What the developer wrote
Authored by fanquake
depends: capnp 1.5.0
What changed, and why it matters
This commit simply updates the version of a build dependency (Cap'n Proto, a data serialization library used during compilation) from 1.4.0 to 1.5.0 in Bitcoin Core's dependency system. It changes only a version number and the corresponding cryptographic hash used to verify the downloaded source. There is no indication in the commit itself of any security bug, vulnerability, or malicious change.
No security action is required based on this commit alone. If reviewing for supply-chain assurance, verify the new SHA-256 hash against the official Cap'n Proto 1.5.0 release tarball published by the upstream project.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies depends/packages/native_capnp.mk, bumping native_capnp from version 1.4.0 to 1.5.0 and updating the SHA-256 hash to match the new upstream tarball. No code logic, build flags, patches, or runtime components are changed. The commit message is purely a version bump with no security context provided.
Changed components
depends/packages/native_capnp.mkInspect captured patch +2 / −2
diff --git a/depends/packages/native_capnp.mk b/depends/packages/native_capnp.mk
index d65a8b97..f207421d 100644
--- a/depends/packages/native_capnp.mk
+++ b/depends/packages/native_capnp.mk
@@ -1,9 +1,9 @@
package=native_capnp
-$(package)_version=1.4.0
+$(package)_version=1.5.0
$(package)_download_path=https://capnproto.org/
$(package)_download_file=capnproto-c++-$($(package)_version).tar.gz
$(package)_file_name=capnproto-cxx-$($(package)_version).tar.gz
-$(package)_sha256_hash=fa02378ad522b318916b9ad928d1372fc9abd43dd1f4f0392e50450f5c87828f
+$(package)_sha256_hash=77dbc13ca82d9c87ddb4581dd49559d45b63096433d3dadea08b7f31b360a5ba
define $(package)_set_vars
$(package)_config_opts := -DBUILD_TESTING=OFF
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.