What the developer wrote
Authored by fanquake
depends: libxcb-util-wm 0.4.2
What changed, and why it matters
This commit updates a build dependency called libxcb-util-wm from version 0.4.1 to 0.4.2 inside Bitcoin Core's 'depends' packaging system. It only changes the version number and the expected file hash (SHA-256) used to verify the downloaded source. There is no statement in the commit or supplied references saying this fixes a security problem, and no details about what changed in libxcb-util-wm 0.4.2 are provided. On its own, this looks like a routine dependency refresh rather than a confirmed security patch.
Verify the SHA-256 hash dcecaaa535802fd57c84cceeff50c64efe7f2326bf752e16d2b77945649c8cd7 against the official xcb-util-wm 0.4.2 release tarball published by freedesktop.org. Review upstream libxcb-util-wm 0.4.2 release notes or git history for any security fixes; if any are found, consider whether the GUI build path is exposed to the relevant code and assess whether a CVE should be requested or referenced.
Security signals we found
Dependency version bump with checksum update
No security-relevant keywords in commit title or message
No CVE, advisory URL, or researcher attribution present in commit
Upstream library is part of the GUI dependency chain, not consensus/networking code
Evidence from the diff
The diff modifies depends/packages/libxcb_util_wm.mk, bumping the package version from 0.4.1 to 0.4.2 and updating the SHA-256 checksum accordingly. libxcb-util-wm is an X11/XCB helper library used in the Qt GUI build path for Bitcoin Core. The commit contains no CVE reference, no security advisory link, no bug-fix description, and no attribution. Without external release notes for libxcb-util-wm 0.4.2, we cannot determine whether the upstream release addresses memory-safety, parsing, or other security issues.
Changed components
depends/packages/libxcb_util_wm.mkBitcoin Core GUI build dependency chain (libxcb-util-wm via Qt)Inspect captured patch +2 / −2
diff --git a/depends/packages/libxcb_util_wm.mk b/depends/packages/libxcb_util_wm.mk
index a43b7ee2..e625496a 100644
--- a/depends/packages/libxcb_util_wm.mk
+++ b/depends/packages/libxcb_util_wm.mk
@@ -1,8 +1,8 @@
package=libxcb_util_wm
-$(package)_version=0.4.1
+$(package)_version=0.4.2
$(package)_download_path=https://xcb.freedesktop.org/dist
$(package)_file_name=xcb-util-wm-$($(package)_version).tar.gz
-$(package)_sha256_hash=038b39c4bdc04a792d62d163ba7908f4bb3373057208c07110be73c1b04b8334
+$(package)_sha256_hash=dcecaaa535802fd57c84cceeff50c64efe7f2326bf752e16d2b77945649c8cd7
$(package)_dependencies=libxcb
define $(package)_set_vars
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.