chore(deps): bump gix from 0.86.0 to 0.87.0 in /tools/rsr-certified

[dependabot]

Bumps gix from 0.86.0 to 0.87.0.

Release notes

Sourced from gix's releases.

gix v0.87.0

Bug Fixes (BREAKING)

• remove need-more-recent-msrv as it's not required anymore It was mostly meant to be internal, but the name didn't indicate this, hence the breaking change.

Test

• assert fetched pack contents rather than pack checksums fetch_pack and fetch_pack_without_local_destination asserted the data_hash/index_hash of a pack produced by the host git. Those cover the pack's compressed bytes, so they silently encode which zlib implementation that git is linked against: with a zlib-ng-linked git (Arch, among others) the 219-byte commit in that pack deflates to 152 bytes where stock zlib produces 153, making the pack 268 bytes instead of 269 and changing both checksums.

  Nothing about the fetch itself differs — re-deflating the very same object payloads with stock zlib and re-hashing reproduces the expected checksum byte for byte, and every other assertion in both tests already passes.

  Assert the pack's object ids instead, read back from the index that was just written. They hash uncompressed content, so they are identical on every host, and they are what the checksums were standing in for. num_objects, pack_version and index_version are untouched; Entry::crc32 is deliberately not used, as it too is computed over compressed bytes.

New Features (BREAKING)

• add Git-compatible commit signature verification with Commit::verify() Breaking because it also adds config::tree::Key::default_value(), which gives Any a default_value field.

  Expose repository-aware verification on commits while delegating verifier execution and result parsing to gix-object plumbing. Resolve supported signature formats, configured programs, trust thresholds, SSH allowed signers and revocations, repository-relative paths, and commit verification time according to Git configuration.

• add commit::Info::generation That way it's evident if a commit-graph was present for this node. Breaking, as it adds a new public field to a structure.

Changed (BREAKING)

• remove the tree-editor feature toggle The workspace MSRV now exceeds Rust 1.75, which stabilized the language feature that originally required tree editing to be gated.

... (truncated)

Commits

• 0c541c7 Release gix-note v0.1.0, gix-pack v0.74.0, gix-odb v0.84.0, gix-refspec v0.45...
• 94aa28e Make gix-note compile on docs.rs
• d2af4ed Release gix-error v0.3.0, gix-date v0.16.0, gix-actor v0.42.0, gix-validate v...
• ebe9095 update manifests prior to release
• 68c263b report proofing
• 0d8bd1d Report August 2026
• 7424676 Merge pull request #2930 from GitoxideLabs/gix-notes
• 5c8d935 thanks clippy
• d934f5b feat: expose git notes in gix::Repository
• dc556e4 feat(gix-glob): add Pattern::has_wildcard()
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR updates the gix dependency to version 0.87.0. While the project remains up to quality standards according to automated analysis, this specific update introduces breaking changes regarding commit::Info and the removal of the tree-editor feature. There is a high risk of compilation or runtime failures because the PR does not include corresponding code adjustments or evidence of verification for these breaking changes.

About this PR

• The update to gix 0.87.0 involves breaking changes, specifically to commit::Info and the removal of the tree-editor feature. Since 0.x version bumps are treated as major changes in Cargo and no code adjustments are included in this PR, there is a high potential for compilation or runtime failures.

Test suggestions

• Verify successful compilation and integration with the breaking changes introduced in gix 0.87.0, specifically regarding commit::Info and the removal of the tree-editor feature.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify successful compilation and integration with the breaking changes introduced in `gix` 0.87.0, specifically regarding `commit::Info` and the removal of the `tree-editor` feature.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud