githubmirror/pkgconf

NEWS
1 192 строки44 KB
Ariadne Conill
NEWS: add updates for 3.0.4
22 июл 2026, 03:36
22 июл 2026, 03:361169189
Changes from previous version of pkgconf
========================================

Changes from 3.0.3 to 3.0.4:
----------------------------

* Fix a crash (stack overflow) triggered by a crafted .pc file containing a
  self-referential fragment variable, such as `x=$${x}` referenced from Cflags.
  Fragment variables are now evaluated only once while re-splitting.  Found
  through fuzzing.

* Fix over-escaping of variable values containing backslash-escaped whitespace,
  such as paths quoted with `printf %q`.  Such a value was stored with its
  escapes intact and then escaped a second time when rendered into a fragment,
  producing output like `-L/a\\\ dir`.  This broke meson's test suite, which
  uses paths with spaces to stay Windows-safe.

* Fix mangled and duplicated -L/-I paths on Windows when PKG_CONFIG_SYSROOT_DIR
  and PKG_CONFIG_LIBDIR are set.  Path separators are now normalized to forward
  slashes for all runtime-injected paths (sysroot, build root, search paths and
  pcfiledir), so that sysroot matching and injection operate on a consistent
  basis.

* Fix `--define-prefix` dropping a path separator when the redefined prefix ends
  with a trailing slash, and only rewrite a package's directories when they match
  the original prefix on a path component boundary.

* Fix single-package queries returning results drawn from more than the requested
  module, by restoring the package limit that was lost during a refactor of the
  query builder.

Changes from 3.0.2 to 3.0.3:
----------------------------

* Restore correct handling of sysroots when emulating legacy pkg-config, and
  add explicit regression tests for this case.

* Fix references to bomtool in spdxtool --help.
  Patch by Pierre Pronchery.

* Fix various typos in the source code.
  Patch by Christian Clauss.

Changes from 3.0.1 to 3.0.2:
----------------------------

* Fix build on systems where readlinkat(2) is missing, such as Illumos when
  built without appropriate CFLAGS.

* Fix detection of readlinkat(2) on systems where it is gated behind
  _ATFILE_SOURCE, such as on certain builds of Illumos.

Changes from 3.0.0 to 3.0.1:
----------------------------

* Various Meson-related fixes and improvements.
  Patches by Benjamin Gilbert.

Changes from 2.5.1 to 3.0.0:
----------------------------

* DEPRECATION: The autotools build system will be dropped after the 3.0 release.
  Building pkgconf with muon is recommended for early bootstrap and meson in later
  stages of bootstrap.
  Alternatively users can use pkgconf-lite for early bootstrap.
  Continuous integration now exercises both the muon and pkgconf-lite builds.
  See https://github.com/pkgconf/pkgconf/issues/481 for rationale and discussion.

* DEPRECATION: Support for setting `PKG_CONFIG_PATH` from the Windows registry
  is slated for removal in 3.1.  It is recommended `PKG_CONFIG_PATH` be set from
  the environment on Windows.
  See https://github.com/pkgconf/pkgconf/issues/546 for rationale and discussion.

* SPDX Software Bill of Materials (SBOM) generation:
  - New spdxtool(1) utility which generates SPDX Lite 3.0.1 SBOM files.  Initial
    implementation by Tuukka Pasanen, sponsored by The FreeBSD Foundation, and
    substantially improved since, with major contributions by Elizabeth Ashford
    and additional patches by Joshua Watt and Pierre Pronchery.
  - bomtool now supports a --output option, which writes the generated SBOM to
    a file instead of standard output, and --define-variable, as the pkgconf CLI
    does.  The --define-variable support is by Tuukka Pasanen.
  - bomtool now supports a --creation-time option, like spdxtool, which sets the
    SBOM creation timestamp (in ISO 8601 format) instead of using the current
    time, and no longer embeds the pkgconf version in its output.  Both changes
    allow for reproducible SBOM generation.
  - bomtool now honors the SOURCE_DATE_EPOCH environment variable, deriving the
    SBOM creation timestamp from it when --creation-time is not given, for
    reproducible builds.
  - bomtool: improved SPDX conformance.  Mandatory PackageCopyrightText and
    PackageLicenseConcluded fields are emitted as NOASSERTION when unavailable,
    a Created timestamp is included, invalid PackageVerificationCode output was
    removed, the package identifier charset was corrected,
    PackageDownloadLocation is derived from the Source tag, and SPDX 2.3 package
    names are used.  Patches by Stéphane Rochoy and Tuukka Pasanen.

* New pccritic(1) utility which scores the quality of pc(5) files.  Each module
  or .pc file is graded from A to F based on findings across several categories:
  required and recommended metadata, version sanity, relocatability of libdir
  and includedir, Cflags and Libs hygiene, the Requires relationship, the NTIA
  SBOM minimum elements, and file-formatting style.  Supports --quiet for a
  one-line score per target, --min-score for use as a CI gate, and colorized
  output.

* New test and I/O framework.
  - kyua is no longer required to run tests.
  - Declarative configuration for integration tests, C unit tests for functional tests.
  - Tests now run on Windows.
  - .pc and personality files are now opened in binary mode, and the line reader
    was reworked to correctly handle LF, CRLF and lone-CR line endings, including
    on non-seekable streams.  Binary-mode handling by moi15moi.
  Major contributions by Elizabeth Ashford.

* New pc(5) features:
  - Source tag: a URI which describes where a given package may be downloaded.
  - License.file tag: a path to a license file that is on disk.
  - Requires.shared tag: like Requires.private, except a list of dependencies only used
    when building in shared mode.
  - Cflags.shared tag: like Cflags.private, except a list of CFLAGS only used when building
    in shared mode.
  - Libs.shared tag: like Libs.private, except a list of LIBS only used when building
    in shared mode.
  - Link.ABI tag: a comma-separated list of tags describing the application binary
    interfaces a consumer must link a package against, such as c++ or fortran.
    Tags are case-insensitive and normalized to lowercase, and may be queried
    with --link-abi.
  The Source and License.file tags are by Tuukka Pasanen; additional patches by
  Elizabeth Ashford.

* Windows support has been significantly improved.
  - pkgconf can now be built and tested with Visual Studio and clang-cl.
  - Windows on ARM builds are supported, and MSI installers are produced for
    x86, x64 and arm64 using MSVC.
  - The console code page is set to UTF-8 and non-ASCII entries in
    PKG_CONFIG_PATH are now handled correctly.
  The clang-cl support, MSI installers and UTF-8 console handling are by
  moi15moi.

* Portability:
  - pkgconf is now built and tested in continuous integration on NetBSD,
    FreeBSD, OpenBSD, Haiku, OmniOS, macOS and Cygwin in addition to Linux and
    Windows.
  - pkgconf now falls back to readlink(2) on systems which lack readlinkat(2).
  - A fallback is provided for platforms without nl_langinfo_l, and xlocale.h is
    included where needed to build on macOS.
  - Fixed -Werror=format build failures on MinGW caused by the PRIu64 macro
    expanding to an MSVCRT format specifier that the GNU format-string checker
    rejects; serial and identifier values are now printed with %llu.
  The expanded platform CI and the nl_langinfo_l/xlocale.h fallbacks are by
  moi15moi.

* Security hardening:
  - Variable substitution is now guarded against denial-of-service inputs,
    including billion-laughs style expansion and excessively complex bytecode
    programs.
  - Dependency traversal is now limited to 256 levels by default to prevent
    stack exhaustion from excessively deep graphs.  A depth of -1 explicitly
    enables unlimited traversal.
  - Bytecode validation now uses overflow-safe bounds checks and rejects
    truncated, oversized and otherwise malformed programs.
  - Dynamic buffers now reject overlapping source and destination storage and
    guard allocation-size arithmetic against overflow.
  - LLVM libFuzzer targets were added for the pc(5) parser and the solver, and
    the numerous out-of-memory and crash paths they surfaced were hardened.
  - Allocation failures are now propagated through parsing, rendering, output
    and SBOM generation instead of silently producing partial results.
  - Dropped use of strlcpy, strlcat and other silently truncating string
    functions.

* CLI changes:
  - New --newlines option, which separates emitted fragments with newlines
    instead of spaces.
  - New --print-digraph-query-nodes option, which annotates the --digraph
    output with the nodes that were part of the original query.
  - --list-all and --list-package-names now include synthesized virtual
    packages provided via the Provides tag.
  - Variables can now be overridden using PKG_CONFIG_MODULENAME_VARIABLENAME
    environment variables.  This was formally specified but never implemented
    in pkgconf.
  - PKG_CONFIG_LOG is now appended to rather than overwritten.
  - --dump-personality output is now consistent with the
    pkgconf-personality(5) format and additionally reports WantDefaultPure and
    WantDefaultStatic.
  - The vestigial --relocate=path option, which existed only for the old test
    suite, has been removed.
  - pccritic --min-score now strictly accepts integer values from 0 through 100.

* Build system changes:
  - The meson build gained a with-pkg-config-dir option to override the default
    package search path, matching the autotools --with-pkg-config-dir option.

* pkg.m4 changes:
  - PKG_WITH_MODULES now properly quotes its action arguments (serial 16).
    Patch by Antonin Décimo.
  - The macros no longer direct users to the freedesktop pkg-config project.

* Correctness fixes:
  - The built-in pkg-config and pkgconf packages are now constructed from the
    configured personality instead of being hardcoded, so their reported data
    reflects the active personality.  They are also exposed as proper versioned
    virtual packages.
  - ${pc_sysrootdir} now defaults to an empty string instead of '/'.
  - Variable substitution was reimplemented using a bytecode engine, which
    tracks whether special variables such as ${pc_sysrootdir} have already been
    applied so that they are not substituted more than once.
  - The solver now re-checks the final solution for conflicts before returning
    success, and tracks the origin of conflict rules.
  - Requires.internal is now treated as a weaker form of Requires.private: its
    dependency nodes need not be satisfied when link libraries are not
    requested.
  - pkgconf now warns about .pc files that duplicate a dependency-list field,
    whose behavior is inconsistent across pkg-config implementations.
  - Version comparison was reworked to use a structured algorithm modeled on
    apk-tools.
  - Newline folding behavior when parsing multi-line fields has been adjusted.
  - Bare variable expansions inside fragment lists are now re-parsed so that any
    flags they expand to are tokenized correctly.
  - ${pc_sysrootdir} is now only injected when it matches a complete path
    boundary, and obviously bogus sysroot_dir definitions are ignored, fixing
    incorrect sysroot injection.
  - Arguments are now combined when a flag is expected to carry a separate
    value, such as -I dir or -framework name.
  - SPDX license expressions in the License field are now properly parsed and
    validated.  Patches by Tuukka Pasanen.

* The libpkgconf API and ABI were substantially reworked, breaking both API and
  ABI compatibility.  Consumers will need source changes as well as a rebuild.
  The libpkgconf soversion is now 8.
  - An abstract pkgconf_buffer_t type is now used throughout libpkgconf in place
    of fixed-size stack buffers, removing a class of truncation bugs.
  - A new pkgconf_output API abstracts all output, allowing the output stream to
    be set per-client and redirected (pkgconf_client_set_output,
    pkgconf_output_file_fmt and friends).
  - The pkgconf_tuple_parse API has been removed; variables are now evaluated
    via pkgconf_variable_eval (backed by the new bytecode engine).
  - The fragment rendering API was reworked around pkgconf_buffer_t, and the old
    pkgconf_fragment_render API has been removed.  Fragment renderer callbacks
    and pkgconf_fragment_render_buf now return bool so allocation and rendering
    failures can be reported.
  - pkgconf_license_render now returns bool so allocation failures can be
    reported.
  - The package copyright field was migrated to a bufferset.
  - Environment variable lookups can now be mocked via pkgconf_client_getenv.
  - Client construction gained an options-based API: pkgconf_client_init_with_options
    and pkgconf_client_new_with_options accept a pkgconf_client_options_t struct, with
    the original pkgconf_client_init and pkgconf_client_new retained as wrappers.  The
    unveil handler may now be supplied directly as a client option.
  - New pkgconf_variable_eval_name API, which evaluates a named variable and
    applies sysroot fixups to the result.
  - The pkgconf_pkg_traverse_func_t callback gained a trailing iter_flags
    argument carrying per-traversal state (PKGCONF_PKG_ITERF_*), replacing the
    removed PKGCONF_PKG_PKGF_ITER_PKG_IS_PRIVATE client flag.

Changes from 2.5.0 to 2.5.1:
----------------------------

* Fix processing of empty dependency lists.

Changes from 2.4.3 to 2.5.0:
----------------------------

* Added a manual page for bomtool.

* Add support for preloaded packages.
  These are modules which are preloaded into the package database
  and preferred over searching the module search path when present.

* Refactor Windows registry PKG_CONFIG_PATH support so that it
  augments the main directory search list instead of being treated
  as a special case.

* Processing of `--with-path` arguments by the pkgconf CLI is
  now deferred until libpkgconf is fully initialized, effectively
  aligning behavior with PKG_CONFIG_PATH processing.

* Fix several minor memory safety bugs which were identified by
  the GCC 15 static analyzer.

* Added support for pledge(2) and unveil(2) on systems where
  this functionality is available.

* Significant improvements to pkgconf's manual pages.
  Patches by Ingo Schwarze and Jonathan Gray (OpenBSD).

* Remove questionable default-static assumption on Windows that
  was inherited from the original pkg-config.  Most distributions
  of pkgconf on Windows were already patching this out.
  Patch by Kai Pastor.

* Add -D_POSIX_C_SOURCE=200809L to the build definitions, which
  is needed for readlinkat on glibc.
  Patch by Filipe Laíns.

Changes from 2.4.2 to 2.4.3:
----------------------------

* Fix additional logic errors relating to the new fragment trees
  functionality.

Changes from 2.4.1 to 2.4.2:
----------------------------

* Fix several logic errors in the pkg-config file parser that were
  surfaced by recent refactoring work.

* Fix BSD make compatibility so that it generates the test data
  before running kyua on BSD make implementations.

Changes from 2.4.0 to 2.4.1:
----------------------------

* Ensure the full DAG is solved for all query types.

Changes from 2.3.0 to 2.4.0:
----------------------------

* Allow multiple package names in solution-based queries such as
  `--print-requires`, `--print-requires-private` and `--print-provides`.

* Use `_DEFAULT_SOURCE` where appropriate on Meson.

* Add an abstract buffer type and use it when loading files from disk
  instead of a 64KB buffer.  This ensures large pkg-config files are
  not truncated.

* Disable graph recursion in `--variable` queries as it was generating
  duplicate output.

* Add infrastructure for tracking fragment group relations and convert
  storage of fragments to use a tree-like structure instead of string
  concatenation.

* Add support for tracking linker groups, e.g.

    -Wl,--start-group -la -lb -lc -Wl,--end-group

  as fragment groups.

* Properly contextualize the sysroot directory when processing package
  information, ensuring packages where ${pc_sysrootdir} does not match
  the default are properly processed.

Changes from 2.2.0 to 2.3.0:
----------------------------

* Fix compile with Meson on Solaris by defining __EXTENSIONS__.

* Add support for the PKG_CONFIG_RELOCATE_PATHS environmental variable.
  When set, the program will act as if --define-prefix is always enabled.

* Color solution nodes that were part of the original query, and use
  that coloring to skip over dependencies when generating DocumentNames
  in bomtool.

* Enhance --env option to support variables with both --variable=varname
  and --print-variables.

* Add --exists-cflags option which creates synthetic preprocessor
  definition flags for every queried dependency when found.

* Document that Requires.private is always used for header paths.
  Patch by Petr Písař.

* Fix minor documentation typos.
  Patch by Pierce.

* Ensure string comparisons using <ctype.h> functions are done with
  unsigned bytes to avoid undefined behavior.
  Patch by Taylor R Campbell.

* Fix parsing edge-case bugs with dependency versions.
  Patch by Kai Pastor.

* Change PKG_PROG_PKG_CONFIG autoconf macro to add a customizable
  failure handler if pkg-config is not found.
  Patch by Ismael Luceno.

Changes from 2.1.1 to 2.2.0:
----------------------------

* libpkgconf SOVERSION is now 5.

* Significant solver rework to flatten both requires and requires.private
  dependencies in a single pass.  Improves performance slightly and ensures
  proper dependency order.
  Patches by Kai Pastor.

* Improve `--digraph` output to reflect more of the solver's state in the
  rendered dependency graph.
  Patches by Kai Pastor.

* Do not reference the graph root by name when presenting error messages about
  directly requested dependency nodes.
  Patch by Kai Pastor.

Changes from 2.1.0 to 2.1.1:
----------------------------

* Documentation fixes from Sam James and Stefan Weil.

* Fix --modversion with constraints.
  Patch by Kai Pastor.

* Reintroduce an optimization to the dependency graph walker which avoids
  revisiting already visited nodes.
  Patch by Yi Chou with some modifications.

* Add a regression test to check that the dependency flattener is working
  as expected.
  Patch by Kai Pastor.

Changes from 2.0.3 to 2.1.0:
----------------------------

* Do not flatten the solver solution into the original world used as
  input to the solver.
  Patches by Kai Pastor.

* Fix warnings with GCC 14 -Walloc-size.
  Patch by Sam James.

* Add --solution to the pkgconf CLI to dump the solver state.

* Improve the --digraph output to clarify cancelled edges in a given
  solution.

* Demote requires dependencies to requires.private when a parent
  dependency is pulled in via requires.private.

* Trim trailing whitespace when processing package arguments.
  Patch by Colin Gillespie.

* Avoid strncmp() in --modversion version comparison.
  Patch by Colin Gillespie.

* Update autoconf compile flag checking macro.
  Patch by Peter Kokot.

* Add system default path configuration to Meson.
  Patch by L. E. Segovia.

* Fix order of PKG_CONFIG_LIBDIR and PKG_CONFIG_PATH element processing.

Changes from 2.0.2 to 2.0.3:
----------------------------

* Fix some edge-cases with the new `--modversion` implementation
  and add additional regression tests.
  Patch by Colin Gillespie.

* Fix some format specifiers to use PRIu64 in debug tracing.

Changes from 2.0.1 to 2.0.2:
----------------------------

* Fix long-standing bug where package identifiers for "uninstalled"
  packages incorrectly included the "-uninstalled" suffix.

  This was exposed by the recent change to `--modversion` in 2.0.1.

Changes from 2.0.0 to 2.0.1:
----------------------------

* The behavior of --modversion was largely reverted back to the traditional
  pkg-config behavior, but still operates on a solved dependency graph.

  The order of --modversion output is based on the dependency resolution
  queue which is passed to the solver, which itself generally maps to the
  order of the constraints provided on the command line.

* A new flag, --verbose, has been added.  When used with `--modversion`, it
  is possible to disambiguate which version belongs to which module:

    % pkgconf --modversion --verbose foo bar
    foo: 1.2.3
    bar: 1.3

Changes from 1.9.5 to 2.0.0:
----------------------------

* When flattening the dependency graph, retain the latest seen edges
  rather than the earliest.

* Fix a long-standing bug where the dependency resolution queue was
  evaluated in reverse.  This bug masked the aforementioned dependency
  flattening bug in many cases.

* Fix handling of --with-path, which was appending paths to the search
  list rather than prepending them as intended.

* Error when --modversion is requested with more than one package, as
  the output is ambiguous.

Changes from 1.9.4 to 1.9.5:
----------------------------

* Fix incorrect assumptions involving the use of ctype(3) functions.
  Patch by Taylor R Campbell.

* Fix detection of provided functions on autoconf.
  Patches by Harmen Stoppels.

* Fix deletion of tests/meson.build by the autoconf build system.
  Patch by h30032433.

* Fix quoting rules in argvsplit.c.
  Patch by huyubiao.

* Update libpkgconf documentation and documentation building scripts.
  Patches by Andrew Shadura.

* Enforce maximum package count correctly for --modversion.

Changes from 1.9.3 to 1.9.4:
----------------------------

* Fix a buffer overflow vulnerability involving very large variable expansions.
  CVE-2023-24056

* Fix a bunch of minor regressions with the solver.

* Create separate solutions for `--cflags` and `--libs` when `--static` is not
  used.

* Remove final trailing whitespace in pkgconf_fragment_render_buf().

* Revert broken pkg.m4 change involving querying module versions in
  PKG_CHECK_MODULES.

* Fix handling of tildes in version strings.

* Various C99 formatting string fixes involving SIZE_FMT_SPECIFIER.

Changes from 1.9.2 to 1.9.3:
----------------------------

* Fix a bunch of minor code issues pointed out using Clang static analyzer.

* New API: pkgconf_solution_free(), which frees a compiled solution graph.

* Fix behavior when overriding global variables with `--define-variable`.

Changes from 1.9.1 to 1.9.2:
----------------------------

* Do not try to break dependency cycles across dependency lists.  This causes
  the solved graph to sometimes miss required dependency nodes because the
  solver detected an incorrect dependency cycle.

* New API: pkgconf_queue_solve(), which replaces pkgconf_queue_apply().
  pkgconf_queue_apply is now deprecated and should not be used in new code.

Changes from 1.9.0 to 1.9.1:
----------------------------

* Skip graph flattening and traversal for query types which only make sense
  for a single pkg-config module.

  The old solver walked these graphs with --maximum-traverse-depth=1 in
  these cases, but this is no longer helpful because the graph is flattened
  by the new solver.

Changes from 1.8.0 to 1.9.0:
----------------------------

* pkgconf 1.9.0 is the first testing release in the pkgconf 2.0 development
  series.  While it is believed to be suitable for production, there may be
  bugs due to the overall redesign of the solver and other initiatives.
  Additionally, a future release of pkgconf plans will have additional ABI
  breaks for the libpkgconf library before the pkgconf 2.0 release is cut.

* There is now a new solver that is designed to provide higher performance
  with complicated graphs, which works by flattening the dependency graph
  into a smaller set of dependencies.  This graph can then be evaluated
  instead of the original dependency graph without having to visit every
  edge in the graph.

  NOTE: This solver, while providing significant performance improvements,
  does so, at the cost of changed behavior for some edge cases (such as
  circular dependencies).

* Bug fixes:
  - Resolved several memory leaks with edge cases when using libpkgconf
    directly.
  - pkgconf CLI now consistently frees libpkgconf resources under all
    circumstances.
  - SYSROOT rules are no longer applied to `-uninstalled` packages by
    default.  Use `PKG_CONFIG_PKGCONF1_SYSROOT_RULES` for legacy behavior.

* A new `--license` selector has been added to the pkgconf CLI.  This uses
  SPDX expressions which can be set as the `License` field in `.pc` files.
  See the `pc(5)` manpage for more information.

* The canonical location for pkgconf maintenance going forward is
  <https://gitea.treehouse.systems/ariadne/pkgconf>.  This is presently
  mirrored to GitHub for user convenience, but that mirroring will
  be terminated at some point (due to GitHub Copilot).

Changes from 1.7.4 to 1.8.0:
----------------------------

* This is the last planned maintenance branch.  I see pkgconf as basically
  a finished tool at this point, and very few people were ultimately interested
  in libpkgconf.  So, from here on out, it will just be bug fixes only and
  very minor enhancements.

* Bug fixes:
  - Improved path handling on Windows to conform to what the MSYS2
    and Cygwin teams were already modifying pkgconf to do.
    Patches by Christoph Reiter.
  - Fix a minor memory leak relating to cross-personalities.
    Patch by Stone Tickle.
  - Fix static builds for Windows on Meson.
    Patch by Alexander Neumann.
  - Fix some edge cases with --redefine-prefix.
    Patch by midipix.
  - Do not prepend sysroot_dir if the .pc file does not exist in the
    sysroot.
    Patch by Sandro Mani.
  - Do not perform path filtering on default system include and library
    path lists.  This fixes consistency with other mechanisms that modify
    these path lists.

* Enhancements:
  - Document the --validate option in the manpage.
    Patch by orbea.

Changes from 1.7.3 to 1.7.4:
----------------------------

* Bug fixes:
  - Fix null-dereference crash when pulling a malformed 'uninstalled'
    .pc file into a dependency tree.  Patch by Tobias Stöckmann.
  - Fix truncation of comment characters when quoted.
  - Fix handling of .pc module names in --list-all on Windows.
    Patch by Ryan Scott.
  - Handle platforms where realpath(3) requires a pre-allocated buffer.
    Patch by Fabian Groffen.
  - Fix version whitespace warning.
    Patch by Christoph Reiter.

* Enhancements:
  - Rewrite DOS paths on native Windows builds that don't use
    Cygwin/MSYS.
  - Add WantDefaultPure cross-compiler personality option.
  - Prefer --static --pure linking on Windows.
  - Add PKG_CONFIG_DONT_DEFINE_PREFIX environment variable.
    Patch by Jeff Moguillansky.
  - Many improvements when building pkgconf with Meson.
    Patches by Christoph Reiter.

Changes from 1.7.2 to 1.7.3:
----------------------------

* Bug fixes:
  - Fix a possible out of boundary write when evaluating dependencies.
    Patch by Tobias Stöckmann.
  - Fix escaping logic on Windows.  Patch by Vincent Torri.
  - Fix out of boundary reads and writes with a malformed fragment.
    Patches by Tobias Stöckmann.
  - Fix a possible out of boundary write when evaluating tuples.
    Patch by Tobias Stöckmann.

Changes from 1.7.1 to 1.7.2:
----------------------------

* Bug fixes:
  - Fix a windows-specific crash relating to path fixups.

Changes from 1.7.0 to 1.7.1:
----------------------------

* Bug fixes:
  - Fix a possible out of boundary access in the parser for the
    cross-compile database.  Patch by Tobias Stöckmann.
  - Missing files for building with Meson are now included in the
    tarball.  Patch by Neal Gompa.
  - Fix calculation of package atoms on Windows with paths that
    use both directory separator characters.

Changes from 1.6.3 to 1.7.0:
----------------------------

* Bug fixes:
  - Fix a possible buffer overflow involving newline escaping.
    Patch by Tobias Stöckmann.
  - Fix an out of boundary access in the parser.
    Patch by Tobias Stöckmann.
  - Fix leakage of strcmp() result value in pkgconf_compare_version()
    responses.
  - Return the default personality if loading a cross-compile
    personality file failed.
  - Do not complain about newlines when validating package versions.
  - Properly detect strndup() on Windows when building with Meson.

* Enhancements:
  - A new --shared option and WantDefaultStatic cross-compile
    configuration option have been added.  This allows for toolchains
    to specify that static linking should be used by default.
  - Support for the PKG_CONFIG_MSVC_SYNTAX environment variable has
    been added.  Patch by Dan Kegel.
  - Support for the PKGCONF_PKG_PKGF_DONT_MERGE_SPECIAL_FRAGMENTS
    client flag which disables emulation of freedesktop.org pkg-config
    fragment merging semantics has been added.
    Patch by Karen Arutyunov.

Changes from 1.6.2 to 1.6.3:
----------------------------

* Bug fixes:
  - Properly tokenize versions.  Versions cannot logically contain
    whitespace, as dependency-lists would not properly tokenize if
    they could.  A diagnostic is generated for malformed version
    strings containing whitespace when --validate is used.

* Enhancements:
  - CMake support has been dropped.  Use Meson to build on Windows.

Changes from 1.6.1 to 1.6.2:
----------------------------

* Bug fixes:
  - Fixed a memory leak when deduplicating paths.
  - Fixed strndup-related build regression on Windows.

* Enhancements:
  - Added pkgconf-lite variant.  pkgconf-lite is a stripped down
    variant of pkgconf that only includes pkg-config features.
  - Added --modversion description to pkgconf(1) man page.

Changes from 1.6.0 to 1.6.1:
----------------------------

* Bug fixes:
  - Fixed an issue where a personality may not be properly selected
    due to argv[0] containing a full path.
  - Fixed a regression where having an empty PKG_CONFIG_LIBDIR
    environment variable would not eliminate the default search
    paths.
  - Use POSIX realpath(3) instead of readlink() for deduplicating the
    search path.  Use _fullpath() on Windows for the same purpose.
  - The dequoting logic for tuples has been improved to ensure that
    quotes *inside* a value remain quoted when necessary.

Changes from 1.5.4 to 1.6.0:
----------------------------

* Bug fixes:
  - Fixed issue where packages which referenced missing packages in
    Requires.private may have crashed due to memory corruption issues
    in some circumstances.
  - Fixed warnings reported by GCC 8 diagnostics.

* Enhancements:
  - Add LIBPKGCONF_VERSION and LIBPKGCONF_VERSION_STR macros for
    determining libpkgconf version.
  - Add pkgconf_fragment_copy_list() to copy a fragment list to
    another fragment list.

Changes from 1.5.3 to 1.5.4:
----------------------------

* Bug fixes:
  - fix build on Windows with Meson
  - fix edge cases for path canonicalization (especially on Windows)

Changes from 1.5.2 to 1.5.3:
----------------------------

* Security fixes:
  - Fix edge cases involving dequoting zero-length tuples that can lead to a
    buffer overflow under the right circumstances.  Thanks to A. Wilcox for
    reporting and supplying a patch.  (MR 3)

Changes from 1.5.1 to 1.5.2:
----------------------------

* Bug fixes:
  - Ensure environment variables override values learned from personality files
    or built-in defaults.

* Documentation enhancements:
  - Add pkgconf-personality(5) manpage documenting the personality file format.

Changes from 1.5.0 to 1.5.1:
----------------------------

* Bug fixes:
  - fixed a crash with some invalid multi-line .pc files

Changes from 1.4.2 to 1.5.0:
---------------------------

* Administrative:
  - The git repository has moved to <https://git.dereferenced.org/pkgconf/pkgconf>,
    due to the acquisition of GitHub by Microsoft.

* Overall enhancements:
  - pkgconf now supports the proposed Requires.internal pkg-config extension,
    by merging it with the Requires.private list (there is no functional difference
    between the two in our resolver implementation)
  - Support for cross-compilation personalities have been added.  To make use of this
    functionality, create a file in the new personality.d directory that sits inside
    the pkgconfig directory.  The personality file format is described in
    pc-personality(5). (github #166)
  - Support for Haiku has been added, including interpretation of BELIBRARIES and
    other toolchain specifics. (github #180)
  - Testsuite support can be disabled when building with Meson. (github #175)

* Bug fixes:
  - tuples are now appropriately dequoted when added by the parser (github #186).

* Various Windows enhancements:
  - CMake supports building with GCC on Windows. (github #179)
  - Prefix rewriting has been improved. (github #177)
  - PKGCONF_API support has been implemented when building with Meson,
    allowing Meson to be used to build pkgconf on Windows. (github #174)

* Documentation fixes:
  - The manpages have been linted and fixed. (github #181, #182, #183)
  - The description of pkgconf --exists has been corrected. (github #173)

Changes from 1.4.1 to 1.4.2:
----------------------------

* Bug fixes:
  - ensure pkgconf_dependency_t nodes have a solution marked when satisfied
    by an indirect provider (github #172)

Changes from 1.4.0 to 1.4.1:
----------------------------

* Bug fixes:
  - revert some quoting changes because they don't work well with certain
    GCC edge cases (github #168)

* Enhancements:
  - add limited support for --cflags with --msvc-syntax

Changes from 1.3.7 to 1.4.0:
----------------------------

* Notable libpkgconf API changes:
  - pkgconf_pkg_t.requires has been renamed to pkgconf_pkg_t.required for
    C++20 compatibility.

* Enhancements:
  - pkgconf and libpkgconf has been ported to Windows as native binaries.
  - improved compatibility with freedesktop.org pkg-config's ${pc_sysrootdir}
    usage pattern.
  - do not mention PKG_CONFIG_SKIP_CONFLICTS environmental variable when
    simplified errors are requested, as with PKG_CONFIG_PATH.
  - the dependency solver now stores solutions to dependency graph elements
    it visits, allowing for the dependency graph to be incrementally solved.
    this improves dependency solving time by an order of magnitude in most
    cases.
  - new --env option allows for exporting cflags/libs fragments as export
    variables
  - new support for building pkgconf with CMake and Meson
  - improved compiler warning flag detection on autoconf and CMake
  - removed PKGCONF_BUFSIZE allocations from the stack where possible
  - allow for customizing the way fragment lists are rendered using a callback API
  - new support for --msvc-syntax output using the new fragment rendering callbacks
  - fragments are now quoted according to POSIX literal rules
  - new variables on the pkg-config builtin:
    - ${pc_system_includedirs}: the system includedir search path known by pkgconf
    - ${pc_system_libdirs}: the system libdir search path known by pkgconf
  - new manpages:
    - pc(5) describing pkgconf's interpretation of pkg-config .pc files
    - pkg.m4(7) describing the autotools macros bundled with pkgconf

* Bug fixes:
  - fix pkgconf_pkg_t.id generation on native Windows where either \ or / are usable
    as path separator.
  - add missing --modversion to --help output
  - do not evaluate module paths for modules that are not actually on disk
  - ensure we work on a zeroed buffer prior to calling realpath(2) with it
  - fix path deduplication edge case when cache-inodes feature is unavailable
  - fix path rewriting regression with PKG_CONFIG_SYSROOT_DIR when
    PKG_CONFIG_SYSROOT_DIR is set to /
  - fix crash in edge case where a .pc file has misquoting in a fragment list.
  - fix logic edge case when comparing relocated paths

Changes from 1.3.6 to 1.3.7:
----------------------------

* Enhancements:
  - improved diagnostics for malformed packages.

* Bug fixes:
  - reject packages which contain incomplete metadata in post-parse phase.

Changes from 1.3.5 to 1.3.6:
----------------------------

* Enhancements:
  - add many cflags to the protected set: -Wa, -Wl, -Wp, -ansi, -std=, -stdlib=,
    -pedantic, -pthread, -trigraphs, -nostdinc, -nostdlibinc, -nobuiltininc.

* Bug fixes:
  - handle -include cflag fragments properly.

Changes from 1.3.4 to 1.3.5:
----------------------------

* Bug fixes:
  - fix --variable output for compatibility some broken configure scripts when they
    request the same variable from multiple packages

Changes from 1.3.3 to 1.3.4:
----------------------------

* Bug fixes:
  - fix a quoting issue exposed by the Go testsuite

Changes from 1.3.2 to 1.3.3:
----------------------------

* Bug fixes:
  - back out disabling the dependency resolver for single-package queries, it caused
    too many regressions.

* Enhancements:
  - allow explicitly disabling the dependency resolver via new environment variable,
    PKG_CONFIG_MINIMUM_TRAVERSE_DEPTH=1.  while pkgconf could already do this using
    --minimum-traverse-depth=1, other pkg-config implementations do not have this
    option, so adding an environment variable allows to make better use of this
    feature (other implementations won't error due to unknown option this way)

Changes from 1.3.1 to 1.3.2:
----------------------------

* Bug fixes:
  - rewrite handling of --modversion, --print-variables and --variable to not require
    the dependency resolver
  - ensure we disable the dependency resolver in all cases where it is a single-package
    query (1.3.1 did not go far enough)

Changes from 1.3.0 to 1.3.1:
----------------------------

* Features:
  - implement --short-errors

* Bug fixes:
  - only consider a single package at a time with --print-requires, --print-requires-private,
    --print-provides, --modversion, --print-variable and --print-variables

* Enhancements:
  - synchronized latest freedesktop.org changes to pkg.m4
  - improve error reporting with legacy --atleast-version and similar flags.

Changes from 1.2.0 to 1.3.0:
----------------------------

* Features:
  - pkgconf --debug now provides a facility for tracing most relevant libpkgconf operations
  - libpkgconf: add warn and trace handlers for warnings
  - replace realpath() with faster, lighter weight path normalization function (github #112)
  - pkgconf CLI now emulates pkg-config quoting rules precisely, while allowing direct access
    to the actual fragments via libpkgconf

* Bug fixes:
  - pkg: properly separate static and virtual packages so they are not inappropriately
    optimized out of the dependency graph (github #108)
  - argvsplit: do not consider ' and " to have similar rules to escape sequences (github #111)
  - pkg: strip trailing whitespace when parsing .pc files

* Enhancements:
  - argvsplit basically rewritten from scratch
  - many code fixes spotted by coverity
  - add PKG_CONFIG_DONT_RELOCATE_PATHS and --dont-relocate-paths environment variables to
    disable path relocation feature if needed
  - remove extra whitespace that was present for compatibility with older pkg-config releases
    (github #113)

Changes from 1.1.0 to 1.2.0:
----------------------------

* Features:
  - new --path option lists the .pc files which provided the requested dependencies
  - new path relocation API: pkgconf_path_relocate(), which wraps functions such as
    realpath() and cygwin_conv_path().
  - new --with-path option adds a path to the search list
  - new --define-prefix and --dont-define-prefix features enable automatic prefix
    detection for relocatable SDKs.  this is mostly useful on windows.

* Bug fixes:
  - fragments: fix even more edge cases involving token concatenation
  - path lists: don't attempt to collect path inodes if the filter is disabled
  - path lists: explicitly avoid uninitialised data for the path inode cache
  - client: properly handle --keep-system-cflags and --keep-system-libs

* Enhancements:
  - windows: build libpkgconf as a DLL
  - fragments: only munge fragments if sysroot_dir is actually set
  - overall API: resolver flags have been moved to being a client-object setting
    instead of used for every function invocation

Changes from 1.0.1 to 1.1.0:
----------------------------

* Features:
  - new Provides system allows alternate .pc files to provide a dependency
  - stable library API (with documentation): http://pkgconf.readthedocs.io/

* Enhancements:
  - make it possible to programmatically declare dependencies instead of just using the parser
  - testsuite migrated to run under kyua
  - provide a libpkgconf.pc file for consumers to use
  - pkgconf client: new --pure flag to enable dependency graph optimization in --static mode
  - significant .pc parser speedups using bsearch(3).
  - handle -idirafter in the same way as -isystem CFLAGS
  - learn toolchain "system" paths from GCC environment variables, if present
  - filter duplicate PKG_CONFIG_PATH (and other) entries by inode

* Bug fixes:
  - fragments: fix another edge case involving empty tokens being concatenated onto previous tokens
    (github #99)
  - libpkgconf: remove dependencies on config.h in public headers

Changes from 1.0.0 to 1.0.1:
----------------------------

* Enhancements:
  - new stub implementation of --print-provides (github #95)

* Bug fixes:
  - fragments: fix an edge case involving path-only fragments and PKG_CONFIG_SYSROOT_DIR (github #94)

Changes from 0.9.12 to 1.0.0:
-----------------------------

* Features:
  - new library: libpkgconf

* Enhancements:
  - testsuite: use an explicit prefix on all tests
  - build: switch to automake

* Bug fixes:
  - cast all usage of ctype(3) functions
  - do not expand variables passed via --define-variable for compatibility with pkg-config 0.29
  - let the CFLAGS being user settable

Changes from 0.9.11 to 0.9.12:
------------------------------

* Features:
  - add --list-package-names

* Enhancements:
  - ensure -I and -L are never pushed back

* Bug fixes:
  - fix implicit conversion warnings with variables over 31bits

Changes from 0.9.10 to 0.9.11:
------------------------------

* Features:
  - add --validate

* Enhancements:
  - add large file support checks in autoconf

* Bug fixes:
  - fix private lib deduplication
  - handle --static correctly in some more esoteric scenarios

Changes from 0.9.9 to 0.9.10:
-----------------------------

* Features:

* Enhancements:

* Bug fixes:
  - Fix parser when dealing with commented lines

Changes from 0.9.8 to 0.9.9:
----------------------------

* Features:
  - add a sub out --print-provides

* Enhancements:

* Bug fixes:
  - Fix parser when dealing with comments in fields

Changes from 0.9.7 to 0.9.8:
----------------------------

* Features:

* Enhancements:
  - Convert manpages to mdoc(7)

* Bug fixes:
  - Fix parsing multiline fields

Changes from 0.9.6 to 0.9.7:
----------------------------

* Features:

* Enhancements:
  - Convert manpages to mdoc(7)

* Bug fixes:
  - Fix parsing multiline fields

Changes from 0.9.5 to 0.9.6:
----------------------------

* Features:
  - add a sub --debug

* Enhancements:
  - Do not hardcode non-posix install(1)

* Bug fixes:
  - fix --with-system-includedir and --with-system-libdir behaviour

Changes from 0.9.4 to 0.9.5:
----------------------------

* Features:

* Enhancements:
  - Make all variables but CFLAGS and LIBS case sensitive

* Bug fixes:

Changes from 0.9.3 to 0.9.4:
----------------------------

* Features:
  - Add a pkgconf(1) manpage

* Enhancements:
  - Improve support for MacOS -framework

* Bug fixes:

Changes from 0.9.2 to 0.9.3:
----------------------------

* Features:
  - Add support for CFLAGS.private

* Enhancements:
  - Support out of source build
  - Improved private libs deduplication

* Bug fixes:

Changes from 0.9.1 to 0.9.2:
----------------------------

* Features:

* Enhancements:

* Bug fixes:
  - Fix PKG_CONFIG_PATH being ignored when a .pc is directly supplied from
    command line

Changes from 0.9.0 to 0.9.1:
----------------------------

* Features:

* Enhancements:
  - --simulate: print depgraph operations
  - --simulate: print bytecode program as a human-readable AST

* Bug fixes:
  - reset parser state on new package atom

Changes from 0.8.12 to 0.9.0:
----------------------------

* Features:

* Enhancements:
  - Rework the internal cache API
  - Rework the internal code to use the new pkg_list_t framework
  - Rework PKG_CONFIG_PATH handling code

* Bug fixes:
  - fix multi-recursion with -framework