chore(deps): bump gix to 0.83.0 and fix 8 security advisories by daviddahl · Pull Request #1388 · open-telemetry/weaver

daviddahl · 2026-04-24T21:43:29Z

Summary

Bump gix from 0.81.0 to 0.83.0 in weaver_common and xtask
Fix 8 security advisories by updating vulnerable transitive dependencies
Work around a gix 0.82.0+ regression affecting shallow clone with tag refspecs
Remove gix's dependency on winnow (replaced with hand-implemented parsers in 0.83.0)

Security Fixes

Package	Before	After	Advisories Fixed	Severity
`aws-lc-sys`	0.37.0	0.40.0	RUSTSEC-2026-{0044,0045,0046,0047,0048}	5x High
`rustls-webpki`	0.103.9	0.103.13	RUSTSEC-2026-0104	High
`quinn-proto`	0.11.13	0.11.14	RUSTSEC-2026-0037	High
`time`	0.3.46	0.3.47	RUSTSEC-2026-0009	Moderate

All security updates are semver-compatible patch/minor bumps with no API changes — only Cargo.lock is affected.

gix 0.82.0+ Shallow Clone Workaround

gix 0.82.0 (via gix-protocol 0.60.0) introduced stricter refspec validation that causes shallow clone + tag refspec to fail. This bug persists in gix 0.83.0. The root cause is in clone/fetch/mod.rs line 119:

Some(Category::LocalBranch.to_full_name(ref_name.as_ref().as_bstr())?)

When a tag name like v1.26.0 is passed as a refspec, Category::LocalBranch converts it to refs/heads/v1.26.0, which doesn't match refs/tags/v1.26.0 on the remote. The new is_missing_required_mapping() validation in gix-protocol 0.60.0+ then rejects the fetch.

Workaround: Skip shallow clone when a specific refspec is provided (since it may be a tag). Non-refspec clones still use shallow clone for performance.

This is the same bug causing CI failures on #1392 and #1393.

Upstream issue: GitoxideLabs/gitoxide#2544

Why 0.83.0 instead of 0.82.0

gix 0.83.0 removes gix's dependency on winnow (replaced with hand-implemented parsers), which resolves multi-version winnow dependency conflicts that were blocking downstream projects like otel-arrow (see #1393).

Testing

cargo build passes for all workspace crates
cargo test --workspace --exclude weaver passes with 0 failures (613+ tests)

- Bump gix from 0.81.0 to 0.82.0 in weaver_common and xtask - Work around gix 0.82.0 regression where shallow clone + tag refspec fails (gix assumes ref is a branch, breaking tags) - Update aws-lc-sys 0.37.0 -> 0.40.0 (fixes RUSTSEC-2026-{0044..0048}) - Update rustls-webpki 0.103.9 -> 0.103.13 (fixes RUSTSEC-2026-0104) - Update quinn-proto 0.11.13 -> 0.11.14 (fixes RUSTSEC-2026-0037) - Update time 0.3.46 -> 0.3.47 (fixes RUSTSEC-2026-0009)

Copilot

Pull request overview

Updates Git-related dependencies and lockfile to address reported RustSec advisories, and adjusts weaver_common’s Git clone behavior to work around a gix 0.82.0 shallow-clone regression when a refspec may be a tag.

Changes:

Bump gix to 0.82.0 in weaver_common and xtask.
Update Cargo.lock to pick up patched transitive dependencies (security advisories).
Modify Git clone flow to skip shallow clone when a refspec is provided.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
crates/xtask/Cargo.toml	Bumps `gix` to 0.82.0 for xtask tooling.
crates/weaver_common/Cargo.toml	Bumps `gix` to 0.82.0 for core library usage.
crates/weaver_common/src/vdir.rs	Workaround: avoid shallow clone when a refspec is provided to prevent tag-related failures.
Cargo.lock	Updates resolved dependency graph to incorporate patched versions addressing advisories.

Comments suppressed due to low confidence (1)

crates/weaver_common/src/vdir.rs:444

The variable name prepare is used for the PrepareFetch builder and then re-used (shadowed) later in let (mut prepare, _outcome) = fetch.fetch_then_checkout(...), which makes this flow harder to follow. Consider renaming one of them (e.g., prepare_fetch for the builder or checkout/worktree for the post-fetch value) to avoid shadowing and improve readability.

        let prepare = PrepareFetch::new(
            url,
            tmp_path.clone(),
            Kind::WithWorktree,
            create::Options {
                destination_must_be_empty: true,
                fs_capabilities: None,
            },
            if is_git_credentials_enabled() {
                open::Options::default()
            } else {
                open::Options::isolated()
            },
        )
        .map_err(|e| GitError {
            repo_url: url.to_owned(),
            message: e.to_string(),
        })?;

        let mut fetch = if refspec.is_none() {
            prepare.with_shallow(Shallow::DepthAtRemote(
                NonZeroU32::new(1).expect("1 is not zero"),
            ))
        } else {
            prepare
        }
        .with_ref_name(refspec.as_ref())
        .map_err(|e| GitError {
            repo_url: url.to_owned(),
            message: e.to_string(),
        })?;

        let (mut prepare, _outcome) = fetch
            .fetch_then_checkout(progress::Discard, &AtomicBool::new(false))
            .map_err(|e| GitError {

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Removes gix's dependency on winnow (replaced with hand-implemented parsers in gix 0.83.0), resolving multi-version winnow conflicts. The shallow clone + tag refspec workaround from the previous commit is still needed as this bug persists in 0.83.0.

Replace placeholder TODO with actual issue URL: GitoxideLabs/gitoxide#2554

lquerel

LGTM. Thank you David.

@jsuereth @jerbly @lmolkova I asked David, who works on my team, to take a look at the security issues (+gix issue). I approved this PR, but I'd prefer to get an approval from one of you as well, so we can follow best practices.

codecov · 2026-04-28T23:36:14Z

Codecov Report

❌ Patch coverage is 50.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.0%. Comparing base (13adab8) to head (04a5d13).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
crates/weaver_common/src/vdir.rs	50.0%	2 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##            main   #1388     +/-   ##
=======================================
- Coverage   82.0%   82.0%   -0.1%     
=======================================
  Files        118     118             
  Lines       9895    9897      +2     
=======================================
- Hits        8120    8119      -1     
- Misses      1775    1778      +3

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

jsuereth · 2026-04-29T12:56:34Z

+        })?;
+
+        let mut fetch = if refspec.is_none() {
+            prepare.with_shallow(Shallow::DepthAtRemote(


Just a note - there is ZERO actual test coverage on this branch - which means we need to manually check git ref support.

Copilot AI review requested due to automatic review settings April 24, 2026 21:43

daviddahl requested a review from a team as a code owner April 24, 2026 21:43

Copilot started reviewing on behalf of daviddahl April 24, 2026 21:43 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Comment thread crates/weaver_common/src/vdir.rs

albertlockett mentioned this pull request Apr 27, 2026

Update weaver crates to v0.23.0 open-telemetry/otel-arrow#2761

Closed

1 task

daviddahl and others added 2 commits April 28, 2026 14:28

Merge branch 'main' into bump-gix-0.82.0

e149dad

daviddahl changed the title ~~chore(deps): bump gix to 0.82.0 and fix 8 security advisories~~ chore(deps): bump gix to 0.83.0 and fix 8 security advisories Apr 28, 2026

daviddahl mentioned this pull request Apr 28, 2026

Shallow clone with tag refspec fails: Category::LocalBranch assumes ref is a branch GitoxideLabs/gitoxide#2554

Closed

chore: update TODO with upstream gix issue link

04a5d13

Replace placeholder TODO with actual issue URL: GitoxideLabs/gitoxide#2554

lquerel approved these changes Apr 28, 2026

View reviewed changes

jsuereth approved these changes Apr 29, 2026

View reviewed changes

jsuereth reviewed Apr 29, 2026

View reviewed changes

jsuereth merged commit 0e42ef2 into open-telemetry:main Apr 29, 2026
26 of 27 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump gix to 0.83.0 and fix 8 security advisories#1388

chore(deps): bump gix to 0.83.0 and fix 8 security advisories#1388
jsuereth merged 4 commits into
open-telemetry:mainfrom
daviddahl:bump-gix-0.82.0

daviddahl commented Apr 24, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

lquerel left a comment

Uh oh!

codecov Bot commented Apr 28, 2026 •

edited

Loading

Uh oh!

jsuereth Apr 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

daviddahl commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Security Fixes

gix 0.82.0+ Shallow Clone Workaround

Why 0.83.0 instead of 0.82.0

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

lquerel left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jsuereth Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

daviddahl commented Apr 24, 2026 •

edited

Loading

codecov Bot commented Apr 28, 2026 •

edited

Loading