arti: update to 2.5.1.
# Arti 2.5.1 - 3 August 2026
Arti 2.5.1 continues development on relays and directory authorities.
It also adds some performance, security, and convenience features for
onion services.
# Arti 2.5.0 — 30 June 2026
Arti 2.5.0 comes with lots of progress in the relay and directory authority
space, including ntor handshake handling, as well as encoding/decoding support
for router- and micro descriptors.
This release also includes a number of important bug fixes, as well as two security
fixes for medium-severity security issues, [TROVE-2026-24] and [TROVE-2026-27].
apr-util: update to 1.6.4.
Changes with APR-util 1.6.4
*) apr_brigade: Don't split the final LF in apr_brigade_split_line() to
avoid producing an empty bucket. PR 64273
[Barnim Dzwillo <dzwillo strato.de>, Joe Orton]
*) apr_brigade: Metadata buckets are now ignored in
apr_brigade_split_line, apr_brigade_flatten and
apr_brigade_to_iovec, fixing possible undefined behaviour. PR 68278
[Ben Kallus <benjamin.p.kallus.gr dartmouth.edu>, Joe Orton]
*) apr_crypto_openssl: Compatibility with OpenSSL 3. [Yann Ylavic]
*) apr_crypto_openssl: use OPENSSL_init_crypto() to initialise OpenSSL
on versions 1.1+. [Graham Leggett]
*) apr_memcache: Fix name lookup to allow IPv6 as well as IPv4.
[5 lines not shown]
[CodeGen] Fix null pointer dereferencing issue (#214543)
Fixes #197580. Fixes 99f7018958ed3daf2abf8d49178c24fbf1eb1010.
In Rematerializer::isRegIdenticalAtUses(), handle case when DefVN is
null.
[AMDGPU] Fix combineMasks dropping condition (#203180)
The problem is related to `S_AND (S_AND x, x), exec` case
When the nested mask op is the outer S_AND/S_OR first operand with two
identical operands, combineMasks kept exec instead of a nested operand,
folding to S_AND exec, exec and dropping the condition
nfs_commonkrpc.c: Get rid of NFSv4.0 delegation cruft
Delegations in NFSv4.0 never worked well and, since
the NFSv4.0 protocol is now deprecated, use of delegations
for NFSv4.0 is disabled as far as the client can do so.
It turns out that some Illumos NFSv4.0 server issues
delegations anyhow (even when the callback path is
specified as 0.0.0.0) and this can cause use after free
problems.
This patch deleted some cruft that did an nfsrpc_openrpc()
call recursively when an NFSv4.0 server failed to issue
a delegation when it had previously done so.
This code was only meant to be an optimization and
would have been rarely exercised. Since this recursive
call of nfsrpc_openrpc() is in some of the backtraces
in the bugzilla PR, getting rid of the cruft makes sense.
[6 lines not shown]
nfs_commonkrpc.c: Fix recovery that was broken by 4d80d4913e79
Commit 4d80d4913e79 added a check for nfsess_defunct already
being set. This was incorrect because, once set, nfsess_defunct
remains set and an additional recovery might be needed.
This patch reverts this part of 4d80d4913e79.
PR: 297252
(cherry picked from commit 5ab48fb9f7ac43fb1242a678312a02df5d4d5b53)
[HIP] Add libhipcxx to the default header search path (#214279)
libhipcxx provides C++ library support for HIP device code, similar to
libcudacxx for CUDA. CUDA toolchains make libcudacxx available through
the
toolkit include path by default. HIP users should likewise be able to
include libhipcxx headers without an installation-specific include
option.
Add include/libhipcxx from the selected ROCm installation when the
directory exists. It follows the same search order and controls as the
other HIP include paths.
nfs_commonkrpc.c: Get rid of NFSv4.0 delegation cruft
Delegations in NFSv4.0 never worked well and, since
the NFSv4.0 protocol is now deprecated, use of delegations
for NFSv4.0 is disabled as far as the client can do so.
It turns out that some Illumos NFSv4.0 server issues
delegations anyhow (even when the callback path is
specified as 0.0.0.0) and this can cause use after free
problems.
This patch deleted some cruft that did an nfsrpc_openrpc()
call recursively when an NFSv4.0 server failed to issue
a delegation when it had previously done so.
This code was only meant to be an optimization and
would have been rarely exercised. Since this recursive
call of nfsrpc_openrpc() is in some of the backtraces
in the bugzilla PR, getting rid of the cruft makes sense.
[6 lines not shown]
nfs_commonkrpc.c: Fix recovery that was broken by 4d80d4913e79
Commit 4d80d4913e79 added a check for nfsess_defunct already
being set. This was incorrect because, once set, nfsess_defunct
remains set and an additional recovery might be needed.
This patch reverts this part of 4d80d4913e79.
PR: 297252
(cherry picked from commit 5ab48fb9f7ac43fb1242a678312a02df5d4d5b53)
[AMDGPU] Fix SIFoldOperands miscompiling values that leave a divergent loop (#203256)
A scalar value latched per-lane inside a divergent loop was being folded
into a use after the loop, so every lane wrongly read the same value
[lldb][test] Skip the frame 0 expedite test with an out-of-tree debugserver (#214448)
`test_memory_reads_when_examining_frame0_locals` asserts that examining
frame 0's locals reads no stack memory, which only holds when
debugserver
expedites the stopped frame's stack in `jThreadsInfo`. That is
added in b631e0cbd1c9, so the assertion only holds for an in-tree
debugserver.
The GreenDragon `lldb-cmake-sanitized` bot configures with
`-DLLDB_USE_SYSTEM_DEBUGSERVER=ON`, so it tests against the debugserver
shipped in Xcode. That one predates the expedite, so test fails:
```
FAIL: test_memory_reads_when_examining_frame0_locals
AssertionError: 2 != 0 : expected NO stack memory reads for frame 0 (its
stack is expedited in jThreadsInfo).
memory reads while examining locals: stack=2 heap=1 other=1 (total=4)
stack region: [0x16b540000,0x16f53c000)
[7 lines not shown]
[SYCL][SPIR-V][Windows] Extend BaseSPIRTargetInfo host-adaptation for Windows support (#208196)
The existing host-adaptation mechanism in BaseSPIRTargetInfo copies type
properties from the host but has gaps causing incorrect behavior on
Windows:
1. PointerWidth/PointerAlign, SizeType, PtrDiffType, IntPtrType were not
copied from the host; derived classes hardcoded LP64 defaults.
2. getBuiltinVaListKind() returned VoidPtr unconditionally instead of
delegating to the host's va_list kind.
3. Derived-class constructors unconditionally overwrote host-adapted
values, working on Linux only by coincidence.
This patch addresses these issues by copying pointer-related types
from the host in BaseSPIRTargetInfo, delegating va_list kind to the
host,
and setting architecture-appropriate defaults in derived classes when no
host is
present or when host and device pointer widths differ.
[2 lines not shown]
[clang][StaticAnalysis] Fix an false negative bug in handling '__builtin*overflow'
For a binary operation 'A op B' and a result type 'T', these builtins
return true/false for whether the operation's result is a value 'T'
cannot hold. CSA models this by computing the operation's result in a
temporary type and comparing it against the bounds of 'T'. However,
the temporary type is only twice as wide as 'T', not the
operands. When either operand is wider than 'T's doubled width, the
result of 'A op B' can silently wrap around before the comparison,
producing a false negative.
The solution is to find the proper type to temporarily hold the result
of 'A op B' from types of 'A' and 'B'.
SDL3: updated to 3.4.14
3.4.14
This is a stable bugfix release, with the following changes:
GPU buffers and textures can have multiple read usages
Fixed X11 crash if the IME service was shutdown in the background
Fixed hang when hiding an X11 window on some window managers
Fixed being unable to get clipboard text on older versions of macOS
Fixed the 8BitDo Pro 3 controller showing up twice on macOS
Fixed Xbox controllers not being detected if SDL is built with GameInput support
Fixed pen creating phantom mouse events in relative mode on Android
openvpn: updated to 2.7.6
2.7.6
Enable TCP_NODELAY by default and push it to clients
options: make 'tun' the default for '--dev'
Correctly calculate packet id size when epoch packet format is in use
test_tls_crypt: Fix issue with temp file name on big endian systems
ssl_pkt: Fix doxygen warning about read_control_auth
t_client.sh.in: Do not run resolvectl if systemd is not running
test_tls_crypt: Fix test failure on Windows
ssl: Ignore hard reset packets with a non-zero packet id
mingw: avoid C99 "hh" scanf length modifier
interactive: forbid "--setenv opt" in startup data
CMake: detect cmocka_version.h via include path, not by linking
options: limit ping and keepalive values to one day
Make --x509-username-field work with Mbed TLS
Remove --providers from --help output for Mbed TLS
gstreamer1: updated to 1.28.6
1.28.6
Highlighted bugfixes:
Various security fixes and playback fixes
playbin3, playbin: fix stalls after re-enabling previously disabled subtitles
Fix regression in core if a pad is re-linked while changed sticky events are being pushed
dtls/webrtc: fix some issues with OpenSSL 4.0.0
RTP retransmission bitrate estimation fixes
Fix RTP depayloading of SMPTE ST291 frames with multiple ANC packets
Add H.266 muxing support to the Rust (f)mp4 muxers
Better handling of input buffers without timestamps in Rust (f)mp4 muxers
webrtcsink H.264 level/profile negotiation fixes and support for nvv4l2h265enc encoder
SMPTE ST2038 ancillary metadata and closed caption combiner improvements
Fix SEI insertion into H.265/HEVC streams with alpha
Windows D3D11 WinRT screen capture element fixes
Improved coded buffer size handling for VA encoders
[5 lines not shown]
