This release includes 2 breaking changes for platform teams planning a safe upgrade.
Published 3d
Version Control
✓ No known CVEs patched
✓ No known CVEs patched in this version
Topics
blazingly-fast
built-with-rust
cli
git
version-control
Affected surfaces
breaking_upgrade
Summary
AI summaryBroad release touches Commit Details, Bug Fixes, Commit Statistics, and New Features.
Full changelog
Bug Fixes
- cap remaining gix-pack allocations
- reject invalid pack entry header metadata
The pack entry decoder stored the consumed header length with an infallible u16
conversion and accepted ref-delta hash lengths through panic-capable slice and
ObjectId conversions. Malformed or unsupported metadata should become decode
errors instead of process panics.
New Features (BREAKING)
- make pack compression levels configurable
Require explicit compression levels when creating pack entries and expose compression in bundle-writing options. Defaults match git: the zlib default for pack entries and the fastest level when completing thin packs with loose-object data.
Bug Fixes (BREAKING)
- prevent panics when decoding malformed pack entry headers
Represent the pack entry object hash asgix_hash::Kindin
Entry::from_bytes()instead of accepting a raw hash length. This keeps callers
from passing unsupported or inconsistent hash lengths and lets the decoder derive
the ref-delta base id length from the selected object format.
Commit Statistics
- 26 commits contributed to the release.
- 31 days passed between releases.
- 4 commits were understood as conventional.
- 3 unique issues were worked on: #2611, #2676, #2690
Commit Details
view details- #2611
- Add a benchmark for pack generation from loose objects (0ba5af4)
- #2676
- Reject invalid pack entry header metadata (5850141)
- #2690
- Cap remaining gix-pack allocations (ace687c)
- Uncategorized
- Update changelogs prior to release (cb6ec7d)
- Release gix-trace v0.1.21, gix-validate v0.11.3, gix-path v0.12.3, gix-utils v0.3.5, gix-config-value v0.19.0, gix-prompt v0.16.0, gix-sec v0.14.2, gix-url v0.37.0, gix-credentials v0.39.0, safety bump 18 crates (f0ec710)
- Merge pull request #2722 from GitoxideLabs/reasons (c16b5a1)
- Replace lint allowances with expectations (43ff87a)
- Merge pull request #2714 from GitoxideLabs/fix-credentials-parsing (cf3053a)
- Release gix-path v0.12.2, gix-error v0.2.5, gix-utils v0.3.4, gix-date v0.15.6, gix-url v0.36.2, gix-credentials v0.38.2 (27aec47)
- Merge pull request #2695 from ameyypawar/fix/2024-compression-level (6e1c4a2)
- Review (f1ac335)
- Make pack compression levels configurable (f26c18a)
- Merge pull request #2707 from ameyypawar/fix/2703-inflate-error (6d95da6)
- Adapt to changes in
gix-features, usegix-zlibaccordingly. (9c2977a) - Merge pull request #2691 from GitoxideLabs/gix-pack-missing-cap (0052e42)
- Merge pull request #2675 from ameyypawar/bench/2611-pack-generation (09642c6)
- Review (223f673)
- Measure the discovery walk and state the benchmark's limits (6391b3e)
- Merge pull request #2678 from GitoxideLabs/pack-entry-header-safety (938506b)
- Remove redundant pack data hash length field (5d4c52b)
- Prevent panics when decoding malformed pack entry headers (b69f0a6)
- Merge pull request #2616 from 0WD0/wd/pack (b2a0fd6)
- Review (3d511c3)
- Merge pull request #2670 from GitoxideLabs/fix-ci (d785bbc)
- Update
mmap2to avoid potential for unsoundness (eda41b1) - Merge pull request #2646 from GitoxideLabs/report (1b1541e)
Breaking Changes
- Make pack compression levels configurable; explicit level required when creating pack entries.
- Prevent panics by rejecting invalid pack entry header metadata and removing redundant hash length field.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- vgix-v0.84.0 Allow checkouts of empty repositories; `destination_must_be_empty` becomes `Option<bool>`
- vgix-worktree-stream-v0.33.0 Changes API of `Stream::add_entry_from_path` to require `hash_kind` argument.
- vgix-object-v0.61.0 Renames `Data::hash_kind` to `Data::object_hash` for consistency.
Beta — feedback welcome: [email protected]