]> git.ipfire.org Git - thirdparty/vim.git/log
thirdparty/vim.git
8 days agopatch 9.2.0363: Vim9: variable shadowed by script-local function 20010/head v9.2.0363
Furkan Sahin [Sun, 19 Apr 2026 18:39:46 +0000 (18:39 +0000)] 
patch 9.2.0363: Vim9: variable shadowed by script-local function

Problem:  Vim9: variable shadowed by script-local function
          (Mao-Yining)
Solution: Set is_global flag to true in find_func() (Furkan Sahin)

fixes:  #20009
closes: #20011

Signed-off-by: Furkan Sahin <furkan-dev@proton.me>
Signed-off-by: Christian Brabandt <cb@256bit.org>
8 days agopatch 9.2.0362: division by zero with smoothscroll and small windows v9.2.0362
Jaehwang Jung [Sun, 19 Apr 2026 18:32:55 +0000 (18:32 +0000)] 
patch 9.2.0362: division by zero with smoothscroll and small windows

Problem:  Resizing a smoothscrolled wrapped window to its textoff width
          with 'showbreak' can leave wrapped continuation lines with
          zero text width. win_lbr_chartabsize() still runs the partial max_head_vcol calculation in
          that state and divides by width2, crashing during redraw.
Solution: Skip that partial head calculation when the wrapped
          continuation width is zero, matching the other width2 guards
          in charset.c (Jaehwang Jung)

closes: #20012

AI-assisted: Codex

Signed-off-by: Jaehwang Jung <tomtomjhj@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
11 days agoCI: Bump the github-actions group across 2 directories with 4 updates
dependabot[bot] [Fri, 17 Apr 2026 16:16:15 +0000 (16:16 +0000)] 
CI: Bump the github-actions group across 2 directories with 4 updates

Bumps the github-actions group with 3 updates in the / directory: [msys2/setup-msys2](https://github.com/msys2/setup-msys2), [actions/cache](https://github.com/actions/cache) and [github/codeql-action](https://github.com/github/codeql-action).
Bumps the github-actions group with 1 update in the /.github/actions/test_artifacts directory: [actions/github-script](https://github.com/actions/github-script).

Updates `msys2/setup-msys2` from 2 to 2.31.0
- [Release notes](https://github.com/msys2/setup-msys2/releases)
- [Changelog](https://github.com/msys2/setup-msys2/blob/main/CHANGELOG.md)
- [Commits](https://github.com/msys2/setup-msys2/compare/v2...v2.31.0)

Updates `actions/cache` from 5 to 5.0.4
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v5...v5.0.4)

Updates `github/codeql-action` from 4 to 4.35.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v4...v4.35.1)

Updates `actions/github-script` from 8 to 9
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v8...v9)

---
updated-dependencies:
- dependency-name: msys2/setup-msys2
  dependency-version: 2.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/cache
  dependency-version: 5.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-version: 4.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/github-script
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

closes: #20001

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
11 days agopatch 9.2.0361: tests: no tests for ch_listen() with IPs v9.2.0361
Zdenek Dohnal [Fri, 17 Apr 2026 15:55:53 +0000 (15:55 +0000)] 
patch 9.2.0361: tests: no tests for ch_listen() with IPs

Problem:  tests: no tests for ch_listen() with IPs
Solution: Add tests that this is disallowed
          (Zdenek Dohnal)

The functionality was removed, so the test is to make sure it fails
as expected.

closes: #19997

Signed-off-by: Zdenek Dohnal <zdohnal@redhat.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
11 days agoruntime(vim9): remove extra escaping in Open
Keith Smiley [Fri, 17 Apr 2026 15:02:39 +0000 (15:02 +0000)] 
runtime(vim9): remove extra escaping in Open

Before 71fd19d7ac9e83bf63d7bad337f43cd830a5b5bd this function went
through a `:!` command on all platforms, so it needed special escaping for `#` and
others. After that commit it doesn't go through that path on unix
platforms. Then with 48581f2ba96550f5499cc322647b2ff1df5ad4ed this
escaping was re-added on unix and it's needs since it goes through
`sh -c`, but it should not have the extra escaping specific to `:!`.

Specifically my original broken command is:

```
PATH=/usr/bin:/bin VIMRUNTIME=~/dev/vim/runtime ./src/vim -u NONE -c 'call dist#vim9#Open("https://github.com/keith/dotfiles/blob/7bce9f5c697df6a549cf97bf5606d8b639e5bf5a/vimrc#L19")'
```

Where the `#L19` ends up being opened as `%5C#L19`. But I verified this
case still works as well:

```
PATH=/usr/bin:/bin VIMRUNTIME=~/dev/vim/runtime ./src/vim -u NONE -c 'call dist#vim9#Open("foo bar.txt")'
```

Which is what would otherwise break if we weren't doing any shell
escaping on unix.

closes: #19996

Signed-off-by: Keith Smiley <keithbsmiley@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
11 days agoruntime(doc): make window option description a bit less vague
zeertzjq [Fri, 17 Apr 2026 14:51:53 +0000 (14:51 +0000)] 
runtime(doc): make window option description a bit less vague

Say explicitly that ":setlocal" sets the local value, while ":set" also
sets the global value.

related: #19993

Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
11 days agoruntime(django): Removed unsupported template statements and filters by current LTS.
tecis [Fri, 17 Apr 2026 14:47:22 +0000 (14:47 +0000)] 
runtime(django): Removed unsupported template statements and filters by current LTS.

Removed djangoStatement:

- ifequal: Depricated version 4.0.
- endifequal: Depricated version 4.0.
- ifnotequal: Depricated version 4.0.
- endifnotequal: Depricated version 4.0.
- parsed
- trans: Renamed to `translate` in version 4.0.
- blocktrans: Renamed to `blocktranslate` in version 4.0.
- endblocktrans: Renamed to `endblocktranslate` in version 4.0.

Removed djangoFilter:

- fix_ampersands: Removed in version 1.8.
- length_is: Removed in version 5.1.

sources:

- Current LTS is version [5.2](https://www.djangoproject.com/download/#supported-versions).
- Documentation template builtins [5.2](https://docs.djangoproject.com/en/5.2/ref/templates/builtins/#truncatechars-html).
- Documentation template builtins [6](https://docs.djangoproject.com/en/6.0/ref/templates/builtins).
- [Django Deprecation Timeline](https://docs.djangoproject.com/en/6.0/internals/deprecation)

closes: #19994

Signed-off-by: tecis <67809811+tecis@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
11 days agoruntime(django): Add missing djangoStatement `get_language_info`.
tecis [Fri, 17 Apr 2026 14:46:01 +0000 (14:46 +0000)] 
runtime(django): Add missing djangoStatement `get_language_info`.

Source: [get_language_info](https://docs.djangoproject.com/en/6.0/topics/i18n/translation/#get-language-info) .

related: #19994

Signed-off-by: tecis <67809811+tecis@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
11 days agoruntime(django): Add missing statements and filters.
tecis [Fri, 17 Apr 2026 14:44:51 +0000 (14:44 +0000)] 
runtime(django): Add missing statements and filters.

Added the fallowing.

djangoStatement:

- querystring: Added in version Django 5.2.
- lorem: Added in version Django 1.8.
- verbatim: Added in version Django 1.10.

djangoFilter:

- force_escape: Added in version Django 1.8.
- iriencode: Added in version Django 1.8.
- json_script: Added in version 2.1.
- truncatechars_html: Added in version 1.7.

> According to current documentation the added keywords are supported [Django version 6](https://docs.djangoproject.com/en/6.0/ref/templates/builtins).

related: #19994

Signed-off-by: tecis <67809811+tecis@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
11 days agoruntime(make): fix wrong highlighting with $ inside double quotes
Christian Brabandt [Thu, 16 Apr 2026 21:25:43 +0000 (21:25 +0000)] 
runtime(make): fix wrong highlighting with $ inside double quotes

fixes: #19986

Co-authored-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Christian Brabandt <cb@256bit.org>
11 days agopatch 9.2.0360: Cannot handle mouse-clicks in the tabpanel v9.2.0360
Yasuhiro Matsumoto [Thu, 16 Apr 2026 20:29:33 +0000 (20:29 +0000)] 
patch 9.2.0360: Cannot handle mouse-clicks in the tabpanel

Problem:  Cannot handle mouse-clicks in the tabpanel
Solution: Add support using the %[FuncName] atom for the tabpanel
          (Yasuhiro Matsumoto)

Extend the statusline/tabline click region mechanism to work with
'tabpanel'. The callback receives a dict with "area" set to "tabpanel"
and a "tabnr" key indicating which tab page label was clicked.

closes: #19960

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
11 days agopatch 9.2.0359: wrong VertSplitNC highlighting on winbar v9.2.0359
Hirohito Higashi [Thu, 16 Apr 2026 20:12:08 +0000 (20:12 +0000)] 
patch 9.2.0359: wrong VertSplitNC highlighting on winbar

Problem:  wrong VertSplitNC highlighting on winbar
          (Maxim Kim, after v9.2.0349)
Solution: Use VertSplit instead of VertSplitNC for winbar rows
          (Hirohito Higashi).

vsep_row_is_curwin() and right_neighbor_at_row() used W_WINROW() which
excludes winbar rows from the window's range.  This caused the vertical
separator at winbar rows to use VertSplitNC even when curwin is adjacent.

Use w_winrow directly so winbar rows are included in the range check.

fixes:  #19985
closes: #19987

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
11 days agopatch 9.2.0358: runtime(vimball): still path traversal attacks possible v9.2.0358
Yasuhiro Matsumoto [Thu, 16 Apr 2026 20:03:39 +0000 (20:03 +0000)] 
patch 9.2.0358: runtime(vimball): still path traversal attacks possible

Problem:  runtime(vimball): still path traversal attacks possible
Solution: block Windows driver letter paths (Yasuhiro Matsumoto)

The path traversal check in vimball#Vimball() did not reject file
names starting with a Windows drive letter (e.g. "C:/foo"). Backslashes
are normalized to forward slashes earlier, so UNC paths are caught by
the leading-slash check, but absolute drive-letter paths slipped
through and could write outside of g:vimball_home on Windows.

Add a "^\a:" check next to the existing "^/" check, and cover it with
a new test.

closes: #19989

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
11 days agoruntime(gzip): Remove compatibility fall-backs, harden random filename generation
Yasuhiro Matsumoto [Thu, 16 Apr 2026 19:21:56 +0000 (19:21 +0000)] 
runtime(gzip): Remove compatibility fall-backs, harden random filename generation

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
12 days agoruntime(netrw): add missing escape() calls
Yasuhiro Matsumoto [Wed, 15 Apr 2026 20:46:19 +0000 (20:46 +0000)] 
runtime(netrw): add missing escape() calls

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
12 days agoruntime(tar): missing g:tar_secure in tar#Extract()
Christian Brabandt [Thu, 16 Apr 2026 12:28:18 +0000 (14:28 +0200)] 
runtime(tar): missing g:tar_secure in tar#Extract()

Signed-off-by: Christian Brabandt <cb@256bit.org>
12 days agopatch 9.2.0357: [security]: command injection via backticks in tag files v9.2.0357
Christian Brabandt [Wed, 15 Apr 2026 20:17:17 +0000 (20:17 +0000)] 
patch 9.2.0357: [security]: command injection via backticks in tag files

Problem:  [security]: command injection via backticks in tag files
          (Srinivas Piskala Ganesh Babu, Andy Ngo)
Solution: Disallow backticks before attempting to expand filenames.

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8

Supported by AI

Signed-off-by: Christian Brabandt <cb@256bit.org>
12 days agopatch 9.2.0356: Cannot apply 'scrolloff' context lines at end of file v9.2.0356
McAuley Penney [Wed, 15 Apr 2026 19:11:12 +0000 (19:11 +0000)] 
patch 9.2.0356: Cannot apply 'scrolloff' context lines at end of file

Problem:  Cannot apply 'scrolloff' context lines at end of file
Solution: Add the 'scrolloffpad' option to keep 'scrolloff' context even
          when at the end of the file (McAuley Penney).

closes: #19040

Signed-off-by: McAuley Penney <jacobmpenney@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
12 days agopatch 9.2.0355: runtime(tar): missing path traversal checks in tar#Extract() v9.2.0355
q1uf3ng [Wed, 15 Apr 2026 18:20:55 +0000 (18:20 +0000)] 
patch 9.2.0355: runtime(tar): missing path traversal checks in tar#Extract()

Problem:  runtime(tar): missing path traversal checks in tar#Extract()
Solution: Add check for leading slash, however gnu tar should already
          detect this (q1uf3ng)

tar#Extract() did not check for ../ sequences or absolute paths,
unlike zip#Extract() which was patched in recent commits. Add the
same checks: ../ (relative traversal), leading slash (Unix), drive
letter and UNC/leading slash (Windows).

closes: #19981

Signed-off-by: q1uf3ng <q1uf3ng@protone.me>
Signed-off-by: Christian Brabandt <cb@256bit.org>
12 days agopatch 9.2.0354: filetype: not all Bitbake include files are recognized v9.2.0354
Martin Schwan [Wed, 15 Apr 2026 18:08:32 +0000 (18:08 +0000)] 
patch 9.2.0354: filetype: not all Bitbake include files are recognized

Problem:  filetype: not all Bitbake include files are recognized
Solution: Enhance the file detection logic and consider varflags
          (Martin Schwan)

closes: #19983

Signed-off-by: Martin Schwan <m.schwan@phytec.de>
Signed-off-by: Christian Brabandt <cb@256bit.org>
12 days agoruntime(bitbake): support forward-slashes in bitbake varflags
Martin Schwan [Wed, 15 Apr 2026 18:07:18 +0000 (18:07 +0000)] 
runtime(bitbake): support forward-slashes in bitbake varflags

Enable syntax highlighting for forward-slashes in Bitbake variables with
varflags. Bitbake allows for forward-slashes in both the variable name
and their potential varflags. E.g. the following should match:

    FOO_BAR[baz] = "foobar"
    FOO_BAR_foo/bar[baz] = "foobar"
    FOO_BAR_foo/bar[baz/bazzer] = "foobar"

Also allow plus-signs in variable names, to be in line with normal
variable names.

related: #19983

Signed-off-by: Martin Schwan <m.schwan@phytec.de>
Signed-off-by: Christian Brabandt <cb@256bit.org>
12 days agopatch 9.2.0353: Missing out-of-memory check in register.c v9.2.0353
John Marriott [Wed, 15 Apr 2026 17:54:22 +0000 (17:54 +0000)] 
patch 9.2.0353: Missing out-of-memory check in register.c

Problem:  Missing out-of-memory check in register.c
Solution: Check for memory allocation failure and return NULL
          (John Marriott).

closes: #19949

Signed-off-by: John Marriott <basilisk@internode.on.net>
Signed-off-by: Christian Brabandt <cb@256bit.org>
13 days agoruntime(doc): Tweak documentation style in channel.txt
Hirohito Higashi [Wed, 15 Apr 2026 17:00:19 +0000 (17:00 +0000)] 
runtime(doc): Tweak documentation style in channel.txt

closes: #19978

Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
13 days agopatch 9.2.0352: 'winhighlight' of left window blends into right window v9.2.0352
Foxe Chen [Wed, 15 Apr 2026 16:52:09 +0000 (16:52 +0000)] 
patch 9.2.0352: 'winhighlight' of left window blends into right window

Problem: 'winhighlight' of left window blends into right window
Solution: Allow to push a NULL highlight override (Foxe Chen)

closes: #19980

Signed-off-by: Foxe Chen <chen.foxe@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
13 days agopatch 9.2.0351: repeat_string() can be improved v9.2.0351
Yasuhiro Matsumoto [Wed, 15 Apr 2026 04:12:55 +0000 (04:12 +0000)] 
patch 9.2.0351: repeat_string() can be improved

Problem:  repeat_string() can be improved
Solution: Replace the for() loop by an exponential growing while loop
          (Yasuhiro Matsumoto)

closes: #19977

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
13 days agoruntime(zip): also block single leading slash and absolute paths in Extract
q1uf3ng [Wed, 15 Apr 2026 04:03:02 +0000 (04:03 +0000)] 
runtime(zip): also block single leading slash and absolute paths in Extract

zip#Write(): the Windows path check did not match a single leading
slash (/path), which resolves to the current drive root on Windows.
Simplify the regex to match any leading slash or backslash.

zip#Extract(): add absolute path checks for both Unix and Windows,
matching the existing checks in zip#Write().

closes: #19976

Signed-off-by: q1uf3ng <glna9@protonmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
13 days agopatch 9.2.0350: Enabling modelines poses a risk v9.2.0350
Christian Brabandt [Tue, 14 Apr 2026 18:51:54 +0000 (18:51 +0000)] 
patch 9.2.0350: Enabling modelines poses a risk

Problem:  Enabling modelines poses a risk, cannot whitelist specific
          modelines
Solution: Include the 'modelinestrict' option, enabled by default, that
          allows only a few very specific modelines, all others will be
          ignored

When set (which it is by default), only the following settings will be
applied, all others will be ignored:

  'autoindent'
  'cindent'
  'commentstring'
  'expandtab'
  'filetype'
  'foldcolumn'
  'foldenable'
  'foldmethod'
  'modifiable'
  'readonly'
  'rightleft'
  'shiftwidth'
  'smartindent'
  'softtabstop'
  'spell'
  'spelllang'
  'tabstop'
  'textwidth'
  'varsofttabstop'
  'vartabstop'

Supported by AI

closes: #19875

Signed-off-by: Christian Brabandt <cb@256bit.org>
13 days agopatch 9.2.0349: cannot style non-current window separator v9.2.0349
Hirohito Higashi [Tue, 14 Apr 2026 18:39:52 +0000 (18:39 +0000)] 
patch 9.2.0349: cannot style non-current window separator

Problem:  cannot style non-current window separator
Solution: Add the VertSplitNC highlighting group
          (Hirohito Higashi).

Add VertSplitNC highlight group for vertical separators of non-current
windows, similar to StatusLine/StatusLineNC distinction.  The separator
adjacent to the current window uses VertSplit, others use VertSplitNC.
Default: linked to VertSplit.

At the current window's status line rows, the separator cell is drawn as
a space with the StatusLine highlight so it blends into the status line
without a stray fillchar glyph.

Also:
- :redrawstatus[!] now also redraws vertical separators.
- statusline height changes trigger vsep redraw.

closes: #19951

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
13 days agopatch 9.2.0348: potential buffer underrun when setting statusline like option v9.2.0348
Christian Brabandt [Tue, 14 Apr 2026 18:18:36 +0000 (18:18 +0000)] 
patch 9.2.0348: potential buffer underrun when setting statusline like option

Problem:  potential buffer underrun when settings statusline like option
          (q1uf3ng)
Solution: Validate that p > out before accessing p[-1]

closes: #19961

Signed-off-by: Christian Brabandt <cb@256bit.org>
13 days agoCI: Separate out ASan tests
Ozaki Kiichi [Tue, 14 Apr 2026 18:13:32 +0000 (18:13 +0000)] 
CI: Separate out ASan tests

closes: #19962

Signed-off-by: Ozaki Kiichi <gclient.gaap@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0347: Vim9: script-local variable not found v9.2.0347
Yegappan Lakshmanan [Tue, 14 Apr 2026 17:02:21 +0000 (17:02 +0000)] 
patch 9.2.0347: Vim9: script-local variable not found

Problem:  Vim9: script-local variable not found after function call
          (Mao-Yining)
Solution: Accept a script local variable in a function which overrides a
          previous block-scope variable (Yegappan Lakshmanan)

fixes:  #19959
closes: #19963

Signed-off-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0346: Wrong cursor position when entering command line window v9.2.0346
Hirohito Higashi [Tue, 14 Apr 2026 16:56:03 +0000 (16:56 +0000)] 
patch 9.2.0346: Wrong cursor position when entering command line window

Problem:  Wrong cursor position when entering command line window
Solution: Add check_cursor() command to verify the cursor position
          (Hirohito Higashi).

When opening the command-line window with CTRL-F after typing a command
that fills the screen width, the cursor was placed past the end of the
line.  Add check_cursor() after setting State to MODE_NORMAL so the
cursor is adjusted to the last character.

Also fix the cmdwin prefix character (e.g. ':') being drawn on wrapped
continuation rows.  Draw an empty space instead so that the text
alignment is preserved.

closes: #19964

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0345: Wrong autoformatting with 'autocomplete' v9.2.0345
zeertzjq [Tue, 14 Apr 2026 16:48:55 +0000 (16:48 +0000)] 
patch 9.2.0345: Wrong autoformatting with 'autocomplete'

Problem:  Wrong autoformatting with 'autocomplete'.
Solution: Don't trigger autoformatting when ending autocompletion
          without selecting an item (zeertzjq).

fixes:  #19954
closes: #19970

Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0344: channel: ch_listen() can bind to network interface v9.2.0344
Zdenek Dohnal [Tue, 14 Apr 2026 16:37:25 +0000 (16:37 +0000)] 
patch 9.2.0344: channel: ch_listen() can bind to network interface

Problem:  channel: ch_listen() can bind to network interface
Solution: Only allow to use Unix domain sockets or localhost interface
          (Zdenek Dohnal)

related: #19231
related: #19799
closes:  #19973

Signed-off-by: Zdenek Dohnal <zdohnal@redhat.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agoruntime(doc): Tweak documentation style in options.txt
Hirohito Higashi [Tue, 14 Apr 2026 16:31:10 +0000 (16:31 +0000)] 
runtime(doc): Tweak documentation style in options.txt

closes: #19971

Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0343: tests: test_clientserver may fail on slower systems v9.2.0343
James McCoy [Tue, 14 Apr 2026 16:25:50 +0000 (16:25 +0000)] 
patch 9.2.0343: tests: test_clientserver may fail on slower systems

Problem:  tests: test_clientserver may fail on slower systems
Solution: Wait for argc() before checking argv() (James McCoy).

On slower systems, the argv() check may run before the server has
populated the arg list.

Add a wait for argc() to be 3 to be more tolerant of such systems

closes: #19974

Signed-off-by: James McCoy <jamessan@jamessan.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0342: tests: test_excmd.vim leaves swapfiles behind v9.2.0342
Christian Brabandt [Tue, 14 Apr 2026 16:10:43 +0000 (16:10 +0000)] 
patch 9.2.0342: tests: test_excmd.vim leaves swapfiles behind

Problem:  tests: test_excmd.vim leaves swapfiles behind
Solution: Close open buffer using :bw!

related: #19975

Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0341: some functions can be run from the sandbox v9.2.0341
q1uf3ng [Tue, 14 Apr 2026 15:58:40 +0000 (15:58 +0000)] 
patch 9.2.0341: some functions can be run from the sandbox

Problem:  some functions can be run from the sandbox
Solution: Block them, so they are not accessible from a modeline
          (q1uf3ng)

closes: #19975

Co-authored-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: q1uf3ng <q1uf3ng@protone.me>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agoruntime(zip): Detect path traversal issues on Windows
Christian Brabandt [Tue, 14 Apr 2026 12:42:48 +0000 (14:42 +0200)] 
runtime(zip): Detect path traversal issues on Windows

Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agoRevert "runtime(jjdescription): allow to configure summary width"
Christian Brabandt [Mon, 13 Apr 2026 13:48:28 +0000 (15:48 +0200)] 
Revert "runtime(jjdescription): allow to configure summary width"

This reverts commit 86ae6858ababe1f80476368c617dc1812df5b781.

related: #19905

Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0340: pum_redraw() may cause flicker v9.2.0340
Yasuhiro Matsumoto [Sun, 12 Apr 2026 16:24:09 +0000 (16:24 +0000)] 
patch 9.2.0340: pum_redraw() may cause flicker

Problem:  pum_redraw() may cause flicker
Solution: Wrap pum_redraw() in synchronized output to avoid flicker
          (Yasuhiro Matsumoto)

closes: #19955

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agoFix a few typos
Yasuhiro Matsumoto [Sun, 12 Apr 2026 16:19:36 +0000 (16:19 +0000)] 
Fix a few typos

closes: #19953

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0339: regexp: nfa_regmatch() allocates and frees too often v9.2.0339
Yasuhiro Matsumoto [Sun, 12 Apr 2026 16:12:22 +0000 (16:12 +0000)] 
patch 9.2.0339: regexp: nfa_regmatch() allocates and frees too often

Problem:  nfa_regmatch() allocates and frees two list buffers on every
          call, causing unnecessary memory allocation overhead for
          frequently used patterns.
Solution: Cache the list buffers in the regprog struct and reuse them
          on subsequent top-level calls. Recursive calls still allocate
          their own buffers. Free cached buffers in nfa_regfree()
          (Yasuhiro Matsumoto).

Benchmark: 10K lines, `:%s` x50 iterations

| Pattern | Before | After | Improvement |
|---|---|---|---|
| `\<\(\w\+\%(ing\|tion\|ed\|ly\)\|\w\{3,}\)\>` (many matches) | 4.384s | 4.299s | -2% |
| `\(foo\|bar\|baz\)\{3,}\(qux\|quux\|corge\)\{2,}...` (no match, high nstate) | 16.927s | 3.015s | -82% |

closes: #19956

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agoruntime(jjdescription): allow to configure summary width
Emilia [Sat, 11 Apr 2026 15:34:53 +0000 (15:34 +0000)] 
runtime(jjdescription): allow to configure summary width

Allow to configure max length for the summary line and fall back to gits
setting.

closes: #19905

Signed-off-by: Emilia <emilia@bewitching.dev>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0338: Cannot handle mouseclicks in the tabline v9.2.0338
Yasuhiro Matsumoto [Sat, 11 Apr 2026 15:22:24 +0000 (15:22 +0000)] 
patch 9.2.0338: Cannot handle mouseclicks in the tabline

Problem:  Cannot handle mouseclicks in the tabline
Solution: Support %[FuncName] click regions in 'tabline', add "area" key
          to the click info dict (Yasuhiro Matsumoto).

The previous implementation resolved and stored click regions only for
per-window statuslines; the tabline path in win_redr_custom() (wp==NULL)
parsed %[FuncName] but discarded the regions, and tabline clicks were
dispatched via TabPageIdxs[] which didn't know about them.

Add a global tabline_stl_click array populated from the tabline path,
refactor stl_click_handler() to take the regions directly, and dispatch
matching clicks from do_mouse() before falling through to tab selection.
The winid entry in the callback dict is 0 for tabline clicks.

related: #19841
closes:  #19950

Supported by AI.

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0337: list indexing broken on big-endian 32-bit platforms v9.2.0337
James McCoy [Sat, 11 Apr 2026 15:00:50 +0000 (15:00 +0000)] 
patch 9.2.0337: list indexing broken on big-endian 32-bit platforms

Problem:  check_range_index_one() expects a long * but n1 is a
          varnumber_T. Casting varnumber_T * to long * is undefined
          behaviour and reads the wrong bytes on big-endian platforms
          (John Paul Adrian Glaubitz)
Solution: Use a local long variable and pass that pointer to
          check_range_index_one() (James McCoy)

fixes:  #19798
closes: #19952

Signed-off-by: James McCoy <jamessan@jamessan.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agoruntime(hlyank): verify winid in lambda before matchdelete()
Christian Brabandt [Sat, 11 Apr 2026 14:53:48 +0000 (14:53 +0000)] 
runtime(hlyank): verify winid in lambda before matchdelete()

Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0336: libvterm: no terminal reflow support v9.2.0336
Cimbali [Fri, 10 Apr 2026 22:02:09 +0000 (22:02 +0000)] 
patch 9.2.0336: libvterm: no terminal reflow support

Problem:  libvterm: no terminal reflow support
Solution: Support for reflowing, sync libvterm to revision 843
          (Cimbali)

fixes:  #2865
closes: #8365
closes: #19863

Co-authored-by: Paul "LeoNerd" Evans <leonerd@leonerd.org.uk>
Signed-off-by: Cimbali <me@cimba.li>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0335: json_encode() uses recursive algorithm v9.2.0335
Yasuhiro Matsumoto [Fri, 10 Apr 2026 21:37:44 +0000 (21:37 +0000)] 
patch 9.2.0335: json_encode() uses recursive algorithm

Problem:  json_encode() uses recursive algorithm
Solution: Convert from recursive to iterative algorithm to prevent
          stack overflow on deep recursive levels
          (Yasuhiro Matsumoto).

closes: #19839

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0334: GTK: window geometry shrinks with with client-side decorations v9.2.0334
Gary Johnson [Fri, 10 Apr 2026 21:23:38 +0000 (21:23 +0000)] 
patch 9.2.0334: GTK: window geometry shrinks with with client-side decorations

Problem:  On GTK3 with client-side decorations the window opens with
          wrong &columns/&lines, and each :tabnew/:tabclose cycle
          shrinks the size further.
Solution: Measure and compensate for the CSD frame offset, discard
          spurious configure events from tabline show/hide
          (Gary Johnson).

closes: #19853

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Gary Johnson <garyjohn@spocom.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0333: filetype: PklProject files are not recognized v9.2.0333
Nihaal Sangha [Fri, 10 Apr 2026 18:40:37 +0000 (18:40 +0000)] 
patch 9.2.0333: filetype: PklProject files are not recognized

Problem:  filetype: PklProject files are not recognized
Solution: Detect PklProject files as pkl filetype
          (Nihaal Sangha).

Reference:
https://pkl-lang.org/
https://github.com/apple/pkl
https://github.com/apple/pkl-pantry

closes: #19948

Signed-off-by: Nihaal Sangha <nihaal.git@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agoruntime(doc): Update documentation on statusline click handler
Christian Brabandt [Fri, 10 Apr 2026 18:37:25 +0000 (18:37 +0000)] 
runtime(doc): Update documentation on statusline click handler

related: #19841

Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0332: popup: still opacity rendering issues v9.2.0332
Yasuhiro Matsumoto [Fri, 10 Apr 2026 17:43:59 +0000 (17:43 +0000)] 
patch 9.2.0332: popup: still opacity rendering issues

Problem:  popup: still opacity rendering issues
Solution: Fix remaining issues, see below
          (Yasuhiro Matsumoto).

This PR fixes the following issues:

- Padding blend hole at wide char boundary: when a padding cell overlaps
  the second half of a wide character, the right half's attr value is
  unreliable. Use the left half's saved attr for blending instead.

- Wide char background split at popup boundary: when a wide character in
  an upper popup straddles the edge of a lower opacity popup, both
  halves got different background colors. Since terminals cannot render
  different left/right background colors for a wide character, detect
  the lower popup with popup_is_over_opacity() and use the non-popup
  side's underlying attr for both halves.

- Wrong blend color with cterm-only highlights under 'termguicolors':
  when a popup highlight has ctermbg but no guibg, bg_rgb is set to
  CTERMCOLOR (not INVALCOLOR). hl_blend_attr() used this value as a real
  RGB color, producing gray instead of the intended color. Use
  COLOR_INVALID() to detect both INVALCOLOR and CTERMCOLOR, and fall back
  to converting the cterm color number to RGB.

closes: #19943

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0331: spellfile: stack buffer overflows in spell file generation v9.2.0331
Christian Brabandt [Thu, 9 Apr 2026 22:27:36 +0000 (22:27 +0000)] 
patch 9.2.0331: spellfile: stack buffer overflows in spell file generation

Problem:  spell_read_aff() uses sprintf() into a fixed-size stack buffer
          without bounds checking. store_aff_word() uses STRCAT() to
          append attacker-controlled strings into newword[MAXWLEN] without
          checking remaining space. Both are reachable via :mkspell with
          crafted .aff/.dic files (xinyi234)
Solution: Replace sprintf() with vim_snprintf() in spell_read_aff().
          Replace STRCAT() with STRNCAT() with explicit remaining-space
          calculation in store_aff_word().

closes: #19944

Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0330: tests: some patterns in tar and zip plugin tests not strict enough v9.2.0330
zeertzjq [Thu, 9 Apr 2026 22:21:23 +0000 (22:21 +0000)] 
patch 9.2.0330: tests: some patterns in tar and zip plugin tests not strict enough

Problem:  Some patterns in tar and zip plugin tests not strict enough.
Solution: Use assert_equal() for lines that should match exactly. Match
          a literal dot properly (zeertzjq).

closes: #19946

Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0329: tests: test_indent.vim leaves swapfiles behind v9.2.0329
Christian Brabandt [Thu, 9 Apr 2026 21:30:19 +0000 (21:30 +0000)] 
patch 9.2.0329: tests: test_indent.vim leaves swapfiles behind

Problem:  tests: test_indent.vim leaves swapfiles behind
Solution: Close open buffer using :bw! instead of :close!

Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0328: Cannot handle mouseclicks in the statusline v9.2.0328
Yasuhiro Matsumoto [Thu, 9 Apr 2026 21:15:30 +0000 (21:15 +0000)] 
patch 9.2.0328: Cannot handle mouseclicks in the statusline

Problem:  Cannot handle mouseclicks in the statusline
Solution: Add the %[FuncName] statusline item to define clickable
          regions with a callback function. (Yasuhiro Matsumoto)

closes: #19841

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0327: filetype: uv scripts are not detected v9.2.0327
Christian Brabandt [Thu, 9 Apr 2026 20:50:01 +0000 (20:50 +0000)] 
patch 9.2.0327: filetype: uv scripts are not detected

Problem:  filetype: uv scripts are not detected
          (Asger Hautop Drewsen)
Solution: Detect uv scripts as python filetype if the shebang line
          contains "uv run"

Reference:
https://docs.astral.sh/uv/guides/scripts/#using-a-shebang-to-create-an-executable-file

fixes: #19941

Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agoruntime(jjdescription): Add highlighting for 'Renamed' status lines
JoĂ«l Stemmer [Thu, 9 Apr 2026 19:32:15 +0000 (19:32 +0000)] 
runtime(jjdescription): Add highlighting for 'Renamed' status lines

`jj status` output uses the 'R' prefix for renamed files.

closes: #19879

Signed-off-by: Joël Stemmer <jstemmer@google.com>
Signed-off-by: Gregory Anders <greg@gpanders.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agoruntime(jjdescription): Anchor status matches to start of line
JoĂ«l Stemmer [Thu, 9 Apr 2026 19:30:53 +0000 (19:30 +0000)] 
runtime(jjdescription): Anchor status matches to start of line

The regex for status line highlighting was too broad, `jjComment` lines
containing e.g. the letter 'A' followed by a space anywhere in the line
were highlighted.

related: #19879

Signed-off-by: Joël Stemmer <jstemmer@google.com>
Signed-off-by: Gregory Anders <greg@gpanders.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0326: runtime(tar): but with dotted path v9.2.0326
Aaron Burrow [Thu, 9 Apr 2026 19:11:16 +0000 (19:11 +0000)] 
patch 9.2.0326: runtime(tar): but with dotted path

Problem:  runtime(tar): but with dotted path
Solution: Do not strip everything after the first dot
          (Aaron Burrow)

tar#Extract was getting the extensionless basename by
stripping away everything starting with the leftmost
dot.  So if a directory had a dot or the file had an
'extra' dot then the code did the wrong thing.  For
example, if it was given:

  /tmp/foo.bar/baz.tar.gz

Then it would treat /tmp/foo as the extensionless
basename, but it actually should have grabbed:

  /tmp/foo.bar/baz

This patch fixes the issue by instead looking at the
rightmost dot(s).

This bug was discovered by ChatGPT 5.4.  I wrote the
patch and tested vim.

closes: #19930

Signed-off-by: Aaron Burrow <burrows@fastmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0325: runtime(tar): bug in zstd handling v9.2.0325
Aaron Burrow [Thu, 9 Apr 2026 19:06:13 +0000 (19:06 +0000)] 
patch 9.2.0325: runtime(tar): bug in zstd handling

Problem:  patch 9.2.0325: runtime(tar): bug in zstd handling
Solution: use correct --zstd argument, separated from other arguments,
          rework testing framework (Aaron Burrow).

The tar.vim plugin allows vim to read and manipulate zstd archives,
but it had a bug that caused extraction attempts to fail.
Specifically, if the archive has a .tar.zst or .tzst extension, then
the code was generating invalid extraction commands that looked like
this:

  tar --zstdpxf foo.tar.zst foo

When they should be like this:

  tar --zstd -pxf foo.tar.zst foo

This patch changes the flag manipulation logic so that --zstd isn't
glued to pxf.

The labor for this change was divided between ChatGPT 5.4 and me.
ChatGPT 5.4 identified the issue (from a code scan?), and I wrote
the patch and tested vim.

related: #19930

Signed-off-by: Aaron Burrow <burrows@fastmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0324: 0x9b byte not unescaped in <Cmd> mapping v9.2.0324
zeertzjq [Thu, 9 Apr 2026 18:55:02 +0000 (18:55 +0000)] 
patch 9.2.0324: 0x9b byte not unescaped in <Cmd> mapping

Problem:  0x9b byte not unescaped in <Cmd> mapping (BenYip).
Solution: Translate K_CSI to CSI like what is done in vgetc().
          (zeertzjq).

fixes:  #19936
closes: #19937

Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agoruntime(doc): Tweak documentation style a bit
Hirohito Higashi [Thu, 9 Apr 2026 18:49:43 +0000 (18:49 +0000)] 
runtime(doc): Tweak documentation style a bit

closes: #19939

Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agoruntime(org): Link to generic bold/Italic highlighting groups
Maxim Kim [Thu, 9 Apr 2026 18:41:47 +0000 (18:41 +0000)] 
runtime(org): Link to generic bold/Italic highlighting groups

fixes: #19933

Signed-off-by: Maxim Kim <habamax@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agoruntime(help): support highlighting groups in translated syntax doc
Hirohito Higashi [Thu, 9 Apr 2026 18:38:35 +0000 (18:38 +0000)] 
runtime(help): support highlighting groups in translated syntax doc

closes: #19942

Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agoruntime(vimball): detect more path traversal attacks
Christian Brabandt [Thu, 9 Apr 2026 18:35:39 +0000 (18:35 +0000)] 
runtime(vimball): detect more path traversal attacks

Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0323: filetype: buf.lock files are not recognized v9.2.0323
Stefan VanBuren [Wed, 8 Apr 2026 18:28:08 +0000 (18:28 +0000)] 
patch 9.2.0323: filetype: buf.lock files are not recognized

Problem:  filetype: buf.lock files are not recognized
Solution: Detect buf.lock files as yaml filetype
          (Stefan VanBuren)

Reference:
https://buf.build/docs/configuration/v2/buf-lock/

closes: #19935

Signed-off-by: Stefan VanBuren <svanburen@buf.build>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0322: tests: test_popupwin fails v9.2.0322
Yasuhiro Matsumoto [Wed, 8 Apr 2026 18:18:53 +0000 (18:18 +0000)] 
patch 9.2.0322: tests: test_popupwin fails

Problem:  tests: test_popupwin fails (after v9.2.0319)
Solution: Regenerate the dump file (Yasuhiro Matsumoto).

The reference dump for Test_popupwin_opacity_wide_2 was not updated
when patch 9.2.0319 changed the blending behavior for double-width
characters at popup padding boundaries. The covered half of a
double-width character now correctly shows a space instead of the
full character.

related: #19881
closes:  #19934

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0321: MS-Windows: No OpenType font support v9.2.0321
Yasuhiro Matsumoto [Tue, 7 Apr 2026 21:07:46 +0000 (21:07 +0000)] 
patch 9.2.0321: MS-Windows: No OpenType font support

Problem:  MS-Windows: No OpenType font support
Solution: Allow specifying OpenType font features directly in 'guifont'
          (Yasuhiro Matsumoto).

Allow specifying OpenType font features directly in 'guifont' using
the ':f' option (e.g., :set guifont=Cascadia_Code:h14:fss19=1:fcalt=0).
Each ':fXXXX=N' sets a single OpenType feature tag with a parameter
value.  Multiple features can be specified by repeating the ':f' option.

This only takes effect when 'renderoptions' is set to use DirectWrite
(type:directx).  Default features (calt, liga, clig, rlig, kern) are
preserved unless explicitly overridden.

closes: #19857

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0320: several bugs with text properties v9.2.0320
Hirohito Higashi [Tue, 7 Apr 2026 20:46:10 +0000 (20:46 +0000)] 
patch 9.2.0320: several bugs with text properties

Problem:  several bugs with text properties
Solution: Fix the bugs, rework the text properties work

related: #19685
fixes:   #19680
fixes:   #19681
fixes:   #12568
fixes:   #19256
closes:  #19869

Co-Authored-By: Paul Ollis <paul@cleversheep.org>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0319: popup: rendering issues with partially transparent popups v9.2.0319
Yasuhiro Matsumoto [Tue, 7 Apr 2026 20:26:17 +0000 (20:26 +0000)] 
patch 9.2.0319: popup: rendering issues with partially transparent popups

Problem:  popup: rendering issues with partially transparent popups.
Solution: Redraw the area under the old popup position on move or
          resize. Apply the background blend only to the covered half of
          a double-width character. (Yasuhiro Matsumoto)

closes: #19881

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0318: cannot configure opacity for popup menu v9.2.0318
Yasuhiro Matsumoto [Tue, 7 Apr 2026 19:51:20 +0000 (19:51 +0000)] 
patch 9.2.0318: cannot configure opacity for popup menu

Problem:  cannot configure opacity for popup menu
Solution: Add the 'pumopt' option, consolidate existing pum options into
          the pumopt option (Yasuhiro Matsumoto)

closes: #19931

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agoruntime(doc): document gitcommit_summary_length
Christian Brabandt [Tue, 7 Apr 2026 19:37:14 +0000 (19:37 +0000)] 
runtime(doc): document gitcommit_summary_length

related: #19905

Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agoruntime(bitbake): Update syntax script
Antonin Godard [Tue, 7 Apr 2026 19:28:27 +0000 (19:28 +0000)] 
runtime(bitbake): Update syntax script

1) add syntax for include_all

The include_all directive was introduced in [1]. It uses the same syntax
as include or require, taking one or more paths as argument.

2) add syntax for inherit_defer

The inherit_defer directive was introduced in [2]. It uses the same syntax
as inherit, taking one or more class name as argument.

3) add syntax for addpylib

The addpylib directive was introduced in [3]. It uses a syntax similar
to addtask or addhandler, taking a directory and python namespace as
argument.

[1]: https://git.openembedded.org/bitbake/commit/?id=d01d5593e7829ac60f37bc23cb87dc6917026471
[2]: https://git.openembedded.org/bitbake/commit/?id=5c2e840eafeba1f0f754c226b87bfb674f7bea29
[3]: https://git.openembedded.org/bitbake/commit/?id=afb8478d3853f6edf3669b93588314627d617d6b

Signed-off-by: Antonin Godard <antonin@godard.cc>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0317: listener functions do not check secure flag v9.2.0317
Christian Brabandt [Tue, 7 Apr 2026 18:57:04 +0000 (18:57 +0000)] 
patch 9.2.0317: listener functions do not check secure flag

Problem:  listener functions do not check secure flag
          (syndicate)
Solution: Call check_secure()

Signed-off-by: Christian Brabandt <cb@256bit.org>
2 weeks agopatch 9.2.0316: [security]: command injection in netbeans interface via defineAnnoType v9.2.0316
Christian Brabandt [Tue, 7 Apr 2026 17:32:02 +0000 (17:32 +0000)] 
patch 9.2.0316: [security]: command injection in netbeans interface via defineAnnoType

Problem:  [security]: The netbeans defineAnnoType command passes typeName, fg and bg
          unsanitized to coloncmd(), allowing a malicious server to inject
          arbitrary Ex commands via '|'. Similarly, specialKeys does not
          validate key tokens before building a map command.
Solution: Validate typeName, fg and bg against an allowlist of safe
          characters before passing them to coloncmd()

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6

Supported by AI

Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agoruntime(doc): clarify incsearch feature and typed chars
Christian Brabandt [Mon, 6 Apr 2026 14:01:20 +0000 (14:01 +0000)] 
runtime(doc): clarify incsearch feature and typed chars

fixes: #19886

Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0315: missing bound-checks v9.2.0315
Yasuhiro Matsumoto [Mon, 6 Apr 2026 13:53:31 +0000 (13:53 +0000)] 
patch 9.2.0315: missing bound-checks

Problem:  missing bound-checks
Solution: Add defensive guards against potential buffer overflow
          (Yasuhiro Matsumoto)

Add bounds checking and integer overflow guards across multiple files
as a defensive measure. While these code paths are unlikely to be
exploitable in practice, the guards prevent undefined behavior in
edge cases.

- libvterm/vterm.c: use heap tmpbuffer instead of stack buffer in
  vsprintf() fallback path
- channel.c: validate len in channel_consume() before mch_memmove()
- spell.c: use long instead of int for addlen to avoid signed overflow
  in size_t subtraction
- alloc.c: add SIZE_MAX overflow check in ga_grow_inner() before
  itemsize multiplication
- list.c: add overflow check before count * sizeof(listitem_T)
- popupwin.c: add overflow check before width * height allocation
- insexpand.c: add overflow check before compl_num_bests multiplication
- regexp_bt.c: replace sprintf() with vim_snprintf() in regprop()
- spellfile.c: use SIZE_MAX instead of LONG_MAX for allocation overflow
  check

closes: #19904

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0314: channel: can bind to all network interfaces v9.2.0314
Zdenek Dohnal [Mon, 6 Apr 2026 13:42:42 +0000 (13:42 +0000)] 
patch 9.2.0314: channel: can bind to all network interfaces

Problem:  channel: can bind to all network interfaces in ch_listen()
          (after v9.2.0153)
Solution: Restrict to a valid hostname, do not allow to bind on all
          network interfaces (Zdenek Dohnal).

This will prevent unintentional binding the process to public network
interfaces, and opening Vim to communication from outside network if
firewall allows it.

related: #19231
closes:  #19799

Signed-off-by: Zdenek Dohnal <zdohnal@redhat.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0313: Callback channel not registered in GUI v9.2.0313
Foxe Chen [Mon, 6 Apr 2026 13:35:27 +0000 (13:35 +0000)] 
patch 9.2.0313: Callback channel not registered in GUI

Problem:  Callback channel not registered in GUI
Solution: Call channel_gui_register_one() in GUI mode
          (Foxe Chen).

closes: #19858

Signed-off-by: Foxe Chen <chen.foxe@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0312: C-type names are marked as translatable v9.2.0312
Eisuke Kawashima [Mon, 6 Apr 2026 13:27:31 +0000 (13:27 +0000)] 
patch 9.2.0312: C-type names are marked as translatable

Problem:  C-type names are marked as translatable
Solution: Use them as-is, do not translate them
          (Eisuke Kawashima)

closes: #19861

Signed-off-by: Eisuke Kawashima <e-kwsm@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0311: redrawing logic with text properties can be improved v9.2.0311
Yasuhiro Matsumoto [Mon, 6 Apr 2026 13:19:04 +0000 (13:19 +0000)] 
patch 9.2.0311: redrawing logic with text properties can be improved

Problem:  redrawing logic with text properties can be improved in
          win_line()
Solution: Avoid repeated sorts, use stack storage for small
          properties, pre-compute whether trailing virtual text follows
          (Yasuhiro Matsumoto)

closes: #19880

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0310: unnecessary work in vim_strchr() and find_term_bykeys() v9.2.0310
Yasuhiro Matsumoto [Mon, 6 Apr 2026 13:12:39 +0000 (13:12 +0000)] 
patch 9.2.0310: unnecessary work in vim_strchr() and find_term_bykeys()

problem:  unnecessary work in vim_strchr() and find_term_bykeys()
Solution: Redirect vim_strchr() to vim_strbyte() for ASCII input
          Add an early exit to find_term_bykeys() using the terminal
          leader table, mirroring check_termcode(). Reduces instruction
          count on startup by about 27%. (Yasuhiro Matsumoto)

closes: #19902

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0309: Missing out-of-memory check to may_get_cmd_block() v9.2.0309
John Marriott [Mon, 6 Apr 2026 13:07:31 +0000 (13:07 +0000)] 
patch 9.2.0309: Missing out-of-memory check to may_get_cmd_block()

Problem:  Missing out-of-memory check to may_get_cmd_block()
Solution: Return p unchanged in case of out-of-memory (John Marriott)

closes: #19906

Signed-off-by: John Marriott <basilisk@internode.on.net>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agoruntime(log): clean up and modernize log syntax
Mao-Yining [Mon, 6 Apr 2026 13:02:04 +0000 (13:02 +0000)] 
runtime(log): clean up and modernize log syntax

- Rename groups to consistent log* naming (LogString→logString, etc.)
- Remove redundant logOperator/logBrackets, use logSymbol for special chars
- Simplify level keywords by removing case variants
- Consolidate syslog column patterns into logSysColumn
- Move custom highlights to portable ctermfg/guifg names
- Update maintainer email address

closes: #19917

Signed-off-by: Mao-Yining <mao.yining@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0308: Error message E1547 is wrong v9.2.0308
Mao-Yining [Mon, 6 Apr 2026 12:54:33 +0000 (12:54 +0000)] 
patch 9.2.0308: Error message E1547 is wrong

Problem:  Error message E1547 is wrong
Solution: Fix error message, re-generate Chinese translations
          (Mao-Yining).

closes: #19920

Signed-off-by: Mao-Yining <mao.yining@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0307: more mismatches between return types and documentation v9.2.0307
Hirohito Higashi [Mon, 6 Apr 2026 12:49:53 +0000 (12:49 +0000)] 
patch 9.2.0307: more mismatches between return types and documentation

Problem:  more mismatches between return types and documentation
Solution: Update documentation, fix return type for remote_foreground()
          and test_mswin_event() (Hirohito Higashi)

Doc summary table fixes:
- ch_info: String -> Dict
- spellbadword: String -> List
- undotree: List -> Dict
- test_getvalue: any -> Number
- instanceof, popup_filter_menu, popup_filter_yesno: Number -> Bool
- remote_foreground: Number -> none
- test_mswin_event: bool -> Bool

evalfunc.c fixes:
- remote_foreground: ret_string -> ret_void
- test_mswin_event: ret_number -> ret_bool

Detail "Return type:" fixes:
- instanceof: Number -> vim9-boolean
- remote_foreground: Number -> void
- popup_filter_menu, popup_filter_yesno: Number -> vim9-boolean

related: #19922
closes:  #19923

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0306: runtime(tar): some issues with lz4 support v9.2.0306
Aaron Burrow [Mon, 6 Apr 2026 12:46:40 +0000 (12:46 +0000)] 
patch 9.2.0306: runtime(tar): some issues with lz4 support

Problem:  runtime(tar): some issues with lz4 support
Solution: Fix bugs (see below) (Aaron Burrow)

The tar plugin allows users to extract files from tar archives that are
compressed with lz4. But, tar#Extract() builds malformed extraction commands
for lz4-compressed tar archives. This commit fixes three issues in that code.
The first affects archives with a .tlz4 extension and the other two affect
archives with .tar.lz4 extension (but one of these is symmetric to the issue
that .tlz4 archives had).

(1) When trying to extract .tlz4 archives the command created by
tar#Extract looked like this:

    tar -I lz4pxf foo.tlz4 foo

This isn't right.  It should be something like this:

    tar -I lz4 -pxf foo.tlz4 foo

This was happening because tar.plugin is just substituting on the
first - in "tar -pxf".  This works fine if we just add a simple flag for
extraction (eg, z for .tgz), but for lz4 we need to add "-I lz4".

I don't believe that there is an obvious good way to fix this without
reworking the way the command is generated.  Probably we should collect
the command and flags separately and the flags should be stored in a
set. Then put everything together into a string just before issuing it
as an extraction command.  Unfortunately, this might break things for users
because they have access to tar_extractcmd.

This patch just makes the substitution a little bit more clever so that it
does the right thing when substituting on a string like "tar -pxf".

(2) .tar.lz4 extractions had the same issue, which my patch fixes in
the same way.

(3) .tar.lz4 extractions had another issue.  There was a space missing
in the command generated by tar#Extract.  This meant that commands
looked like this (notice the lack of space between the archive and output
file names):

    tar -I lz4pxf foo.tar.lz4foo

This patch just puts a space where it should be.

Finally, I should note that ChatGPT 5.4 initially identified this issue
in the code and generated the test cases.  I reviewed the test cases,
wrote the patch, and actually ran vim against the tests (both with and
without the patch).

closes: #19925

Signed-off-by: Aaron Burrow <burrows@fastmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agoruntime(vim9): Fix dist#vim9#Open() spaced paths and SIGPIPE crashes
Furkan Sahin [Mon, 6 Apr 2026 12:43:07 +0000 (12:43 +0000)] 
runtime(vim9): Fix dist#vim9#Open() spaced paths and SIGPIPE crashes

Problem:    dist#vim9#Open() fails to open files with spaces on Linux
            because Launch() splits the command string. Also,
            background GUI viewers (e.g., xdg-open) crash with SIGPIPE
            when Vim destroys the default job_start() IO pipes.
Solution:   Use job_start() with 'sh -c' to let the POSIX shell parse
            the shellescaped quotes safely. Set 'in_io', 'out_io', and
            'err_io' to 'null' to completely detach the background
            process and prevent pipe crashes. Unify the Launch()
            execution block across all operating systems.

closes: #19928
fixes:  #19916

Signed-off-by: Furkan Sahin <furkan-dev@proton.me>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0305: mismatch between return types and documentation v9.2.0305
Hirohito Higashi [Sun, 5 Apr 2026 16:53:52 +0000 (16:53 +0000)] 
patch 9.2.0305: mismatch between return types and documentation

Problem:  mismatch between return types and documentation
Solution: Fix documentation, update f_err_teapot() return type to void
          (Hirohito Higashi)

- Fix summary table in builtin.txt: feedkeys, foreground, setcharsearch,
  term_wait, test_void, wildtrigger, ch_sendraw from non-none to none;
  listener_remove and prop_add from none to Number
- Fix err_teapot in evalfunc.c: ret_number_bool to ret_void
- Fix "Return type:" in detailed doc sections (64 functions across builtin.txt,
  channel.txt, terminal.txt, popup.txt, testing.txt, textprop.txt) from wrong
  types to void
- Add missing "Return type: void" for prompt_setcallback and prop_add_list

closes: #19922

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0304: tests: test for 9.2.0285 doesn't always fail without the fix v9.2.0304
zeertzjq [Sun, 5 Apr 2026 16:45:29 +0000 (16:45 +0000)] 
patch 9.2.0304: tests: test for 9.2.0285 doesn't always fail without the fix

Problem:  When the terminal is very large, test for 9.2.0285 doesn't
          trigger an ASAN error without the fix.
Solution: Use a window with fixed height (zeertzjq)

closes: #19924

Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0303: tests: zip plugin tests don't check for warning message properly v9.2.0303
zeertzjq [Sun, 5 Apr 2026 16:41:15 +0000 (16:41 +0000)] 
patch 9.2.0303: tests: zip plugin tests don't check for warning message properly

Problem:  zip plugin tests may match messages from previous test cases
          when checking for warning message.
Solution: Clear messages at the start of these tests (zeertzjq).

closes: #19926

Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0302: runtime(netrw): RFC2396 decoding double escaping spaces v9.2.0302
Christian Brabandt [Sun, 5 Apr 2026 16:34:24 +0000 (16:34 +0000)] 
patch 9.2.0302: runtime(netrw): RFC2396 decoding double escaping spaces

Problem:  runtime(netrw): RFC2396 decoding double escaping spaces
          (lilydjwg, after 3e60f03d942d6bb0f7eac)
Solution: Remove escape() call, since we are using fnameescape() anyhow

fixes: #19913

Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0301: Vim9: void function return value inconsistent v9.2.0301
Hirohito Higashi [Sun, 5 Apr 2026 16:17:58 +0000 (16:17 +0000)] 
patch 9.2.0301: Vim9: void function return value inconsistent

Problem:  Vim9: void function return value inconsistent between
          script and :def
Solution: Make void built-in functions like bufload() return void
          consistently (Hirohito Higashi)

In Vim9 script, calling a void built-in function (e.g. bufload()) at the
script level did not set rettv to VAR_VOID, making it appear to return
0. Inside :def it correctly returned VAR_VOID and raised E1031.  Set
rettv to VAR_VOID after calling a ret_void built-in function in Vim9
script so the behavior is consistent.

Also fix the documentation for bufload() and ch_logfile() to correctly
state that the return type is void.

closes: #19919

Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0300: The vimball plugin needs some love v9.2.0300
Christian Brabandt [Sun, 5 Apr 2026 16:08:12 +0000 (16:08 +0000)] 
patch 9.2.0300: The vimball plugin needs some love

Problem:  The vimball plugin needs some love
          (syndicate)
Solution: Clean-up, refactor and update the plugin,
          in particular, catch path traversal attacks

This change does the following
- Clean up Indentation and remove calls to Decho
- Increase minimum Vim version to 7.4 for mkdir()
- Use mkdir() consistently
- Update Metadata Header
- Remove check for fnameescape()
- Catch path traversal attacks
- Add vimball basic tests
- Remove mentioning of g:vimball_mkdir in documentation

closes: #19921

Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0299: runtime(zip): may write using absolute paths v9.2.0299
Christian Brabandt [Sun, 5 Apr 2026 15:58:00 +0000 (15:58 +0000)] 
patch 9.2.0299: runtime(zip): may write using absolute paths

Problem:  runtime(zip): may write using absolute paths
          (syndicate)
Solution: Detect this case and abort on Unix, warn in the documentation
          about possible issues

Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agoruntime(zathurarc): Update page-padding, wrap the zathurarcOption keywords
Carlo Klapproth [Sat, 4 Apr 2026 09:22:50 +0000 (09:22 +0000)] 
runtime(zathurarc): Update page-padding, wrap the zathurarcOption keywords

page-padding was split in page-v-padding and page-h-padding

closes: #19899

Signed-off-by: Carlo Klapproth <6682561+elcarlosIII@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0298: Some internal variables are not modified v9.2.0298
Hirohito Higashi [Sat, 4 Apr 2026 09:09:13 +0000 (09:09 +0000)] 
patch 9.2.0298: Some internal variables are not modified

Problem:  Some internal variables are not modified
Solution: Add const qualifier to static table data
          (Hirohito Higashi).

Several static arrays that are never modified at runtime were missing the
const qualifier. Add const to move them from .data to .rodata section.

closes: #19901

Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
3 weeks agopatch 9.2.0297: libvterm: can improve CSI overflow code v9.2.0297
Yasuhiro Matsumoto [Sat, 4 Apr 2026 09:04:34 +0000 (09:04 +0000)] 
patch 9.2.0297: libvterm: can improve CSI overflow code

Problem:  libvterm: can improve CSI overflow code
Solution: Handle overflow cases better (Yasuhiro Matsumoto)

closes: #19903

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>