What changed, and why it matters
This commit updates the Qt graphical toolkit used by Bitcoin Core from version 6.8.3 to 6.8.4 in the project's dependency build system. It also refreshes Bitcoin-specific patches, removes one now-unneeded build patch, and disables a new RISC-V vector optimization in the bundled libpng to avoid cross-compilation link failures. Qt 6.8.4 is a routine patch release by Qt, and the commit message frames this as a standard dependency update rather than a security fix. There is no direct evidence in the commit or supplied references that this resolves a known vulnerability in Bitcoin Core.
Treat as a normal dependency maintenance update. Monitor Qt 6.8.4 release notes for any security advisories, but no immediate security action is required based on this commit alone. Verify reproducible builds and riscv64 cross-compilation still succeed.
Security signals we found
Dependency version bump to Qt 6.8.4
Removal of local build patch now upstreamed in Qt 6.8.4
Bundled libpng RISC-V vector extension disabled for riscv64 cross-compile
Patch line-number refresh only; no semantic security-related changes in Bitcoin-specific patches
Evidence from the diff
The change bumps depends/packages/qt_details.mk to Qt 6.8.4, updates tarball URLs/hashes, switches the top-level CMakeLists.txt source from a branch ref to a v6.8.4-lts-lgpl tag, and adjusts local patch hunks (line-number offsets only) for fix-gcc16-qcompare.patch, fix-gcc16-sfinae-qanystringview.patch, fix-gcc16-sfinae-qchar.patch, qtbase_plugins_cocoa.patch, and qtbase_skip_tools.patch. The qtbase_platformsupport.patch is removed because the upstream fix is included in Qt 6.8.4. A new -DPNG_RISCV_RVV_OPT=0 C flag is added to work around a link failure when cross-compiling the bundled libpng 1.6.49 for riscv64-linux-gnu. No Bitcoin Core source code is modified.
Changed components
depends/packages/qt.mkdepends/packages/qt_details.mkdepends/patches/qt/fix-gcc16-qcompare.patchdepends/patches/qt/fix-gcc16-sfinae-qanystringview.patchdepends/patches/qt/fix-gcc16-sfinae-qchar.patchdepends/patches/qt/qtbase_plugins_cocoa.patchdepends/patches/qt/qtbase_skip_tools.patchInspect captured patch +21 / −53
diff --git a/depends/packages/qt.mk b/depends/packages/qt.mk
index 500a2729..fdc39696 100644
--- a/depends/packages/qt.mk
+++ b/depends/packages/qt.mk
@@ -14,7 +14,6 @@ $(package)_patches_path := $(qt_details_patches_path)
$(package)_patches := cocoa_compat.patch
$(package)_patches += dont_hardcode_pwd.patch
$(package)_patches += qtbase_avoid_qmain.patch
-$(package)_patches += qtbase_platformsupport.patch
$(package)_patches += qtbase_plugins_cocoa.patch
$(package)_patches += qtbase_skip_tools.patch
$(package)_patches += rcc_hardcode_timestamp.patch
@@ -181,7 +180,11 @@ $(package)_cmake_opts += --log-level=STATUS
endif
$(package)_cmake_opts += -DQT_USE_DEFAULT_CMAKE_OPTIMIZATION_FLAGS=ON
-$(package)_cmake_opts += -DCMAKE_C_FLAGS="$$($(package)_cppflags) $$($$($(package)_type)_CFLAGS) -ffile-prefix-map=$$($(package)_extract_dir)=/usr"
+# The bundled libpng 1.6.49 in Qt 6.8.4 introduced support for
+# the RISC-V Vector Extension (RVV). However, the resulting library
+# fails to link when cross-compiling for riscv64-linux-gnu.
+# Disable this feature for now.
+$(package)_cmake_opts += -DCMAKE_C_FLAGS="$$($(package)_cppflags) -DPNG_RISCV_RVV_OPT=0 $$($$($(package)_type)_CFLAGS) -ffile-prefix-map=$$($(package)_extract_dir)=/usr"
$(package)_cmake_opts += -DCMAKE_C_FLAGS_RELEASE="$$($$($(package)_type)_release_CFLAGS)"
$(package)_cmake_opts += -DCMAKE_C_FLAGS_DEBUG="$$($$($(package)_type)_debug_CFLAGS)"
$(package)_cmake_opts += -DCMAKE_CXX_FLAGS="$$($(package)_cppflags) $$($$($(package)_type)_CXXFLAGS) -ffile-prefix-map=$$($(package)_extract_dir)=/usr"
@@ -277,7 +280,6 @@ define $(package)_preprocess_cmds
patch -p1 -i $($(package)_patch_dir)/cocoa_compat.patch && \
patch -p1 -i $($(package)_patch_dir)/dont_hardcode_pwd.patch && \
patch -p1 -i $($(package)_patch_dir)/qtbase_avoid_qmain.patch && \
- patch -p1 -i $($(package)_patch_dir)/qtbase_platformsupport.patch && \
patch -p1 -i $($(package)_patch_dir)/qtbase_plugins_cocoa.patch && \
patch -p1 -i $($(package)_patch_dir)/qtbase_skip_tools.patch && \
patch -p1 -i $($(package)_patch_dir)/rcc_hardcode_timestamp.patch && \
diff --git a/depends/packages/qt_details.mk b/depends/packages/qt_details.mk
index e49ac6a2..1808f342 100644
--- a/depends/packages/qt_details.mk
+++ b/depends/packages/qt_details.mk
@@ -1,19 +1,19 @@
-qt_details_version := 6.8.3
+qt_details_version := 6.8.4
qt_details_download_path := https://download.qt.io/archive/qt/6.8/$(qt_details_version)/submodules
-qt_details_suffix := everywhere-src-$(qt_details_version).tar.xz
+qt_details_suffix := everywhere-opensource-src-$(qt_details_version).tar.xz
qt_details_qtbase_file_name := qtbase-$(qt_details_suffix)
-qt_details_qtbase_sha256_hash := 56001b905601bb9023d399f3ba780d7fa940f3e4861e496a7c490331f49e0b80
+qt_details_qtbase_sha256_hash := 532dfbf3fa3cbc68fa37441ea9e81c5009da044eaecda78ffaeafd8bd125532f
qt_details_qttranslations_file_name := qttranslations-$(qt_details_suffix)
-qt_details_qttranslations_sha256_hash := c3c61d79c3d8fe316a20b3617c64673ce5b5519b2e45535f49bee313152fa531
+qt_details_qttranslations_sha256_hash := 33b1fd1d75598cbf54da12263957f18292c9fb01e42fcc3ab9bd2f8ac79763b7
qt_details_qttools_file_name := qttools-$(qt_details_suffix)
-qt_details_qttools_sha256_hash := 02a4e219248b94f1333df843d25763f35251c1074cdc4fb5bda67d340f8c8b3a
+qt_details_qttools_sha256_hash := c6030ea66d7be1ca7e3b40578beb35b0f4ff4014277d8e051d3219759f6ab399
qt_details_patches_path := $(PATCHES_PATH)/qt
-qt_details_top_download_path := https://raw.githubusercontent.com/qt/qt5/refs/heads/$(qt_details_version)
+qt_details_top_download_path := https://raw.githubusercontent.com/qt/qt5/refs/tags/v$(qt_details_version)-lts-lgpl
qt_details_top_cmakelists_file_name := CMakeLists.txt
qt_details_top_cmakelists_download_file := $(qt_details_top_cmakelists_file_name)
qt_details_top_cmakelists_sha256_hash := 54e9a4e554da37792446dda4f52bc308407b01a34bcc3afbad58e4e0f71fac9b
diff --git a/depends/patches/qt/fix-gcc16-qcompare.patch b/depends/patches/qt/fix-gcc16-qcompare.patch
index e56f610a..c2c1100a 100644
--- a/depends/patches/qt/fix-gcc16-qcompare.patch
+++ b/depends/patches/qt/fix-gcc16-qcompare.patch
@@ -105,7 +105,7 @@ index d82cf5ab4a4e..7eee69db66a3 100644
namespace Qt {
class weak_ordering;
-@@ -157,12 +183,18 @@ public:
+@@ -156,12 +182,18 @@ public:
constexpr Q_IMPLICIT operator std::partial_ordering() const noexcept
{
static_assert(sizeof(*this) == sizeof(std::partial_ordering));
@@ -127,7 +127,7 @@ index d82cf5ab4a4e..7eee69db66a3 100644
switch (m_order) {
case qToUnderlying(O::Less): return R::less;
case qToUnderlying(O::Greater): return R::greater;
-@@ -170,7 +202,6 @@ public:
+@@ -169,7 +201,6 @@ public:
case qToUnderlying(U::Unordered): return R::unordered;
}
Q_UNREACHABLE_RETURN(R::unordered);
@@ -135,7 +135,7 @@ index d82cf5ab4a4e..7eee69db66a3 100644
}
friend constexpr bool operator==(partial_ordering lhs, std::partial_ordering rhs) noexcept
-@@ -349,18 +380,18 @@ public:
+@@ -347,18 +378,18 @@ public:
constexpr Q_IMPLICIT operator std::weak_ordering() const noexcept
{
static_assert(sizeof(*this) == sizeof(std::weak_ordering));
@@ -158,7 +158,7 @@ index d82cf5ab4a4e..7eee69db66a3 100644
}
friend constexpr bool operator==(weak_ordering lhs, std::weak_ordering rhs) noexcept
-@@ -547,18 +578,18 @@ public:
+@@ -542,18 +573,18 @@ public:
constexpr Q_IMPLICIT operator std::strong_ordering() const noexcept
{
static_assert(sizeof(*this) == sizeof(std::strong_ordering));
@@ -181,7 +181,7 @@ index d82cf5ab4a4e..7eee69db66a3 100644
}
friend constexpr bool operator==(strong_ordering lhs, std::strong_ordering rhs) noexcept
-@@ -625,6 +656,8 @@ inline constexpr strong_ordering strong_ordering::greater(QtPrivate::Ordering::G
+@@ -620,6 +651,8 @@ inline constexpr strong_ordering strong_ordering::greater(QtPrivate::Ordering::G
} // namespace Qt
diff --git a/depends/patches/qt/fix-gcc16-sfinae-qanystringview.patch b/depends/patches/qt/fix-gcc16-sfinae-qanystringview.patch
index 11c27949..42f13ebb 100644
--- a/depends/patches/qt/fix-gcc16-sfinae-qanystringview.patch
+++ b/depends/patches/qt/fix-gcc16-sfinae-qanystringview.patch
@@ -19,7 +19,7 @@ diff --git a/qtbase/src/corelib/text/qanystringview.cpp b/qtbase/src/corelib/tex
index 7bf8a3fa1fd..3c993ff1da0 100644
--- a/qtbase/src/corelib/text/qanystringview.cpp
+++ b/qtbase/src/corelib/text/qanystringview.cpp
-@@ -243,6 +243,10 @@ QT_BEGIN_NAMESPACE
+@@ -355,6 +355,10 @@ QT_BEGIN_NAMESPACE
\sa isNull(), isEmpty()
*/
diff --git a/depends/patches/qt/fix-gcc16-sfinae-qchar.patch b/depends/patches/qt/fix-gcc16-sfinae-qchar.patch
index 888e128c..e8afea81 100644
--- a/depends/patches/qt/fix-gcc16-sfinae-qchar.patch
+++ b/depends/patches/qt/fix-gcc16-sfinae-qchar.patch
@@ -37,7 +37,7 @@ diff --git a/qtbase/src/corelib/kernel/qmetatype.cpp b/qtbase/src/corelib/kernel
index e70583404a46..54a0fe671fe0 100644
--- a/qtbase/src/corelib/kernel/qmetatype.cpp
+++ b/qtbase/src/corelib/kernel/qmetatype.cpp
-@@ -1212,7 +1212,7 @@ QT_WARNING_DISABLE_CLANG("-Wtautological-compare")
+@@ -1230,7 +1230,7 @@ QT_WARNING_DISABLE_CLANG("-Wtautological-compare")
return true;
);
QMETATYPE_CONVERTER(QString, Char32,
diff --git a/depends/patches/qt/qtbase_platformsupport.patch b/depends/patches/qt/qtbase_platformsupport.patch
deleted file mode 100644
index 45ccaea5..00000000
--- a/depends/patches/qt/qtbase_platformsupport.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-CMake: Prevent creation of empty InputSupportPrivate module
-
-The combination of
- -no-feature-evdev
- -no-feature-tslib
- -no-feature-libinput
-led to the creation of the InputSupportPrivate module without source
-files.
-
-This triggered CMake upstream issue 23464 when using CMake < 3.25.
-
-Fix this by adjusting the inexact condition that decides whether to
-build InputSupportPrivate.
-
-
-See: https://codereview.qt-project.org/c/qt/qtbase/+/633612
-
-
---- a/qtbase/src/platformsupport/CMakeLists.txt
-+++ b/qtbase/src/platformsupport/CMakeLists.txt
-@@ -3,7 +3,12 @@
-
- add_subdirectory(devicediscovery)
- add_subdirectory(fbconvenience)
--if(QT_FEATURE_evdev OR QT_FEATURE_integrityhid OR QT_FEATURE_libinput OR QT_FEATURE_tslib OR QT_FEATURE_xkbcommon)
-+if(QT_FEATURE_evdev
-+ OR QT_FEATURE_vxworksevdev
-+ OR QT_FEATURE_integrityhid
-+ OR QT_FEATURE_libinput
-+ OR QT_FEATURE_tslib
-+ OR (QT_FEATURE_libinput AND QT_FEATURE_xkbcommon))
- add_subdirectory(input)
- endif()
- if(QT_FEATURE_kms)
diff --git a/depends/patches/qt/qtbase_plugins_cocoa.patch b/depends/patches/qt/qtbase_plugins_cocoa.patch
index 2b0cc509..1f055353 100644
--- a/depends/patches/qt/qtbase_plugins_cocoa.patch
+++ b/depends/patches/qt/qtbase_plugins_cocoa.patch
@@ -8,7 +8,7 @@ See: https://codereview.qt-project.org/c/qt/qtbase/+/634002
--- a/qtbase/src/plugins/platforms/cocoa/CMakeLists.txt
+++ b/qtbase/src/plugins/platforms/cocoa/CMakeLists.txt
-@@ -107,3 +107,10 @@ qt_internal_extend_target(QCocoaIntegrationPlugin CONDITION QT_FEATURE_sessionma
+@@ -108,3 +108,10 @@ qt_internal_extend_target(QCocoaIntegrationPlugin CONDITION QT_FEATURE_sessionma
SOURCES
qcocoasessionmanager.cpp qcocoasessionmanager.h
)
diff --git a/depends/patches/qt/qtbase_skip_tools.patch b/depends/patches/qt/qtbase_skip_tools.patch
index eef65425..77cb3e3f 100644
--- a/depends/patches/qt/qtbase_skip_tools.patch
+++ b/depends/patches/qt/qtbase_skip_tools.patch
@@ -9,7 +9,7 @@ Skip building/installing unneeded tools:
--- a/qtbase/cmake/QtBaseGlobalTargets.cmake
+++ b/qtbase/cmake/QtBaseGlobalTargets.cmake
-@@ -118,9 +118,6 @@ qt_generate_global_module_pri_file()
+@@ -128,9 +128,6 @@ qt_generate_global_module_pri_file()
qt_generate_global_device_pri_file()
qt_generate_qmake_and_qtpaths_wrapper_for_target()
@@ -19,7 +19,7 @@ Skip building/installing unneeded tools:
qt_internal_add_platform_internal_target(GlobalConfigPrivate)
target_link_libraries(GlobalConfigPrivate INTERFACE GlobalConfig)
-@@ -390,12 +387,3 @@ elseif(WASM)
+@@ -400,12 +397,3 @@ elseif(WASM)
qt_install(PROGRAMS "${QT_BUILD_DIR}/${INSTALL_LIBEXECDIR}/qt-wasmtestrunner.py"
DESTINATION "${INSTALL_LIBEXECDIR}")
endif()
Why this scored 22/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.