CVE-2026-91986

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and logs.

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and logs.

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and logs.

These are all security issues fixed in the gitoxide-0.58.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the openai-codex-0.158.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the stgit-2.7.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for gitoxide fixes the following issues:

Changes in gitoxide:

• CVE-2026-91986: gix-transport CR/LF/NUL injection into git-daemon connect request via crafted git URL path, allowing virtual-host spoofing (boo#1281749)

This update for gitoxide fixes the following issues:

Changes in gitoxide:

Update to version 0.60.0:

• BREAKING: remove the full-screen progress mode: the --progress and --progress-keep-open flags and the prodash-render-tui feature are gone, line progress stays the only progress UI
• Trace output is now independently configurable with a bounded -t/--trace counter, separate from verbose and progress rendering
• Add gix worktree add (alias create) and worktree remove
• Various security improvements and more consistent error handling across the plumbing crates

• Refresh the vendored dependencies. The linked graph still carries MPL-2.0 only (uluru, option-ext); the License tag is unchanged.

• Restore the explicit prodash feature dropped in the gix-utils 0.5.0 dep: migration, which broke workspace-wide cargo metadata --features as run by cargo-auditable.

Update to version 0.59.0:

• Ships gix-transport 0.60.0, which rejects NUL/LF in git-daemon connect requests: drops the backported fix for CVE-2026-91986 (boo#1281749), now fixed upstream
  • gix-transport-reject-control-bytes.patch
• New gix editor command with Git-compatible selection
• Raise the Rust floor to 1.88 (upstream MSRV, dua-core)

• Refresh the vendored dependencies. The linked graph still carries MPL-2.0 only (uluru, option-ext); the License tag is unchanged.

Update to 0.58.0:

• gix tix is now the full gix-tix platform embedded in the plumbing command instead of a second parser and dispatcher, so standalone and plumbing invocations behave alike and amend and spill are reachable through gix tix
• tix decorates commits checked out by other main or linked worktrees with light-blue name@ labels, keeps the marker for the checkout it was opened from, and watches linked HEAD and worktree membership so the decorations stay current
• tix gained -w/--worktrees to add every resolved worktree HEAD to the traversal tips without weakening hidden-revision exclusions
• gix tix no longer accepts --screen: the interactive history always owns the alternate screen, so the automatic and half-screen modes were removed

• Refresh the vendored dependencies. The linked graph gains a second MPL-2.0 crate, option-ext, reached through the directories and dirs-sys crates that gix-tix newly depends on; the License tag already covers MPL-2.0 and is unchanged.

Update to 0.57.0:

• Add gix clone --revision, and PrepareFetch::with_revision(), for cloning a single revision named by a full ref, HEAD or a full object id: HEAD is detached to the fetched commit, no ordinary refs are created, no fetch refspec is persisted and tag following is disabled
• Fix a panic when a full object id was passed to with_ref_name(), which produced an object-id refspec mapping that clone expected to be named
• Rewrite relative date parsing to follow git: several count and unit pairs are applied in input order, as in "2 days 3 hours ago", counts may be spelled out, any non-alphanumeric byte separates the parts, the trailing "ago" is optional, and a leading "@" may introduce a timestamp. Month and year steps now walk the calendar fields, so a day past the end of the shorter target month rolls over into the following month
• gix commit verify now checks signatures through the library rather than spawning gpg itself, so the configured gpg program is honoured and an invalid or untrusted signature is reported as such
• Fix the conflict stage labels printed by gix revision explain, which called stage 0 "base"; they are now unconflicted, base, ours and theirs
• Reject a TREE index extension whose child entry counts overflow instead of wrapping while verifying them
• Replace the jwalk directory walker with dua-core

• Refresh the vendored dependencies. The licence set is unchanged: re-derived over the new vendor tree, uluru (MPL-2.0) is…

This update for stgit fixes the following issues:

Changes in stgit:

• Update to version 2.7.0:
  • Allow unambiguous command shorthands, opt-in with stgit.infer-commands.
  • Accept git approxidate spellings for dates, e.g. "2 days ago" and "@<epoch>"; relative dates are now anchored in the local time zone.
  • Run git mergetool for stg push with stgit.autoimerge.
  • Reject "@" as a branch name for stg branch --create.
  • Bump gix to 0.89 and MSRV to 1.88.
  • CVE-2026-91986: gix-transport CR/LF/NUL injection into git-daemon connect request via crafted git URL path (boo#1281742).
  • CVE-2026-109349, CVE-2026-109350, CVE-2026-109351: gix-pack denial of service via pack version 3 header, ofs-delta base distance and pack header object count (boo#1285176).