[dependabot]

Bumps gix from 0.89.0 to 0.90.0.

Release notes

Sourced from gix's releases.

gix v0.90.0

New Features (BREAKING)

• add worktree locking and a lock override that preserves changes

  Expose Worktree::set_lock(Option<&BStr>) and worktree::Proxy::set_lock() so callers can protect linked worktrees from pruning, moving, or removal, including when their checkout is offline. Implement file handling in gix_worktree::set_lock(): preserve byte-oriented reasons, append Git's trailing newline when needed, and make unlocking idempotent. Reject the main worktree in the porcelain and avoid writing through lock-file symlinks.

  Previously Force::OverrideLock also discarded local changes and initialized submodules. Add Force::OverrideLockKeepChanges to bypass just the lock check, retaining status and submodule validation. This expands an exhaustive public enum, so adapt the Tix caller in the same commit; existing CLI force levels retain their behavior.

  Git reference: v2.56.0-116-g6de20f6092 (6de20f6092dcf9bdb1c8efe03db4b70c82b423dd), builtin/worktree.c lock/unlock/removal, wrapper.c newline encoding, and t/t2403-worktree-move.sh. Git's worktree remove -ff bypasses both lock and cleanliness checks; the new mode deliberately permits bypassing only the lock. exposes a pre-existing unresolved with_fetch_options link in clone docs.

Test

• worktree removal with late writes to both roots Inject bounded writes through removal progress after scanning, proving that one-pass deletion leaves files while default retries finish.

Performance

• don't look for new packs before writing an object

Reverted (BREAKING)

• remove the obsolete max-performance-safe feature gix always uses zlib-rs, so the safe bundle no longer differs from max-performance. Make max-performance own the default cache setup and update defaults, cache tests, and developer commands. Downstream users of the removed name must select max-performance instead.

New Features

• add Submodule::resolved_url() for cloning Definitely went through the tests quickly, besides the usual 'make it a shell script', but poked the URL resolution and Windows

... (truncated)

Commits

• dd39fb6 Release gix-error v0.5.2, gix-date v0.18.1, gix-actor v0.44.1, gix-trace v0.3...
• b3248cf proof-read (ortho-grammatical)
• 76f8da2 Add monthly report for October
• b8ef9ea Merge pull request #3082 from 10ne1/sha256-ci-fixes
• 6260a55 review
• 75ca154 remove hard-coded SHA-1 from the Commit::short_id() doctest
• 521b3b2 fix: create SHA-256 repositories for object_hash: None in SHA-256-only builds
• 36aaf51 make SHA-256-only lib tests really SHA-256-only
• 59ba38b Merge pull request #3080 from cruessler/add-shortcut-for-trivial-myers-changes
• b7927e6 review
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.