What the developer wrote
Authored by fanquake
depends: libxcb 1.15
What changed, and why it matters
This commit updates the libxcb dependency used when building Bitcoin Core from source. It bumps the version from 1.14 to 1.15, switches the download archive format from .tar.xz to .tar.gz, updates the SHA-256 checksum, and refreshes a documentation link. There is no direct evidence in the commit that this fixes a specific security vulnerability, but dependency updates can include upstream security fixes.
Review upstream libxcb 1.15 release notes and changelog for security-relevant fixes. If any CVEs are addressed, consider backporting or noting them in release notes. Otherwise, treat as routine maintenance.
Security signals we found
Dependency version bump
Checksum/hash update for build system
No explicit security claim in commit message
Evidence from the diff
The change modifies depends/packages/libxcb.mk to use libxcb 1.15 instead of 1.14. The archive format changes from tar.xz to tar.gz, requiring a new SHA-256 hash. A comment link is updated from Qt 5.15 to Qt 6 requirements. No code changes or patch modifications are present in the diff. The security implications depend entirely on what upstream libxcb 1.15 addressed, which is not described in the commit or supplied references.
Changed components
depends/packages/libxcb.mklibxcb build dependencyInspect captured patch +4 / −4
diff --git a/depends/packages/libxcb.mk b/depends/packages/libxcb.mk
index 5d5aa7fc..a4875947 100644
--- a/depends/packages/libxcb.mk
+++ b/depends/packages/libxcb.mk
@@ -1,8 +1,8 @@
package=libxcb
-$(package)_version=1.14
+$(package)_version=1.15
$(package)_download_path=https://xcb.freedesktop.org/dist
-$(package)_file_name=$(package)-$($(package)_version).tar.xz
-$(package)_sha256_hash=a55ed6db98d43469801262d81dc2572ed124edc3db31059d4e9916eb9f844c34
+$(package)_file_name=$(package)-$($(package)_version).tar.gz
+$(package)_sha256_hash=1cb65df8543a69ec0555ac696123ee386321dfac1964a3da39976c9a05ad724d
$(package)_dependencies=xcb_proto libXau
$(package)_patches = remove_pthread_stubs.patch
@@ -10,7 +10,7 @@ define $(package)_set_vars
$(package)_config_opts=--disable-shared --disable-devel-docs --without-doxygen --without-launchd
$(package)_config_opts += --disable-dependency-tracking --enable-option-checking
# Disable unneeded extensions.
-# More info is available from: https://doc.qt.io/qt-5.15/linux-requirements.html
+# More info is available from: https://doc.qt.io/qt-6/linux-requirements.html
$(package)_config_opts += --disable-composite --disable-damage --disable-dpms
$(package)_config_opts += --disable-dri2 --disable-dri3 --disable-glx
$(package)_config_opts += --disable-present --disable-record --disable-resource
Why this scored 13/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.