eb55 docs: Add link to article
* 6cd634d875a99dd152b1a8fd1ae7fba67f13659f docs: Add link to article