XZ Utils

IMPORTANT: This includes a fix for a security issue that affects all XZ Utils versions since 5.0.0. This and a few other fixes have also been committed to the old stable branches (v5.2, v5.4, and v5.6) in the xz Git repository. Those fixes are marked below. No new 5.2.x, 5.4.x, or 5.6.x releases will be made.

5.8.4 (2026-09-09)

    * liblzma:

        - lzma_alone_decoder(), lzma_lzip_decoder(),
          lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an
          invalid memory access after memory allocation has failed and
          the application reinitializes the existing decoder to decode
          a different file. This bug could at least result in a crash.
          This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
          (Also in v5.2, v5.4, and v5.6.)

        - lzma_stream_buffer_decode(): Fix wrong error code and,
          in debug builds, assertion failure. LZMA_BUF_ERROR could
          be returned with truncated inputs while LZMA_DATA_ERROR
          is the correct one in this function.
          (Also in v5.2, v5.4, and v5.6.)

        - Fix a performance issue in the typical use case of
          lzma_index_cat(). Internally liblzma calls it from
          lzma_file_info_decoder(), so that was affected too. The
          problem occurred if the input .xz file was created by
          concatenating a large number of .xz files. A crafted file
          could make "xz --list" very slow or effectively hang.
          Normal decompression doesn't use these functions and
          thus wasn't affected.
          (Also in v5.2, v5.4, and v5.6.)

        - Fix a theoretical integer overflow in lzma_index_cat().
          (Also in v5.2, v5.4, and v5.6.)

        - Fix bogus memory usage report in lzma_index_decoder() when
          the .xz Index is obviously invalid. A huge bogus value could
          cause an integer overflow in lzma_file_info_decoder()'s
          memory usage reporting due to a missing overflow check,
          making lzma_memused() report an incorrect tiny value. This
          bug didn't affect the memory usage limiter in these two
          decoders; only the reporting via lzma_memused() was affected.
          (Also in v5.2, v5.4, and v5.6.)

        - Fix a too low memory usage report in lzma_index_decoder()
          if lzma_memused() is called after a part of the Index has
          already been decoded. The typical use case is to call
          lzma_memused() immediately after LZMA_MEMLIMIT_ERROR,
          which did work correctly.

        - Fix copying of check type in lzma_index_dup(). Calling
          lzma_index_checks() on the duplicated lzma_index returned
          return garbage a result. lzma_index_dup() is rarely used;
          liblzma doesn't use it internally and xz itself doesn't use
          it either.
          (Also in v5.2, v5.4, and v5.6.)

        - lzma_file_info_decoder() and lzma_index_decoder(): Reject
          an obviously-invalid Number of Records field earlier.
          (Partially also in v5.2, v5.4, and v5.6.)

        - Fix a missing synchronization in the threaded .xz decoder. It
          could make lzma_get_progress() return incorrect progress info.
          (Also in v5.4 and v5.6.)

        - Detect certain kinds of corrupt inputs slightly earlier in
          the LZMA2 decoder.

        - ARM64 and LoongArch: Don't use aligned reads on unaligned
          buffers. This makes the code work on strict-align processors
          and fixes a sanitizer error in other cases. (Since 5.7.1alpha)

    * xz:

        - Fix a use-after-free when showing an error message if --files
          or --files0 was specified in the environment variables XZ_OPT
          or XZ_DEFAULTS.
          (Also in v5.2, v5.4, and v5.6.)

        - Fix a use-after-free bug when --verbose is used and
          standard error isn't a terminal. (Since 5.7.1alpha)

        - Make it an error if the totals in "xz --list" exceed the range
          of 64-bit integers.
          (Also in v5.2, v5.4, and v5.6.)

    * xz and xzdec on Linux:

        - Add support for Landlock ABI version 9.

        - Use fallback macros for Landlock ABI version 2, 3, and 5
          (but not 4) if <linux/landlock.h> is older than ABI version 5.
          This makes the binary slightly more protected if it is run on
          a kernel that supports newer ABIs than <linux/landlock.h>.

    * Scripts:

        - xzgrep: Fix handling of the ' char at the end of a command
          line option. For example, the following tricked xzgrep to
          run "id": xzgrep "-e'" "-e;id;'" somefile
          (Also in v5.2, v5.4, and v5.6.)

        - xzdiff: Use the C locale (LC_ALL=C) with "sed" and "expr"
          to ensure safe behavior with invalid multibyte sequences.
          An equivalent improvement was made in xzgrep in 5.2.6
          (2022-08-12), but it was forgotten from xzdiff.
          (Also in v5.2, v5.4, and v5.6.)

    * Tests:

        - Improve a few tests and fuzz targets.

        - Add new test files:
            * bad-0-index-1.xz (32 bytes)
            * bad-1-index-huge-uncomp.xz (72 bytes)

    * Man pages:

        - Improve the rendering with OpenBSD's mandoc(1).

        - Reduce indentation of the tables to avoid overlong lines
          in translated versions of the xz man page.

    * Translations:

        - In translated man pages, workaround an issue with non-ASCII
          characters in tables.

        - Fix syntax errors in a few man page translations.

        - Update Arabic and German man page translations.

        - Update Brazilian Portuguese, Croatian, Dutch, German, Italian,
          Korean, Polish, Portuguese, Romanian, and Ukrainian message
          translations.

IMPORTANT: This includes a fix for CVE-2026-34743 which affects all XZ Utils versions since 5.0.0. No new 5.2.x, 5.4.x, or 5.6.x releases will be made, but the fix is in the v5.2, v5.4, and v5.6 branches in the xz Git repository.

5.8.3 (2026-03-31)

    * liblzma:

        - Fix a buffer overflow in lzma_index_append(): If
          lzma_index_decoder() was used to decode an Index that
          contained no Records, the resulting lzma_index was left in
          a state where where a subsequent lzma_index_append() would
          allocate too little memory, and a buffer overflow would occur.

          The lzma_index functions are rarely used by applications
          directly. In the few applications that do use these functions,
          the combination of function calls required to trigger this bug
          are unlikely to exist, because there typically is no reason to
          append Records to a decoded lzma_index. Thus, it's likely that
          this bug cannot be triggered in any real-world application.

          The bug was reported and discovered by Cantina using their
          AppSec agent, Apex.

        - Fix the build on Windows ARM64EC.

        - Add "License: 0BSD" to liblzma.pc.

    * xz:

        - Fix invalid memory access in --files and --files0. All of
          the following must be true to trigger it:

            1. A string being read (which supposedly is a filename) is
               at least SIZE_MAX / 2 bytes long. This size is plausible
               on 32-bit platforms (2 GiB - 1 B).

            2. realloc(ptr, SIZE_MAX / 2 + 1) must succeed.
               On glibc >= 2.30 it shouldn't because the value
               exceeds PTRDIFF_MAX.

            3. An integer overflow results in a realloc(ptr, 0) call.
               If it doesn't return NULL, then invalid memory access
               will occur.

        - On QNX, don't use fsync() on directories because it fails.

    * Autotools: Enable 32-bit x86 assembler on Hurd by default.
      It was already enabled in the CMake-based build.

    * Translations: Add Arabic man page translations.

5.8.2 (2025-12-17)

    * liblzma:

        - Fix the build on ARM64 on glibc versions older than
          2.24 (2016). They don't have HWCAP_CRC32 in <sys/auxv.h>.

        - Disable CLMUL CRC code when building for 32-bit x86 with
          old MSVC versions. This avoids a compiler bug. The exact
          compiler version in which the issue was fixed is unknown,
          but VS 2022 17.13 (MSVC 19.43.34808) is known to work, so
          CLMUL CRC on 32-bit x86 is disabled with MSVC versions
          older than that.

    * xz:

        - Add a workaround for Red Hat Enterprise Linux 9 kernel bug
          which made xz fail with "xz: Failed to enable the sandbox".
          It only occurs with xz 5.8.0 and 5.8.1 binaries built for
          other distros. For example, running Debian 13 in a container
          on RHEL/CentOS 9 would trigger the issue.

          The bug was introduced in RHEL 9 kernel 5.14.0-603.el9
          (2025-07-30) and fixed in 5.14.0-648.el9 (2025-12-05).
          However, as of writing, the fixed kernel isn't available
          to RHEL 9 users yet, so including the workaround in this
          xz release seems reasonable. The workaround will be removed
          when it's no longer needed.

          xzdec was also affected by this issue.

        - On AIX, don't use fsync() on directories because it fails.

        - Fix the build on Emscripten.

        - Fix the build on clang-cl on Windows.

        - Take resource limits (RLIMIT_DATA, RLIMIT_AS, and RLIMIT_VMEM)
          into account when determining the default memory usage limit
          for multithreaded mode. This should prevent xz from failing
          when a resource limit has been set to a value that is less
          than 1/4 of total RAM. Other memory limits can still trigger
          the same issue, for example, Linux cgroup v2 memory.max.

    * Build systems:

        - When symbol versioning is enabled, pass --undefined-version
          to the linker if the option is supported. This fixes the
          build when using LLVM's lld and some liblzma features have
          been disabled at build time.

        - ARM64: Fix autodetection of fast unaligned memory access when
          using GCC and -mstrict-align is in effect. Previously the
          build systems would incorrectly guess that unaligned access
          is fast, which would result in much slower binaries than
          needed. The fix is a workaround for GCC bug 111555;
          autodetection already worked with Clang.

        - LoongArch: Autodetect if fast unaligned memory access is
          supported. This can improve compression speed by 15 % (but
          not decompression speed).

    * Translations:

        - Update the Spanish translation.

        - Add Swedish man page translations.

        - Update Italian, Korean, Romanian, Serbian, and Ukrainian
          man page translations.

IMPORTANT: This includes a security fix for CVE-2025-31115 which affects XZ Utils from 5.3.3alpha to 5.8.0. See the security advisory for details.

5.8.1 (2025-04-03)

    * Multithreaded .xz decoder (lzma_stream_decoder_mt()):

        - Fix a bug that could at least result in a crash with
          invalid input. (CVE-2025-31115)

        - Fix a performance bug: Only one thread was used if the whole
          input file was provided at once to lzma_code(), the output
          buffer was big enough, timeout was disabled, and LZMA_FINISH
          was used. There are no bug reports about this, thus it's
          possible that no real-world application was affected.

    * Avoid <stdalign.h> even with C11/C17 compilers. This fixes the
      build with Oracle Developer Studio 12.6 on Solaris 10 when the
      compiler is in C11 mode (the header doesn't exist).

    * Autotools: Restore compatibility with GNU make versions older
      than 4.0 by creating the package using GNU gettext 0.23.1
      infrastructure instead of 0.24.

    * Update Croatian translation.

5.8.0 (2025-03-25)

    This bumps the minor version of liblzma because new features were
    added. The API and ABI are still backward compatible with liblzma
    5.6.x, 5.4.x, 5.2.x, and 5.0.x.

    * liblzma on 32/64-bit x86: When possible, use SSE2 intrinsics
      instead of memcpy() in the LZMA/LZMA2 decoder. In typical cases,
      this may reduce decompression time by 0-5 %. However, when built
      against musl libc, over 15 % time reduction was observed with
      highly compressed files.

    * CMake: Make the feature test macros match the Autotools-based
      build on NetBSD, Darwin, and mingw-w64.

    * Update the Croatian, Italian, Portuguese, and Romanian
      translations.

    * Update the German, Italian, Korean, Romanian, Serbian, and
      Ukrainian man page translations.

    Summary of changes in the 5.7.x development releases:

    * Mark the following LZMA Utils script aliases as deprecated:
      lzcmp, lzdiff, lzless, lzmore, lzgrep, lzegrep, and lzfgrep.

    * liblzma:

        - Improve LZMA/LZMA2 encoder speed on 64-bit PowerPC (both
          endiannesses) and those 64-bit RISC-V processors that
          support fast unaligned access.

        - Add low-level APIs for RISC-V, ARM64, and x86 BCJ filters
          to lzma/bcj.h. These are primarily for erofs-utils.

        - x86/x86-64/E2K CLMUL CRC code was rewritten.

        - Use the CRC32 instructions on LoongArch.

    * xz:

        - Synchronize the output file and its directory using fsync()
          before deleting the input file. No syncing is done when xz
          isn't going to delete the input file.

        - Add --no-sync to disable the sync-before-delete behavior.

        - Make --single-stream imply --keep.

    * xz, xzdec, lzmainfo: When printing messages, replace
      non-printable characters with question marks.

    * xz and xzdec on Linux: Support Landlock ABI versions 5 and 6.

    * CMake: Revise the configuration variables and some of their
      options, and document them in the file INSTALL. CMake support
      is no longer experimental. (It was already not experimental
      when building for native Windows.)

    * Add build-aux/license-check.sh.

5.7.2beta (2025-03-08)

    * On the man pages, mark the following LZMA Utils script aliases as
      deprecated: lzcmp, lzdiff, lzless, lzmore, lzgrep, lzegrep, and
      lzfgrep. The commands that start with xz* instead of lz* have
      identical behavior.

      The LZMA Utils aliases lzma, unlzma, and lzcat aren't deprecated
      because some of these aliases are still in common use. lzmadec
      and lzmainfo aren't deprecated either.

    * xz: In the ENVIRONMENT section of the man page, warn about
      problems that some uses of XZ_DEFAULTS and XZ_OPT may create.

    * Windows (native builds, not Cygwin): In xz, xzdec, and lzmadec,
      avoid an error message on broken pipe.

    * Autotools: Fix out-of-tree builds when using the bundled
      getopt_long.

    * Translations:

        - Updated: Chinese (traditional), Croatian, Finnish, Georgian,
          German, Korean, Polish, Romanian, Serbian, Spanish, Swedish,
          Turkish, and Ukrainian

        - Added: Dutch

    * Man page translations:

        - Updated: German, Korean, Romanian, and Ukrainian

        - Added: Italian and Serbian

5.7.1alpha (2025-01-23)

   * All fixes from 5.6.4.

   * liblzma:

       - Improve LZMA/LZMA2 encoder speed on 64-bit PowerPC (both
         endiannesses) and those 64-bit RISC-V processors that
         support fast unaligned access.

       - x86/x86-64/E2K CLMUL CRC code was rewritten. It's faster and
         doesn't cause false positives from sanitizers. Attributes
         like __attribute__((__no_sanitize_address__)) are no longer
         present.

       - On 32-bit x86, CLMUL CRC and the old (but still good)
         assembly versions now co-exist with runtime detection.
         Both Autotools and CMake build systems handle this
         automatically now.

       - Use the CRC32 instructions on LoongArch to make CRC32
         calculation faster.

       - Add low-level APIs for RISC-V, ARM64, and x86 BCJ filters
         to lzma/bcj.h. These are primarily for erofs-utils.

       - Minor tweaks to ARM64 CRC32 code and BCJ filters were made.

   * xz:

       - Synchronize the output file and its directory before deleting
         the input file using fsync(). This reduces the probability of
         data loss after a system crash. However, it can be a major
         performance hit if processing many small files.

         NOTE: No syncing is done when xz isn't going to delete
         the input file.

       - Add a new option --no-sync to disable the sync-before-delete
         behavior. It's useful when compressing many small files and
         one doesn't worry about data loss in case of a system crash.

       - Make --single-stream imply --keep.

       - Use automatic word wrapping for the text in --help and
         similar situations to hopefully make the strings easier for
         majority of translators (no need to count spaces anymore).

   * xz, xzdec, lzmainfo: When printing messages, replace
     non-printable characters with question marks. This way
     malicious filenames cannot be used to send escape sequences
     to a terminal. This change is also applied to filenames shown
     in "xz --robot --list".

   * xz and xzdec on Linux: Add support for Landlock ABI versions 5
     and 6.

   * CMake updates:

       - Increase the minimum required CMake version to 3.20.

       - Revise the configuration variables and some of their options.
         Document them in the file INSTALL.

       - Attempt to produce liblzma.pc so that the paths are based on
         ${prefix}, which makes it simpler to override the paths
         if the liblzma files have been moved.

       - To enable translations, gettext-tools is now required. The
         CMake build no longer supports installing pre-compiled
         message catalog binary files (po/*.gmo).

       - Apple: Use Mach-O shared library versioning that is
         compatible with GNU Libtool. This should make it easier to
         switch between the build systems on Apple OSes that enforce
         the correct compatibility_version (macOS >= 12 doesn't?).
         This change is backward compatible: binaries linked against
         old CMake-built liblzma will run with liblzma that uses
         Libtool style versioning.

       - Windows (not Cygwin): Document CMAKE_DLL_NAME_WITH_SOVERSION
         (CMake >= 3.27) in the file INSTALL. This option should
         usually be left to its default value (OFF). It can be set
         to ON if the liblzma DLL filename must be compatible with
         the versioned filename produced by GNU Libtool. For example,
         binaries distributed in MSYS2 use a versioned DLL filename.

       - CMake support is no longer experimental. (It was already
         not experimental when building for native Windows.)

   * Windows: Building liblzma with Visual Studio 2013 is no longer
     supported. Visual Studio 2015 or later (with CMake) can be used
     to build liblzma and the command line tools.

   * Add preliminary Georgian translation. This already contains
     translations of most of the strings that are now automatically
     word wrapped.

   * Add build-aux/license-check.sh. Without arguments, it checks that
     no license information has been forgotten. With the -v argument,
     it shows the license info (or the lack of it) for each file.

     If the .git directory is available, only the files in the
     repository are checked. Without the .git directory, a clean tree
     from an extracted release tarball is expected.

5.6.4 (2025-01-23)

    * liblzma: Fix LZMA/LZMA2 encoder on big endian ARM64.

    * xz:

        - Fix --filters= and --filters1= ... --filters9= options
          parsing. They require an argument, thus "xz --filters lzma2"
          should work in addition to "xz --filters=lzma2".

        - On the man page, note in the --compress and --decompress
          options that the default behavior is to delete the input
          file unless writing to standard output. It was already
          documented in the DESCRIPTION section but new users in
          a hurry might miss it.

    * Windows (native builds, not Cygwin): Fix regressions introduced
      in XZ Utils 5.6.3 which caused non-ASCII characters to display
      incorrectly. Only builds with translation support were affected
      (--enable-nls or ENABLE_NLS=ON). The following changes affect
      builds that have translations enabled:

        - Require UCRT because MSVCRT doesn't support UTF-8
          locales and thus translations won't be readable on
          Windows 10 version 1903 and later. (MSVCRT builds
          are still possible with --disable-nls or ENABLE_NLS=OFF.)

        - Require gettext-runtime >= 0.23.1 because older versions
          don't autodetect the use of the UTF-8 code page. This
          resulted in garbled non-ASCII characters even with UCRT.

        - Partially fix alignment issues in xz --verbose --list
          with translated messages. Chinese (simplified),
          Chinese (traditional), and Korean column headings
          are misaligned still because Windows and MinGW-w64
          don't provide wcwidth() and XZ Utils doesn't include
          a replacement function either.

    * CMake: Explicitly disable unity builds. This prevents build
      failures when another project uses XZ Utils via CMake's
      FetchContent module, and that project enables unity builds.

    * Update Chinese (traditional) and Serbian translations.

5.6.3 (2024-10-01)

    IMPORTANT: This includes a Windows-specific security fix to
    the command line tools. liblzma isn't affected by this issue.

    * liblzma:

        - Fix x86-64 inline assembly compatibility with GNU Binutils
          older than 2.27.

        - Fix the build with GCC 4.2 on OpenBSD/sparc64.

    * xzdec: Display an error instead of failing silently if the
      unsupported option -M is specified.

    * lzmainfo: Fix integer overflows when rounding the dictionary and
      uncompressed sizes to the nearest mebibyte.

    * Windows (except Cygwin and MSYS2): Add an application manifest to
      xz, xzdec, lzmadec, and lzmainfo executables:

        - Declare them compatible with Vista/7/8/8.1/10/11. This way
          the programs won't needlessly use Operating System Context
          of Vista when running on later Windows versions. This setting
          doesn't mean that the executables cannot run on even older
          versions if otherwise built that way.

        - Declare them as UAC-compliant. MSVC added this by default
          already but it wasn't done with MinGW-w64, at least not
          with all toolchain variants.

        - Declare them long path aware. This makes long path names
          work on Windows 10 and 11 if the feature has been enabled
          in the Windows registry.

        - Use the UTF-8 code page on Windows 10 version 1903 and later.

            * Now command line tools can access files whose names
              contain characters that don't exist in the current
              legacy code page.

            * The options --files and --files0 now expect file lists
              to be in UTF-8 instead of the legacy code page.

            * This fixes a security issue: If a command line contains
              Unicode characters (for example, filenames) that don't
              exist in the current legacy code page, the characters are
              converted to similar-looking characters with best-fit
              mapping. Some best-fit mappings result in ASCII
              characters that change the meaning of the command line,
              which can be exploited with malicious filenames to do
              argument injection or directory traversal attacks.
              UTF-8 avoids best-fit mappings and thus fixes the issue.

              Forcing the process code page to UTF-8 is possible only
              on Windows 10 version 1903 and later. The command line
              tools remain vulnerable if used on an old older
              version of Windows.

              This issue was discovered by Orange Tsai and splitline
              from DEVCORE Research Team.

              A related smaller issue remains: Windows filenames may
              contain unpaired surrogates (invalid UTF-16). These are
              converted to the replacement character U+FFFD in the
              UTF-8 code page. Thus, filenames with different unpaired
              surrogates appear identical and aren't distinguishable
              from filenames that contain the actual replacement
              character U+FFFD.

            * When building with MinGW-w64, it is recommended to use
              UCRT version instead of the old MSVCRT. For example,
              non-ASCII characters from filenames won't print
              correctly in messages to console with MSVCRT with
              the UTF-8 code page (a cosmetic issue). liblzma-only
              builds are still fine with MSVCRT.

        - Cygwin and MSYS2 process command line options differently and
          the above issues don't exist. There is no need to replace the
          default application manifest on Cygwin and MSYS2.

    * Autotools-based build:

        - Fix feature checks with link-time optimization (-flto).

        - Solaris: Fix a compatibility issue in version.sh. It matters
          if one wants to regenerate configure by running autoconf.

    * CMake:

        - Use paths relative to ${prefix} in liblzma.pc when possible.
          This is done only with CMake >= 3.20.

        - MSVC: Install liblzma.pc as it can be useful with MSVC too.

        - Windows: Fix liblzma filename prefix, for example:

            * Cygwin: The DLL was incorrectly named liblzma-5.dll.
              Now it is cyglzma-5.dll.

            * MSVC: Rename import library from liblzma.lib to lzma.lib
              while keeping liblzma.dll name as is. This helps with
              "pkgconf --msvc-syntax --libs liblzma" because it mungles
              "-llzma" in liblzma.pc to "lzma.lib".

            * MinGW-w64: No changes.

        - Windows: Use the correct resource file for lzmadec.exe.
          Previously the resource file for xzdec.exe was used for both.
          Autotools-based build isn't affected.

        - Prefer a C11 compiler over a C99 compiler but accept both.

        - Link Threads::Threads against liblzma using PRIVATE so that
          -pthread and such flags won't unnecessarily get included in
          the usage requirements of shared liblzma. That is,
          target_link_libraries(foo PRIVATE liblzma::liblzma) no
          longer adds -pthread if using POSIX threads and linking
          against shared liblzma. The threading flags are still added
          if linking against static liblzma.

    * Updated translations: Catalan, Chinese (simplified), and
      Brazilian Portuguese.

NOTE: 5.2.13, 5.4.7, and 5.6.2 have a build system issue that prevents building of shared libraries on some systems like mips64. See the patch itself for details. The same patch applies to 5.2.13, 5.4.7, and 5.6.2.

5.6.2 (2024-05-29)

    * Remove the backdoor (CVE-2024-3094).

    * Not changed: Memory sanitizer (MSAN) has a false positive
      in the CRC CLMUL code which also makes OSS Fuzz unhappy.
      Valgrind is smarter and doesn't complain.

      A revision to the CLMUL code is coming anyway and this issue
      will be cleaned up as part of it. It won't be backported to
      5.6.x or 5.4.x because the old code isn't wrong. There is
      no reason to risk introducing regressions in old branches
      just to silence a false positive.

    * liblzma:

        - lzma_index_decoder() and lzma_index_buffer_decode(): Fix
          a missing output pointer initialization (*i = NULL) if the
          functions are called with invalid arguments. The API docs
          say that such an initialization is always done. In practice
          this matters very little because the problem can only occur
          if the calling application has a bug and these functions
          return LZMA_PROG_ERROR.

        - lzma_str_to_filters(): Fix a missing output pointer
          initialization (*error_pos = 0). This is very similar
          to the fix above.

        - Fix C standard conformance with function pointer types.

        - Remove GNU indirect function (IFUNC) support. This is *NOT*
          done for security reasons even though the backdoor relied on
          this code. The performance benefits of IFUNC are too tiny in
          this project to make the extra complexity worth it.

        - FreeBSD on ARM64: Add error checking to CRC32 instruction
          support detection.

        - Fix building with NVIDIA HPC SDK.

    * xz:

        - Fix a C standard conformance issue in --block-list parsing
          (arithmetic on a null pointer).

        - Fix a warning from GNU groff when processing the man page:
          "warning: cannot select font 'CW'"

    * xzdec: Add support for Linux Landlock ABI version 4. xz already
      had the v3-to-v4 change but it had been forgotten from xzdec.

    * Autotools-based build system (configure):

        - Symbol versioning variant can now be overridden with
          --enable-symbol-versions. Documentation in INSTALL was
          updated to match.

        - Add new configure option --enable-doxygen to enable
          generation and installation of the liblzma API documentation
          using Doxygen. Documentation in INSTALL and PACKAGERS was
          updated to match.

    CMake:

        - Fix detection of Linux Landlock support. The detection code
          in CMakeLists.txt had been sabotaged.

        - Disable symbol versioning on non-glibc Linux to match what
          the Autotools build does. For example, symbol versioning
          isn't enabled with musl.

        - Symbol versioning variant can now be overridden by setting
          SYMBOL_VERSIONING to "OFF", "generic", or "linux".

        - Add support for all tests in typical build configurations.
          Now the only difference to the tests coverage to Autotools
          is that CMake-based build will skip more tests if features
          are disabled. Such builds are only for special cases like
          embedded systems.

        - Separate the CMake code for the tests into tests/tests.cmake.
          It is used conditionally, thus it is possible to

              rm -rf tests

          and the CMake-based build will still work normally except
          that no tests are then available.

        - Add a option ENABLE_DOXYGEN to enable generation and
          installation of the liblzma API documentation using Doxygen.

    * Documentation:

        - Omit the Doxygen-generated liblzma API documentation from the
          package. Instead, the generation and installation of the API
          docs can be enabled with a configure or CMake option if
          Doxygen is available.

        - Remove the XZ logo which was used in the API documentation.
          The logo has been retired and isn't used by the project
          anymore. However, it's OK to use it in contexts that refer
          to the backdoor incident.

        - Remove the PDF versions of the man pages from the source
          package. These existed primarily for users of operating
          systems which don't come with tools to render man page
          source files. The plain text versions are still included
          in doc/man/txt. PDF files can still be generated to doc/man,
          if the required tools are available, using "make pdf" after
          running "configure".

        - Update home page URLs back to their old locations on
          tukaani.org.

        - Update maintainer info.

    * Tests:

        - In tests/files/README, explain how to recreate the ARM64
          test files.

        - Remove two tests that used tiny x86 and SPARC object files
          as the input files. The matching .c file was included but
          the object files aren't easy to reproduce. The test cases
          weren't great anyway; they were from the early days (2009)
          of the project when the test suite had very few tests.

        - Improve a few tests.

NOTE: 5.2.13, 5.4.7, and 5.6.2 have a build system issue that prevents building of shared libraries on some systems like mips64. See the patch itself for details. The same patch applies to 5.2.13, 5.4.7, and 5.6.2.

5.4.7 (2024-05-29)

    * Not changed: Memory sanitizer (MSAN) has a false positive
      in the CRC CLMUL code which also makes OSS Fuzz unhappy.
      Valgrind is smarter and doesn't complain.

      A revision to the CLMUL code is coming anyway and this issue
      will be cleaned up as part of it. It won't be backported to
      5.6.x or 5.4.x because the old code isn't wrong. There is
      no reason to risk introducing regressions in old branches
      just to silence a false positive.

    * liblzma:

        - lzma_index_decoder() and lzma_index_buffer_decode(): Fix
          a missing output pointer initialization (*i = NULL) if the
          functions are called with invalid arguments. The API docs
          say that such an initialization is always done. In practice
          this matters very little because the problem can only occur
          if the calling application has a bug and these functions
          return LZMA_PROG_ERROR.

        - lzma_str_to_filters(): Fix a missing output pointer
          initialization (*error_pos = 0). This is very similar
          to the fix above.

        - Fix C standard conformance with function pointer types.
          This newly showed up with Clang 17 with -fsanitize=undefined.
          There are no bug reports about this.

        - Fix building with NVIDIA HPC SDK.

    * xz:

        - Fix a C standard conformance issue in --block-list parsing
          (arithmetic on a null pointer).

        - Fix a warning from GNU groff when processing the man page:
          "warning: cannot select font 'CW'"

        - Fix outdated threading related information on the man page.

    * xzless:

        - With "less" version 451 and later, use "||-" instead of "|-"
          in the environment variable LESSOPEN. This way compressed
          files that contain no uncompressed data are shown correctly
          as empty.

        - With "less" version 632 and later, use --show-preproc-errors
          to make "less" show a warning on decompression errors.

    * Autotools-based build system (configure):

        - Symbol versioning variant can now be overridden with
          --enable-symbol-versions. Documentation in INSTALL was
          updated to match.

    CMake:

        - Linux on MicroBlaze is handled specially now. This matches
          the changes made to the Autotools-based build in XZ Utils
          5.4.2 and 5.2.11.

        - Disable symbol versioning on non-glibc Linux to match what
          the Autotools build does. For example, symbol versioning
          isn't enabled with musl.

        - Symbol versioning variant can now be overridden by setting
          SYMBOL_VERSIONING to "OFF", "generic", or "linux".

    * Documentation:

        - Clarify the description of --disable-assembler in INSTALL.
          The option only affects 32-bit x86 assembly usage.

        - Add doc/examples/11_file_info.c. It was added to the
          Git repository in 2017 but forgotten to be added into
          distribution tarballs.

        - Don't install the TODO file as part of the documentation.
          The file is out of date.

        - Update home page URLs back to their old locations on
          tukaani.org.

        - Update maintainer info.