Skip to content

gitoxide

vgix-packetline-v0.21.5 scope: gix-packetline Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Version Control
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

blazingly-fast built-with-rust cli git version-control

Summary

AI summary

Updates Commit Details, Commit Statistics, and Bug Fixes across a mixed release.

Full changelog

Bug Fixes

  • avoid packetline panic on empty sideband payload
    GHSA-2vh6-hw4j-32ww reports that gix-packetline can panic when side-band
    progress or error packets contain only the band designator and no payload. The
    same unchecked indexing pattern also existed in PacketLineRef::decode_band() for
    direct empty side-band data.

    Git baseline: git.git sideband.c demultiplex_sideband() handles side-band
    records by checking the received length before using the band designator,
    reports missing designators as protocol errors, and permits progress/error
    payload handling without assuming non-empty text.

Commit Statistics

  • 5 commits contributed to the release over the course of 20 calendar days.
  • 20 days passed between releases.
  • 1 commit was understood as conventional.
  • 0 issues like '(#ID)' were seen in commit messages

Commit Details

view details
  • Uncategorized
    • Refactor tests (34e6eb5)
    • Avoid packetline panic on empty sideband payload (4bef04a)
    • Merge pull request #2635 from GitoxideLabs/dependabot/cargo/cargo-7b971a5e8c (155ff6d)
    • Bump the cargo group with 40 updates (9402adc)
    • Merge pull request #2618 from GitoxideLabs/report (f7d4f33)

Security Fixes

  • GHSA-2vh6-hw4j-32ww — prevents panic in gix-packetline when sideband payload is empty
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track gitoxide

Get notified when new releases ship.

Sign up free

About gitoxide

An idiomatic, lean, fast & safe pure Rust implementation of Git

All releases →

Related context

Related tools

Earlier breaking changes

  • vgix-v0.84.0 Allow checkouts of empty repositories; `destination_must_be_empty` becomes `Option<bool>`
  • vgix-worktree-stream-v0.33.0 Changes API of `Stream::add_entry_from_path` to require `hash_kind` argument.
  • vgix-object-v0.61.0 Renames `Data::hash_kind` to `Data::object_hash` for consistency.

Beta — feedback welcome: [email protected]