GitoxideLabs/gitoxide gix-hash-v0.27.0

gix-hash v0.27.0

on GitHub

Bug Fixes

• require patched faster-hex for hex conversions

  Port 8523d62 to fix
  RUSTSEC-2026-0306. The safe hex_decode_unchecked() API in
  faster-hex 0.10.0 can read beyond short input on the AVX2 path; the
  0.10.1 backport fixes it without an API migration.

  Require the patched version in gix-hash and gix-packetline, preserving
  this branch's thiserror dependency in the latter, and update Cargo.lock.

  Clear the remaining Cargo deny warnings by upgrading yanked chacha20
  0.10.1 to 0.10.2, dropping the obsolete RUSTSEC-2024-0436,
  RUSTSEC-2026-0118, and RUSTSEC-2026-0119 ignores, and removing the
  unused OpenSSL license allowance. Keep the applicable async-std ignore.

Performance

• upgrade sha1dc to 0.1.2
  sha1dc 0.1.2 speeds up the collision check: recompression now uses the
  SHA-1 hardware instructions where available, and the filter for known
  disturbance vectors got cheaper. The minimum version is raised so
  dependents of gix-hash pick it up too.
• use sha1dc for sha-1 object ids
  Swaps the SHA-1 backend of gix-hash to
  sha1dc, which detects the same
  collision attacks but uses native sha-1 and vector instructions where
  available.

Changed (BREAKING)

• migrate errors to gix-error

• raise MSRV to Rust 1.88

  The newly published dua-core 3.3 release used by linked-worktree removal
  requires Rust 1.88, so raise every workspace crate and the advertised badge
  together.

  Keep the MSRV checks buildable by selecting the latest sysinfo and rusqlite
  release lines that support Rust 1.88.

Commit Statistics

• 13 commits contributed to the release over the course of 32 calendar days.
• 33 days passed between releases.
• 5 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details