Release Date for musl-1.2.6

Release Date for musl-1.2.6

[Samarjit Ram]

[-- Attachment #1: Type: text/plain, Size: 307 bytes --]

Hi Team,

We are getting affected by CVE-2025-26519<https://www.openwall.com/lists/musl/2025/02/13/1> that is present in 1.2.5.

Hence, I wished to enquire on the expected release date for MUSL 1.2.6.

Note – I am an non- member and want to receive a reply. Kindly keep me Cc’d.

Regards,
Samar


[-- Attachment #2: Type: text/html, Size: 3160 bytes --]

Re: Release Date for musl-1.2.6

[Rich Felker]

On Wed, May 28, 2025 at 04:44:35PM +0000, Samarjit Ram wrote:
> Hi Team,
> 
> We are getting affected by CVE-2025-26519<https://www.openwall.com/lists/musl/2025/02/13/1> that is present in 1.2.5.
> 
> Hence, I wished to enquire on the expected release date for MUSL 1.2.6.
> 
> Note – I am an non- member and want to receive a reply. Kindly keep me Cc’d.

Release preparation is in the works, but I'm purposefully not rushing
it since I had a bunch of queued up patches I'd neglected to push, and
I don't want folks to be scrambling to check that there's nothing bad.
1-2 weeks out is probably the soonest I'd try to declare a release.

In the mean time, the recommended action for the iconv issue is to
apply the patches linked from the website. They should apply cleanly
to all affected versions.

Rich

Re: Release Date for musl-1.2.6

[Rob Landley]

On 5/28/25 19:33, Rich Felker wrote:
> On Wed, May 28, 2025 at 04:44:35PM +0000, Samarjit Ram wrote:
>> Hi Team,
>>
>> We are getting affected by CVE-2025-26519<https://www.openwall.com/lists/musl/2025/02/13/1> that is present in 1.2.5.
>>
>> Hence, I wished to enquire on the expected release date for MUSL 1.2.6.
>>
>> Note – I am an non- member and want to receive a reply. Kindly keep me Cc’d.
> 
> Release preparation is in the works, but I'm purposefully not rushing
> it since I had a bunch of queued up patches I'd neglected to push, and
> I don't want folks to be scrambling to check that there's nothing bad.
> 1-2 weeks out is probably the soonest I'd try to declare a release.

It's been about 6. How's it going?

Rob

Re: Release Date for musl-1.2.6

[Rich Felker]

On Sat, Jul 12, 2025 at 12:36:54AM -0500, Rob Landley wrote:
> On 5/28/25 19:33, Rich Felker wrote:
> > On Wed, May 28, 2025 at 04:44:35PM +0000, Samarjit Ram wrote:
> > > Hi Team,
> > > 
> > > We are getting affected by CVE-2025-26519<https://www.openwall.com/lists/musl/2025/02/13/1> that is present in 1.2.5.
> > > 
> > > Hence, I wished to enquire on the expected release date for MUSL 1.2.6.
> > > 
> > > Note – I am an non- member and want to receive a reply. Kindly keep me Cc’d.
> > 
> > Release preparation is in the works, but I'm purposefully not rushing
> > it since I had a bunch of queued up patches I'd neglected to push, and
> > I don't want folks to be scrambling to check that there's nothing bad.
> > 1-2 weeks out is probably the soonest I'd try to declare a release.
> 
> It's been about 6. How's it going?

Alright. If you're watching the list, there's the arm __getauxval/SME
issue I'm trying to make sure is not left in a future-breaking state
for release. Otherwise, I have a draft writeup of the WHATSNEW. If you
or anyone else has time, help checking for any overlooked pending
patches that would be non-invasive to merge, like adding missing new
linux/arch-specific stuff in headers, especially between last fall and
now, would be most welcome.

Rich

Re: Release Date for musl-1.2.6

[Rob Landley]

On 7/12/25 09:47, Rich Felker wrote:
> On Sat, Jul 12, 2025 at 12:36:54AM -0500, Rob Landley wrote:
>>> Release preparation is in the works, but I'm purposefully not rushing
>>> it since I had a bunch of queued up patches I'd neglected to push, and
>>> I don't want folks to be scrambling to check that there's nothing bad.
>>> 1-2 weeks out is probably the soonest I'd try to declare a release.
>>
>> It's been about 6. How's it going?
> 
> Alright. If you're watching the list, there's the arm __getauxval/SME
> issue I'm trying to make sure is not left in a future-breaking state
> for release. Otherwise, I have a draft writeup of the WHATSNEW. If you
> or anyone else has time, help checking for any overlooked pending
> patches that would be non-invasive to merge, like adding missing new
> linux/arch-specific stuff in headers, especially between last fall and
> now, would be most welcome.

I spent 3 weeks in tokyo and moved to a new apartment when I got back, 
and have completely lost track of everything. Is there news here?

I built a new toolchain with musl-git a couple weeks back and didn't 
spot any obvious failures in the resulting mkroot images, although 
that's not a particularly stressful test...

Rob