Skip to content

gitoxide

vgix-pack-v0.73.0 scope: gix-pack Breaking

This release includes 2 breaking changes for platform teams planning a safe upgrade.

Published 3d Version Control
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

blazingly-fast built-with-rust cli git version-control

Affected surfaces

breaking_upgrade

Summary

AI summary

Broad release touches Commit Details, Bug Fixes, Commit Statistics, and New Features.

Full changelog

Bug Fixes

  • cap remaining gix-pack allocations
  • reject invalid pack entry header metadata
    The pack entry decoder stored the consumed header length with an infallible u16
    conversion and accepted ref-delta hash lengths through panic-capable slice and
    ObjectId conversions. Malformed or unsupported metadata should become decode
    errors instead of process panics.

New Features (BREAKING)

  • make pack compression levels configurable
    Require explicit compression levels when creating pack entries and expose compression in bundle-writing options. Defaults match git: the zlib default for pack entries and the fastest level when completing thin packs with loose-object data.

Bug Fixes (BREAKING)

  • prevent panics when decoding malformed pack entry headers
    Represent the pack entry object hash as gix_hash::Kind in
    Entry::from_bytes() instead of accepting a raw hash length. This keeps callers
    from passing unsupported or inconsistent hash lengths and lets the decoder derive
    the ref-delta base id length from the selected object format.

Commit Statistics

  • 26 commits contributed to the release.
  • 31 days passed between releases.
  • 4 commits were understood as conventional.
  • 3 unique issues were worked on: #2611, #2676, #2690

Commit Details

view details
  • #2611
    • Add a benchmark for pack generation from loose objects (0ba5af4)
  • #2676
    • Reject invalid pack entry header metadata (5850141)
  • #2690
    • Cap remaining gix-pack allocations (ace687c)
  • Uncategorized
    • Update changelogs prior to release (cb6ec7d)
    • Release gix-trace v0.1.21, gix-validate v0.11.3, gix-path v0.12.3, gix-utils v0.3.5, gix-config-value v0.19.0, gix-prompt v0.16.0, gix-sec v0.14.2, gix-url v0.37.0, gix-credentials v0.39.0, safety bump 18 crates (f0ec710)
    • Merge pull request #2722 from GitoxideLabs/reasons (c16b5a1)
    • Replace lint allowances with expectations (43ff87a)
    • Merge pull request #2714 from GitoxideLabs/fix-credentials-parsing (cf3053a)
    • Release gix-path v0.12.2, gix-error v0.2.5, gix-utils v0.3.4, gix-date v0.15.6, gix-url v0.36.2, gix-credentials v0.38.2 (27aec47)
    • Merge pull request #2695 from ameyypawar/fix/2024-compression-level (6e1c4a2)
    • Review (f1ac335)
    • Make pack compression levels configurable (f26c18a)
    • Merge pull request #2707 from ameyypawar/fix/2703-inflate-error (6d95da6)
    • Adapt to changes in gix-features, use gix-zlib accordingly. (9c2977a)
    • Merge pull request #2691 from GitoxideLabs/gix-pack-missing-cap (0052e42)
    • Merge pull request #2675 from ameyypawar/bench/2611-pack-generation (09642c6)
    • Review (223f673)
    • Measure the discovery walk and state the benchmark's limits (6391b3e)
    • Merge pull request #2678 from GitoxideLabs/pack-entry-header-safety (938506b)
    • Remove redundant pack data hash length field (5d4c52b)
    • Prevent panics when decoding malformed pack entry headers (b69f0a6)
    • Merge pull request #2616 from 0WD0/wd/pack (b2a0fd6)
    • Review (3d511c3)
    • Merge pull request #2670 from GitoxideLabs/fix-ci (d785bbc)
    • Update mmap2 to avoid potential for unsoundness (eda41b1)
    • Merge pull request #2646 from GitoxideLabs/report (1b1541e)

Breaking Changes

  • Make pack compression levels configurable; explicit level required when creating pack entries.
  • Prevent panics by rejecting invalid pack entry header metadata and removing redundant hash length field.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track gitoxide

Get notified when new releases ship.

Sign up free

About gitoxide

An idiomatic, lean, fast & safe pure Rust implementation of Git

All releases →

Related context

Related tools

Earlier breaking changes

  • vgix-v0.84.0 Allow checkouts of empty repositories; `destination_must_be_empty` becomes `Option<bool>`
  • vgix-worktree-stream-v0.33.0 Changes API of `Stream::add_entry_from_path` to require `hash_kind` argument.
  • vgix-object-v0.61.0 Renames `Data::hash_kind` to `Data::object_hash` for consistency.

Beta — feedback welcome: [email protected]