build(deps): bump simple-git from 3.36.0 to 4.0.2

.github/dependabot.yml

@@ -1,6 +1,44 @@
 version: 2
 updates:
+  # One PR for all actions, so upload-artifact and download-artifact always
+  # move together.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      actions:
+        patterns: ["*"]
+
+  # The extension's packages. engine/package.json declares none of its own.
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    # pnpm refuses anything published less than a day ago (minimumReleaseAge),
+    # so give a release a few days before proposing it.
+    cooldown:
+      default-days: 3
+    groups:
+      npm-minor-patch:
+        update-types: ["minor", "patch"]
+    ignore:
+      # Must not run ahead of engines.vscode, or vsce refuses to package.
+      # Raise both together, by hand, when the minimum VS Code moves.
+      - dependency-name: "@types/vscode"
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
+
+  # The Rust engine. rust-toolchain.toml is left out on purpose: raising the
+  # channel is a deliberate act (see that file).
+  - package-ecosystem: "cargo"
+    directory: "/engine"
+    schedule:
+      interval: "weekly"
+    groups:
+      # The napi crates move in lockstep, majors included.
+      napi:
+        patterns: ["napi", "napi-derive", "napi-build"]
+      # gix is pre-1.0, so its "minor" bumps break; keep them in their own PR.
+      cargo-minor-patch:
+        update-types: ["minor", "patch"]
+        exclude-patterns: ["gix"]

.github/workflows/native-build.yml

@@ -42,7 +42,7 @@ jobs:
       # Windows targets. Fixed content, so the key only has to change when the
       # build script that drives it does.
       - name: Cache the MSVC CRT
-        uses: actions/cache@v4.2.0
+        uses: actions/cache@v6.1.0
         with:
           path: ~/.cache/cargo-xwin
           key: xwin-${{ runner.os }}-${{ hashFiles('engine/scripts/build-addon.mjs') }}
@@ -51,7 +51,7 @@ jobs:
       # ~350 MB: the pinned zig. Keyed on the script that names the version,
       # so a new pin fetches a new wheel instead of reusing the old one.
       - name: Cache the pinned zig
-        uses: actions/cache@v4.2.0
+        uses: actions/cache@v6.1.0
         with:
           path: engine/.toolchain
           key: zig-${{ runner.os }}-${{ hashFiles('engine/scripts/build-all.mjs') }}
@@ -78,7 +78,7 @@ jobs:
       # job restores them in one step and the layout it gets is the layout
       # `.vscodeignore` whitelists and the loader reads.
       - name: Upload engine binaries
-        uses: actions/upload-artifact@v4.0.0
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: native-all
           path: engine/native/*/git-graph.node

.github/workflows/publish.yml

@@ -38,7 +38,7 @@ jobs:
       # cost is deliberate — every install carries seven binaries it cannot
       # load — and buys one file to download instead of nine.
       - name: Download engine binaries
-        uses: actions/download-artifact@v4.0.0
+        uses: actions/download-artifact@v8.0.1
         with:
           name: native-all
           path: engine/native/
@@ -71,7 +71,7 @@ jobs:
           echo "Packaged $vsix ($(du -h "$vsix" | cut -f1))"
 
       - name: Upload VSIX
-        uses: actions/upload-artifact@v4.0.0
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: vsix
           path: ${{ steps.package.outputs.vsix }}
@@ -92,7 +92,7 @@ jobs:
       - run: corepack enable && pnpm install --frozen-lockfile
 
       - name: Download VSIX
-        uses: actions/download-artifact@v4.0.0
+        uses: actions/download-artifact@v8.0.1
         with:
           name: vsix
           path: dist/

CHANGELOG.md

@@ -9,9 +9,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- **The graph opens roughly three and a half times faster.** Measured on a
-  2,000-commit repository: the work behind opening the view went from 67 ms to
-  19 ms, and reading the branch, tag, remote and stash lists from 59 ms to 8 ms.
+- **Searching history is about eight times faster**, and no longer starts four
+  `git` processes for one search. Measured on a real 1,036-commit repository:
+  62 ms to 8 ms. What it matches is unchanged — the same literal text search
+  over messages, the same author and commit-hash matching, in the same order.
+- **The graph opens roughly four times faster.** Measured on a real
+  1,036-commit repository: the work behind opening the view went from 69 ms to
+  16 ms, reading the branch, tag, remote and stash lists from 60 ms to 8 ms,
+  and loading a page of commits from 12 ms to 8 ms. Loading commits no longer
+  starts a `git` process at all.
+- **The engine is about 1.4 MB smaller per platform**, after removing code
+  that could never be reached — around 10 MB off the download.
 - **A built-in Git engine, so the graph stops waiting on `git` processes.**
   Reading a repository — opening the graph, loading a page of commits, opening
   commit details, comparing two commits, reading a file at a revision — now
@@ -23,8 +31,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   that engine and the previous behavior. `"git-cli"` is a complete opt-out:
   the engine is not even loaded.
 
+### Changed
+
+- **"Load more" now loads 750 commits at a time instead of 100**, and the graph
+  opens with 250 rather than 300. The first page appears a touch sooner, and
+  scrolling further into history pauses roughly seven times less often.
+  `initialLoadCommits` and `loadMoreCommits` remain configurable if you want
+  the old behavior.
+
 ### Fixed
 
+- **Searching for text containing `(` or `[` no longer fails the Find
+  dialogue.** A query with an unbalanced bracket made Git reject the search
+  outright and the dialogue reported an error instead of results. Author
+  matching is unchanged otherwise — it still matches names and email addresses,
+  ignoring case.
+- **Signed tags keep their badge, and `origin/HEAD` keeps its label**, without
+  the extension running extra `git` commands to find either out. Both are now
+  read directly from the repository along with everything else on the row. A
+  lightweight tag pointing at a signed commit is correctly *not* marked as a
+  signed tag, matching `git` itself.
 - **The author filter lists everyone who has contributed**, not only the people
   whose commits are reachable from the branch you have checked out. Anyone whose
   work is on another branch — a remote branch you have fetched but not checked

README.md

@@ -86,8 +86,8 @@ All settings use the `git-graph-libre` prefix.
 | `fetchAvatars`                                 | `false`         | Fetch avatars (sends email to external services) |
 | `graphColors`                                  | 12 defaults     | Colors for graph lines                           |
 | `graphStyle`                                   | `"rounded"`     | `"rounded"` or `"angular"`                       |
-| `initialLoadCommits`                           | `300`           | Commits to load on open                          |
-| `loadMoreCommits`                              | `100`           | Commits to load on demand                        |
+| `initialLoadCommits`                           | `250`           | Commits to load on open                          |
+| `loadMoreCommits`                              | `750`           | Commits to load on demand                        |
 | `maxDepthOfRepoSearch`                         | `0`             | Folder depth for repo search                     |
 | `repository.boldCheckedOutCommit`              | `false`         | Bold the checked-out commit's message            |
 | `repository.fetchTagsByDefault`                | `true`          | Pre-check "Fetch all tags" in the Fetch dialog   |