Release gix-packetline v0.21.5

Author: Byron

Cargo.lock

@@ -28,7 +28,7 @@ gix-command = { version = "^0.9.1", path = "../gix-command" }
 gix-quote = { version = "^0.7.2", path = "../gix-quote" }
 gix-utils = { version = "^0.3.3", path = "../gix-utils" }
 gix-path = { version = "^0.12.1", path = "../gix-path" }
-gix-packetline = { version = "^0.21.4", path = "../gix-packetline", features = ["blocking-io"] }
+gix-packetline = { version = "^0.21.5", path = "../gix-packetline", features = ["blocking-io"] }
 gix-attributes = { version = "^0.33.1", path = "../gix-attributes" }
 
 encoding_rs = "0.8.32"

gix-filter/Cargo.toml

@@ -5,13 +5,51 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.21.5 (2026-06-16)
+
+### Bug Fixes
+
+ - <csr-id-4bef04ae8a261634200b3a6faabdd77e25aeb8c1/> avoid packetline panic on empty sideband payload
+   GHSA-2vh6-hw4j-32ww reports that gix-packetline can panic when side-band
+   progress or error packets contain only the band designator and no payload. The
+   same unchecked indexing pattern also existed in PacketLineRef::decode_band() for
+   direct empty side-band data.
+   
+   Git baseline: git.git sideband.c demultiplex_sideband() handles side-band
+   records by checking the received length before using the band designator,
+   reports missing designators as protocol errors, and permits progress/error
+   payload handling without assuming non-empty text.
+
+### Commit Statistics
+
+<csr-read-only-do-not-edit/>
+
+ - 5 commits contributed to the release over the course of 20 calendar days.
+ - 20 days passed between releases.
+ - 1 commit was understood as [conventional](https://www.conventionalcommits.org).
+ - 0 issues like '(#ID)' were seen in commit messages
+
+### Commit Details
+
+<csr-read-only-do-not-edit/>
+
+<details><summary>view details</summary>
+
+ * **Uncategorized**
+    - Refactor tests ([`34e6eb5`](https://github.com/GitoxideLabs/gitoxide/commit/34e6eb57999b0e188fa09cc1d5702cbe3be151d5))
+    - Avoid packetline panic on empty sideband payload ([`4bef04a`](https://github.com/GitoxideLabs/gitoxide/commit/4bef04ae8a261634200b3a6faabdd77e25aeb8c1))
+    - Merge pull request #2635 from GitoxideLabs/dependabot/cargo/cargo-7b971a5e8c ([`155ff6d`](https://github.com/GitoxideLabs/gitoxide/commit/155ff6d345ba49ff72cb25c08a8b9dfae8c41bc7))
+    - Bump the cargo group with 40 updates ([`9402adc`](https://github.com/GitoxideLabs/gitoxide/commit/9402adc4c854f72906392a157b848a0ff36900a2))
+    - Merge pull request #2618 from GitoxideLabs/report ([`f7d4f33`](https://github.com/GitoxideLabs/gitoxide/commit/f7d4f33b58503996ae90497b69ce4c3a757982ac))
+</details>
+
 ## 0.21.4 (2026-05-26)
 
 ### Commit Statistics
 
 <csr-read-only-do-not-edit/>
 
- - 5 commits contributed to the release over the course of 30 calendar days.
+ - 6 commits contributed to the release over the course of 30 calendar days.
  - 31 days passed between releases.
  - 0 commits were understood as [conventional](https://www.conventionalcommits.org).
  - 0 issues like '(#ID)' were seen in commit messages
@@ -23,6 +61,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 <details><summary>view details</summary>
 
  * **Uncategorized**
+    - Release gix-error v0.2.4, gix-date v0.15.4, gix-actor v0.41.1, gix-trace v0.1.20, gix-validate v0.11.2, gix-path v0.12.1, gix-utils v0.3.3, gix-features v0.48.1, gix-hash v0.25.1, gix-hashtable v0.15.1, gix-object v0.61.0, gix-glob v0.26.1, gix-quote v0.7.2, gix-attributes v0.33.1, gix-command v0.9.1, gix-packetline v0.21.4, gix-filter v0.31.0, gix-fs v0.21.2, gix-chunk v0.7.2, gix-commitgraph v0.37.1, gix-revwalk v0.32.0, gix-traverse v0.58.0, gix-worktree-stream v0.33.0, gix-archive v0.33.0, gix-bitmap v0.3.2, gix-tempfile v23.0.1, gix-lock v23.0.1, gix-index v0.52.0, gix-config-value v0.18.1, gix-pathspec v0.18.1, gix-ignore v0.21.1, gix-worktree v0.53.0, gix-imara-diff v0.2.2, gix-diff v0.64.0, gix-blame v0.14.0, gix-ref v0.64.0, gix-sec v0.14.1, gix-config v0.57.0, gix-prompt v0.15.1, gix-url v0.36.1, gix-credentials v0.38.1, gix-discover v0.52.0, gix-dir v0.26.0, gix-mailmap v0.33.1, gix-revision v0.46.0, gix-merge v0.17.0, gix-negotiate v0.32.0, gix-pack v0.71.0, gix-odb v0.81.0, gix-refspec v0.42.0, gix-shallow v0.12.1, gix-transport v0.57.1, gix-protocol v0.62.0, gix-status v0.31.0, gix-submodule v0.31.0, gix-worktree-state v0.31.0, gix v0.84.0, gix-fsck v0.22.0, gitoxide-core v0.58.0, gitoxide v0.54.0, safety bump 27 crates ([`10c58bb`](https://github.com/GitoxideLabs/gitoxide/commit/10c58bb56597d9335611da121aac21f9b09b6e5b))
     - Merge pull request #2568 from GitoxideLabs/dependabot/cargo/cargo-56d6b174d8 ([`ab2fee1`](https://github.com/GitoxideLabs/gitoxide/commit/ab2fee14651202fcb7b3d8178932090c73492014))
     - Update crates to Rust 2024 edition ([`2cb17b2`](https://github.com/GitoxideLabs/gitoxide/commit/2cb17b2e7f6009693a55af907614f705a29d8c29))
     - Remove rust_2018_idioms lint declarations ([`e10d5f6`](https://github.com/GitoxideLabs/gitoxide/commit/e10d5f662df2ee05f973a3167ad215a330ee74e1))

gix-packetline/CHANGELOG.md

@@ -2,7 +2,7 @@ lints.workspace = true
 
 [package]
 name = "gix-packetline"
-version = "0.21.4"
+version = "0.21.5"
 repository = "https://github.com/GitoxideLabs/gitoxide"
 license = "MIT OR Apache-2.0"
 description = "A crate of the gitoxide project implementing the pkt-line serialization format"

gix-packetline/Cargo.toml

@@ -89,7 +89,7 @@ gix-command = { version = "^0.9.1", path = "../gix-command" }
 gix-features = { version = "^0.48.1", path = "../gix-features" }
 gix-url = { version = "^0.36.1", path = "../gix-url" }
 gix-sec = { version = "^0.14.1", path = "../gix-sec" }
-gix-packetline = { version = "^0.21.4", path = "../gix-packetline" }
+gix-packetline = { version = "^0.21.5", path = "../gix-packetline" }
 gix-credentials = { version = "^0.38.1", path = "../gix-credentials", optional = true }
 gix-quote = { version = "^0.7.2", path = "../gix-quote" }