# XZ Utils changelog > XZ Utils release notes. - Vendor: XZ Utils - Category: System Utilities - Language: C - Official site: https://tukaani.org/xz/ - Tracked by: What's New (https://whatsnew.fyi/product/xz-utils) - Harvested from: GitHub (tukaani-project/xz) - Entries below: 11 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## Releases ### v5.8.4 — XZ Utils 5.8.4 (stable) - Date: 2026-09-09 - Version: v5.8.4 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.4 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.8.4 - **security** — Fix an invalid memory access after memory allocation has failed in lzma_alone_decoder(), lzma_lzip_decoder(), lzma_auto_decoder(), and lzma_microlzma_decoder() that could result in a crash (GHSA-5qpq-xqfv-j9pg) - **fixed** — Fix wrong error code in lzma_stream_buffer_decode() where LZMA_BUF_ERROR could be returned with truncated inputs instead of the correct LZMA_DATA_ERROR - **fixed** — Fix a performance issue in lzma_index_cat() that could cause concatenated .xz files to make 'xz --list' very slow or effectively hang - **fixed** — Fix a theoretical integer overflow in lzma_index_cat() - **fixed** — Fix bogus memory usage report in lzma_index_decoder() when the .xz Index is invalid, which could cause an integer overflow in lzma_file_info_decoder()'s memory usage reporting - **fixed** — Fix a too low memory usage report in lzma_index_decoder() if lzma_memused() is called after a part of the Index has already been decoded - **fixed** — Fix copying of check type in lzma_index_dup() - **fixed** — Reject an obviously-invalid Number of Records field earlier in lzma_file_info_decoder() and lzma_index_decoder() - **fixed** — Fix a missing synchronization in the threaded .xz decoder that could make lzma_get_progress() return incorrect progress info - **fixed** — Detect certain kinds of corrupt inputs slightly earlier in the LZMA2 decoder - **fixed** — ARM64 and LoongArch: Don't use aligned reads on unaligned buffers to work on strict-align processors - **fixed** — Fix a use-after-free when showing an error message if --files or --files0 was specified in the environment variables XZ_OPT or XZ_DEFAULTS - **fixed** — Fix a use-after-free bug when --verbose is used and standard error isn't a terminal - **fixed** — Make it an error if the totals in 'xz --list' exceed the range of 64-bit integers - **added** — Add support for Landlock ABI version 9 in xz and xzdec on Linux - **changed** — Use fallback macros for Landlock ABI version 2, 3, and 5 if is older than ABI version 5 - **fixed** — Fix handling of the ' char at the end of a command line option in xzgrep - **fixed** — Use the C locale (LC_ALL=C) with 'sed' and 'expr' in xzdiff to ensure safe behavior with invalid multibyte sequences **IMPORTANT:** This includes a fix for [a security issue](https://github.com/tukaani-project/xz/security/advisories/GHSA-5qpq-xqfv-j9pg) that affects all XZ Utils versions since 5.0.0. This and a few other fixes have also been committed to the old stable branches (v5.2, v5.4, and v5.6) in the xz Git repository. Those fixes are marked below. No new 5.2.x, 5.4.x, or 5.6.x releases will be made. ``` 5.8.4 (2026-09-09) * liblzma: - lzma_alone_decoder(), lzma_lzip_decoder(), lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an invalid memory access after memory allocation has failed and the application reinitializes the existing decoder to decode a different file. This bug could at least result in a crash. This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending. (Also in v5.2, v5.4, and v5.6.) - lzma_stream_buffer_decode(): Fix wrong error code and, in debug builds, assertion failure. LZMA_BUF_ERROR could be returned with truncated inputs while LZMA_DATA_ERROR is the correct one in this function. (Also in v5.2, v5.4, and v5.6.) - Fix a performance issue in the typical use case of lzma_index_cat(). Internally liblzma calls it from lzma_file_info_decoder(), so that was affected too. The problem occurred if the input .xz file was created by concatenating a large number of .xz files. A crafted file could make "xz --list" very slow or effectively hang. Normal decompression doesn't use these functions and thus wasn't affected. (Also in v5.2, v5.4, and v5.6.) - Fix a theoretical integer overflow in lzma_index_cat(). (Also in v5.2, v5.4, and v5.6.) - Fix bogus memory usage report in lzma_index_decoder() when the .xz Index is obviously invalid. A huge bogus value could cause an integer overflow in lzma_file_info_decoder()'s memory usage reporting due to a missing overflow check, making lzma_memused() report an incorrect tiny value. This bug didn't affect the memory usage limiter in these two decoders; only the reporting via lzma_memused() was affected. (Also in v5.2, v5.4, and v5.6.) - Fix a too low memory usage report in lzma_index_decoder() if lzma_memused() is called after a part of the Index has already been decoded. The typical use case is to call lzma_memused() immediately after LZMA_MEMLIMIT_ERROR, which did work correctly. - Fix copying of check type in lzma_index_dup(). Calling lzma_index_checks() on the duplicated lzma_index returned return garbage a result. lzma_index_dup() is rarely used; liblzma doesn't use it internally and xz itself doesn't use it either. (Also in v5.2, v5.4, and v5.6.) - lzma_file_info_decoder() and lzma_index_decoder(): Reject an obviously-invalid Number of Records field earlier. (Partially also in v5.2, v5.4, and v5.6.) - Fix a missing synchronization in the threaded .xz decoder. It could make lzma_get_progress() return incorrect progress info. (Also in v5.4 and v5.6.) - Detect certain kinds of corrupt inputs slightly earlier in the LZMA2 decoder. - ARM64 and LoongArch: Don't use aligned reads on unaligned buffers. This makes the code work on strict-align processors and fixes a sanitizer error in other cases. (Since 5.7.1alpha) * xz: - Fix a use-after-free when showing an error message if --files or --files0 was specified in the environment variables XZ_OPT or XZ_DEFAULTS. (Also in v5.2, v5.4, and v5.6.) - Fix a use-after-free bug when --verbose is use _[Truncated at 4000 characters — full notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.4]_ ### v5.8.3 — XZ Utils 5.8.3 (stable) - Date: 2026-03-31 - Version: v5.8.3 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.3 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.8.3 - **security** — Fix a buffer overflow in lzma_index_append() when lzma_index_decoder() decodes an Index with no Records - **fixed** — Fix invalid memory access in --files and --files0 options that could occur with very long filename strings and certain realloc() behaviors - **fixed** — Fix the build on Windows ARM64EC - **added** — Add License: 0BSD to liblzma.pc - **fixed** — On QNX, do not use fsync() on directories as it fails - **changed** — Enable 32-bit x86 assembler on Hurd by default in Autotools - **added** — Add Arabic man page translations **IMPORTANT:** This includes a fix for CVE-2026-34743 which affects all XZ Utils versions since 5.0.0. No new 5.2.x, 5.4.x, or 5.6.x releases will be made, but the fix is in the v5.2, v5.4, and v5.6 branches in the xz Git repository. ``` 5.8.3 (2026-03-31) * liblzma: - Fix a buffer overflow in lzma_index_append(): If lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. The lzma_index functions are rarely used by applications directly. In the few applications that do use these functions, the combination of function calls required to trigger this bug are unlikely to exist, because there typically is no reason to append Records to a decoded lzma_index. Thus, it's likely that this bug cannot be triggered in any real-world application. The bug was reported and discovered by Cantina using their AppSec agent, Apex. - Fix the build on Windows ARM64EC. - Add "License: 0BSD" to liblzma.pc. * xz: - Fix invalid memory access in --files and --files0. All of the following must be true to trigger it: 1. A string being read (which supposedly is a filename) is at least SIZE_MAX / 2 bytes long. This size is plausible on 32-bit platforms (2 GiB - 1 B). 2. realloc(ptr, SIZE_MAX / 2 + 1) must succeed. On glibc >= 2.30 it shouldn't because the value exceeds PTRDIFF_MAX. 3. An integer overflow results in a realloc(ptr, 0) call. If it doesn't return NULL, then invalid memory access will occur. - On QNX, don't use fsync() on directories because it fails. * Autotools: Enable 32-bit x86 assembler on Hurd by default. It was already enabled in the CMake-based build. * Translations: Add Arabic man page translations. ``` ### v5.8.2 — XZ Utils 5.8.2 (stable) - Date: 2025-12-17 - Version: v5.8.2 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.2 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.8.2 - **fixed** — Fix the build on ARM64 on glibc versions older than 2.24 which don't have HWCAP_CRC32 in - **fixed** — Disable CLMUL CRC code when building for 32-bit x86 with old MSVC versions to avoid a compiler bug - **added** — Add a workaround for Red Hat Enterprise Linux 9 kernel bug that caused xz to fail with sandbox errors when running containers on RHEL/CentOS 9 - **fixed** — On AIX, don't use fsync() on directories because it fails - **fixed** — Fix the build on Emscripten - **fixed** — Fix the build on clang-cl on Windows - **changed** — Take resource limits RLIMIT_DATA, RLIMIT_AS, and RLIMIT_VMEM into account when determining the default memory usage limit for multithreaded mode - **fixed** — When symbol versioning is enabled, pass --undefined-version to the linker if the option is supported to fix the build with LLVM's lld when some liblzma features are disabled - **fixed** — Fix autodetection of fast unaligned memory access on ARM64 when using GCC with -mstrict-align in effect - **added** — Autodetect if fast unaligned memory access is supported on LoongArch to improve compression speed by up to 15 percent - **changed** — Update the Spanish translation - **added** — Add Swedish man page translations - **changed** — Update Italian, Korean, Romanian, Serbian, and Ukrainian man page translations ``` 5.8.2 (2025-12-17) * liblzma: - Fix the build on ARM64 on glibc versions older than 2.24 (2016). They don't have HWCAP_CRC32 in . - Disable CLMUL CRC code when building for 32-bit x86 with old MSVC versions. This avoids a compiler bug. The exact compiler version in which the issue was fixed is unknown, but VS 2022 17.13 (MSVC 19.43.34808) is known to work, so CLMUL CRC on 32-bit x86 is disabled with MSVC versions older than that. * xz: - Add a workaround for Red Hat Enterprise Linux 9 kernel bug which made xz fail with "xz: Failed to enable the sandbox". It only occurs with xz 5.8.0 and 5.8.1 binaries built for other distros. For example, running Debian 13 in a container on RHEL/CentOS 9 would trigger the issue. The bug was introduced in RHEL 9 kernel 5.14.0-603.el9 (2025-07-30) and fixed in 5.14.0-648.el9 (2025-12-05). However, as of writing, the fixed kernel isn't available to RHEL 9 users yet, so including the workaround in this xz release seems reasonable. The workaround will be removed when it's no longer needed. xzdec was also affected by this issue. - On AIX, don't use fsync() on directories because it fails. - Fix the build on Emscripten. - Fix the build on clang-cl on Windows. - Take resource limits (RLIMIT_DATA, RLIMIT_AS, and RLIMIT_VMEM) into account when determining the default memory usage limit for multithreaded mode. This should prevent xz from failing when a resource limit has been set to a value that is less than 1/4 of total RAM. Other memory limits can still trigger the same issue, for example, Linux cgroup v2 memory.max. * Build systems: - When symbol versioning is enabled, pass --undefined-version to the linker if the option is supported. This fixes the build when using LLVM's lld and some liblzma features have been disabled at build time. - ARM64: Fix autodetection of fast unaligned memory access when using GCC and -mstrict-align is in effect. Previously the build systems would incorrectly guess that unaligned access is fast, which would result in much slower binaries than needed. The fix is a workaround for GCC bug 111555; autodetection already worked with Clang. - LoongArch: Autodetect if fast unaligned memory access is supported. This can improve compression speed by 15 % (but not decompression speed). * Translations: - Update the Spanish translation. - Add Swedish man page translations. - Update Italian, Korean, Romanian, Serbian, and Ukrainian man page translations. ``` ### v5.8.1 — XZ Utils 5.8.1 (stable) - Date: 2025-04-03 - Version: v5.8.1 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.1 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.8.1 - **security** — Fix a bug in the multithreaded .xz decoder that could result in a crash with invalid input (CVE-2025-31115) - **fixed** — Fix a performance bug in the multithreaded .xz decoder where only one thread was used if the whole input file was provided at once to lzma_code() with a sufficiently large output buffer, timeout disabled, and LZMA_FINISH used - **fixed** — Avoid using to fix the build with Oracle Developer Studio 12.6 on Solaris 10 when the compiler is in C11 mode - **changed** — Restore compatibility with GNU make versions older than 4.0 by using GNU gettext 0.23.1 infrastructure instead of 0.24 - **changed** — Update Croatian translation **IMPORTANT:** This includes a security fix for CVE-2025-31115 which affects XZ Utils from 5.3.3alpha to 5.8.0. See the [security advisory](https://tukaani.org/xz/threaded-decoder-early-free.html) for details. ``` 5.8.1 (2025-04-03) * Multithreaded .xz decoder (lzma_stream_decoder_mt()): - Fix a bug that could at least result in a crash with invalid input. (CVE-2025-31115) - Fix a performance bug: Only one thread was used if the whole input file was provided at once to lzma_code(), the output buffer was big enough, timeout was disabled, and LZMA_FINISH was used. There are no bug reports about this, thus it's possible that no real-world application was affected. * Avoid even with C11/C17 compilers. This fixes the build with Oracle Developer Studio 12.6 on Solaris 10 when the compiler is in C11 mode (the header doesn't exist). * Autotools: Restore compatibility with GNU make versions older than 4.0 by creating the package using GNU gettext 0.23.1 infrastructure instead of 0.24. * Update Croatian translation. ``` ### v5.8.0 — XZ Utils 5.8.0 (stable) - Date: 2025-03-25 - Version: v5.8.0 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.0 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.8.0 - **added** — liblzma on 32/64-bit x86: Use SSE2 intrinsics instead of memcpy() in the LZMA/LZMA2 decoder - **changed** — CMake: Make the feature test macros match the Autotools-based build on NetBSD, Darwin, and mingw-w64 - **changed** — Update Croatian, Italian, Portuguese, and Romanian translations - **changed** — Update German, Italian, Korean, Romanian, Serbian, and Ukrainian man page translations - **deprecated** — Mark the following LZMA Utils script aliases as deprecated: lzcmp, lzdiff, lzless, lzmore, lzgrep, lzegrep, and lzfgrep - **changed** — Improve LZMA/LZMA2 encoder speed on 64-bit PowerPC and 64-bit RISC-V processors with fast unaligned access support - **added** — Add low-level APIs for RISC-V, ARM64, and x86 BCJ filters to lzma/bcj.h - **changed** — Rewrite x86/x86-64/E2K CLMUL CRC code - **changed** — Use the CRC32 instructions on LoongArch - **changed** — Synchronize the output file and its directory using fsync() before deleting the input file - **added** — Add --no-sync flag to disable the sync-before-delete behavior - **changed** — Make --single-stream imply --keep - **changed** — xz, xzdec, lzmainfo: When printing messages, replace non-printable characters with question marks - **changed** — xz and xzdec on Linux: Support Landlock ABI versions 5 and 6 - **changed** — CMake: Revise the configuration variables and some of their options, and document them in the file INSTALL - **added** — Add build-aux/license-check.sh ``` 5.8.0 (2025-03-25) This bumps the minor version of liblzma because new features were added. The API and ABI are still backward compatible with liblzma 5.6.x, 5.4.x, 5.2.x, and 5.0.x. * liblzma on 32/64-bit x86: When possible, use SSE2 intrinsics instead of memcpy() in the LZMA/LZMA2 decoder. In typical cases, this may reduce decompression time by 0-5 %. However, when built against musl libc, over 15 % time reduction was observed with highly compressed files. * CMake: Make the feature test macros match the Autotools-based build on NetBSD, Darwin, and mingw-w64. * Update the Croatian, Italian, Portuguese, and Romanian translations. * Update the German, Italian, Korean, Romanian, Serbian, and Ukrainian man page translations. Summary of changes in the 5.7.x development releases: * Mark the following LZMA Utils script aliases as deprecated: lzcmp, lzdiff, lzless, lzmore, lzgrep, lzegrep, and lzfgrep. * liblzma: - Improve LZMA/LZMA2 encoder speed on 64-bit PowerPC (both endiannesses) and those 64-bit RISC-V processors that support fast unaligned access. - Add low-level APIs for RISC-V, ARM64, and x86 BCJ filters to lzma/bcj.h. These are primarily for erofs-utils. - x86/x86-64/E2K CLMUL CRC code was rewritten. - Use the CRC32 instructions on LoongArch. * xz: - Synchronize the output file and its directory using fsync() before deleting the input file. No syncing is done when xz isn't going to delete the input file. - Add --no-sync to disable the sync-before-delete behavior. - Make --single-stream imply --keep. * xz, xzdec, lzmainfo: When printing messages, replace non-printable characters with question marks. * xz and xzdec on Linux: Support Landlock ABI versions 5 and 6. * CMake: Revise the configuration variables and some of their options, and document them in the file INSTALL. CMake support is no longer experimental. (It was already not experimental when building for native Windows.) * Add build-aux/license-check.sh. ``` ### v5.7.2beta — XZ Utils 5.7.2beta (unstable) - Date: 2025-03-08 - Version: v5.7.2beta - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.7.2beta - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.7.2beta - Labels: Pre-release - **deprecated** — Mark the LZMA Utils script aliases lzcmp, lzdiff, lzless, lzmore, lzgrep, lzegrep, and lzfgrep as deprecated in man pages - **changed** — Add warning in xz man page ENVIRONMENT section about problems that some uses of XZ_DEFAULTS and XZ_OPT may create - **fixed** — On Windows native builds, avoid an error message on broken pipe in xz, xzdec, and lzmadec - **fixed** — Fix out-of-tree builds when using the bundled getopt_long - **added** — Add Dutch translation - **added** — Add Italian and Serbian man page translations ``` 5.7.2beta (2025-03-08) * On the man pages, mark the following LZMA Utils script aliases as deprecated: lzcmp, lzdiff, lzless, lzmore, lzgrep, lzegrep, and lzfgrep. The commands that start with xz* instead of lz* have identical behavior. The LZMA Utils aliases lzma, unlzma, and lzcat aren't deprecated because some of these aliases are still in common use. lzmadec and lzmainfo aren't deprecated either. * xz: In the ENVIRONMENT section of the man page, warn about problems that some uses of XZ_DEFAULTS and XZ_OPT may create. * Windows (native builds, not Cygwin): In xz, xzdec, and lzmadec, avoid an error message on broken pipe. * Autotools: Fix out-of-tree builds when using the bundled getopt_long. * Translations: - Updated: Chinese (traditional), Croatian, Finnish, Georgian, German, Korean, Polish, Romanian, Serbian, Spanish, Swedish, Turkish, and Ukrainian - Added: Dutch * Man page translations: - Updated: German, Korean, Romanian, and Ukrainian - Added: Italian and Serbian ``` ### v5.7.1alpha — XZ Utils 5.7.1alpha (unstable) - Date: 2025-01-23 - Version: v5.7.1alpha - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.7.1alpha - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.7.1alpha - Labels: Pre-release - **changed** — Improve LZMA/LZMA2 encoder speed on 64-bit PowerPC and 64-bit RISC-V processors with fast unaligned access support - **changed** — Rewrite x86/x86-64/E2K CLMUL CRC code for improved performance and to eliminate false positives from sanitizers - **changed** — Add runtime detection for 32-bit x86 to co-exist CLMUL CRC and assembly versions with automatic handling in Autotools and CMake - **changed** — Use CRC32 instructions on LoongArch to accelerate CRC32 calculation - **added** — Add low-level APIs for RISC-V, ARM64, and x86 BCJ filters to lzma/bcj.h - **changed** — Synchronize output file and its directory before deleting the input file using fsync() to reduce probability of data loss after system crash - **added** — Add --no-sync option to disable sync-before-delete behavior - **changed** — Make --single-stream imply --keep - **changed** — Use automatic word wrapping for text in --help and similar situations - **changed** — Replace non-printable characters with question marks when printing messages to prevent malicious filenames from sending escape sequences to terminals - **changed** — Apply non-printable character replacement to filenames shown in xz --robot --list - **added** — Add support for Landlock ABI versions 5 and 6 on xz and xzdec on Linux - **changed** — Increase minimum required CMake version to 3.20 - **changed** — Revise CMake configuration variables and their options - **changed** — Attempt to produce liblzma.pc with paths based on ${prefix} for easier path overrides - **changed** — Require gettext-tools to enable translations in CMake build - **changed** — Use Mach-O shared library versioning compatible with GNU Libtool on Apple - **removed** — Remove support for building liblzma with Visual Studio 2013 - **added** — Add preliminary Georgian translation ``` 5.7.1alpha (2025-01-23) * All fixes from 5.6.4. * liblzma: - Improve LZMA/LZMA2 encoder speed on 64-bit PowerPC (both endiannesses) and those 64-bit RISC-V processors that support fast unaligned access. - x86/x86-64/E2K CLMUL CRC code was rewritten. It's faster and doesn't cause false positives from sanitizers. Attributes like __attribute__((__no_sanitize_address__)) are no longer present. - On 32-bit x86, CLMUL CRC and the old (but still good) assembly versions now co-exist with runtime detection. Both Autotools and CMake build systems handle this automatically now. - Use the CRC32 instructions on LoongArch to make CRC32 calculation faster. - Add low-level APIs for RISC-V, ARM64, and x86 BCJ filters to lzma/bcj.h. These are primarily for erofs-utils. - Minor tweaks to ARM64 CRC32 code and BCJ filters were made. * xz: - Synchronize the output file and its directory before deleting the input file using fsync(). This reduces the probability of data loss after a system crash. However, it can be a major performance hit if processing many small files. NOTE: No syncing is done when xz isn't going to delete the input file. - Add a new option --no-sync to disable the sync-before-delete behavior. It's useful when compressing many small files and one doesn't worry about data loss in case of a system crash. - Make --single-stream imply --keep. - Use automatic word wrapping for the text in --help and similar situations to hopefully make the strings easier for majority of translators (no need to count spaces anymore). * xz, xzdec, lzmainfo: When printing messages, replace non-printable characters with question marks. This way malicious filenames cannot be used to send escape sequences to a terminal. This change is also applied to filenames shown in "xz --robot --list". * xz and xzdec on Linux: Add support for Landlock ABI versions 5 and 6. * CMake updates: - Increase the minimum required CMake version to 3.20. - Revise the configuration variables and some of their options. Document them in the file INSTALL. - Attempt to produce liblzma.pc so that the paths are based on ${prefix}, which makes it simpler to override the paths if the liblzma files have been moved. - To enable translations, gettext-tools is now required. The CMake build no longer supports installing pre-compiled message catalog binary files (po/*.gmo). - Apple: Use Mach-O shared library versioning that is compatible with GNU Libtool. This should make it easier to switch between the build systems on Apple OSes that enforce the correct compatibility_version (macOS >= 12 doesn't?). This change is backward compatible: binaries linked against old CMake-built liblzma will run with liblzma that uses Libtool style versioning. - Windows (not Cygwin): Document CMAKE_DLL_NAME_WITH_SOVERSION (CMake >= 3.27) in the file INSTALL. This option should usually be left to its default value (OFF). It can be set to ON if the liblzma DLL filename must be compatible with the versioned filename produced by GNU Libtool. For example, binaries distributed in MSYS2 use a versioned DLL filename. - CMake support is no longer experimental. (It was already not experimental when building for native Windows.) * Windows: Building liblzma with Visual Studio 2013 is no longer supported. Visual Studio 2015 or later (with CMake) can be used _[Truncated at 4000 characters — full notes: https://github.com/tukaani-project/xz/releases/tag/v5.7.1alpha]_ ### v5.6.4 — XZ Utils 5.6.4 (stable) - Date: 2025-01-23 - Version: v5.6.4 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.6.4 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.6.4 - **fixed** — Fix LZMA/LZMA2 encoder on big endian ARM64 - **fixed** — Fix --filters= and --filters1= ... --filters9= options parsing to accept argument with or without equals sign - **changed** — Add note to man page in --compress and --decompress options documenting that the default behavior deletes the input file unless writing to standard output - **fixed** — Fix regressions on Windows native builds with translation support where non-ASCII characters displayed incorrectly - **changed** — Require UCRT instead of MSVCRT for Windows builds with translation support to enable UTF-8 locale support - **changed** — Require gettext-runtime >= 0.23.1 for Windows builds with translation support for proper UTF-8 code page autodetection - **fixed** — Partially fix alignment issues in xz --verbose --list with translated messages - **fixed** — Explicitly disable unity builds in CMake to prevent build failures when using XZ Utils via CMake FetchContent module - **changed** — Update Chinese (traditional) and Serbian translations ``` 5.6.4 (2025-01-23) * liblzma: Fix LZMA/LZMA2 encoder on big endian ARM64. * xz: - Fix --filters= and --filters1= ... --filters9= options parsing. They require an argument, thus "xz --filters lzma2" should work in addition to "xz --filters=lzma2". - On the man page, note in the --compress and --decompress options that the default behavior is to delete the input file unless writing to standard output. It was already documented in the DESCRIPTION section but new users in a hurry might miss it. * Windows (native builds, not Cygwin): Fix regressions introduced in XZ Utils 5.6.3 which caused non-ASCII characters to display incorrectly. Only builds with translation support were affected (--enable-nls or ENABLE_NLS=ON). The following changes affect builds that have translations enabled: - Require UCRT because MSVCRT doesn't support UTF-8 locales and thus translations won't be readable on Windows 10 version 1903 and later. (MSVCRT builds are still possible with --disable-nls or ENABLE_NLS=OFF.) - Require gettext-runtime >= 0.23.1 because older versions don't autodetect the use of the UTF-8 code page. This resulted in garbled non-ASCII characters even with UCRT. - Partially fix alignment issues in xz --verbose --list with translated messages. Chinese (simplified), Chinese (traditional), and Korean column headings are misaligned still because Windows and MinGW-w64 don't provide wcwidth() and XZ Utils doesn't include a replacement function either. * CMake: Explicitly disable unity builds. This prevents build failures when another project uses XZ Utils via CMake's FetchContent module, and that project enables unity builds. * Update Chinese (traditional) and Serbian translations. ``` ### v5.6.3 — XZ Utils 5.6.3 (stable) - Date: 2024-10-01 - Version: v5.6.3 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.6.3 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.6.3 - **security** — Fix command line argument injection vulnerability on Windows by using UTF-8 code page on Windows 10 version 1903 and later to prevent best-fit character mapping exploits - **fixed** — Fix x86-64 inline assembly compatibility with GNU Binutils older than 2.27 - **fixed** — Fix build with GCC 4.2 on OpenBSD/sparc64 - **fixed** — Make xzdec display an error instead of failing silently if unsupported option -M is specified - **fixed** — Fix integer overflows in lzmainfo when rounding dictionary and uncompressed sizes to nearest mebibyte - **added** — Add application manifest to Windows executables declaring compatibility with Vista/7/8/8.1/10/11 to prevent unnecessary compatibility mode - **added** — Declare Windows executables as UAC-compliant in application manifest - **added** — Declare Windows executables as long path aware to support long filenames on Windows 10 and 11 with registry feature enabled - **changed** — Options --files and --files0 now expect file lists in UTF-8 instead of legacy code page on Windows 10 version 1903 and later - **fixed** — Fix feature checks with link-time optimization (-flto) in Autotools-based build - **fixed** — Fix compatibility issue in version.sh for Solaris in Autotools-based build - **changed** — Use paths relative to ${prefix} in liblzma.pc when possible with CMake >= 3.20 - **added** — Install liblzma.pc with MSVC in CMake builds - **fixed** — Fix Cygwin DLL name from liblzma-5.dll to cyglzma-5.dll in CMake builds - **changed** — Rename MSVC import library from liblzma.lib to lzma.lib while keeping liblzma.dll name in CMake builds - **fixed** — Use correct resource file for lzmadec.exe in CMake builds - **changed** — Prefer C11 compiler over C99 compiler but accept both in CMake builds - **changed** — Link Threads::Threads against liblzma using PRIVATE to prevent unnecessary inclusion of threading flags in shared library usage requirements ``` 5.6.3 (2024-10-01) IMPORTANT: This includes a Windows-specific security fix to the command line tools. liblzma isn't affected by this issue. * liblzma: - Fix x86-64 inline assembly compatibility with GNU Binutils older than 2.27. - Fix the build with GCC 4.2 on OpenBSD/sparc64. * xzdec: Display an error instead of failing silently if the unsupported option -M is specified. * lzmainfo: Fix integer overflows when rounding the dictionary and uncompressed sizes to the nearest mebibyte. * Windows (except Cygwin and MSYS2): Add an application manifest to xz, xzdec, lzmadec, and lzmainfo executables: - Declare them compatible with Vista/7/8/8.1/10/11. This way the programs won't needlessly use Operating System Context of Vista when running on later Windows versions. This setting doesn't mean that the executables cannot run on even older versions if otherwise built that way. - Declare them as UAC-compliant. MSVC added this by default already but it wasn't done with MinGW-w64, at least not with all toolchain variants. - Declare them long path aware. This makes long path names work on Windows 10 and 11 if the feature has been enabled in the Windows registry. - Use the UTF-8 code page on Windows 10 version 1903 and later. * Now command line tools can access files whose names contain characters that don't exist in the current legacy code page. * The options --files and --files0 now expect file lists to be in UTF-8 instead of the legacy code page. * This fixes a security issue: If a command line contains Unicode characters (for example, filenames) that don't exist in the current legacy code page, the characters are converted to similar-looking characters with best-fit mapping. Some best-fit mappings result in ASCII characters that change the meaning of the command line, which can be exploited with malicious filenames to do argument injection or directory traversal attacks. UTF-8 avoids best-fit mappings and thus fixes the issue. Forcing the process code page to UTF-8 is possible only on Windows 10 version 1903 and later. The command line tools remain vulnerable if used on an old older version of Windows. This issue was discovered by Orange Tsai and splitline from DEVCORE Research Team. A related smaller issue remains: Windows filenames may contain unpaired surrogates (invalid UTF-16). These are converted to the replacement character U+FFFD in the UTF-8 code page. Thus, filenames with different unpaired surrogates appear identical and aren't distinguishable from filenames that contain the actual replacement character U+FFFD. * When building with MinGW-w64, it is recommended to use UCRT version instead of the old MSVCRT. For example, non-ASCII characters from filenames won't print correctly in messages to console with MSVCRT with the UTF-8 code page (a cosmetic issue). liblzma-only builds are still fine with MSVCRT. - Cygwin and MSYS2 process command line options differently and the above issues don't exist. There is no need to replace the default application manifest on Cygwin and MSYS2. * Autotools-based build: - Fix feature checks with link-time optimization (-flto). - Solaris: Fix a compatibility issue in version.sh. It matters if one wants to rege _[Truncated at 4000 characters — full notes: https://github.com/tukaani-project/xz/releases/tag/v5.6.3]_ ### v5.6.2 — XZ Utils 5.6.2 (stable) - Date: 2024-05-29 - Version: v5.6.2 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.6.2 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.6.2 - **security** — Remove the backdoor (CVE-2024-3094) - **fixed** — Fix a missing output pointer initialization (*i = NULL) in lzma_index_decoder() and lzma_index_buffer_decode() when called with invalid arguments - **fixed** — Fix a missing output pointer initialization (*error_pos = 0) in lzma_str_to_filters() - **fixed** — Fix C standard conformance with function pointer types in liblzma - **removed** — Remove GNU indirect function (IFUNC) support - **fixed** — Add error checking to CRC32 instruction support detection on FreeBSD ARM64 - **fixed** — Fix building with NVIDIA HPC SDK - **fixed** — Fix a C standard conformance issue in --block-list parsing (arithmetic on a null pointer) - **fixed** — Fix a warning from GNU groff when processing the man page: "warning: cannot select font 'CW'" - **added** — Add support for Linux Landlock ABI version 4 in xzdec - **added** — Add new configure option --enable-doxygen to enable generation and installation of the liblzma API documentation using Doxygen - **changed** — Symbol versioning variant can now be overridden with --enable-symbol-versions in Autotools-based build system - **fixed** — Fix detection of Linux Landlock support in CMake - **changed** — Disable symbol versioning on non-glibc Linux in CMake to match Autotools build behavior - **changed** — Symbol versioning variant can now be overridden by setting SYMBOL_VERSIONING to "OFF", "generic", or "linux" in CMake - **changed** — Add support for all tests in typical CMake build configurations - **changed** — Separate the CMake code for tests into tests/tests.cmake to allow removing the tests directory - **added** — Add ENABLE_DOXYGEN option in CMake to enable generation and installation of the liblzma API documentation using Doxygen - **removed** — Omit the Doxygen-generated liblzma API documentation from the source package - **removed** — Remove the XZ logo from API documentation **NOTE:** 5.2.13, 5.4.7, and 5.6.2 have a build system issue that prevents building of shared libraries on some systems like mips64. See the patch itself for details. The same patch applies to 5.2.13, 5.4.7, and 5.6.2. ``` 5.6.2 (2024-05-29) * Remove the backdoor (CVE-2024-3094). * Not changed: Memory sanitizer (MSAN) has a false positive in the CRC CLMUL code which also makes OSS Fuzz unhappy. Valgrind is smarter and doesn't complain. A revision to the CLMUL code is coming anyway and this issue will be cleaned up as part of it. It won't be backported to 5.6.x or 5.4.x because the old code isn't wrong. There is no reason to risk introducing regressions in old branches just to silence a false positive. * liblzma: - lzma_index_decoder() and lzma_index_buffer_decode(): Fix a missing output pointer initialization (*i = NULL) if the functions are called with invalid arguments. The API docs say that such an initialization is always done. In practice this matters very little because the problem can only occur if the calling application has a bug and these functions return LZMA_PROG_ERROR. - lzma_str_to_filters(): Fix a missing output pointer initialization (*error_pos = 0). This is very similar to the fix above. - Fix C standard conformance with function pointer types. - Remove GNU indirect function (IFUNC) support. This is *NOT* done for security reasons even though the backdoor relied on this code. The performance benefits of IFUNC are too tiny in this project to make the extra complexity worth it. - FreeBSD on ARM64: Add error checking to CRC32 instruction support detection. - Fix building with NVIDIA HPC SDK. * xz: - Fix a C standard conformance issue in --block-list parsing (arithmetic on a null pointer). - Fix a warning from GNU groff when processing the man page: "warning: cannot select font 'CW'" * xzdec: Add support for Linux Landlock ABI version 4. xz already had the v3-to-v4 change but it had been forgotten from xzdec. * Autotools-based build system (configure): - Symbol versioning variant can now be overridden with --enable-symbol-versions. Documentation in INSTALL was updated to match. - Add new configure option --enable-doxygen to enable generation and installation of the liblzma API documentation using Doxygen. Documentation in INSTALL and PACKAGERS was updated to match. CMake: - Fix detection of Linux Landlock support. The detection code in CMakeLists.txt had been sabotaged. - Disable symbol versioning on non-glibc Linux to match what the Autotools build does. For example, symbol versioning isn't enabled with musl. - Symbol versioning variant can now be overridden by setting SYMBOL_VERSIONING to "OFF", "generic", or "linux". - Add support for all tests in typical build configurations. Now the only difference to the tests coverage to Autotools is that CMake-based build will skip more tests if features are disabled. Such builds are only for special cases like embedded systems. - Separate the CMake code for the tests into tests/tests.cmake. It is used conditionally, thus it is possible to rm -rf tests and the CMake-based build will still work normally except that no tests are then available. - Add a option ENABLE_DOXYGEN to enable generation and installation of the liblzma API documentation using Doxygen. * Documentation: - Omit the Doxygen-generated liblzma API docume _[Truncated at 4000 characters — full notes: https://github.com/tukaani-project/xz/releases/tag/v5.6.2]_ ### v5.4.7 — XZ Utils 5.4.7 (old stable) - Date: 2024-05-29 - Version: v5.4.7 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.4.7 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.4.7 - **fixed** — Fix missing output pointer initialization in lzma_index_decoder() and lzma_index_buffer_decode() when called with invalid arguments - **fixed** — Fix missing output pointer initialization in lzma_str_to_filters() - **fixed** — Fix C standard conformance with function pointer types - **fixed** — Fix building with NVIDIA HPC SDK - **fixed** — Fix C standard conformance issue in --block-list parsing with arithmetic on a null pointer - **fixed** — Fix GNU groff warning when processing the man page about font selection - **fixed** — Fix outdated threading related information on the man page - **changed** — xzless now uses ||- instead of |- in LESSOPEN environment variable with less version 451 and later to correctly show compressed files with no uncompressed data - **changed** — xzless now uses --show-preproc-errors flag with less version 632 and later to show warnings on decompression errors - **changed** — Symbol versioning variant can now be overridden with --enable-symbol-versions in Autotools-based build system - **changed** — CMake now handles Linux on MicroBlaze specially to match Autotools build - **changed** — CMake now disables symbol versioning on non-glibc Linux to match Autotools build - **changed** — CMake symbol versioning variant can now be overridden by setting SYMBOL_VERSIONING to OFF, generic, or linux - **changed** — Clarify description of --disable-assembler in INSTALL documentation to specify it only affects 32-bit x86 assembly usage - **added** — Add doc/examples/11_file_info.c to distribution tarballs - **removed** — Stop installing the TODO file as part of the documentation - **changed** — Update home page URLs back to their old locations on tukaani.org - **changed** — Update maintainer info **NOTE:** 5.2.13, 5.4.7, and 5.6.2 have a build system issue that prevents building of shared libraries on some systems like mips64. See the patch itself for details. The same patch applies to 5.2.13, 5.4.7, and 5.6.2. ``` 5.4.7 (2024-05-29) * Not changed: Memory sanitizer (MSAN) has a false positive in the CRC CLMUL code which also makes OSS Fuzz unhappy. Valgrind is smarter and doesn't complain. A revision to the CLMUL code is coming anyway and this issue will be cleaned up as part of it. It won't be backported to 5.6.x or 5.4.x because the old code isn't wrong. There is no reason to risk introducing regressions in old branches just to silence a false positive. * liblzma: - lzma_index_decoder() and lzma_index_buffer_decode(): Fix a missing output pointer initialization (*i = NULL) if the functions are called with invalid arguments. The API docs say that such an initialization is always done. In practice this matters very little because the problem can only occur if the calling application has a bug and these functions return LZMA_PROG_ERROR. - lzma_str_to_filters(): Fix a missing output pointer initialization (*error_pos = 0). This is very similar to the fix above. - Fix C standard conformance with function pointer types. This newly showed up with Clang 17 with -fsanitize=undefined. There are no bug reports about this. - Fix building with NVIDIA HPC SDK. * xz: - Fix a C standard conformance issue in --block-list parsing (arithmetic on a null pointer). - Fix a warning from GNU groff when processing the man page: "warning: cannot select font 'CW'" - Fix outdated threading related information on the man page. * xzless: - With "less" version 451 and later, use "||-" instead of "|-" in the environment variable LESSOPEN. This way compressed files that contain no uncompressed data are shown correctly as empty. - With "less" version 632 and later, use --show-preproc-errors to make "less" show a warning on decompression errors. * Autotools-based build system (configure): - Symbol versioning variant can now be overridden with --enable-symbol-versions. Documentation in INSTALL was updated to match. CMake: - Linux on MicroBlaze is handled specially now. This matches the changes made to the Autotools-based build in XZ Utils 5.4.2 and 5.2.11. - Disable symbol versioning on non-glibc Linux to match what the Autotools build does. For example, symbol versioning isn't enabled with musl. - Symbol versioning variant can now be overridden by setting SYMBOL_VERSIONING to "OFF", "generic", or "linux". * Documentation: - Clarify the description of --disable-assembler in INSTALL. The option only affects 32-bit x86 assembly usage. - Add doc/examples/11_file_info.c. It was added to the Git repository in 2017 but forgotten to be added into distribution tarballs. - Don't install the TODO file as part of the documentation. The file is out of date. - Update home page URLs back to their old locations on tukaani.org. - Update maintainer info. ```