CGA-v7g6-w33g-gcpp

This vulnerability affects gix-date 0.10.2, a transitive dependency of watchexec v2.3.2. The vulnerability is fixed in gix-date >= 0.12.0, but upgrading is blocked by version incompatibilities in the dependency chain.

Dependency Chain:

• watchexec v2.3.2 → gix v0.72.1 (via bosion crate)
• gix v0.72.1 requires gix-date ^0.10.1 (0.10.x only)
• Fix requires gix-date >= 0.12.0 (incompatible with gix 0.72.1)

The gix v0.72.1 constraint (^0.10.1) prevents upgrading gix-date to 0.12.0. Upgrading gix-date requires gix 0.77.0+, which in turn requires a new watchexec release.

In order to remediate this vulnerability, upstream must release a new version of watchexec that uses gix 0.77.0 or later, which supports gix-date 0.12.0+.