What the developer wrote
Authored by fanquake
depends: freetype 2.11.1
What changed, and why it matters
This commit updates the FreeType font-rendering library used in Bitcoin Core's build dependencies from version 2.11.0 to 2.11.1. It changes the download URL, archive format, and verification hash, and adjusts a small build patch. FreeType is a widely used library for drawing text, and newer point releases often include bug fixes. The commit itself does not say whether this fixes a security issue, and no security references were provided.
Treat as a routine dependency update. Review upstream FreeType 2.11.1 release notes for any security fixes; if any are identified, assess whether Bitcoin Core's use of FreeType (GUI text rendering) is exposed. No immediate action is indicated by the commit alone.
Security signals we found
Dependency version bump of a widely used font-rendering library
Archive format and hash changed, consistent with a routine upstream update
No CVE, security advisory, or security-related wording in commit or supplied references
Evidence from the diff
The change bumps the depends-system FreeType package from 2.11.0 to 2.11.1. It switches the source archive from .tar.xz to .tar.gz and updates the SHA-256 checksum accordingly. The cmake_minimum.patch is refreshed to apply against the new upstream CMakeLists.txt (context line numbers shifted). FreeType 2.11.1 was a maintenance release; upstream changelog mentions bug fixes but the commit message does not cite a CVE or security issue.
Changed components
depends/packages/freetype.mkdepends/patches/freetype/cmake_minimum.patchFreeType 2.11.0 -> 2.11.1 dependencyInspect captured patch +4 / −4
diff --git a/depends/packages/freetype.mk b/depends/packages/freetype.mk
index a97f82e7..b34edc60 100644
--- a/depends/packages/freetype.mk
+++ b/depends/packages/freetype.mk
@@ -1,8 +1,8 @@
package=freetype
-$(package)_version=2.11.0
+$(package)_version=2.11.1
$(package)_download_path=https://download.savannah.gnu.org/releases/$(package)
-$(package)_file_name=$(package)-$($(package)_version).tar.xz
-$(package)_sha256_hash=8bee39bd3968c4804b70614a0a3ad597299ad0e824bc8aad5ce8aaf48067bde7
+$(package)_file_name=$(package)-$($(package)_version).tar.gz
+$(package)_sha256_hash=f8db94d307e9c54961b39a1cc799a67d46681480696ed72ecf78d4473770f09b
$(package)_build_subdir=build
$(package)_patches += cmake_minimum.patch
diff --git a/depends/patches/freetype/cmake_minimum.patch b/depends/patches/freetype/cmake_minimum.patch
index 0a976f8a..b0a3d10e 100644
--- a/depends/patches/freetype/cmake_minimum.patch
+++ b/depends/patches/freetype/cmake_minimum.patch
@@ -2,7 +2,7 @@ build: set minimum required CMake to 3.12
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
-@@ -97,7 +97,7 @@
+@@ -109,7 +109,7 @@
# FreeType explicitly marks the API to be exported and relies on the compiler
# to hide all other symbols. CMake supports a C_VISBILITY_PRESET property
# starting with 2.8.12.
Why this scored 26/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.