This update for gitoxide fixes the following issues:
Changes in gitoxide:
Update to version 0.60.0:
* BREAKING: remove the full-screen progress mode: the --progress
and --progress-keep-open flags and the prodash-render-tui
feature are gone, line progress stays the only progress UI
* Trace output is now independently configurable with a bounded
-t/--trace counter, separate from verbose and progress rendering
* Add gix worktree add (alias create) and worktree remove
* Various security improvements and more consistent error
handling across the plumbing crates
- Refresh the vendored dependencies. The linked graph still
This update for gitoxide fixes the following issues:
Changes in gitoxide:
- CVE-2026-91986: gix-transport CR/LF/NUL injection into
git-daemon connect request via crafted git URL path,
allowing virtual-host spoofing (boo#1281749)
This update for gitoxide fixes the following issues:
Changes in gitoxide:
- Update to 0.56.0:
* Fixes CVE-2026-40034 (boo#1266434): the CommandForbiddenInModules
trust check could be bypassed in gix_submodule::File::update(),
which allowed arbitrary command execution from a crafted
.gitmodules file
* Fixes a submodule name validation bypass that allowed traversal
out of .git/modules and disclosure of credentials
* Fixes symlinked .gitmodules files being followed and parsed from
outside the repository
* Fixes several denial-of-service vectors in gix-pack: unchecked
indexing panics and uncapped allocations from