Update Rust crate gix-commitgraph to 0.39

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
gix-commitgraph	dependencies	minor	0.34 → 0.39
gix-commitgraph	dev-dependencies	minor	0.34 → 0.39

---

Release Notes

GitoxideLabs/gitoxide (gix-commitgraph)

v0.39.0

Compare Source

New Features

• add gix merge commit --debug
  This yields additional debugging information with details about detected conflicts.
• add gix merge commits
• add gix merge tree to merge trees similarly to git merge-tree.

Commit Statistics

• 9 commits contributed to the release over the course of 21 calendar days.
• 33 days passed between releases.
• 3 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details

view details

• Uncategorized
  • Merge pull request #​1661 from GitoxideLabs/merge (0b7abfb)
  • Add gix merge commit --debug (0a5993f)
  • Merge pull request #​1658 from GitoxideLabs/merge (905e5b4)
  • Add gix merge commits (4a5afc7)
  • Merge pull request #​1651 from GitoxideLabs/merge (a876533)
  • Adapt to changes in gix (8d590f3)
  • Merge pull request #​1618 from GitoxideLabs/merge (3fb989b)
  • Add gix merge tree to merge trees similarly to git merge-tree. (84707c2)
  • Support for merge related options in config tree (80e006b)

v0.38.0

Compare Source

New Features

• support for listing worktrees with gix worktree list

• add first 'debug' version of gix diff tree.
  It's primarily meant to better understand gix blame.

• add new gix cat command.
  It only prints things without fuzz.

  Inspired by https://youtu.be/JYH5ILv5g1g?si=bHLBPFJiZyRUTl6u&t=211.

• add gix merge-file with similar features as git merge-file

• gix merge-base for the CLI
  For now it only supports the standard merge-base, but more derivatives
  can be added easily on demand.

Bug Fixes

• Adjust gix clean warning and help for worktree fix
• Clarify -r/--repositories and --skip-hidden-repositories
  This adds information to the help text for the git clean options
  -r/--repositories and --skip-hidden-repositories to make it
  clearer what their relationship is, avoid creating the false
  impression that repositories are never deleted in the absence of
  -r/--repositories, and note that --skip-hidden-repositories
  is sometimes needed to preserve not only separate repositories but
  the (probably rarer) case of hidden nested worktrees of the current
  repository.

Commit Statistics

• 28 commits contributed to the release over the course of 89 calendar days.
• 91 days passed between releases.
• 9 commits were understood as conventional.
• 1 unique issue was worked on: #​1572

Commit Details

view details

• #​1572
  • Make clear what gix commit-graph is (49bca2a)
• Uncategorized
  • Merge pull request #​1639 from cruessler/respect-env-variables (48aa74b)
  • Respect env variables when running gix (0bebe52)
  • Merge pull request #​1626 from cruessler/add-gix-diff (f186c23)
  • Some minor modifications (6777ecb)
  • Add first 'debug' version of gix diff tree. (0c554e0)
  • Merge pull request #​1616 from Byron/git-cat (31bdd2e)
  • Add new gix cat command. (9c8bc03)
  • Merge pull request #​1611 from Byron/merge (5ffccd2)
  • Add gix merge-file with similar features as git merge-file (3da2da9)
  • Add all keys for merge-configuration (e0b09d2)
  • Merge pull request #​1566 from Byron/merge (d69c617)
  • Merge pull request #​1557 from Byron/merge-base (649f588)
  • gix merge-base for the CLI (7249291)
  • Allow empty-docs (beba720)
  • Merge pull request #​1546 from nyurik/semilocons (f992fb7)
  • Add missing semicolons (ec69c88)
  • Merge pull request #​1537 from EliahKagan/progress-style (472fe5f)
  • Unify style in config support info (786bfec)
  • Merge pull request #​1531 from EliahKagan/progress-typos (25a3f1b)
  • Fix typos in config support info (b31d6b7)
  • Merge branch 'ag/jiff' (5871fb1)
  • Switch from time to jiff (28ac657)
  • Merge pull request #​1471 from EliahKagan/hidden (a9aac4f)
  • Adjust gix clean warning and help for worktree fix (6eb4ea6)
  • Clarify -r/--repositories and --skip-hidden-repositories (c241422)
  • Merge branch 'fix-clean' (33eacfb)
  • Support for listing worktrees with gix worktree list (c7213bc)

v0.37.1: gix-features v0.37.1

Compare Source

Chore

• change rust-version manifest field back to 1.65.
  They didn't actually need to be higher to work, and changing them
  unecessarily can break downstream CI.

  Let's keep this value as low as possible, and only increase it when
  more recent features are actually used.

Commit Statistics

• 2 commits contributed to the release.
• 1 commit was understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details

view details

• Uncategorized
  • Merge branch 'msrv' (8c492d7)
  • Change rust-version manifest field back to 1.65. (3bd09ef)

v0.37.0

Compare Source

New Features

• add mailmap check similar to git check-mailmap.
  That way it becomes a little easier to maybe try out other special cases
  in the wild.
• gix clone with --ref support.
  --ref is similar to --branch, but was renamed as it also supports
  tags for example.

Commit Statistics

• 13 commits contributed to the release.
• 62 days passed between releases.
• 3 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Thanks Clippy

Clippy helped 1 time to make code idiomatic.

Commit Details

view details

• Uncategorized
  • Merge branch 'fix-mailmap' (f107014)
  • Add descriptive docs for mailmap check (3e08fa3)
  • Add mailmap check similar to git check-mailmap. (2a56387)
  • Merge branch 'main' into config-key-take-2 (9fa1054)
  • Merge branch 'feat/checkout-other-refs' (ecfde07)
  • gix clone with --ref support. (9bf01e4)
  • Merge branch 'status' (2f9f0ac)
  • Thanks clippy (acc1331)
  • Merge pull request #​1384 from NobodyXu/feat/easier-to-compile-gix-as-dynlib (bb30e52)
  • Fix clippy warning (bf5a111)
  • Fix compilation error in src/plumbing/main.rs (4596a39)
  • Fix compilation errors (0b5dc74)
  • Make it easier to compile gitoxide as dynlib (202f3e4)

v0.36.0

Compare Source

New Features

• checkout respects options for core.protectHFS and core.protectNTFS.
  This also adds gitoxide.core.protectWindows as a way to enforce
  additional restrictions that are usually only available on Windows.

  Note that core.protectNFS is always enabled by default, just like
  it is in Git.

Bug Fixes

• more robustness in the face of a trampling-herd of threads loading a single index.
  The motivating example is here: praetorian-inc/noseyparker#179

  Previously, it was possible for a trampling herd of threads to consolidate the
  disk state. Most of them would be 'needs-init' threads which could notice that
  the initialization already happened, and just use that.

  But a thread might be late for the party and somehow manages to not get any
  newly loaded index, and thus tries to consolidate with what's on disk again.
  Then it would again determine no change, and return nothing, causing the caller
  to abort and not find objects it should find because it wouldn't see the index
  that it should have seen.

  The reason the thread got into this mess is that the 'is-load-ongoing' flagging
  was racy itself, so it would not wait for ongoing loads and just conclude nothing
  happened. An extra delay (by yielding) now assures it either seees the loading state
  and waits for it, sees the newly loaded indices.

  Note that this issue can be reproduced with:

  './target/release/gix -r repo-with-one-pack -t10 --trace odb stats --extra-header-lookup'
  

Commit Statistics

• 6 commits contributed to the release over the course of 10 calendar days.
• 39 days passed between releases.
• 2 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details

view details

• Uncategorized
  • Merge branch 'various-fixes' (d6cd449)
  • Merge pull request from GHSA-7w47-3wg8-547c (79dce79)
  • Checkout respects options for core.protectHFS and core.protectNTFS. (886d6b5)
  • Mark safety-related core-flags as planned (f3d5a69)
  • Merge branch 'status' (04ef31e)
  • More robustness in the face of a trampling-herd of threads loading a single index. (addf446)

v0.35.0

Compare Source

New Features

• add gix status --ignored support

• add gix status --index-worktree-renames
  This enables rename-tracking between worktree and index, something
  that Git also doesn't do or doesn't do by default.
  It is, however, available in git2.

• gix status with submodule and rewrite support.
  Submodule changes are now picked up as long as the submodule is
  in the index.
  Further, it's possible to enable rename-tracking between
  index and worktree separately.

• add gix is-clean|is-changed
  It's a good way to compare the time it takes to run a full status
  compared to a quick is-dirty check.

• gix submodules list --dirty-suffix for dirty-information
  This is a submodule-centric and greatly simplified way of obtaining
  describe information with dirty-suffix.

  Note that status information is also possible, but it seems
  hard to display nicely, which this command isn't great at
  in the first place.

• add gix commit describe --dirty-suffix
  That way a suffix will be added depending on the dirty-state of the repository.

Commit Statistics

• 11 commits contributed to the release.
• 6 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details

view details

• Uncategorized
  • Merge pull request #​1341 from szepeviktor/typos (55f379b)
  • Fix typos (f72ecce)
  • Merge branch 'status' (3e5c974)
  • Add gix status --format to communicate the current format is very simple. (23bea36)
  • Add gix status --ignored support (84c74ff)
  • Add gix status --index-worktree-renames (66e87cd)
  • Fix lints for nightly, and clippy (f8ce3d0)
  • gix status with submodule and rewrite support. (61c002b)
  • Add gix is-clean|is-changed (98b3680)
  • gix submodules list --dirty-suffix for dirty-information (afd20ca)
  • Add gix commit describe --dirty-suffix (58231b4)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[greptile-apps]

PR author is in the excluded authors list.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5e5f2ef2d7

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Regenerate standalone lockfiles for scanner-git consumers

scanner-git is also built from two independent workspaces with their own lockfiles, and both still pin the old crate version: tools/eval-harness/Cargo.lock:599-607 and crates/scanner-git/fuzz/Cargo.lock:376-384 both resolve gix-commitgraph 0.34.0. Because .github/workflows/ci.yml:419-445 and .github/workflows/ci.yml:480-520 run Cargo from those directories, they do not consume the root Cargo.lock; local runs there will keep testing 0.34 until the lockfiles are regenerated, and CI will have to mutate the checked-in lockfiles on the fly. This leaves the dependency update only partially applied.

Useful? React with 👍 / 👎.

[kilo-code-bot]

CRITICAL: gix-commitgraph 0.35 no longer matches the crate's gix-hash pin

scanner-git still depends on gix-hash = { version = "0.22", ... }, but gix-commitgraph 0.35 resolves gix-hash 0.23 and exposes that type in Graph::commit_by_id. crates/scanner-git/src/synthetic_ref.rs:358-360 currently passes a 0.22 gix_hash::ObjectId into that API, so this branch stops compiling until scanner-git is bumped to gix-hash 0.23 too or the commitgraph bump stays on 0.34.

[kilo-code-bot]

Code Review Summary

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

CRITICAL

File	Line	Issue
crates/scanner-git/Cargo.toml	28	gix-commitgraph 0.37 resolves gix-hash 0.25.1, but scanner-git still depends on gix-hash 0.22.1; synthetic_ref.rs builds a 0.22 ObjectId and passes it to Graph::commit_by_id, which expects the commitgraph crate's 0.25 ObjectId.

Fix these issues in Kilo Cloud

Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File	Line	Issue
tools/eval-harness/Cargo.lock	593	Standalone lockfiles under tools/eval-harness and crates/scanner-git/fuzz still pin gix-commitgraph 0.34.0, so --locked checks for those independent workspaces do not validate the 0.37 dependency graph.

Files Reviewed (3 files)

• Cargo.lock - 0 issues
• crates/scanner-engine-integration-tests/Cargo.toml - 0 issues
• crates/scanner-git/Cargo.toml - 1 issue

---

_{Reviewed by gpt-5.5-2026-04-23 · 793,489 tokens}