--- a/mercurial/help/config.txt Sun Nov 05 21:51:42 2017 +0900
+++ b/mercurial/help/config.txt Mon Nov 06 14:56:17 2017 -0500
@@ -1905,6 +1905,13 @@
When disallowed, any commands including :hg:`update` will fail if
subrepositories are involved.
+
+ Security note: auditing in Mercurial is known to be insufficient
+ to prevent clone-time code execution with carefully constructed
+ Git subrepos. It is unknown if a similar defect is present in
+ Subversion subrepos, so both are disabled by default out of an
+ abundance of caution. Re-enable such subrepos via this setting
+ with caution.
(default: `hg`)
``templatealias``