What the developer wrote
Authored by Hennadii Stepanov
depends: xcb_proto 1.17.0
What changed, and why it matters
This commit updates a build dependency called xcb_proto from version 1.15.2 to 1.17.0 inside Bitcoin Core's dependency system. It only changes a version number, download URL extension, and the cryptographic hash used to verify the downloaded file. There is no direct evidence in the commit that this fixes a security vulnerability, but updating dependencies can sometimes include upstream security fixes.
Review the upstream xcb-proto 1.17.0 release notes for any security-relevant fixes. If upstream discloses security issues, consider whether Bitcoin Core's build process is affected and if additional backports or advisories are needed. Otherwise, treat as routine maintenance.
Security signals we found
Dependency version bump with no stated security rationale
SHA-256 hash updated to match new upstream tarball
No mention of CVE, vulnerability, or security fix in commit message
Evidence from the diff
The commit modifies depends/packages/xcb_proto.mk to bump xcb-proto from 1.15.2 to 1.17.0. The file extension changes from .tar.xz to .tar.gz and the SHA-256 hash is updated accordingly. xcb-proto is an X11 protocol description package used in the build process for GUI-related dependencies. The commit message gives no security context, and no verified references are supplied.
Changed components
depends/packages/xcb_proto.mkxcb-proto build dependencyInspect captured patch +3 / −3
diff --git a/depends/packages/xcb_proto.mk b/depends/packages/xcb_proto.mk
index 6e1c5a10..5ac0e799 100644
--- a/depends/packages/xcb_proto.mk
+++ b/depends/packages/xcb_proto.mk
@@ -1,8 +1,8 @@
package=xcb_proto
-$(package)_version=1.15.2
+$(package)_version=1.17.0
$(package)_download_path=https://xorg.freedesktop.org/archive/individual/proto
-$(package)_file_name=xcb-proto-$($(package)_version).tar.xz
-$(package)_sha256_hash=7072beb1f680a2fe3f9e535b797c146d22528990c72f63ddb49d2f350a3653ed
+$(package)_file_name=xcb-proto-$($(package)_version).tar.gz
+$(package)_sha256_hash=392d3c9690f8c8202a68fdb89c16fd55159ab8d65000a6da213f4a1576e97a16
define $(package)_config_cmds
$($(package)_autoconf)
Why this scored 13/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.