[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
gix	dependencies	minor	0.87.0 → 0.90.0
pyo3 (source)	dependencies	minor	0.29.0 → 0.30.0

---

Release Notes

GitoxideLabs/gitoxide (gix)

v0.90.0: gix v0.90.0

Compare Source

New Features (BREAKING)

• add worktree locking and a lock override that preserves changes

  Expose Worktree::set_lock(Option<&BStr>) and worktree::Proxy::set_lock()
  so callers can protect linked worktrees from pruning, moving, or removal,
  including when their checkout is offline. Implement file handling in
  gix_worktree::set_lock(): preserve byte-oriented reasons, append Git's
  trailing newline when needed, and make unlocking idempotent. Reject the
  main worktree in the porcelain and avoid writing through lock-file symlinks.

  Previously Force::OverrideLock also discarded local changes and initialized
  submodules. Add Force::OverrideLockKeepChanges to bypass just the lock check,
  retaining status and submodule validation. This expands an exhaustive public
  enum, so adapt the Tix caller in the same commit; existing CLI force levels
  retain their behavior.

  Git reference: v2.56.0-116-g6de20f6092
  (6de20f6092dcf9bdb1c8efe03db4b70c82b423dd), builtin/worktree.c
  lock/unlock/removal, wrapper.c newline encoding, and
  t/t2403-worktree-move.sh. Git's worktree remove -ff bypasses both lock and
  cleanliness checks; the new mode deliberately permits bypassing only the lock.
  exposes a pre-existing unresolved with_fetch_options link in clone docs.

Test

• worktree removal with late writes to both roots Inject bounded writes through removal progress after scanning, proving that
  one-pass deletion leaves files while default retries finish.

Performance

• don't look for new packs before writing an object

Reverted (BREAKING)

• remove the obsolete max-performance-safe feature gix always uses zlib-rs, so the safe bundle no longer differs from
  max-performance. Make max-performance own the default cache setup and
  update defaults, cache tests, and developer commands. Downstream users of
  the removed name must select max-performance instead.

New Features

• add Submodule::resolved_url() for cloning
  Definitely went through the tests quickly, besides the usual
  'make it a shell script', but poked the URL resolution and Windows
  special cases.
  Some of the newly added drive-prefix tests are truly from another world,
  and I don't think I could ever have written those, for better or worse.

  Relative submodule URLs in .gitmodules refer to the superproject's
  upstream, even when that upstream uses ssh://, git://, or SCP syntax.
  Passing the existing Submodule::url() result directly to a clone treats
  ./ and ../ entries as local paths instead.

  Document url() as the raw configured accessor and add resolved_url()
  for cloning or fetching. Port Git's byte-oriented relative_url() rules
  from remote.c, select the current branch's remote or the default remote,
  and fall back to the superproject itself when the selected URL is missing.
  Make local paths absolute so the result does not depend on the caller's
  working directory. Honor configuration overrides as initialized URLs,
  avoiding a second remote-relative resolution of local URLs written by
  git submodule init.

  Validate transport and local URLs, traversal errors, default-remote
  selection, initialized overrides, unborn and bare repositories, and
  non-UTF-8 local paths in disposable repositories. Compare resolution with
  git submodule init; include native-separator coverage for Windows.

• expose selected global attribute paths

  Allow callers that retain detached diff results to track the attribute files
  selected by the repository. Reuse the existing resolver so permissions,
  configuration interpolation, fallback paths, and precedence stay consistent
  with the attribute stack.

  Return selected paths even when files are missing so their later creation can
  invalidate cached results. Per-directory attributes and info/attributes
  remain separate because their locations are already known to the caller.

• provide safe interrupt setup and handle SIGHUP

  Applications that only need the shared cancellation flag should not have to
  supply an unsafe signal callback. Add interrupt::init_handler_default() as a
  safe entry point while preserving the callback and grace policy of an existing
  registration, including when a UI runs inside the gix command.

  Treat Unix SIGHUP like the other termination signals so long-running work can
  observe cancellation and callers can restore terminal state before exiting.
  It previously bypassed the shared flag and terminated immediately. Repeated
  signals retain the existing forced-termination policy.

  Exercise all supported termination signals and nested safe registration in
  isolated subprocesses. Four interrupt tests pass with the feature enabled and
  two pass without it.

• add Remote::default_branch() to learn the default branch of a remote without connecting to it.
  git clone and git remote set-head record the default branch of a remote in the symbolic reference
  refs/remotes/<name>/HEAD, which points to the remote-tracking branch of that branch, like
  refs/remotes/origin/main. Since Git 2.48, git fetch also creates it if it's missing.

• make repository paths absolute without reloading

  Went through the tests quite quickly, thinking their are deep and thorough
  as usual.

  Relative repository paths depend on the process current directory. Changing it
  after opening a repository can redirect checkout validation, Git-link handling,
  HEAD and object reads, or index persistence away from the intended repository.

  Add Repository::make_paths_absolute() to anchor the selected Git directory,
  common directory, worktree, index, and object database to the CWD captured at
  opening. Unlike reload(), this keeps runtime configuration, reference namespaces,
  and in-memory objects. Join paths lexically so missing worktrees remain supported
  and destination symlinks are still rejected. Leave existing clones unchanged,
  avoid partial updates on failure, and make repeated calls a no-op.

  Recreate relative reference and object stores through their existing APIs.
  Reset caches carrying relative index paths or store-specific pack IDs while
  preserving outstanding snapshots.

  Use an anchored repository view for initial checkout, and anchor global attribute
  paths before optional-file metadata checks. Document the interpolation helper
  and its captured-directory behavior.

  Cover CWD changes, main and linked worktrees, bare repositories, missing checkouts,
  index overrides, retained runtime state, idempotence, and failed reconstruction.
  Include a Windows-only test for rejecting unresolved drive-relative index paths
  without partially updating the repository.

• separate linked worktree registration from checkout

  Skipped over the tests, knowing they are very detailed
  can be trusted by now.

  Add Repository::prepare_add_worktree() with consuming checkout and explicit
  persistence. Persisted repositories can run their initial checkout later, even
  after their checkout directory is removed, while failed unpersisted checkouts
  roll back their owned data.

Bug Fixes

• create SHA-256 repositories for object_hash: None in SHA-256-only builds
  Previously a SHA-1 repository was created that the same build couldn't open.
  Now None falls back to the build's default object format.

• respect section trust for filesystem path protections

  GHSA-q54r-jf2p-rfr2 reports that path-protection configuration did not
  respect the section filter used for security-relevant settings. Use the
  filter for core.protectHFS, core.protectNTFS, and
  gitoxide.core.protectWindows, including the latter's early read for the
  reference store. Keep platform defaults and boolean error handling intact.

  Read-only fixtures exercise local and worktree configuration, full and
  reduced trust, custom filters, trusted API overrides, and malformed
  values in strict and lenient mode. Before the fix, reduced-trust settings
  replaced the defaults and a rejected malformed Windows setting prevented
  opening. Validation also exercises representative path names.

  Git baseline: the local Git reference identifies itself as v2.56.GIT.
  Its t/t1014-read-tree-confusing.sh and read-cache.c:verify_path_internal
  cover filesystem-specific path protections. Git's ownership policy in
  setup.c:ensure_valid_ownership rejects dubious ownership, whereas gix
  supports reduced trust by filtering configuration.

• match Git clone reference handling and preserve offline defaults

  The prior CI run failed check-mode because make_clone_refs.sh had a
  shebang without its executable bit. Its ARM32 tests also ran Git 2.47.3,
  which rejects clone --revision; the matrix mistook that unsupported
  option for a clone failure and disagreed with successful gix clones.

  Mark the fixture executable and detect revision support from git clone -h.
  Skip only revision baselines on older Git, retaining all 72 other cases
  and the independent gix revision tests. Modern Git still exercises all
  81 baseline cases. Capture help despite its expected nonzero exit status.

• match Git clone reference handling and preserve offline defaults

  gix clones recorded remote HEAD as a direct object ID, losing the
  branch relationship needed by later fetches and Remote::default_branch().
  Bare clones also used the ordinary remote-tracking layout, while detached
  remote heads and custom destinations selected different references from
  git clone.

  Match Git's clone orchestration and reference selection:

  • Store bare-clone branches in refs/heads/*, without a default persisted
    fetch refspec, tracking HEAD, or branch upstream configuration. Keep
    explicit refspecs persistent and use WithWorktree plus fetch_only()
    for ordinary clones without a checkout.
  • Select the advertised symbolic target or guess a branch matching a
    detached HEAD, preferring init.defaultBranch, then master, then the
    first matching branch by name. Record the selected branch's first mapped
    peer before updating local HEAD, including overwriting a branch named
    HEAD; omit tracking HEAD when the selected target is excluded.
  • Detach and peel tag and revision selections, check out the selected
    HEAD, and align shallow selection, tag policy, initial packed-reference
    reflogs, and persisted revision configuration with Git. Preserve the
    reference directory required for repository discovery.

  Preserve fetch-source identity when deriving an offline default branch.
  Recognize refs/heads/ sources and exact heads/<name> sources, including
  an exact source whose mapping was deduplicated against a glob. Return
  None for sources whose branch cannot be identified offline, count all
  ambiguous mappings, and share reverse mapping with upstream-branch lookup.

  Consult Git's builtin/clone.c and remote.c, and add deterministic
  Git-produced baselines for 27 cases in normal, no-checkout, and bare modes.
  Compare complete references, relevant configuration, reflog IDs, checkout
  contents, shallow boundaries, and success or failure with installed Git.
  Keep source fixtures read-only and read their existing refs through gix.
  Update API docs, CLI help and update printing, and affected clone/fetch tests.

  Known difference: replacing a direct branch named HEAD with the tracking
  symref logs a null old object ID in gix-ref; Git logs the resolved target.
  The baseline test explicitly checks this exception. Replacement-only custom
  refspecs remain a gix extension rather than being compared with Git's
  supplementary clone mappings.

• resolve linked worktree submodules in their private Git directory

  Git stores each linked superproject's submodule repositories under
  .git/worktrees/<id>/modules/<name>, separately from the main worktree's
  .git/modules/<name> repositories. Using common_dir() for
  Submodule::git_dir() could open the main worktree's submodule before
  initialization or after deinitialization of the linked submodule.

  Derive the path from the superproject's git_dir() instead. Preserve name
  validation and the precedence of an existing submodule .git file.

  Cover initial checkout, initialization, and deinitialization using Git to
  populate a disposable linked worktree created by gix. Check that the main
  submodule remains populated and that linked repository state and opening
  follow its own lifecycle.

• honor replacement refs and bypass stale commit graphs

  Enable standard replacement refs by default and honor core.useReplaceRefs
  with the same polarity as Git. The presence of GIT_NO_REPLACE_OBJECTS
  disables them regardless of its value.

  Commit graphs contain original parent links, so skip them while object
  replacements are active, including when a caller forces or supplies a
  cache. Per-handle raw reads can still use the graph. Document the corrected
  opening and graph behavior.

  The regression first failed on the original code, then passed for ordinary
  open/discovery in bare and non-bare repositories, reopening after a graft,
  configuration and environment disablement, explicit raw reads, supplied
  and forced graphs, merge-base, and graph removal. All 503 gix integration
  tests passed; the regression also passed with only revision,sha1 enabled.
  Native rebuilt gix log and tix show match Git across two grafts in both
  repository kinds with pre-existing raw graphs.

Commit Statistics

• 36 commits contributed to the release over the course of 14 calendar days.
• 14 days passed between releases.
• 16 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details

view details

• Uncategorized
  • Merge pull request #​3082 from 10ne1/sha256-ci-fixes (b8ef9ea)
  • Review (6260a55)
  • Remove hard-coded SHA-1 from the Commit::short_id() doctest (75ca154)
  • Create SHA-256 repositories for object_hash: None in SHA-256-only builds (521b3b2)
  • Make SHA-256-only lib tests really SHA-256-only (36aaf51)
  • Merge pull request #​3079 from krlvi/write-exists-check-no-pack-refresh (7a22948)
  • Merge pull request #​3065 from srijs/claude/project-thread-kr3hdl (0a49d46)
  • Don't look for new packs before writing an object (779b6c0)
  • Merge pull request #​3072 from juanibiapina/fix-status-filter-path (86d5fa6)
  • Merge pull request #​3068 from GitoxideLabs/fix-protect-access (38beb4d)
  • Respect section trust for filesystem path protections (7439578)
  • Merge pull request #​3064 from GitoxideLabs/various-improvements (8c513c5)
  • Add Submodule::resolved_url() for cloning (41cb46f)
  • Expose selected global attribute paths (a6f95af)
  • Provide safe interrupt setup and handle SIGHUP (840faa0)
  • Merge pull request #​3066 from GitoxideLabs/check-commit-graph (7540f69)
  • Merge pull request #​3037 from ameyypawar/gix-remote-default-branch (ad0202e)
  • Match Git clone reference handling and preserve offline defaults (1cc509b)
  • Match Git clone reference handling and preserve offline defaults (aa7eaea)
  • Add Remote::default_branch() to learn the default branch of a remote without connecting to it. (2ddcae4)
  • Merge pull request #​3057 from GitoxideLabs/worktree-add-windows (eae2fef)
  • Document and test partial clone checkouts after interruption (31185ff)
  • Merge pull request #​3058 from GitoxideLabs/worktree-improvements (79f3880)
  • Add worktree locking and a lock override that preserves changes (862e9c3)
  • Merge pull request #​3056 from GitoxideLabs/worktree-sparse-checkout (ca9eb08)
  • Merge pull request #​3053 from GitoxideLabs/various-improvements (2d8dcc4)
  • Enable core.longpaths when initializing linked-submodule fixtures (7edbf02)
  • Release gix-error v0.5.1, gix-utils v0.5.1 (6d1b686)
  • Resolve linked worktree submodules in their private Git directory (54234a6)
  • Merge pull request #​3052 from GitoxideLabs/various-improvements (2711f6a)
  • Honor replacement refs and bypass stale commit graphs (1b6d8da)
  • Remove the obsolete max-performance-safe feature (7467af0)
  • Make repository paths absolute without reloading (b94cd79)
  • Separate linked worktree registration from checkout (32a27be)
  • Worktree removal with late writes to both roots (e3b7670)
  • Merge pull request #​3048 from GitoxideLabs/new-release (5fccccf)

v0.89.0: gix v0.89.0

Compare Source

Reverted (BREAKING)

• replace fs with gix-fs

  gix-fs already provides the filesystem helpers and recursive walkers.
  Keeping their duplicate implementation in gix-features adds unnecessary
  filesystem dependencies to the foundational feature crate.

  Remove the fs module and the walkdir and fs-read-dir features. Migrate
  workspace callers to gix_fs, move traversal requests to gix-fs/walkdir,
  and update the manifests, lockfile, traversal documentation, and feature
  check script together.

Changed (BREAKING)

• use gix::Result throughout the public API

  The error migration left public gix methods, iterators, callbacks, and
  configuration validators returning a mixture of exceptions, I/O errors,
  custom error enums, and even the rejected input itself. Callers still had
  to adapt these separately despite the common gix::Error boundary.

  Use the crate-level Result throughout APIs defined by gix, including
  fallible configuration inputs and owned TryFrom implementations. Keep
  underlying causes, classifications, and diagnostic metadata available
  through gix::Error. Configuration adapters accept arbitrary caller errors
  without panicking or losing their causes. Object kind conversions report
  validation errors. Re-exported plumbing APIs and error types required by
  external traits retain their existing contracts.

  Adapt gitoxide-core and gix-tix callers in the same breaking change,
  removing explicit conversions that became identities.

New Features

• remove linked worktrees safely

  Expose safe linked-worktree removal through gix, using the gix-worktree
  removal plumbing. Validate the selected worktree, inspect dirty and locked
  states, and preserve the checkout unless the requested removal policy permits
  deleting it.

  Enable removal through worktree-mutation and report progress and cleanup
  outcomes to callers. Keep branch deletion explicit, adding compare-and-swap
  branch removal for callers that have already inspected a target so concurrent
  branch changes are not lost. Cover porcelain removal behavior and conditional
  branch deletion in disposable repositories.

• add and check out linked worktrees

  Expose Repository::add_worktree() for existing local branches and detached
  commits. Prepare the links, initialize HEAD and its reflog, check out
  the commit, and write the index, rolling back created files on failure or
  interruption.

  Inherit worktree configuration and common attributes before checkout. Enumerate
  the main and linked repositories consistently so additions and branch deletion
  protect branches checked out or reserved by bisect and rebase, while matching
  Git's default namespace behavior.

  Support worktree.useRelativePaths with its repository-format upgrade and
  extensions.relativeWorktrees validation. Compare behavior with Git for
  bare parents, separate Git directories, moved relative links, configuration
  inheritance, invalid destinations, and rollback.

  Format already-registered worktree destinations with Path::display().

Bug Fixes

• honor section trust when merging submodule overrides

  A report describes reduced-trust repository configuration overriding
  submodule settings, including command-valued updates. Apply the repository's
  existing configurable section filter for worktree, index, and HEAD module
  sources, and retain each copied section's origin metadata.

  Keep trusted API overrides usable and restrict module enumeration to the
  original module definitions. The regressions first reproduced both the trust
  bypass and lost provenance, then covered custom filters and every source.

  Git reference: setup.c::ensure_valid_ownership, submodule-config.c, and
  builtin/submodule--helper.c at d38352cd43ab9745686d697872408bc3249a153f
  distinguish shared module definitions from trusted local overrides.

• read the target reflog when a symbolic ref has no log

  Reflog specifications such as refs/symref@{0} failed when the symbolic
  reference had no log of its own, even though its final target had one.

  Follow symbolic references only when their own reflog is absent, retaining
  precedence of an existing log. Reuse the reference-following helper for
  chained references, cycle detection, and missing-ref errors.
  The regression compares indexed and dated queries, chained references,
  and existing-log precedence against isolated Git invocations in a
  disposable repository.

  Git reference: /Users/byron/dev/github.com/git/git,
  refs.c::repo_dwim_log() prefers a reference's own log, then its resolved
  target's log. Runtime comparisons used Git 2.54.0 (Apple Git-157).

• resolve HEAD tracking branches through the current branch

  Repository::rev_parse_single() rejected HEAD@{upstream}, HEAD@{u},
  and HEAD@{push} because it looked for tracking configuration on HEAD
  instead of the currently checked out branch.

  Follow HEAD before looking up tracking configuration, reusing the existing
  symbolic-reference resolution helper and retaining missing-ref errors.
  The regression compares all three tracking aliases with their implicit
  forms and isolated Git invocations in a disposable repository.

  Git reference: /Users/byron/dev/github.com/git/git,
  remote.c::repo_branch_get() treats HEAD as the current branch.
  Runtime comparisons used Git 2.54.0 (Apple Git-157).

• match equivalent Windows paths when removing worktrees
  The Windows fast-test job failed in Tix associated-branch cleanup:
  C:\Users\RUNNER~1\...\topic was reported as not registered even
  though Git had created the worktree. Git can record the long-name path,
  while callers retain a short-name or verbatim path for the same directory.
  The shared-base removal resolver only compared path components after
  symlink resolution, which does not expand Windows short names.

  After the existing component comparison fails on Windows, compare
  canonical paths when both exist. Apply this at the shared equality helper
  used for target selection and backlink validation. Keep the original
  comparison and missing-path behavior so absent or inaccessible checkouts
  can still be unregistered. Add a Windows regression that registers a
  worktree with Git and removes it via its canonical path, and document
  equivalent path selection.

• don't apply the caller's GIT_INDEX_FILE or GIT_WORK_TREE to a new clone

• preserve caller locations in native error adapters

  Passing a #[track_caller] constructor directly to map_err() records
  the FnOnce shim in core as the caller. Use or_error() for native
  error adapters in gix, gix-actor, and gix-config so diagnostics record
  the adapter and use the usual exception formatting, including with
  tree-error.

  Keep Error::from_boxed() inside a closure for boxed trait-object errors,
  which ResultExt does not accept. Add a regression for invalid branch
  merge references and document when constructors still require closures.

• anchor worktree removal paths to the repository CWD

  A repository opened through a relative path retains the CWD that gives its
  paths meaning. Changing the process CWD before worktree removal made exact
  lookup and suffix disambiguation resolve registrations against the wrong
  location. Registration scans, lock checks, and reopening a selected worktree
  also depended on the process CWD.

  Resolve registered checkout paths with repo.current_dir(). Anchor proxy
  private Git directories and reopened common directories to that captured
  CWD, so enumeration, lookup by ID, locks, status, and removal keep using the
  original repository. Keep caller-supplied relative targets relative to the
  current process CWD. Document that proxy paths are now absolute.

  Extend the isolated relative-path removal test with a CWD change and lock
  checks, and cover absolute lookup, ambiguous suffix disambiguation, repository
  inspection, and main-worktree protection from both main and linked handles.
  The new CWD cases failed before the fix.

Commit Statistics

• 30 commits contributed to the release over the course of 13 calendar days.
• 13 days passed between releases.
• 11 commits were understood as conventional.
• 2 unique issues were worked on: #​3039, #​3040

Commit Details

view details

• #​3039
  • Resolve HEAD tracking branches through the current branch (ab83e97)
• #​3040
  • Read the target reflog when a symbolic ref has no log (5146c90)
• Uncategorized
  • Prepare changelogs prior to release (794eeef)
  • Merge pull request #​3042 from cruessler/branch-9 (c2f1925)
  • Merge pull request #​3032 from GitoxideLabs/sec-audit (1d7bac7)
  • Honor section trust when merging submodule overrides (c860df3)
  • Replace fs with gix-fs (cf1ba49)
  • Merge pull request #​3046 from GitoxideLabs/gix-error-optional-bstr (9272d45)
  • Merge pull request #​3047 from GitoxideLabs/revparse-fixes (49885cd)
  • Merge pull request #​2938 from GitoxideLabs/tix-improvements (ac6e89f)
  • Match equivalent Windows paths when removing worktrees (9289a4c)
  • Merge pull request #​3033 from GitoxideLabs/gix-cli-progress-cleanup (80f4b03)
  • Merge pull request #​3035 from any-victor/fix/clone-ignores-caller-repository-env (d2d078f)
  • Review (95043b9)
  • Don't apply the caller's GIT_INDEX_FILE or GIT_WORK_TREE to a new clone (90bdb18)
  • Merge pull request #​3022 from GitoxideLabs/release-testtools (f819565)
  • Use existing error helpers for guards and conversions (1c25831)
  • Preserve caller locations in native error adapters (6723b31)
  • Merge pull request #​3029 from cruessler/fix-minor-sha-256-issues-in-cli (6c12f2d)
  • Remove outdated note saying SHA-256 is not fully supported (20b201b)
  • Use gix::Result throughout the public API (9a5777e)
  • Merge pull request #​3025 from GitoxideLabs/worktree-create (acf906f)
  • Anchor worktree removal paths to the repository CWD (fe2018f)
  • Remove linked worktrees safely (a5e4378)
  • Merge pull request #​3026 from GitoxideLabs/status-fix (3f6fcda)
  • Merge pull request #​3027 from cruessler/remove-sha-1-default-in-pipeline (06b0098)
  • Merge pull request #​2977 from GitoxideLabs/worktree-create (d9f7c85)
  • Fixup! feat(gix): add and check out linked worktrees (ed1f6dd)
  • Add and check out linked worktrees (eec2e3a)
  • Merge pull request #​3020 from GitoxideLabs/report-september (5fb3dcf)

v0.88.0: gix v0.88.0

Compare Source

Bug Fixes (BREAKING)

• preserve causes across fallible conversions

  Rubber stamp, looked at diff. This is a cleanup commit.
  There is going to be considerable cleanup done later as well.

  Parsers and adapters discarded encoding, integer, date, signature, and
  object-access failures when replacing them with context. Preserve their
  concrete causes so classification and downcasting keep working after
  conversion to gix::Error or an I/O error.

  Return Exn from fallible path, command-line, gitdir, and pack-entry
  conversions where necessary, and adapt their consumers in the same change.
  Packed-ref and reflog errors retain their parser sources and input details;
  reflog recovery reports the actual recovery failure. Loose-object verification
  now propagates lookup and enumeration failures instead of treating every
  lookup error as retryable or silently skipping failed enumeration.

  Remove unnecessary UTF-8 conversions for ASCII suffixes and check span bounds
  before narrowing. Parsers that only return () explicitly destructure it.
  No production map_err() closure still discards a wildcard-bound error.
  Also preserve causes in formatting-only CLI and commit-graph adapters, where
  stringification previously lost checksum corruption classifications.

• locate vi/vim in Git's core directory on Windows; change Repository::editor() -> Option<gix_command::Prepare>

  On Windows, Git's bundled vi may not be available through PATH. Resolve the
  default editor in Git's core directory first and retain the bare command as
  fallback.

New Features (BREAKING)

• return the local branches actually deleted

  Callers that needed to know whether branch deletion removed anything had
  to look up each reference separately. That duplicated reference reads and
  could report stale existence information by the time deletion took its
  locks.

  Return sorted, deduplicated full names from the committed reference edits
  whose previous values were observed under lock. Missing branches are
  excluded while their stale local configuration is still removed. Expose
  the same list as deleted in delete::Error::Cleanup so callers can recover
  it when only configuration cleanup fails; retain references as the full
  requested batch.

  The success value changes from () to Vec<FullName>, and Cleanup gains
  a deleted field. Strengthen the existing tests for loose, packed, dangling
  symbolic, duplicate, missing, empty, and linked-worktree branch requests.

Changed (BREAKING)

• remove redundant error aliases

  rubberstamp

  The crate-by-crate migration retained operation-specific error aliases to
  limit downstream churn. With the migration complete, those names only hide
  the shared error types and keep otherwise empty API namespaces alive.

  Use the underlying gix_error types directly throughout the workspace,
  including indirect aliases, renamed exports, test helpers, and the URL fuzz
  target. Remove namespaces and files that only held forwarding aliases, and
  update documentation and migration guidance to use the canonical types.
  Adjust the source locations recorded in error snapshots after deleting the
  alias declarations.

  Keep gix::{Error, Exn} and gix::error as the central facade, along with
  unrenamed canonical re-exports, required associated types, concrete errors,
  and aliases that add structure. Preserve each Exn parameter, conditional
  error alternative, error message, and source chain. Include all downstream
  adaptations in this breaking change so the stack remains buildable.

• consolidate public API failures under gix::Error

  rubberstamp

• raise MSRV to Rust 1.88

  The newly published dua-core 3.3 release used by linked-worktree removal
  requires Rust 1.88, so raise every workspace crate and the advertised badge
  together.

  Keep the MSRV checks buildable by selecting the latest sysinfo and rusqlite
  release lines that support Rust 1.88.

New Features

• add Repository::config_path()

  Callers with a repository currently have to select local and worktree
  configuration paths themselves before falling back to gix::config_path().
  Expose that selection on Repository, using its common directory for
  Source::Local, its Git directory for Source::Worktree, and its opening
  options with the existing resolver for global sources.

  Keep the worktree path available even when extensions.worktreeConfig is
  disabled, so callers can locate and prepare that physical file. Preserve
  the existing errors for disabled sources and sources without a file.

  Git reference: builtin/config.c and Documentation/git-config.adoc in
  the local Git checkout at 1630431f326e15fcde608827b5ff38422528eb59.
  The executable baseline was Git 2.50.1 (Apple Git-155).

• expose standalone configuration paths with config_path()

  Callers need to locate a configuration file before starting a
  config_mut() transaction so they can inspect it, prepare its parent
  directory, or load it themselves.

  Extract the existing path selection into gix::config_path(source, options) and use it from config_mut(). Preserve source and environment
  permissions, explicit path overrides, and current-directory anchoring.
  Path lookup succeeds without existing parent directories or valid
  configuration contents, and does not acquire a transaction lock or
  evaluate transaction settings.

  Git reference: v2.55.0-782-g1630431f32, config.c functions
  git_system_config() and git_global_config_paths(), plus the global and
  system override tests in t/t1300-config.sh. The shared resolver retains
  the existing source-specific path and override behavior.

• add standalone config_mut() transactions

  Callers can load global configuration with gix::config(), but editing
  one physical file previously required a repository. Add a sibling that
  accepts config::Source and open::Options and returns the existing
  config::FileTransaction.

  Share source-path resolution and core.configLockTimeout parsing with
  configuration loading and repository transactions. Honor source and
  environment permissions, preserve source metadata, and keep physical
  edits lossless without persisting includes or runtime overrides.
  Global files use normal filesystem permissions; missing files can be
  created on commit when their parent directory already exists.

• allow presetting system configuration paths

  Callers that already know the Git-installation and system configuration files
  can now provide both paths through gix::open::Options. The paths flow through
  repository opening and standalone configuration loading, while the existing
  source permissions continue to decide whether each file is read.

  Preset paths replace path discovery, but must not bypass Git's explicit
  GIT_CONFIG_NOSYSTEM switch. Read the permitted environment value once before
  selecting Git-installation and system sources, preserving the behavior already
  implemented by gix_config::Source::storage_location().

• add worktreeProxy::is_prunable() + fix

  Expose worktree::Proxy::is_prunable() with Git-compatible semantics: locked
  worktrees are retained, while unreadable gitdir files and missing checkout
  targets are prunable. Treat any filesystem entry at locked as a lock,
  including symlinks.

  When opening a proxy as a repository, use the common directory already known
  by its parent instead of relying on the linked worktree’s optional commondir
  file. This prevents incomplete administration from being mistaken for a
  standalone repository and keeps HEAD access routed through the repository ref
  store for backend compatibility.

  Fetch can consequently inspect linked-worktree heads without failing for missing
  checkouts, locks, or missing and malformed commondir files.

• edit physical configuration files atomically with Repository::config_file_mut()

  Add Repository::config_file_mut() as a transaction over one physical
  configuration file. It acquires a symlink-aware lock before reading, parses
  without expanding includes, preserves formatting and existing permissions, and
  resolves relative paths against the opening CWD.

  Lock acquisition honors the discoverable core.configLockTimeout key
  with Git-compatible parsing and a 1000 ms default. New files also honor
  core.sharedRepository after the process umask, including named, boolean,
  compatibility, and explicit octal modes.

  Committing only writes the file atomically. Repository state changes through
  an explicit full reload, which retains normal Git-compatible validation and
  rebuilds include- and bootstrap-dependent state without a second partial-refresh
  path.

• add Repository::committer_or_set_fallback()

  Applications that configure gitoxide.committer.*Fallback unconditionally can
  override a complete user.* identity because these keys resolve first.

  Add Repository::committer_or_set_fallback() so callers can provide a
  last-resort identity without changing normal configured-user behavior. Keep the
  generic helper as a wrapper, and document and test the precedence.

Bug Fixes

• propagate failed fetch ancestry checks
  Looked at this in detail to understand how error handling improvements
  were made. It all makes sense, and teaches me to... not ignore or
  skip over errors, ever, it's basically a bug unless there is a test
  that proves it's not a bug.

  Fetch ref updates discarded commit decoding and traversal setup errors,
  treating any such failure as permission to force the update. A malformed
  local or remote commit could therefore overwrite a ref without a force
  refspec. Traversal errors were also ignored when looking for the ancestor.

  Propagate those failures with their original causes and context. Check
  object kinds explicitly to retain the existing behavior for non-commit
  targets without mistaking corruption for an object-kind mismatch.

• Keep rust workspace tests inside disposable repositories and isolated environments

  Direct Git launches inherited repository selectors and user configuration even
  when tests supplied a fixture working directory. Tests of default-environment
  APIs and local Git transports also shared the runner's environment. A few
  journey tests wrote beneath source directories or used the source checkout as
  the repository under test.

  Use the shared gix-testtools Git command builder for subprocess setup, isolated
  repository options for fixtures, and isolated child processes where the real
  environment-reading API must be exercised. Scope CWD changes, copy the fixture
  used by an object-write test, and run shell journeys through jtt run. Keep
  journey worktrees and example output within their disposable sandboxes and
  replace the attributes checkout test with a representative fixture repository.
  Prompt examples also run in isolated children and must build successfully; the
  old tests could ignore build failures and execute stale cached binaries.

  The affected Rust crate suites, internal test-tool build, and max-pure journey
  suite pass from a source copy without Git metadata. Signing and Git-daemon
  checks use only disposable keys, repositories, and local sockets.

• find bundled signature programs on Windows

  Git for Windows makes its bundled gpg, gpgsm, and ssh-keygen available
  by prepending installation directories to PATH. Gitoxide can run outside that
  prepared environment, so bare defaults may not resolve.

  Use gix_path::env::installation_program() for unconfigured defaults on Windows
  and retain the bare name as fallback. Explicit configuration and non-Windows
  behavior stay unchanged.

• interpolate signature verifier program paths
  Git treats gpg.*.program values as pathnames and expands a leading tilde
  before launching the verifier. Signing already did this, but verification kept
  the raw configured string, which fails with direct program invocation.

  Resolve OpenPGP, X.509, and SSH verifier programs through the existing
  trusted-path handling while preserving defaults and the legacy gpg.program
  fallback.

• normalize safe-directory paths before trust checks

  Windows canonicalization can produce verbatim paths with a \\?\ prefix while
  included configuration metadata uses an ordinary drive path. Comparing those
  representations directly prevents an explicitly safe config file from being
  promoted to full trust, including after repository reloads.

  Canonicalize both the path under test and configured safe-directory paths
  through the filesystem before exact or wildcard comparison. Retain the existing
  lexical realpath fallback for missing paths.

• make identity fallbacks true last-resort values

  gitoxide.{author,committer}.*Fallback shared its configuration slot with the
  corresponding environment overrides. This placed application fallbacks before
  user.*, while also placing GIT_{AUTHOR,COMMITTER}_* after role-specific
  configuration.

  Store environment overrides under author.* and committer.*, then resolve
  explicit fallback keys only after user.*. This matches Git precedence and lets
  applications configure fallbacks without replacing a valid user identity.

Commit Statistics

• 49 commits contributed to the release over the course of 31 calendar days.
• 32 days passed between releases.
• 19 commits were understood as conventional.
• 1 unique issue was worked on: #​2959

Commit Details

view details

• #​2959
  • Add worktreeProxy::is_prunable() + fix (0af2f91)
• Uncategorized
  • Merge pull request #​2847 from GitoxideLabs/gix-error-completion (6356013)
  • Preserve causes across fallible conversions (dcf08a4)
  • Propagate failed fetch ancestry checks (0b2a5c4)
  • Add error context without preliminary erasure (9d0329a)
  • Use implicit error conversion at gix API boundaries (ba2c7f2)
  • Use borrowed error inspection throughout the workspace (daf73b5)
  • Remove redundant error aliases (2176245)
  • Consolidate public API failures under gix::Error (b1e31eb)
  • Merge pull request #​3004 from GitoxideLabs/gix-notes-example (a5e8c4d)
  • Add the notes benchmark as a gix Cargo example (2bab44c)
  • Merge pull request #​2989 from GitoxideLabs/error-conversion-review (4b9ff51)
  • Merge pull request #​2996 from GitoxideLabs/credential-helper-non-interactive (2fb9b8a)
  • Merge pull request #​2990 from GitoxideLabs/various-improvements (c609062)
  • Keep rust workspace tests inside disposable repositories and isolated environments (4e0f8ff)
  • Merge pull request #​2992 from GitoxideLabs/fix-message-newline (4f29e0c)
  • Merge pull request #​2984 from justonemorenight/fix/config-path-tilde-parity (92b6508)
  • Auto-review (2742f05)
  • Merge pull request #​2979 from GitoxideLabs/absent-objects-info-dir-fix (dfc8e8c)
  • Merge pull request #​2975 from GitoxideLabs/repo-config-path (283937b)
  • Add Repository::config_path() (76502a0)
  • Merge pull request #​2974 from GitoxideLabs/global-config-path (be7bb02)
  • Expose standalone configuration paths with config_path() (707818c)
  • Merge pull request #​2971 from GitoxideLabs/diff-nullid-fix (d7551f1)
  • Return the local branches actually deleted (3b60097)
  • Add standalone config_mut() transactions (18ac842)
  • Merge pull request #​2970 from GitoxideLabs/better-reftable-error (6b2f33d)
  • Merge pull request #​2963 from GitoxideLabs/gix-notes-perf (4a870be)
  • Merge pull request #​2964 from GitoxideLabs/error-conversion-review (36b6310)
  • Allow presetting system configuration paths (653c002)
  • Merge pull request #​2960 from GitoxideLabs/fetch-in-linked-wt (87727ee)
  • Merge pull request #​2958 from GitoxideLabs/sign-on-windows (c16300c)
  • Find bundled signature programs on Windows (3c45a7d)
  • Merge pull request #​2957 from GitoxideLabs/sign-on-windows (b7bedcf)
  • Interpolate signature verifier program paths (ec63505)
  • Merge pull request #​2949 from GitoxideLabs/error-conversion-review (a095334)
  • Raise MSRV to Rust 1.88 (4b42e0c)
  • Merge pull request #​2929 from GitoxideLabs/config-refresh (b14028d)
  • Normalize safe-directory paths before trust checks (c48fe1e)
  • Edit physical configuration files atomically with Repository::config_file_mut() (913f631)
  • Merge pull request #​2955 from GitoxideLabs/transport-url-encoding (7e35849)
  • Release gix-path v0.12.6, gix-error v0.3.2, gix-command v0.10.1, gix-transport v0.59.2 ([888677a](https://redirect.github.com/GitoxideLab

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🎉 This PR is included in version 1.0.8 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀