What the developer wrote
Authored by fanquake
depends: capnp 1.4.0
What changed, and why it matters
This commit simply updates a build dependency, the Cap'n Proto library, from version 1.3.0 to 1.4.0 inside Bitcoin Core's build system. It changes the version number and the cryptographic checksum used to verify the downloaded source. There is no indication in the commit itself that this fixes a security problem, and no security advisory was provided. Dependency updates can sometimes include hidden security fixes, but this change alone does not show one.
Review the upstream Cap'n Proto 1.4.0 release notes for any security advisories or bug fixes. If any are relevant, consider backporting or documenting the security rationale. Otherwise, treat as a routine dependency update.
Security signals we found
Dependency version bump with no stated security relevance
SHA-256 hash updated to match new upstream tarball
No CVE, advisory, or security-related commit message present in supplied materials
Evidence from the diff
The diff modifies depends/packages/native_capnp.mk, bumping native_capnp from 1.3.0 to 1.4.0 and updating the corresponding SHA-256 hash. This is a routine dependency version bump in Bitcoin Core’s depends build system. The commit message and diff contain no CVE reference, security rationale, or patch details. Without external references, we cannot classify this as a security fix; it is best treated as a maintenance update with unverified potential for indirect security improvements from the upstream release.
Changed components
depends/packages/native_capnp.mknative_capnp build dependency (Cap'n Proto C++ library)Inspect captured patch +2 / −2
diff --git a/depends/packages/native_capnp.mk b/depends/packages/native_capnp.mk
index 0cd0dcdf..d65a8b97 100644
--- a/depends/packages/native_capnp.mk
+++ b/depends/packages/native_capnp.mk
@@ -1,9 +1,9 @@
package=native_capnp
-$(package)_version=1.3.0
+$(package)_version=1.4.0
$(package)_download_path=https://capnproto.org/
$(package)_download_file=capnproto-c++-$($(package)_version).tar.gz
$(package)_file_name=capnproto-cxx-$($(package)_version).tar.gz
-$(package)_sha256_hash=098f824a495a1a837d56ae17e07b3f721ac86f8dbaf58896a389923458522108
+$(package)_sha256_hash=fa02378ad522b318916b9ad928d1372fc9abd43dd1f4f0392e50450f5c87828f
define $(package)_set_vars
$(package)_config_opts := -DBUILD_TESTING=OFF
Why this scored 13/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.