{"id":"openSUSE-SU-2026:22126-1","summary":"Security update for gitoxide","details":"This update for gitoxide fixes the following issues:\n\nChanges in gitoxide:\n\nUpdate to version 0.60.0:\n\n  * BREAKING: remove the full-screen progress mode: the --progress\n    and --progress-keep-open flags and the prodash-render-tui\n    feature are gone, line progress stays the only progress UI\n  * Trace output is now independently configurable with a bounded\n    -t/--trace counter, separate from verbose and progress rendering\n  * Add gix worktree add (alias create) and worktree remove\n  * Various security improvements and more consistent error\n    handling across the plumbing crates\n- Refresh the vendored dependencies. The linked graph still carries\n  MPL-2.0 only (uluru, option-ext); the License tag is unchanged.\n\n- Restore the explicit prodash feature dropped in the gix-utils 0.5.0 dep:\n  migration, which broke workspace-wide cargo metadata --features as\n  run by cargo-auditable.\n\nUpdate to version 0.59.0:\n\n  * Ships gix-transport 0.60.0, which rejects NUL/LF in\n    git-daemon connect requests: drops the backported fix\n    for CVE-2026-91986 (boo#1281749), now fixed upstream\n    * gix-transport-reject-control-bytes.patch\n  * New gix editor command with Git-compatible selection\n  * Raise the Rust floor to 1.88 (upstream MSRV, dua-core)\n\n- Refresh the vendored dependencies. The linked graph\n  still carries MPL-2.0 only (uluru, option-ext); the\n  License tag is unchanged.\n\nUpdate to 0.58.0:\n\n  * gix tix is now the full gix-tix platform embedded in the plumbing\n    command instead of a second parser and dispatcher, so standalone\n    and plumbing invocations behave alike and amend and spill are\n    reachable through gix tix\n  * tix decorates commits checked out by other main or linked\n    worktrees with light-blue name@ labels, keeps the marker for the\n    checkout it was opened from, and watches linked HEAD and worktree\n    membership so the decorations stay current\n  * tix gained -w/--worktrees to add every resolved worktree HEAD to\n    the traversal tips without weakening hidden-revision exclusions\n  * gix tix no longer accepts --screen: the interactive history always\n    owns the alternate screen, so the automatic and half-screen modes\n    were removed\n\n- Refresh the vendored dependencies. The linked graph gains a second\n  MPL-2.0 crate, option-ext, reached through the directories and\n  dirs-sys crates that gix-tix newly depends on; the License tag\n  already covers MPL-2.0 and is unchanged.\n\nUpdate to 0.57.0:\n\n  * Add gix clone --revision, and PrepareFetch::with_revision(), for\n    cloning a single revision named by a full ref, HEAD or a full\n    object id: HEAD is detached to the fetched commit, no ordinary\n    refs are created, no fetch refspec is persisted and tag\n    following is disabled\n  * Fix a panic when a full object id was passed to with_ref_name(),\n    which produced an object-id refspec mapping that clone expected\n    to be named\n  * Rewrite relative date parsing to follow git: several count and\n    unit pairs are applied in input order, as in \"2 days 3 hours\n    ago\", counts may be spelled out, any non-alphanumeric byte\n    separates the parts, the trailing \"ago\" is optional, and a\n    leading \"@\" may introduce a timestamp. Month and year steps now\n    walk the calendar fields, so a day past the end of the shorter\n    target month rolls over into the following month\n  * gix commit verify now checks signatures through the library\n    rather than spawning gpg itself, so the configured gpg program\n    is honoured and an invalid or untrusted signature is reported\n    as such\n  * Fix the conflict stage labels printed by gix revision explain,\n    which called stage 0 \"base\"; they are now unconflicted, base,\n    ours and theirs\n  * Reject a TREE index extension whose child entry counts overflow\n    instead of wrapping while verifying them\n  * Replace the jwalk directory walker with dua-core\n- Refresh the vendored dependencies. The licence set is unchanged:\n  re-derived over the new vendor tree, uluru (MPL-2.0) is still the\n  only copyleft crate linked into the binaries, and the new dua-core\n  dependency is MIT.\n","modified":"2026-10-20T19:15:04.884738287Z","published":"2026-10-19T16:29:07Z","related":["CVE-2026-91986"],"upstream":["CVE-2026-91986"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281749"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-91986"}],"affected":[{"package":{"name":"gitoxide","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/gitoxide&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.0-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"gitoxide":"0.60.0-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22126-1.json"}}],"schema_version":"1.9.0"}