Skip to content

build(deps): bump gix from 0.87.1 to 0.88.0 in /engine - #16

Closed
dependabot[bot] wants to merge 10 commits into
mainfrom
dependabot/cargo/engine/gix-0.88.0
Closed

dependabot[bot] wants to merge 10 commits into
mainfrom
dependabot/cargo/engine/gix-0.88.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 3, 2026 •

Copy link
Copy Markdown

Bumps gix from 0.87.1 to 0.88.0.

Release notes

Sourced from gix's releases.

gix v0.88.0

Bug Fixes (BREAKING)

  • preserve causes across fallible conversions

    Rubber stamp, looked at diff. This is a cleanup commit. There is going to be considerable cleanup done later as well.

    Parsers and adapters discarded encoding, integer, date, signature, and object-access failures when replacing them with context. Preserve their concrete causes so classification and downcasting keep working after conversion to gix::Error or an I/O error.

    Return Exn from fallible path, command-line, gitdir, and pack-entry conversions where necessary, and adapt their consumers in the same change. Packed-ref and reflog errors retain their parser sources and input details; reflog recovery reports the actual recovery failure. Loose-object verification now propagates lookup and enumeration failures instead of treating every lookup error as retryable or silently skipping failed enumeration.

    Remove unnecessary UTF-8 conversions for ASCII suffixes and check span bounds before narrowing. Parsers that only return () explicitly destructure it. No production map_err() closure still discards a wildcard-bound error. Also preserve causes in formatting-only CLI and commit-graph adapters, where stringification previously lost checksum corruption classifications.

  • locate vi/vim in Git's core directory on Windows; change Repository::editor() -> Option<gix_command::Prepare>

    On Windows, Git's bundled vi may not be available through PATH. Resolve the default editor in Git's core directory first and retain the bare command as fallback.

New Features (BREAKING)

  • return the local branches actually deleted

    Callers that needed to know whether branch deletion removed anything had to look up each reference separately. That duplicated reference reads and could report stale existence information by the time deletion took its locks.

    Return sorted, deduplicated full names from the committed reference edits whose previous values were observed under lock. Missing branches are excluded while their stale local configuration is still removed. Expose the same list as deleted in delete::Error::Cleanup so callers can recover it when only configuration cleanup fails; retain references as the full requested batch.

    The success value changes from () to Vec<FullName>, and Cleanup gains

... (truncated)

Commits
  • 37860b3 Release gix-error v0.4.0, gix-date v0.17.0, gix-actor v0.43.0, gix-trace v0.2...
  • 7f69d07 chore: add cargo smart-release incantation to justfile
  • e11a4c2 report proofing
  • 9f1a6cc report September 2026
  • 591380a Merge pull request #3019 from GitoxideLabs/mailmap-perf
  • b9b3d42 chore(gix-mailmap): modernize integration test layout
  • 4163b89 fix(gix-mailmap): build snapshots without quadratic insertion
  • 6356013 Merge pull request #2847 from GitoxideLabs/gix-error-completion
  • da0f21d change(gix-error)!: unify diagnostics as Message and preserve causes
  • f79ab74 Exclude Rust tests and examples from CodeQL analysis
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependabot Bot and others added 10 commits October 3, 2026 20:34
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.0.0 to 8.0.1.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4.0.0...v8.0.1)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4.0.0...v7.0.1)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/cache](https://github.com/actions/cache) from 4.2.0 to 6.1.0.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v4.2.0...v6.1.0)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…g both ref fills

`loadCommits` was the one read the engine lost: 12.9 ms against the CLI's
10.8 ms on a 1,036-commit repository, even though the engine call itself
took 7.1 ms. The gap was two sequential `for-each-ref` spawns running
after it (16.5d3/d5), putting back two fields the engine's types did not
carry. Same defect as the repoInfo one fixed in 9fe6599, one layer down,
so the same fix: teach the engine the field, delete the fill.

`GitTagRef` and `GitCommitTag` gain `signed`. `refs.rs` reads it from the
tag object it was already peeling, and records it on both records of an
annotated tag, since the signature belongs to the tag rather than to
either hash. `find_header` settles the object kind first, so a
lightweight tag costs a header lookup, not a commit read.

The semantics were checked against git rather than assumed:
`%(contents:signature)` is non-empty only for a signed annotated tag
object. A lightweight tag over a genuinely signed commit (`%G?` = `G`)
reports unsigned, and the engine matches by construction.

`read_remote_refs` now resolves symbolic refs instead of dropping them,
which is what `%(objectname)` reports for the `refs/remotes/<remote>/HEAD`
every clone writes.

Verified on a clone carrying all four tag shapes and a symbolic
origin/HEAD: engine and CLI ref labels identical with the engine serving
the read, and the engine path down from 2 git spawns to 0 (the CLI uses
3). loadCommits 300: 11.5 ms CLI vs 7.7 ms engine, 0.8x -> 1.5x; view
load 4.4x. Two tests pin it, each mutation-checked to kill only its own.
The signed-tag fixture writes the tag object by hand, so CI needs no
keyring.

Also fixes a defaults drift found while answering why `initialLoadCommits`
is 300: `loadMoreCommits` is 100 in the manifest and README but fell back
to 75 in config.ts, with the test pinning the wrong value. It never fired
in a real install, since VS Code returns the manifest default for an unset
key. The 300 itself is left alone and documented as inherited from
upstream — the git read and the graph layout do not justify it, but DOM
row insertion was not measured and is the one cost that still could.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
… at 300

The first page is the latency-critical one and stays at 300. The
follow-on page goes from 100 to 1000, which is the better trade for how
the table is actually rendered.

`renderTable` builds one HTML string over every loaded commit and assigns
it to `innerHTML`, so each "load more" rebuilds the whole table rather
than appending to it. Reaching 3,000 commits therefore costs about 27
growing rebuilds at a step of 100 and about 3 at a step of 1,000 - a
larger step is strictly less total work, not more. It also matters more
than it looks, because `autoLoadMoreCommitsOnScroll` fires whenever the
viewport comes within 96px of the bottom, so the small step stalls
repeatedly during ordinary scrolling rather than only on a click.

Measured through the webview harness, a full rebuild is 921 ms at 1,000
rows and 2,783 ms at 2,000. Those are jsdom figures and are not browser
figures - jsdom parses HTML far more slowly and does no layout or paint -
but they establish that the rebuild is at least linear in total rows with
a constant that is not small. The engine-side read is negligible by
comparison: 13.6 ms for 1,000 commits.

The real fix is to append new rows instead of regenerating the table,
making a page nearly free; that is a separate change to `renderTable` and
is recorded in the knowledge base rather than attempted here.

Manifest, accessor, README and the config test are set together, since
that table mirrors the manifest by hand and had already drifted once.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Replaces the 300/1000 set in 9751c15 at the maintainer's direction. The
reasoning there is unchanged - `renderTable` rebuilds the whole table on
every load, so a larger step is strictly less total work, and
`autoLoadMoreCommitsOnScroll` makes the small step stall repeatedly
during ordinary scrolling - only the two numbers move.

250 trims the latency-critical first paint slightly. 750 keeps the
follow-on page well clear of the old 100 while sitting below the 1,000
the render figures were taken at, which is the conservative direction
given those figures are jsdom's and not a browser's.

Manifest, accessor, README and the config test move together, since that
table mirrors the manifest by hand and had already drifted once.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…'s escaping

Slice 16.7 declined `search_history` because the engine's search and this
project's search answer different questions: a regex over messages across
every ref, against a literal substring search plus author matching, hash
resolution, ref filters and a position for each hit. The decline was
right; the conclusion that search therefore stays on four `git`
processes was not. The engine gains `search_commits`, which reproduces
these semantics. `search_history` stays where it is, unused.

The CLI runs `--fixed-strings --grep`, `--author`, a hash lookup and one
unbounded walk that numbers every commit, then merges by that numbering.
The numbering is also a filter - a hit with no position is dropped, which
is why a hash resolving to an unreachable commit is not a result. The
engine does the same three matches in a single walk, which is where the
speed comes from: 62.0 ms -> 7.8 ms (7.9x) on a 1,036-commit repository.

Pinned at the boundaries the two would disagree on - eight parity cases
and twelve engine-side tests: a literal dot a regex would widen, a query
that is not valid regex, case folding, a body-only term `--grep` reaches
and `%s` does not show, an author-only match, an abbreviated hash, a hash
that resolves but is unreachable, and a `--glob=` pattern that still
declines to the CLI.

The parity table then failed on the CLI side, which is the point of
having one. `searchCommits` escaped its `--author` query with a
JavaScript-style `escapeRegExp`, but `--author` takes a *basic* regular
expression, where `\(` opens a group rather than escaping a parenthesis.
The escaping inverted the meaning, and since the four runs share a
`Promise.all`, any query containing an unbalanced `(` or `[` failed the
whole Find dialogue with `fatal: header, '\(': Unmatched ( or \(`.
`--fixed-strings` expresses the literal match that was always intended,
and still matches name and email substrings ignoring case - verified
against git before changing anything.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…pping regex

Five exports whose consumers a permanent non-goal blocks forever, not
merely functions nothing calls today. `search_history` was superseded by
`search_commits` in the previous commit. `current_branch_name`,
`current_branch_upstream`, `remote_names` and `load_commit_subject` are
all read inside `kind: "action"` write flows, and "every write stays on
`runGitRaw`" is the first entry in the permanent non-goals - so none of
them had a reachable future.

This is worth doing rather than leaving alone because a `#[napi]`
function is an exported symbol, so it is a linker root and LTO cannot
strip it: a dead export is genuinely carried in every shipped binary.
`search_history` was also the only consumer of the `regex` crate, which
goes with it.

  before  6,183,072 bytes
  after   4,814,416 bytes
  saving  1,368,656 (22.1%) per platform, ~10.4 MB across all eight

Their `api::Engine` methods went too, along with the now-orphaned
`GitHistoryMatch`, `SEARCH_LIMIT` and `collapse_whitespace`, and their
tests. `Repo::remote_names` is a different function and stays -
`graph.rs` needs it for `load_commits`. The bare-repository test keeps
its object-read coverage and is renamed for what it now proves; the
`Engine` smoke test reads the checked-out branch from `info.head`.

TypeScript loses `currentBranchName`, which was declared on `EngineAddon`
*and* in the `isEngineAddon` load-time guard - it could have rejected a
good engine binary over a method nothing called.

The 13 exports still unwired are kept and inventoried in the knowledge
base with what each would serve, including `author_stats` and
`activity_heatmap`, which the maintainer intends to wire for a Statistics
tab. That slice has no CLI counterpart, so it is a deliberate exception
to the two-backends-agree rule and is recorded as one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bumps [gix](https://github.com/GitoxideLabs/gitoxide) from 0.87.1 to 0.88.0.
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-v0.87.1...gix-v0.88.0)

---
updated-dependencies:
- dependency-name: gix
  dependency-version: 0.88.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 3, 2026

Copy link
Copy Markdown
Author

Looks like gix is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 3, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/engine/gix-0.88.0 branch October 3, 2026 18:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant