Commit Graph

23637 Commits

Author SHA1 Message Date
Yasuhiro Matsumoto da5ebe71cb patch 9.2.0501: GTK4: there is no GTK4 UI available
Problem:  GTK4: there is no GTK4 UI available
Solution: Implement GTK4 UI (Yasuhiro Matsumoto).

To enable, use the --enable-gui=gtk4 configure switch. Configure
currently favors GTK3 over GTK4 if no explicit --enable-gui switch has
been given and both libraries are present

closes: #19815

Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0501
2026-05-19 18:20:19 +00:00
tecis d004cc4f89 runtime(htmldjango): Remove unnecessary code.
I submitted the PR #20232 to resolve an undesired behavior in with the
highlighter inheriting from "django.vim" and "html.vim". After
further testing I noticed the re-declaration of `djangoOperators` in
"htmldjango" is not necessary, and my conclusions where a mistake from a
not-clean test environment.

This PR reverses the effect of the commit #f03155a.

related: #20232
closes:  #20248

Signed-off-by: tecis <67809811+tecis@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-19 17:09:11 +00:00
K.Takata 9b1d657bca CI: Stop using AppVeyor
We started the Windows CI with AppVeyor (v7.4.872), but nowadays, GitHub Actions
supports Windows, and the performance is better than AppVeyor.
Especially, AppVeyor doesn't allow running multiple jobs in parallel.

Before 9.0.0529, we used VC 2010 on AppVeyor to ensure that C99 syntax
was not used.
Now we use some C99 syntax. Also, MSVC's C99 support level remains
almost the same since VS 2015. So, using VS 2015 isn't very useful.

closes: #20251

Signed-off-by: K.Takata <kentkt@csc.jp>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-18 21:19:27 +00:00
truffle 354ab1a69e patch 9.2.0500: filetype: some html files wrongly recognized as htmlangular
Problem:  filetype: some html files are wrongly recognized as htmlangular
Solution: Use the \< atom to anchor ng-template and ng-content to start
          of word (truffle)

Prevent false-positive htmlangular detection on words containing
'ng-template' or 'ng-content' as a substring (e.g. 'song-template',
'sing-content'). Anchor both branches with \< to require a word start,
matching the \<DTD\s\+XHTML\s idiom used five lines below.

related: neovim/neovim#39778.
closes:  #20246

Signed-off-by: truffle <truffleagent@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0500
2026-05-18 20:46:24 +00:00
tecis 6daa721dc0 runtime(doc): INSTALL: "libwayland-dev" is required on Ubuntu for Wayland clipboard support
In GNU/Linux distros without X11 and only depending on the Wayland
Composer as a display server I could not find official documentation on
how to compile VIM with clipbloard support.

> This will become more relevant as common distros ship with Wayland
only environments. (sources & articles bellow)

Sources.

- [Gnome Blog: X11 Session Removal FAQ.](https://blogs.gnome.org/alatiera/2025/06/23/x11-session-removal-faq/)
- [KDE Blog: Going all-in on a Wayland future 2025-11-26.](https://blogs.kde.org/2025/11/26/going-all-in-on-a-wayland-future/)
- [Gnome Blog: An update on the X11 GNOME Session Removal 2025-06-08.](https://blogs.gnome.org/alatiera/2025/06/08/the-x11-session-removal/)

Articles.

- [It’s Foss: No More Xorg! Fedora 43 Will Be Wayland-only 2025-05-21](https://itsfoss.com/news/fedora-43-wayland-only/)
- [Desde Linux: The depreciation of X11 in Fedora continues and in Fedora 41 the Gnome session in X11 will disappear.](https://blog.desdelinux.net/en/The-depreciation-of-x11-in-fedora-continues-and-in-fedora-41-the-gnome-session-in-x11-will-disappear/)
- [How-To-Geek: The writing is on the wall for X11 on Linux, here's what is replacing it 2025-12-29.](https://www.howtogeek.com/x11-is-going-away-on-linux-heres-how-to-prepare/).
- [Dev.To: GNOME 50 Removes X11: What It Means for Linux Users 2026-03-16.](https://dev.to/the_nazar/gnome-50-removes-x11-what-it-means-for-linux-users-1ike)
- [LinuxSecurity.com: GNOME 50: Wayland-Only Brings Enhanced Security and Isolation](https://linuxsecurity.com/news/desktop-security/gnome-50-wayland-linux-security)
- [XDA Developers: KDE is finally killing X11, and I'm not as sad as I thought I'd be 2026-05-14](https://www.xda-developers.com/kde-dropping-x11-support/).

closes: #20245

Signed-off-by: tecis <67809811+tecis@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-18 20:42:01 +00:00
nagbu 5c496beb18 runtime(typeset): Correct whitespace error in :lcd command
closes: #20242
closes: #20244

Signed-off-by: nagbu <me@nagbu.net>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-18 20:36:07 +00:00
Aliaksei Budavei e543abbf8e tests(commondumps): Use character counts when marking columns
Continue using "strwidth" when calculating the position of
a column of interest, and start using "setcharpos" when
marking a line of interest so that paired-up marks remain
aligned columnwise across all three parts generated by
"term_dumpdiff", especially when multibyte characters are
written in the line before the marked column.

closes: #20237

Signed-off-by: Aliaksei Budavei <0x000c70@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-18 19:07:08 +00:00
Christian Brabandt 4397227119 patch 9.2.0499: modeline: allow to disable modelines with modelinestrict
Problem:  Cannot disable modeline processing when loading a file
          (Mao-Yining, after v9.2.0350)
Solution: Allow to disable modeline processing even when
          'modelienstrict' is in effect.

fixes:  #20103
closes: #20229

Signed-off-by: Christian Brabandt <cb@256bit.org>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0499
2026-05-18 18:59:03 +00:00
Foxe Chen c920d93443 patch 9.2.0498: potential heap buffer overflow in if_xcmdsrv.c
Problem:  potential heap buffer overflow in if_xcmdsrv.c
          server_parse_message() (Michael Bommarito)
Solution: Add strlen() call (Foxe Chen)

fixes:  #20235
closes: #20236

Signed-off-by: Foxe Chen <chen.foxe@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0498
2026-05-17 20:42:20 +00:00
Miguel Barro 4a99175e39 patch 9.2.0497: Cannot jump to remote tags
Problem:  Cannot jump to remote tags
          (after v9.2.0405)
Solution: Add the 'tagsecure' option (Miguel Barro)

closes: #20162

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Miguel Barro <miguel.barro@live.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0497
2026-05-17 20:11:52 +00:00
Christian Brabandt a65a52d684 patch 9.2.0496: [security]: Code Injection in cucumber filetype plugin
Problem:  [security]: Code Injection in cucumber filetype plugin
          (Christopher Lusk)
Solution: Use rubys Regexp.new() with the untrusted pattern

Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9

Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0496
2026-05-17 19:39:24 +00:00
Christian Brabandt f08ab2f4d7 patch 9.2.0495: [security]: runtime(netrw): code injection via NetrwBookHistSave()
Problem:  [security]: runtime(netrw): code injection via
          NetrwBookHistSave()
Solution: Properly quote the directory name using string() function
          (Srinivas Piskala Ganesh Babu)

Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c

Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0495
2026-05-17 18:53:48 +00:00
mathmil 2a01e59671 runtime(just): add 'suffixesadd' to ftplugin
closes: #20197

Signed-off-by: mathmil <82173590+mathmil@users.noreply.github.com>
Signed-off-by: Peter Benjamin <petermbenjamin@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-17 18:08:46 +00:00
Aliaksei Budavei 23c77d8ec8 runtime(sh): Do not conflate empty array and function declarations in Bash
Although the "=" character is permitted in function names,
a construct that parses as a variable assignment is
preferred to it parsing as a function declaration.  See the
updated test file "sh_functions_bash.sh" for details.

fixes:  #20183
closes: #20205

Co-authored-by: Doug Kearns <dougkearns@gmail.com>
Signed-off-by: Aliaksei Budavei <0x000c70@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-17 18:06:22 +00:00
Maxim Kim f0e874a129 patch 9.2.0494: User commands cannot handle single args with spaces
Problem:  User commands cannot handle single args with spaces
Solution: Add the -nargs=_ attribute (Maxim Kim)

-nargs=_ allow user commands to have a single argument with spaces.

For example given the following Test command and TestComplete function:

```
vim9script
def TestComplete(A: string, _: string, _: number): list<string>
    var all = ["qqqq", "aaaa", "qq aa"]
    return all->matchfuzzy(A)
enddef
command! -nargs=_ -complete=customlist,TestComplete Test echo <q-args>
```

`:Test q a<tab>` should successfully complete `qq aa`

fixes:  #20102
closes: #20189

Signed-off-by: Maxim Kim <habamax@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0494
2026-05-17 17:58:15 +00:00
Yasuhiro Matsumoto abecad5af0 patch 9.2.0493: popup: missing Popup, PopupBorder and PopupTitle hi groups
Problem:  popup: missing Popup, PopupBorder and PopupTitle highlight groups
Solution: add Popup, PopupBorder and PopupTitle highlight groups and
          fall back to Pmenu related highlighting groups (Yasuhiro Matsumoto).

fixes:  #20110
closes: #20208

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0493
2026-05-17 17:49:42 +00:00
Yasuhiro Matsumoto 3db4c3a20b patch 9.2.0492: popup: decoration wrongly drawn with clipping on border
Problem:  popup: clipwindow popups with border and padding could still
          spill into the surrounding chrome of the host window
Solution: Consume the border first, then the padding, per edge; spill
          any leftover clip into the opposite edge's decoration; derive
          the bottom padding row from total_height; skip the scrollbar
          branch for clipwindow popups (Yasuhiro Matsumoto).

closes: #20227

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0492
2026-05-17 09:27:04 +00:00
Philip H. ab24858cf5 CI: Update clang to v22
closes: #20228

Signed-off-by: Philip H. <47042125+pheiduck@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-17 08:48:14 +00:00
tecis f03155aa2a runtime(htmldjango): Add syntax highlighting of comparison operators
The presence `djangoOperators` in the file `syntax/django.vim` and
having the highlight function with a `match` statement leads to a
highlight spill-over with other elements defined in `syntax/html.vim`.
To avoid the highlight spill-over declare a region called
`djangoTagBlockNaive` to limit `djangoOperator` to only be matched
within.

related: #20225
closes:  #20232

Signed-off-by: tecis <67809811+tecis@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-17 08:44:39 +00:00
tecis 8b25d90b08 runtime(django): Resolve FIXME of comparrison operators + localization tags
Summary: Add highlight of comparison operators resolving FIXME left by maintainer.

How it works: By creating a the variable ‘djangoOperator’ with the regex
and defining to only highlight when enclosed within ‘djangoTag’ and
‘djangoVarBlock’ the highlight works as expected.

Note: Note even though the maintainer had left the note “FIXME ==, !=,
      <, >, <=, and >= should be djangoStatements” the results do work
as I think he intended even though the variable ‘djangoOperator’ had to
be created to achieve the result. By doing it this way the highlight
process does not get confused depending on the spacing of the comparison
operator. Example: {{ x>=10 }} and {{ x >= 10 }} work as expected.

Add tags related to localization.

Documentation source:

- https://docs.djangoproject.com/en/5.2/topics/i18n/formatting/#controlling-localization-in-templates

closes: #20225

Signed-off-by: tecis <67809811+tecis@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-17 08:32:15 +00:00
orbisai0security 403ba303b9 ccfilter: uses unbounded strcat()/strcpy()
Problem:  ccfilter.c copies compiler output into fixed-size buffers
          with strcat() and strcpy(), so very long diagnostics can
          overflow.
Solution: replace with snprintf() bounded by LINELENGTH.

Automated security fix generated by Orbis Security AI

closes: #20233

Signed-off-by: orbisai0security <mediratta01.pally@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-17 08:22:08 +00:00
K.Takata 8ae45e4202 NSIS: Don't install 32-bit dll on ARM64
closes: #20234

Signed-off-by: K.Takata <kentkt@csc.jp>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-16 15:51:03 +00:00
Zoltan Arpadffy d8c4774273 patch 9.2.0491: VMS: various build issues
Problem:  VMS: various build issues
Solution: Fix issues for VMS (Zoltan Arpadffy)

closes: #20131

Signed-off-by: Zoltan Arpadffy <zoltan.arpadffy@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0491
2026-05-16 08:42:47 +00:00
glepnir 88b00d1c57 patch 9.2.0490: matchfuzzy() can crash on long multi-word patterns
Problem:  matchfuzzy() can crash on long multi-word patterns.
Solution: Clamp pat_chars to maxMatches and stop before calling
          match_positions() when the buffer is full (glepnir).

closes: #20209

Signed-off-by: glepnir <glephunter@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0490
2026-05-16 08:36:39 +00:00
Phạm Bình An 591db923ba runtime(zip,tar): Add support for compressed .cbz and .cbt files
*.cbz and *.cbt files are just zip and tar files for comic books.
https://en.wikipedia.org/wiki/Comic_book_archive

closes: #20206

Signed-off-by: Phạm Bình An <phambinhanctb2004@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-16 08:02:13 +00:00
Doug Kearns f7e239bd0e runtime(sh): Update syntax, don't include parens in function name highlighting
Parentheses are not part of the function name so highlight them
differently.

closes: #20219

Signed-off-by: Doug Kearns <dougkearns@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-16 07:57:10 +00:00
Keith Smiley bc7f736a39 patch 9.2.0489: filetype: some Objective-C files are not recognized
Problem:  filetype: some Objective-C files are not recognized
Solution: Add g:filetype_mm override variable, improve the objective c
          pattern detection (Keith Smiley).

closes: #20221

Signed-off-by: Keith Smiley <keithbsmiley@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0489
2026-05-16 07:46:25 +00:00
dependabot[bot] 7cb86f46cb CI: Bump the github-actions group across 1 directory with 2 updates
Bumps the github-actions group with 2 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action) and [actions/labeler](https://github.com/actions/labeler).

Updates `github/codeql-action` from 4.35.3 to 4.35.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v4.35.3...v4.35.4)

Updates `actions/labeler` from 6.0.1 to 6.1.0
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](https://github.com/actions/labeler/compare/v6.0.1...v6.1.0)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/labeler
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

closes: #20226

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-16 07:40:21 +00:00
Hirohito Higashi b467b56ef0 patch 9.2.0488: statusline: status line highlight blends into adjacent vsep cells
Problem:  When two windows are placed side by side with vsplit and
          their status lines are connected (the cell between them
          is drawn with the 'stl' / 'stlnc' fillchar, not the
          'vert' character), that connecting cell still uses the
          VertSplit highlight.  The status line bar therefore
          looks broken at the separator column, and any custom
          edge highlight set in 'statusline' (%#XX# / %N*) is cut
          off there.
Solution: Make that connecting cell take the highlight from the
          neighbouring status line edge instead of VertSplit:
            - Next to the current window, use the current
              window's edge highlight, so the StatusLine bar (and
              any %#... at the edge) extends into the column
              without a seam.
            - Between two non-current windows whose status
              fillchar is a space, use the left window's
              right-edge highlight, so the StatusLineNC bar is
              continuous across the column too.
          Cells drawn with the 'vert' character (the two windows
          do not share a status line) keep the VertSplit
          highlight as before.

          Add Test_statusline_vsep_borrow_hl with two layouts
          (NC | cur | NC | NC and NC | NC | cur | NC) so all
          three cases above are covered.

closes: #20182

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0488
2026-05-15 16:52:29 +00:00
Yasuhiro Matsumoto ee49669e8f patch 9.2.0487: viminfo: possible signed int overflow in register array
Problem:  viminfo: possible signed int overflow in register array growth
Solution: Cast to size_t (Yasuhiro Matsumoto)

The expression `limit * 2 * sizeof(string_T)` in read_viminfo_register()
multiplies in int and overflows once limit exceeds INT_MAX/2. Cast to
size_t first so the size computation stays unsigned. Defensive only;
reaching this path requires registers consuming many gigabytes.

closes: #20207

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0487
2026-05-15 16:44:46 +00:00
Christian Brabandt de7a5b5425 patch 9.2.0486: out-of-bound read when recovering swap files
Problem:  out-of-bound read when recovering corrupted swap files
          (Rahul Hoysala)
Solution: Validate the db_txt_start field when recovering a swap
          file.

Supported by AI

Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0486
2026-05-15 16:34:53 +00:00
Foxe Chen e85e3e5d85 patch 9.2.0485: clipboard provider callback can be called recursively
Problem:  clipboard provider callback can be called recursively, leading
          to E132: Function call depth is higher than 'maxfuncdepth'
Solution: Prevent recursive calls of
          clip_provider_copy()/clip_provider_paste() (Foxe Chen).

closes: #20213

Signed-off-by: Foxe Chen <chen.foxe@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0485
2026-05-15 16:00:04 +00:00
Foxe Chen bec23ef65c patch 9.2.0484: TextPutPre triggers clipboard provider callback twice
Problem:  TextPutPre triggers clipboard provider callback twice
          when do_put() runs autocommands that themselves request
          the clipboard.
Solution: Guard do_put() and put_do_autocmd() with
          inc_clip_provider()/dec_clip_provider() so the provider
          is queried at most once per put operation (Foxe Chen).

closes: #20215

Signed-off-by: Foxe Chen <chen.foxe@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0484
2026-05-15 15:45:11 +00:00
Jonathan Demme 77b8a12f82 runtime(doc): Update 'softtabstop' documentation
closes: #20218

Signed-off-by: Jonathan Demme <j.b.demme@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-15 15:37:31 +00:00
Hirohito Higashi f281493c49 patch 9.2.0483: popup: terminal embedded in an opacity popup freezes Vim on input
Problem:  When a terminal buffer is shown inside a popup with 'opacity'
          set to a value other than 100, typing into it freezes Vim.
          Only the first keystroke is drawn; afterwards no input is
          processed and the screen stops updating.
Solution: When marking background lines for redraw to keep opacity
          blend cells fresh, do not raise must_redraw.  This marking
          happens from inside update_screen() (via
          may_update_popup_mask()), so raising must_redraw makes
          terminal_loop()'s "while (must_redraw != 0) update_screen()"
          loop never terminate.  Add redraw_win_range_now() that
          updates only the per-window state and use it from
          redraw_win_under_opacity_popup() (Hirohito Higashi)

fixes:  #20214
closes: #20220

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0483
2026-05-15 15:02:48 +00:00
Foxe Chen 37d61dae72 runtime(doc): update doc for clipboard provider
closes: #20217

Signed-off-by: Foxe Chen <chen.foxe@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-15 09:46:47 +00:00
Foxe Chen 29fa934344 patch 9.2.0482: runtime(osc52): triggered twice with TextPutPoste autocmd
Problem:  runtime(osc52): triggered twice with TextPutPoste autocmd
Solution: Detect recursive trigger and return null (Foxe Chen)

closes: #20216

Signed-off-by: Foxe Chen <chen.foxe@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0482
2026-05-15 02:09:24 +00:00
Christian Brabandt 8e41c34aba patch 9.2.0481: runtime(netrw): command injection possible via maps
Problem:  runtime(netrw): command injection possible via crafted
          directory names in NetrwMaps() (Christopher Lusk)
Solution: Temporarily remove B flag in NetrwMaps() to prevent command
          injection

Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0481
2026-05-14 18:52:08 +00:00
Christian Brabandt 8af0f098c3 patch 9.2.0480: [security]: runtime(netrw): code injection via mf command
Problem:  [security]: runtime(netrw): code injection via mf command
          (Christopher Lusk, Zdenek Dohnal)
Solution: Do not use string concatenation inside the filter() commands
          (Zdenek Dohnal)

Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3

Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0480
2026-05-14 16:43:15 +00:00
Christian Brabandt 3fb5e58fbc patch 9.2.0479: [security]: runtime(tar): command injection in tar plugin
Problem:  [security]: runtime(tar): command injection in tar plugin
          (Christopher Lusk)
Solution: Use the correct shellescape(args, 1) form for a :! command

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w

Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0479
2026-05-14 15:43:44 +00:00
K.Takata 950f501a18 runtime(doc): Fix file mode for the Italian manpage
closes: #20210

Signed-off-by: K.Takata <kentkt@csc.jp>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-14 08:39:03 +00:00
yilisharcs 702d32e161 runtime(compiler): set zig errorformat
includes a new zig_cc file to catch warnings

closes: #20198

Signed-off-by: yilisharcs <yilisharcs@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-12 18:11:55 +00:00
John Marriott 8aecd377f0 patch 9.2.0478: channel: redundant str/length assignments in channel_part_info()
Problem:  channel: redundant str/length assignments in channel_part_info
Solution: Use the STR_LITERAL_SET() macro (John Marriott)

closes: #20199

Signed-off-by: John Marriott <basilisk@internode.on.net>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0478
2026-05-12 17:58:21 +00:00
Yasuhiro Matsumoto 3a9e1bb7e2 patch 9.2.0477: popup: leftover content after popup_free under layout change
Problem:  popup_mask still marks the freed popup's cells as covered
          until may_update_popup_mask() runs inside the next
          update_screen.  Any screen_fill / screen_puts called in
          between (for example msg_clr_eos triggered by a status message
          from :copen) hits skip_for_popup() and silently drops writes
          to those cells, so the popup's chars survive on screen until
          those cells happen to be redrawn for another reason.
Solution: Add popup_clear_mask_for() and call it from popup_hide() and
          popup_free() when the popup was visible, so the upcoming
          writes take effect immediately (Yasuhiro Matsumoto)

Note: The test is limited to MS-Windows because the original report
      (#20178) was reproduced there and the redraw timing required to
      surface the bug differs on other platforms.

fixes:  #20178
closes: #20188

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0477
2026-05-12 17:47:41 +00:00
glepnir 38237411e4 patch 9.2.0476: pattern completion leaks memory on alloc failures
Problem:  copy_substring_from_pos() leaked on ga_grow() failures,
          expand_pattern_in_buf() leaked "match" on ga_grow() failure,
          fuzzy_match_str_with_pos() ignored ga_grow() failures
Solution: Route failures through cleanup paths, check ga_grow before
          writing to ga_data (glepnir)

closes: #20203

Signed-off-by: glepnir <glephunter@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0476
2026-05-12 17:40:19 +00:00
Antonio Giovanni Colombo 78302b7b4a translation(it): Update Italian manpage
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-12 17:30:26 +00:00
Foxe Chen f45ed6465d runtime(hlyamk): Allow to highlight put regions using TextPutPost
closes: #20196

Signed-off-by: Foxe Chen <chen.foxe@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
2026-05-11 17:23:01 +00:00
J. Paulo Seibt 74019bea8c patch 9.2.0475: runtime(netrw): bookmark paths not normalized
Problem:  the bookmarks list can have duplicate entries, more often
          in win32 (due to mixed slashes and capitalization) and when
          g:netrw_keepdir=0 (which could introduce relative paths).
          Duplicate entries could be: C:\foo\BAR\baz.file
                                     c:\foo\bar\baz.file
                                     c:/foo\BAR/baz.file
                                     BAR/baz.file
Solution: Normalize the paths and make sure they are always absolute
          (J. Paulo Seibt).

closes: #20194

Signed-off-by: J. Paulo Seibt <jpseibt@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0475
2026-05-11 17:10:55 +00:00
K.Takata 7784fac15f patch 9.2.0474: MS-Windows: hard to tell which Visual Studio version was selected with MSVC
Problem:  When running msvc*.bat there is no indication of which
          Visual Studio version and target architecture got
          selected.
Solution: After vcvarsall.bat returns, echo the VS version, VC
          tools version and target architecture, and set the
          Command Prompt title accordingly (Ken Takata).

closes: #20193

Signed-off-by: K.Takata <kentkt@csc.jp>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0474
2026-05-11 16:58:24 +00:00
zeertzjq a70b7a85af patch 9.2.0473: Pasting ". register without autocommands breaks TextPut*
Problem:  Pasting ". register without TextPut* autocommands breaks
          subsequent TextPut* autocommands (after 9.2.0470).
Solution: Only decrement add_last_insert if it has been incremented
          (zeertzjq).

closes: #20192

Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
v9.2.0473
2026-05-11 16:49:19 +00:00