GitoxideLabs/gitoxide gix-v0.88.0

gix v0.88.0

on GitHub

Bug Fixes (BREAKING)

• preserve causes across fallible conversions

  Rubber stamp, looked at diff. This is a cleanup commit.
  There is going to be considerable cleanup done later as well.

  Parsers and adapters discarded encoding, integer, date, signature, and
  object-access failures when replacing them with context. Preserve their
  concrete causes so classification and downcasting keep working after
  conversion to gix::Error or an I/O error.

  Return Exn from fallible path, command-line, gitdir, and pack-entry
  conversions where necessary, and adapt their consumers in the same change.
  Packed-ref and reflog errors retain their parser sources and input details;
  reflog recovery reports the actual recovery failure. Loose-object verification
  now propagates lookup and enumeration failures instead of treating every
  lookup error as retryable or silently skipping failed enumeration.

  Remove unnecessary UTF-8 conversions for ASCII suffixes and check span bounds
  before narrowing. Parsers that only return () explicitly destructure it.
  No production map_err() closure still discards a wildcard-bound error.
  Also preserve causes in formatting-only CLI and commit-graph adapters, where
  stringification previously lost checksum corruption classifications.

• locate vi/vim in Git's core directory on Windows; change Repository::editor() -> Option<gix_command::Prepare>

  On Windows, Git's bundled vi may not be available through PATH. Resolve the
  default editor in Git's core directory first and retain the bare command as
  fallback.

New Features (BREAKING)

• return the local branches actually deleted

  Callers that needed to know whether branch deletion removed anything had
  to look up each reference separately. That duplicated reference reads and
  could report stale existence information by the time deletion took its
  locks.

  Return sorted, deduplicated full names from the committed reference edits
  whose previous values were observed under lock. Missing branches are
  excluded while their stale local configuration is still removed. Expose
  the same list as deleted in delete::Error::Cleanup so callers can recover
  it when only configuration cleanup fails; retain references as the full
  requested batch.

  The success value changes from () to Vec<FullName>, and Cleanup gains
  a deleted field. Strengthen the existing tests for loose, packed, dangling
  symbolic, duplicate, missing, empty, and linked-worktree branch requests.

Changed (BREAKING)

• remove redundant error aliases

  rubberstamp

  The crate-by-crate migration retained operation-specific error aliases to
  limit downstream churn. With the migration complete, those names only hide
  the shared error types and keep otherwise empty API namespaces alive.

  Use the underlying gix_error types directly throughout the workspace,
  including indirect aliases, renamed exports, test helpers, and the URL fuzz
  target. Remove namespaces and files that only held forwarding aliases, and
  update documentation and migration guidance to use the canonical types.
  Adjust the source locations recorded in error snapshots after deleting the
  alias declarations.

  Keep gix::{Error, Exn} and gix::error as the central facade, along with
  unrenamed canonical re-exports, required associated types, concrete errors,
  and aliases that add structure. Preserve each Exn parameter, conditional
  error alternative, error message, and source chain. Include all downstream
  adaptations in this breaking change so the stack remains buildable.

• consolidate public API failures under gix::Error

  rubberstamp

• raise MSRV to Rust 1.88

  The newly published dua-core 3.3 release used by linked-worktree removal
  requires Rust 1.88, so raise every workspace crate and the advertised badge
  together.

  Keep the MSRV checks buildable by selecting the latest sysinfo and rusqlite
  release lines that support Rust 1.88.

New Features

• add Repository::config_path()

  Callers with a repository currently have to select local and worktree
  configuration paths themselves before falling back to gix::config_path().
  Expose that selection on Repository, using its common directory for
  Source::Local, its Git directory for Source::Worktree, and its opening
  options with the existing resolver for global sources.

  Keep the worktree path available even when extensions.worktreeConfig is
  disabled, so callers can locate and prepare that physical file. Preserve
  the existing errors for disabled sources and sources without a file.

  Git reference: builtin/config.c and Documentation/git-config.adoc in
  the local Git checkout at 1630431f326e15fcde608827b5ff38422528eb59.
  The executable baseline was Git 2.50.1 (Apple Git-155).

• expose standalone configuration paths with config_path()

  Callers need to locate a configuration file before starting a
  config_mut() transaction so they can inspect it, prepare its parent
  directory, or load it themselves.

  Extract the existing path selection into gix::config_path(source, options) and use it from config_mut(). Preserve source and environment
  permissions, explicit path overrides, and current-directory anchoring.
  Path lookup succeeds without existing parent directories or valid
  configuration contents, and does not acquire a transaction lock or
  evaluate transaction settings.

  Git reference: v2.55.0-782-g1630431f32, config.c functions
  git_system_config() and git_global_config_paths(), plus the global and
  system override tests in t/t1300-config.sh. The shared resolver retains
  the existing source-specific path and override behavior.

• add standalone config_mut() transactions

  Callers can load global configuration with gix::config(), but editing
  one physical file previously required a repository. Add a sibling that
  accepts config::Source and open::Options and returns the existing
  config::FileTransaction.

  Share source-path resolution and core.configLockTimeout parsing with
  configuration loading and repository transactions. Honor source and
  environment permissions, preserve source metadata, and keep physical
  edits lossless without persisting includes or runtime overrides.
  Global files use normal filesystem permissions; missing files can be
  created on commit when their parent directory already exists.

• allow presetting system configuration paths

  Callers that already know the Git-installation and system configuration files
  can now provide both paths through gix::open::Options. The paths flow through
  repository opening and standalone configuration loading, while the existing
  source permissions continue to decide whether each file is read.

  Preset paths replace path discovery, but must not bypass Git's explicit
  GIT_CONFIG_NOSYSTEM switch. Read the permitted environment value once before
  selecting Git-installation and system sources, preserving the behavior already
  implemented by gix_config::Source::storage_location().

• add worktreeProxy::is_prunable() + fix

  Expose worktree::Proxy::is_prunable() with Git-compatible semantics: locked
  worktrees are retained, while unreadable gitdir files and missing checkout
  targets are prunable. Treat any filesystem entry at locked as a lock,
  including symlinks.

  When opening a proxy as a repository, use the common directory already known
  by its parent instead of relying on the linked worktree’s optional commondir
  file. This prevents incomplete administration from being mistaken for a
  standalone repository and keeps HEAD access routed through the repository ref
  store for backend compatibility.

  Fetch can consequently inspect linked-worktree heads without failing for missing
  checkouts, locks, or missing and malformed commondir files.

• edit physical configuration files atomically with Repository::config_file_mut()

  Add Repository::config_file_mut() as a transaction over one physical
  configuration file. It acquires a symlink-aware lock before reading, parses
  without expanding includes, preserves formatting and existing permissions, and
  resolves relative paths against the opening CWD.

  Lock acquisition honors the discoverable core.configLockTimeout key
  with Git-compatible parsing and a 1000 ms default. New files also honor
  core.sharedRepository after the process umask, including named, boolean,
  compatibility, and explicit octal modes.

  Committing only writes the file atomically. Repository state changes through
  an explicit full reload, which retains normal Git-compatible validation and
  rebuilds include- and bootstrap-dependent state without a second partial-refresh
  path.

• add Repository::committer_or_set_fallback()

  Applications that configure gitoxide.committer.*Fallback unconditionally can
  override a complete user.* identity because these keys resolve first.

  Add Repository::committer_or_set_fallback() so callers can provide a
  last-resort identity without changing normal configured-user behavior. Keep the
  generic helper as a wrapper, and document and test the precedence.

Bug Fixes

• propagate failed fetch ancestry checks
  Looked at this in detail to understand how error handling improvements
  were made. It all makes sense, and teaches me to... not ignore or
  skip over errors, ever, it's basically a bug unless there is a test
  that proves it's not a bug.

  Fetch ref updates discarded commit decoding and traversal setup errors,
  treating any such failure as permission to force the update. A malformed
  local or remote commit could therefore overwrite a ref without a force
  refspec. Traversal errors were also ignored when looking for the ancestor.

  Propagate those failures with their original causes and context. Check
  object kinds explicitly to retain the existing behavior for non-commit
  targets without mistaking corruption for an object-kind mismatch.

• Keep rust workspace tests inside disposable repositories and isolated environments

  Direct Git launches inherited repository selectors and user configuration even
  when tests supplied a fixture working directory. Tests of default-environment
  APIs and local Git transports also shared the runner's environment. A few
  journey tests wrote beneath source directories or used the source checkout as
  the repository under test.

  Use the shared gix-testtools Git command builder for subprocess setup, isolated
  repository options for fixtures, and isolated child processes where the real
  environment-reading API must be exercised. Scope CWD changes, copy the fixture
  used by an object-write test, and run shell journeys through jtt run. Keep
  journey worktrees and example output within their disposable sandboxes and
  replace the attributes checkout test with a representative fixture repository.
  Prompt examples also run in isolated children and must build successfully; the
  old tests could ignore build failures and execute stale cached binaries.

  The affected Rust crate suites, internal test-tool build, and max-pure journey
  suite pass from a source copy without Git metadata. Signing and Git-daemon
  checks use only disposable keys, repositories, and local sockets.

• find bundled signature programs on Windows

  Git for Windows makes its bundled gpg, gpgsm, and ssh-keygen available
  by prepending installation directories to PATH. Gitoxide can run outside that
  prepared environment, so bare defaults may not resolve.

  Use gix_path::env::installation_program() for unconfigured defaults on Windows
  and retain the bare name as fallback. Explicit configuration and non-Windows
  behavior stay unchanged.

• interpolate signature verifier program paths
  Git treats gpg.*.program values as pathnames and expands a leading tilde
  before launching the verifier. Signing already did this, but verification kept
  the raw configured string, which fails with direct program invocation.

  Resolve OpenPGP, X.509, and SSH verifier programs through the existing
  trusted-path handling while preserving defaults and the legacy gpg.program
  fallback.

• normalize safe-directory paths before trust checks

  Windows canonicalization can produce verbatim paths with a \\?\ prefix while
  included configuration metadata uses an ordinary drive path. Comparing those
  representations directly prevents an explicitly safe config file from being
  promoted to full trust, including after repository reloads.

  Canonicalize both the path under test and configured safe-directory paths
  through the filesystem before exact or wildcard comparison. Retain the existing
  lexical realpath fallback for missing paths.

• make identity fallbacks true last-resort values

  gitoxide.{author,committer}.*Fallback shared its configuration slot with the
  corresponding environment overrides. This placed application fallbacks before
  user.*, while also placing GIT_{AUTHOR,COMMITTER}_* after role-specific
  configuration.

  Store environment overrides under author.* and committer.*, then resolve
  explicit fallback keys only after user.*. This matches Git precedence and lets
  applications configure fallbacks without replacing a valid user identity.

Commit Statistics

• 49 commits contributed to the release over the course of 31 calendar days.
• 32 days passed between releases.
• 19 commits were understood as conventional.
• 1 unique issue was worked on: #2959

Commit Details