This release adds 1 notable feature for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryUpdates Commit Details, Commit Statistics, and New Features across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Adds `rng` module to `gix-utils` for inter-process seeding. Adds `rng` module to `gix-utils` for inter-process seeding. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | High |
Fixes flaky capability tests by ensuring per-process unique random seeds. Fixes flaky capability tests by ensuring per-process unique random seeds. Source: llm_adapter@2026-07-15 Confidence: low |
— |
| Bugfix | Medium |
Ensures fast pseudo-random numbers differ across processes by using per-thread seeded generators. Ensures fast pseudo-random numbers differ across processes by using per-thread seeded generators. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
Full changelog
New Features
- add
rngmodule togix-utilsfor better inter-process seeding
This should avoid flaky capability tests of multiple process acting on the
same repository.
Bug Fixes
-
seed fast pseudo-random numbers to differ across processes
gix-utilsandgix-fsdrew fast pseudo-random numbers fromfastrand's
global generators, whose per-thread seed is derived only from values that
can coincide between separate processes (notably small thread IDs). Two
concurrently running processes could therefore produce identical sequences,
which weakens backoff jitter (meant to avoid a thundering herd of retries)
and can make the filesystem capability probes collide on their temporary
file names -- e.g. spuriously reporting that symlinks are unsupported (#1789).Add a
gix_utils::rngmodule that draws from a per-threadfastrand::Rng
seeded from a high-entropy OS source viagetrandom, and route the affected
call sites (backoff jitter and thegix-fscapability probes) through it.getrandomis a target-specific dependency that is excluded on
wasm32-unknown-unknown, which has no entropy backend by default and runs a
single process; there a best-effort seed is used that deliberately avoids
Instant::now()(which panics on that target).For https://github.com/GitoxideLabs/gitoxide/issues/1816
Commit Statistics
- 5 commits contributed to the release.
- 50 days passed between releases.
- 2 commits were understood as conventional.
- 0 issues like '(#ID)' were seen in commit messages
Commit Details
view details- Uncategorized
- Merge pull request #2663 from ameyypawar/fix/1816-rng-seed (386f31a)
- Add
rngmodule togix-utilsfor better inter-process seeding (96ead72) - Auto-review (bf4b474)
- Seed fast pseudo-random numbers to differ across processes (efa5ffc)
- Merge pull request #2618 from GitoxideLabs/report (f7d4f33)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- vgix-v0.84.0 Allow checkouts of empty repositories; `destination_must_be_empty` becomes `Option<bool>`
- vgix-worktree-stream-v0.33.0 Changes API of `Stream::add_entry_from_path` to require `hash_kind` argument.
- vgix-object-v0.61.0 Renames `Data::hash_kind` to `Data::object_hash` for consistency.
Beta — feedback welcome: [email protected]