etc/plan/bug-fixes.md
Generated on 2026-04-30 after downloading all GitHub issues in
GitoxideLabs/gitoxide. The actionable backlog below is filtered to open
GitHub issues, and intentionally excludes feature requests, tracking issues,
integration requests, and documentation-only requests unless the issue
describes incorrect behavior, a regression, a failing test, or a
soundness/security concern.
Source set: 712 GitHub issues total, excluding pull requests; 164 are open.
Priority key:
wontfix, ambiguous, or
mostly require a product decision before implementation.#1534 -
gitoxide-core does not neutralize terminal control characters.
Security-sensitive terminal output can render untrusted object data without
sufficient escaping. Start by auditing every command path that prints names,
object data, refs, config values, or remote-provided strings, then add a
shared terminal-safe rendering helper and regression tests.
#2421 -
index.write() can corrupt the effective index when the tree extension is
stale.
Updating index entries without updating or removing the tree cache can make
git status and later commits disagree about what is staged. First safe
fix: remove the tree extension before writing unless it can be updated
correctly, then add a mixed Git/gix regression that demonstrates stale tree
cache invisibility.
#1231 -
ItemSliceSync::get_mut() may be unsafely callable for the same index.
The report suggests a bad packfile might violate aliasing assumptions.
Treat this as an audit before assuming it is benign: prove callers partition
indexes, or replace the abstraction with checked interior mutability.
#1784 - Nonexclusive checkout never removes executable permissions. Checkout can leave executable bits behind when the target index says the file is non-executable. Reproduce with two checkouts over the same worktree, then make mode reconciliation explicit for reused files.
#1783 -
Delayed process filters suppress executable bits in gix clone.
Files that should be checked out as executable are left non-executable when
a long-running smudge filter supports delayed output. Add a fixture with a
delayed process filter and assert the final mode after delayed checkout.
#135 - Fetching from misbehaving servers can block forever. Network operations need bounded progress or interruptibility. Start with a small fake server fixture that stops responding, then add timeout/cancel handling in the affected transport path.
#24 - Robustness when killed in the middle. Interrupted operations should not leave repositories in misleading or corrupt states. Identify write paths that lack temp-file-plus-rename or rollback behavior and add crash/interruption-oriented tests around them.
#2554 -
Shallow clone with a tag refspec fails.
PrepareFetch::with_shallow() plus .with_ref_name() treats the ref as a
local branch, producing refs/heads/<tag> and failing required refspec
validation. Fix ref-name classification for tags and add a shallow tag clone
regression.
#1025 -
Azure DevOps clone failure with REF_DELTA objects.
Pack resolution needs Git-style delta handling for Azure-generated packs.
Reproduce against the reported Azure fixture or archived pack, then align
delta resolution with Git behavior.
#1096 -
gix fails to decode a tree object that Git accepts.
This is a compatibility failure in object decoding. Preserve the reported
tree object as a fixture and decide whether the decoder needs to accept a
Git-compatible edge case or improve diagnostics.
#2140 -
Clone fails with blocking-http-transport-reqwest.
The same clone works with curl and reqwest-rustls, so this is likely a
transport configuration or error-surface bug. Add a focused clone example
test for the failing feature set and expose the underlying source error.
#2313 -
Local clones fail when git-upload-pack is available through git but not
directly in PATH.
Mainly affects Windows installations such as Scoop. For local clones, fall
back to git upload-pack or derive the helper path from the discovered Git
executable.
#1055 - Fetching repositories with special branch names breaks on Windows. Branch names that are acceptable to Git can collide with Windows path or ref handling. Capture the reported names in tests and fix ref storage/path translation.
#2052 -
Worktree path resolves incorrectly for a bare repository with submodules.
gix status resolves a submodule under /home/... without the username and
fails. Reproduce with the dotfiles-style bare setup and trace worktree root
derivation for submodules.
#2210 -
Valid negative fetch refspecs are rejected as NegativeGlobPattern.
Git accepts negative glob refspecs such as ^refs/heads/*-deploy. Narrow
the invalid-pattern check so valid negative fetch exclusions parse and round
trip correctly.
#1912 -
safe.directory and trust handling hide remotes unexpectedly.
A repository listed in safe.directory can still yield no remotes. Add a
trust test with owned, unowned, and safe-directory cases, then make remote
lookup either honor the trust exception or fail explicitly.
#2067 -
Trust checks do not work for UNC paths on Windows.
GetNamedSecurityInfoW or path conversion appears to fail for WSL/network
paths and long UNC paths. Add Windows-specific coverage for UNC inputs and
support Git's safe.directory escape hatch behavior.
#1951 - New remotes can be saved into global-config metadata instead of repo config. Creating a local remote named like a global remote can mutate/select the wrong config section metadata. Make remote creation target the repository config file explicitly.
#1819 -
ein tool organize cannot organize reftable repositories.
Reftable repositories are not recognized by the organizer. Add a minimal
reftable fixture and route detection through repository format support
rather than loose-ref assumptions.
#1621 -
Unable to extract a pack entry from irs-manual-demo.git.
Preserve the problematic pack or a minimized reproduction and fix the pack
access path that fails on the entry.
#1391 - libcurl reports unknown option 48 on CentOS 7. Older libcurl builds reject an option currently passed by the transport layer. Gate the option by libcurl version/capability or make it optional.
#1353 -
gix clone ignores global core.symlinks on Windows.
Windows checkout should respect global symlink capability/configuration.
Add a Windows regression with core.symlinks=false and compare Git's
checkout result.
#1119 -
gix-url does not compile with the url version it specifies.
Minimal-version builds fail because the crate uses APIs newer than its
declared lower bound. Raise the dependency floor or avoid the newer API.
#2490 -
gix status --submodules all falsely reports submodules dirty when they
only contain empty untracked directories.
Git ignores empty directories. Add the reported submodule fixture and make
untracked-directory detection require files.
#2161 - Breadth-first simple commit traversal does not hide commits correctly. Add a graph where a hidden branch contains all traversed commits and assert breadth-first traversal matches the non-breadth-first hiding behavior.
#2159 - Hidden tips do not work with single-parent traversal. Single-parent traversal still needs to inspect all parents for hide propagation while only yielding first-parent results. Add explicit tests for that bitflag propagation.
#1832 - Rename tracking depends on order. Rename detection should be stable regardless of input ordering. Build a minimized fixture that shuffles candidate order and assert identical output.
#1816 - Pseudorandom numbers are sometimes identical across processes. Review seed generation for process-local uniqueness, especially in tests or temp fixture naming, and add a repeated-process smoke test.
#1798 -
UTF-32 encoding is missing for ansible.git from Salsa.
Add the reported repository or minimized object/config data as a fixture and
extend encoding detection/decoding to cover the missing UTF-32 case.
#2467 -
SCP-like URL to SSH URL conversion is lossy.
The current conversion changes home-relative SCP-like paths into absolute
SSH paths. Decide the canonical representation, then add round-trip tests
for host:path, host:/path, host:~/path, and host:~user/path.
#1868 -
gix-command on Windows can run shell commands outside POSIX mode.
Git for Windows shims may invoke bash.exe instead of sh.exe semantics.
Detect or invoke the POSIX-mode shell path deliberately.
#1869 -
gix-command on Unix can choose non-POSIX /bin/sh.
POSIX-compatible sh is not guaranteed to be /bin/sh. Consider resolving
sh through the standard path or getconf PATH on affected platforms.
#1842 -
gix-command passes -- as $0 to sh -c.
This produces confusing shell diagnostics. Pass an informative shell name
or command label as $0 and add a test for error output.
#1615 -
gix-trace tracing level set by subscriber is not always respected.
Audit where trace level filtering is overridden or cached and add a
subscriber-driven filtering test.
#1649 -
gix worktree list mixes branch names and worktree names in similar rows.
The output is easy to misread and differs from Git semantics. Clarify row
labels or align with Git's worktree-list output.
#1269 -
Replace an mtime workaround with the fixed rustix API.
Upgrade to a rustix version containing the mtime fix and remove the local
workaround once tests confirm equivalent behavior.
#235 -
make tests performs duplicate checks.
Remove duplicated test invocations or split the target so repeated checks
are intentional and visible.
#2424 -
phpstan/phpstan pack resolves with a single thread only.
Clone spends roughly 20 minutes resolving a large pack. Profile pack
resolution on the reported repository and identify why parallelism is not
engaged.
#2024 -
Pack size regressed by about 50 percent from gix-pack 0.58 to 0.59.
Use the provided wide-tree reproduction to bisect pack generation changes
and add a size regression test with a stable threshold.
#2296 -
gix status is slow on Windows.
Direct lstat checks scale poorly. Investigate a Windows directory-listing
stat cache shared across status traversal workers.
#1771 -
gix status performance is inconsistent on clean trees.
A Linux tree can be much slower with gix status than with the previous
tool. Reproduce on the reported large repositories and profile unchanged and
untracked paths separately.
#2450 -
Dependabot cargo dependency runs time out.
This blocks dependency maintenance. Compare Dependabot resolution behavior
with cargo update, then reduce update scope, split ecosystems, or switch
tooling if no Dependabot-specific mitigation is practical.
#1788 - The slotmap turned out to be too small. Confirm where capacity assumptions fail, then replace the fixed-size structure or make growth explicit and tested.
#2548 -
gix-status-tests fixture creation fails with PermissionDenied.
Regenerating fixtures can fail for unreadable_untracked.tar. Make fixture
generation robust to unreadable files and ignored generated archives.
#2259 -
gix-worktree-tests baseline ignore test fails because
user_exclude_path.is_file() is false.
Find why the expected user exclude file is absent in the reported setup and
make the fixture setup explicit.
#2006 -
Rare symlink overwrite protection test failure.
The case sensitivity of FAKE-FILE changes in a macOS CI run. Add logging
around the checkout path and try to reproduce under repeated nextest runs.
#1894 -
armv7-linux-androideabi cross tests panic in miniz_oxide.
Determine whether this is a dependency, target, or gitoxide pack handling
issue. Keep the cross target as a focused reproducer.
#1890 - Four pack-related tests fail on s390x. Preserve failing outputs and compare endian-sensitive pack and multi-index code paths. Add s390x coverage if a hosted runner or emulator is reliable.
#1722 - Some tests terminate unusually when canceled on Windows. Ctrl-C during nextest can produce unusual termination. Investigate signal handling and child process cleanup in test helpers and spawned commands.
#1622 -
regex_matches baseline fails after Git 2.47 rev-parse behavior changes.
Update fixture generation or expected baseline behavior so tests compare
against the intended Git version semantics.
#1575 -
jj_realistic_needs_to_be_more_clever failure is not limited to CI.
Reproduce locally and decide whether the test expectation, fixture, or jj
integration behavior needs to change.
#1358 -
Twelve Windows tests fail with GIX_TEST_IGNORE_ARCHIVES=1.
Regenerated fixtures differ from committed archives on Windows. Work through
the failures in small groups and commit platform-stable fixture generation.
#2363 -
CHANGELOG.md files are no longer kept up to date.
This is a release-process defect rather than a code bug. Add a release
checklist or CI check that catches stale changelog state before publishing.
#1930 -
Checkout of a specific branch, tag, or revision does not work in the
expected cargo-generate migration flow.
This is labeled wontfix, so do not schedule implementation without first
deciding whether the current clone/checkout API intentionally omits this
behavior or should grow a supported path.
#2429 -
LsRefsCommand, RefSpec, and RefSpecRef construction is confusing.
Primarily documentation/API usability, not a runtime bug. It may become a
bug-fix task only if the API is proven to make valid protocol usage
impossible or misleading.
#1787 -
overwrite_existing: false is not documented to let executable bits be set.
Mostly documentation around checkout semantics. Link this to #1783 and
#1784 while fixing mode behavior.
gix-command execution model.