Both vulnerabilities are reported as git for windows vulnerabilities, aren't they? I do not quite understand what is the 'correct' behaviour considering the pa

Both vulnerabilities are reported as git for windows vulnerabilities, aren't they? I do not quite understand what is the 'correct' behaviour considering the parent directory thing. The concrete problem seems rather than that there is no -safe switch to use in prompts, etc.