From 77c235e28f32b5c83f653cb6871cf5ecf9e2fb02 Mon Sep 17 00:00:00 2001
From: Scott Odle <sodle@splunk.com>
Date: Tue, 22 Sep 2026 09:48:20 -0600
Subject: [PATCH 1/2] chore: refresh development tooling

Update pre-commit hook revisions before the functional connector change.

Written by Codex.
---
 .pre-commit-config.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index f429f95..40b32d4 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -33,7 +33,7 @@ repos:
         args: [ "--fix", "--unsafe-fixes"] # Allow unsafe fixes (ruff pretty strict about what it can fix)
       - id: ruff-format
   - repo: https://github.com/djlint/djLint
-    rev: v1.46.1
+    rev: v1.46.2
     hooks:
       - id: djlint-reformat-django
       - id: djlint-django
@@ -61,7 +61,7 @@ repos:
         exclude: "README.md"
   # Central hooks
   - repo: https://github.com/phantomcyber/dev-cicd-tools
-    rev: v2.2.10
+    rev: v2.2.12
     hooks:
       - id: build-docs
         language: python

From e010da63f46a6ee22bf8424642af3993c812309a Mon Sep 17 00:00:00 2001
From: Scott Odle <sodle@splunk.com>
Date: Tue, 22 Sep 2026 09:50:41 -0600
Subject: [PATCH 2/2] fix: reset Git request state per parameter

Refs PSAAS-30533, VULN-93258, and FS-955.

Rebuild repository and credential state from trusted asset configuration for every parameter dictionary so a previous caller URL cannot receive stored credentials.

Written by Codex.
---
 git_connector.py            | 11 ++++++++---
 release_notes/unreleased.md |  2 ++
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/git_connector.py b/git_connector.py
index e60cee9..6a7a4ef 100644
--- a/git_connector.py
+++ b/git_connector.py
@@ -92,13 +92,18 @@ def _set_repo_attributes(self, param={}):
         """
 
         configured_repo_uri = self.config.get(consts.GIT_CONFIG_REPO_URI)
+        configured_repo_name = self.config.get(consts.GIT_CONFIG_REPO_NAME)
+        configured_branch_name = self.config.get(consts.GIT_CONFIG_BRANCH_NAME, "master")
+        configured_access_token = self.config.get("access_token")
         requested_repo_uri = param.get("repo_url")
-        self.repo_uri = requested_repo_uri or self.repo_uri
-        self.branch_name = param.get("branch") or self.branch_name
+        self.repo_uri = requested_repo_uri or configured_repo_uri
+        self.repo_name = configured_repo_name
+        self.branch_name = param.get("branch") or configured_branch_name
         self.modified_repo_uri = self.repo_uri
+        self.ssh = False
         supplied_access_token = param.get("access_token")
         use_asset_credentials = not requested_repo_uri or self._same_remote(configured_repo_uri, requested_repo_uri)
-        self.access_token = supplied_access_token or (self.access_token if use_asset_credentials else None)
+        self.access_token = supplied_access_token or (configured_access_token if use_asset_credentials else None)
 
         # create another copy so that URL with password is not displayed during test_connectivity action
         try:
diff --git a/release_notes/unreleased.md b/release_notes/unreleased.md
index fbcb2fd..ca3537b 100644
--- a/release_notes/unreleased.md
+++ b/release_notes/unreleased.md
@@ -1 +1,3 @@
 **Unreleased**
+
+* Reset per-parameter repository state before applying asset credentials.