| AArch64 | |
| ppc64le | |
| s390x | |
| x86-64 |
- Update to 0.56.0:
* Fixes CVE-2026-40034 (boo#1266434): the CommandForbiddenInModules
trust check could be bypassed in gix_submodule::File::update(),
which allowed arbitrary command execution from a crafted
.gitmodules file
* Fixes a submodule name validation bypass that allowed traversal
out of .git/modules and disclosure of credentials
* Fixes symlinked .gitmodules files being followed and parsed from
outside the repository
* Fixes several denial-of-service vectors in gix-pack: unchecked
indexing panics and uncapped allocations from crafted pack data
* Fixes HTTP credentials being leaked to the redirected host by the
curl transport backend
* Add the gix config show, gix config list, gix config fmt,
gix free remote refs, gix free trust, gix dirwalk and gix tix
subcommands
* Add a gix status --untracked flag and gix merge tree --message
for creating commits
* gix exclude query is now index-aware and no longer reports ignore
matches for tracked files, matching git check-ignore
* Preserve all configured remote URLs rather than only the last one
* Fix fetching and cloning with tag refspecs in shallow clones,
relative worktree linking files and loose ref path-prefix
collisions
* Update the crates to the Rust 2024 edition
- Correct License to (Apache-2.0 OR MIT) AND MPL-2.0: the binaries
statically link the vendored uluru crate, which is MPL-2.0. This
corrects an existing condition rather than recording a new
dependency, as uluru was already linked in 0.50.0 - the derivation
is recorded in a Legal-Review-Notice comment above the tag.
- Require rust >= 1.85, the minimum declared by upstream (edition 2024).
- Build against pkgconfig(openssl) instead of openssl-devel.
- Follow the upstream repository move to the GitoxideLabs organisation.
- Refresh the vendored dependencies. Recording the state of the
remaining open CVE bugs against this version, none of which it is
affected by:
* CVE-2026-25541 (boo#1274525): the vendored bytes is now 1.12.1,
above the 1.11.1 fix
* CVE-2025-22620 (boo#1236139): gix-worktree-state is 0.33.0, far
above the 0.17.0 that fixed the world-writable checkout of
executable files
- update to 0.50.0: see https://github.com/GitoxideLabs/gitoxide/compare/v0.42.0...v0.50.0 - drop workaround-cargo-bug.patch
- update to 0.42.0: * add first 'debug' version of gix diff file * use revspecs for revision and path * CVE-2025-31130: use collision-detecting SHA-1 hash boo#1240872
- Add workaround-cargo-bug.patch -- There is currently a bug with cargo
in which `cargo metadata` returns
See gh#rust-secure-code/cargo-auditable#124
- Update to version 0.41.0:
* add gix blame -L start,end
* add gix env to print paths relevant to the Git installation.
* Document the remaining subcommands
* Add support for statistics and additional performance
information.
* add gix blame to the CLI. That way it's possible to see the
blame result of any file in the repository.
- Updates from version 0.40.0:
* add first 'debug' version of gix log. It's primarily meant to
better understand gix blame.
* add --tree-favor to gix merge tree|commit. With it one can
decide which side to favor in case of irreconcilable
tree-conflicts.
* CVE-2025-22620: gix-worktree-state specifies 0777 permissions
when checking out executable files (boo#1236139)
- Update to version 0.39.0: New Features * add gix merge commit --debug * add gix merge commits * add gix merge tree to merge trees similarly to git merge-tree.
- Update to version 0.38.0: New Features * support for listing worktrees with gix worktree list * add first 'debug' version of gix diff tree. * add new gix cat command. * add gix merge-file with similar features as git merge-file * gix merge-base for the CLI Bug Fixes * Adjust gix clean warning and help for worktree fix * Clarify -r/--repositories and --skip-hidden-repositories Other * switch from time to jiff * Unify style in config support info
- Update to version 0.37.0:
New Features
* add mailmap check similar to git check-mailmap. That way it
becomes a little easier to maybe try out other special cases in
the wild.
* gix clone with --ref support. --ref is similar to --branch, but
was renamed as it also supports tags for example.
Other
* Make it easier to compile gitoxide as dynlib. Also optimize
compilation time: By making plumbing and porcelain as modules
the lib.rs, they can be compiled after the rmeta for the
dependencies are generated.
* For the uni.rs which uses both plumbing and porcelain, this
would avoid compiling these two modules twice.
- Update to version 0.36.0:
* Fixes for CVE-2024-35186 and CVE-2024-35197
* checkout respects options for core.protectHFS and
core.protectNTFS
* more robustness in the face of a trampling-herd of threads
loading a single index
- Update to version 0.35.0: * add gix status --ignored support * add gix status --index-worktree-renames * gix status with submodule and rewrite support. * add gix is-clean|is-changed * gix submodules list --dirty-suffix for dirty-information * add gix commit describe --dirty-suffix
- Specfile to modern rust, add copyright and cleanup
- Update to version 0.34.0 (bsc#1223249, CVE-2024-32650):
* add gix clean --patterns-for-entries|-m to help with wildcards.
* basic gix clean
* Allow the -n argument as no-op to make them more compatible.
* Fix clippy lints
* Add back line wrapping simplify Usage Variants
* Tell clap that ein is named ein
* Copy over code from gix to generate completions for ein as well
* Fix indenting by removing formatting on the config str
* Reserve 50 characters for the config name
* Bring back old implementation from 65e6496 - this also removes
terminal_size, although its not large
* Use chunks_exact where possible
- Updates from version 0.33.0:
* Add rev parse --reference. It's similar to git rev-parse
- -symbolic-full-name.
* mark gix::interrupt::init_handler() as unsafe
- Updates from version 0.32.0:
* gix rev parse --format to provide different versions of the
same content.
* in --trace mode, greatly increase message-buffer size.
* set binary name for completions
* rename GITOXIDE_* environment variables to GIX_#
* Add thediff::resource_cache() low-level utility for rapid
in-memory diffing of combinations of resources.
* In gix read http.sslVerify config value and pass it to
gix-transport.
* Remove dead code from non-existent "lean-cli" feature
* Replace all docsrs config by the document-features feature
* Add basic connectivity check
* Allow to print a tree without prettification, using
tree-style --raw.
* Automatically enforce strict mode if -c options are given on
the command-line.
- Updates from version 0.31.0:
* add shell completions for bash
* User decides completion output
* gix status auto-writes changed indices.
* This prevents expensive operations to re-occour.
* gix status -s/--statistics to obtain additional information on
what happened.
- Updates from version 0.30.0:
* gix status with basic index-worktree comparison
* gix free index from-list and gix index from-tree gain
- -skip-hash.
* both ein and gix now share some code via the gitoxide library.
This can slightly improve compile times as well, even though it
wasn't measured.
- Updates from version 0.29.0:
* gix submodule subcommand for simple submodule listing and
information retrieval
* gix index entries --recurse-subomdules to also list submodules.
* gix index entries with styles and pathspecs.
* use real pathspecs where it was supported before.
* add gix commit verify-signature to do something akin to git ...
- -show-signature.
- Updates from version 0.28.0:
* add simple CLI for gix archive
- Updates from version 0.27.0:
* list commit-graph entries by graph traversal, move commit-graph
up to gix level.
* gix --trace to also print tree-like instrumentation
* gix fetch --open-negotiation-graph[=limit]
* gix fetch --negotiation-info to provide additional information
about the negotiation phase.
* bit revision list --svg to create a visual graph of commits.
- Updates from version 0.26.0:
* gix attributes validate to validate attributes and ignore
against git as baseline.
* --statistics for gix excludes query
* gix attribute query as something similar to git check-attrs.
* no-repo index from-list to create an index with empty files
from the given list.
* add pro-forma library to allow feature documentation of
gitoxide on docs.rs
- Updates from version 0.25.0:
* A maintenance release without user-facing changes, just to
fix installation
- Updates from version 0.24.0:
* gix index entries also prints attributes.
* gix clone and gix fetch with controls for shallow repositories.
* ein t trace-path know accepts the trace-file alias.
* printing to stdout for commands that don't show progress is
greatly improved. Previously it would have to lock stdout on
each write, now this is done only once.
* opening repositories without 'strict' mode also ignores
IO errors. These will instead be logged, but won't make it
impossible to open an otherwise fine repository.
* turn gix free index entries into gix index entries.
- Updates from version 0.23.0:
* ein tool query - a git analytics engine. A tool to build and
efficiently maintain a database of information contained in
a git repository, preferably the kind of information that is
expensive to obtain, in order to facilitate queries that would
be prohibitive without an accelerating data structure.
* gix tree entries with rev-spec support.
- Updates from version 0.22.0:
* A maintenance release without user-facing changes.
- Chore
+ upgrade to clap 4.1
- New Features
+ gix clone <url> is now permitted without specifying a destination directory.
+ Note that the implementation doesn't take into account potential redirects and renames
+ as it's implemented only with the first URL it sees (not the redirected ones).
+ make more HTTP options available
+ http.schannelCheckRevoke