Problem: [security]: code injection in netrw via bookmarks and history
(David Carliez)
Solution: Escape the '|' explicitly (Yasuhiro Matsumoto)
The bookmark and history menu builders interpolate paths into :execute'd
:menu commands using g:netrw_menu_escape, which did not escape the Ex
command separator '|'. A crafted path could break out of the :menu command
and run arbitrary Ex/shell commands when the menu was built or triggered.
Add '|' to g:netrw_menu_escape for the menu names, escape the :e right-hand
side with fnameescape(), and quote the netrw#MakeTgt() argument with
string() instead of raw single-quote interpolation.
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r229c6fd090d
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Problem: [security]: arbitrary code execution via keyword lookup in
sh.vim, zsh.vim and ps1.vim filetype plugin
(manus-use)
Solution: For powershell, quote the commands using single quotes, for
sh/zsh pass the argument as a separate list item to term_start()/system()
(Yasuhiro Matsumoto).
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2c5a82fe013
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Problem:
The preview-window (:pedit, etc.) always uses a split, but it would be
useful as a floatwin (or "popup").
Solution:
Support Vim's 'previewpopup' option.
Vim's code and test for channel,job API are already N/A.
Blacklisting runtime/doc/channel.txt ensures most patches for it
will be detected as N/A.
Vim's API that is too incompatible with Neovim must be handled
outside vim-patch.sh .
Problem:
`:restart` on Windows always forces `AllocConsole`, even though we could
reuse old server's existing console + unnecessary env.
Analysis:
After d5516daf121aa718e79bcd423ee24c24492893c0 changed the restart
lifecycle and 789741bb83d1f31b7162cd8944bc2d846fa2fa51 separated the
Windows console paths, we no longer need to force `AllocConsole()` for
`:restart`. The `:detach` path now allocates its own console when it
actually runs.
Solution:
Try to attach the replacement server to its parent’s console and fall
back to `AllocConsole()` if attachment fails. Drop the restart-specific
env that forced allocation.
As documented by Microsoft, [“A console is closed when the last process
attached to it terminates or calls
`FreeConsole`.”](https://learn.microsoft.com/en-us/windows/console/attachconsole)
Btw, this way we can preserve `io.stdout:write()`, though if for some
reason `AttachConsole` would fail then it won't work; but now at least
it's not always not rendering on `:restart`.
vim-patch:9.2.0820: GUI: hidden popup image is displayed and not erased
vim-patch:9.2.0822: GTK4: crash menu id is null in gui_mch_destroy_menu()
vim-patch:9.2.0823: tests: Test_clientserver_servlist_list may fail
vim-patch:9.2.0824: Makefile: Make tags depends on configure
vim-patch:9.2.0828: GTK4: hardware rendering can be improved
vim-patch:2f0178afe Update .gitignore and .hgignore files
vim-patch:9.2.0832: socketserver: remote commands can be processed in reverse order
vim-patch:9.2.0833: GTK4: menu mnemonics do not work properly
vim-patch:bb86a1866 runtime(doc): clarify re-sourcing of Vim9 script behaviour
Co-authored-by: marvim <marvim@users.noreply.github.com>
Problem: When the terminal reports no colors ("t_Co" is 0 or 1) the
insert mode completion popup menu is not shown at all, while
the command line completion popup menu ('wildoptions' contains
"pum") is shown. In 'wildmenu' completion the current match
cannot be told apart from the other matches (Maxim Kim)
Solution: Show the insert mode completion popup menu regardless of the
number of colors and add "term" attributes to the default
highlighting of Pmenu, PmenuSel and PmenuThumb. The wildmenu
is drawn with the attributes of the status line, which is
reversed, and on most terminals the standout mode is the same
as the reverse mode, thus use the underline mode for the
default highlighting of WildMenu (Hirohito Higashi).
fixes: vim/vim#20800closes: vim/vim#2080352485e0d24
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: filetype: .git-blame-ignore-revs file is not recognized
Solution: Detect .git-blame-ignore-revs file as gitrevlist filetype,
include syntax and filetype plugins (Fionn Fitzmaurice)
A Git revision list is
> a list of object names (i.e. one unabbreviated SHA-1 per line)...,
> comments (#), empty lines, and any leading and trailing whitespace are
> ignored.
(from Git's fsck.skipList documentation).
The default output of git rev-list will match this. It is also suitable
as input to git blame --ignore-revs-file.
This adds filetype detection matching .git-blame-ignore-revs files,
syntax highlighting and basic filetype settings.
closes: vim/vim#20702a8d5be9284
Co-authored-by: Fionn Fitzmaurice <fionn@github.com>
Problem: Opening a file from a netrw listing throws
"E471: Argument required: keepj keepalt 2wincmd 1" when
g:netrw_chgwin equals winnr('$')+1, e.g. after opening
:Lexplore (which sets g:netrw_chgwin=2) and closing the
sidebar, then browsing with :Explore in the remaining window.
s:NetrwBrowseChgDir builds the window jump as
"g:netrw_chgwin wincmd curwin", passing the saved window
NUMBER where wincmd expects its single-letter argument.
Solution: Jump back to the saved window with "curwin wincmd w", as the
surrounding comment intends; the following statement then
performs the actual jump to g:netrw_chgwin.
The faulty line dates back to at least Vim 9.0
(runtime/autoload/netrw.vim:4976 at v9.0.0000).
Reported (against the since-archived netrw repo) in
saccarosium/netrw.vim#98 and neovim/neovim#34169.
Note: no test, because the error reproduces only in Neovim.
closes: vim/vim#207416e46829991
Co-authored-by: erdivartanovich <erdivartanovich@gmail.com>
Problem:
The core behaviors of `nvim.dir` cannot be reused by consumers
such as the archive plugin, ssh browser, etc.
Solution:
- Define a basic "provider" shape.
- Extract the filesystem provider.
Problem:
When buffer is open in multiple windows and its line count changes, any
'statusline' or 'rulerformat' items depending on it (e.g. %P) will
become invalid in non-current windows because w_redr_status is only set
on first change.
Solution:
Set w_redr_status on all windows with the buffer when the line count
changes.
Signed-off-by: Ondrej Balaz <blami@blami.net>
Problem:
Redundant code.
Solution:
Combine path_has_wildcard() and path_has_exp_wildcard(). They have similar logic.
Also, the latter operates on whatever wildcards remain after shell/env/backtick
expansion, so the two felt somewhat related.
Also drop some unnecessary MB_PTR_ADV calls.
Problem: ":startinsert" enters Insert mode in a buffer where
'modifiable' is off, the error only appears when a character
is typed. Typing "i" gives the error right away (Barrett Ruth)
Solution: Give the error when the buffer is not modifiable, like "i"
does. Keep ignoring the command in a terminal window, where
":startinsert" is documented to be ineffective, and keep
accepting it when 'insertmode' is set, like "i" does
(Hirohito Higashi).
fixes: vim/vim#20804closes: vim/vim#208066ab1976e49
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Problem: do_sub() only checks the timeout limit after finishing a line.
A pathological regex will run on a single line input unbounded
until the compute is completed.
Solution: Pass the timeout limit to `vim_regexec_multi()` so the
computation on the regex engine is bounded per-line.
Signed-off-by: XiaowenHu96 <me@xiaowenhu.com>
* fix(help): preserve multi-letter CTRL modifiers in :help subject
Problem: After PR 39537 normalized `CTRL-U-default` by excluding
`-` from the trigger char class, the regex `(CTRL%-[^{])([^-_\\])`
also fires between `CTRL-S` and the `H` of the `SHIFT` modifier
in tags like `c_CTRL-SHIFT-V`, splitting it into the non-existent
`c_CTRL-S_HIFT-V`.
Solution: Exclude uppercase letters from the char class so a
multi-letter modifier following `CTRL-X` (e.g. `SHIFT`, `ALT`) is
no longer split. The `-` exclusion from 39537 is preserved so
`i_CTRL-U-default` still works.
* fix(help): escape ~ in expr-=~? exception to keep regex valid
Problem: The `expr-=~?` exception in the tag alias table maps to
`=~?`, but in Vim's regex engine `~` refers to the previous
substitute pattern. With no prior substitute the pattern fails to
compile, so `:help expr-=~?` returns E149 even though the tag exists.
Solution: Escape `~` as \\\~` so the alias expands to a valid
regex (`=\\\~?`) that substring-matches the `expr-=~?` tag. Other
`expr-X?` entries are unaffected since they don't contain `~`.
* fix(help): don't insert _ before CTRL- when preceded by -
Problem: The rule `([^_])CTRL%- -> %1_CTRL-` inserts an underscore
between any non-underscore char and `CTRL-`, which wrongly rewrites
tags like `map-CTRL-C` and `telnet-CTRL-]` (where `CTRL-` is
literal text in the tag, not a key chord).
Solution: Exclude `-` from the trigger char class so a hyphen
immediately before `CTRL-` is preserved. The existing behavior for
`iCTRL-GCTRL-J` -> `i_CTRL-G_CTRL-J` is unaffected because the
`G` before `CTRL-J` is not `-`.
* fix(help): only treat ^X as caret notation for valid control chars
Problem: The regex `%^([^_])` converts any `^X` to `CTRL-X`,
including `:set^=` where `^=` is literal text in the tag, not a
caret-notation control character.
Solution: Restrict the transformation to caret-notation chars
(`%a` or one of `?@[\\]^{}`). This matches the C reference
behavior where `^X` is only converted when X is alphanumeric or one
of the control-notation punctuation chars. `{` is retained so
`^{char}` still maps to the `CTRL-{char}` placeholder tag.
Problem: With the NFA engine a sub-expression inside a variable width
look-behind, e.g. "\v(.)@<=", is empty for the first match on
every line except the first one. The old engine is correct
(Mukundan)
Solution: The look-behind is retried from the previous line, because the
width of "." is over-estimated. While scanning that line the
start state is added at the end of the line, where it gets the
position of the line break as its start position, even though
the match actually starts on the next line. Use the position
of the start of the next line in that case (Hirohito Higashi).
fixes: vim/vim#20802closes: vim/vim#20805ade577e4dc
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem:
on_attach() calls refresh(), but there is no guarantee the attached
buffer is the current buffer. This can make linked editing request
handling assume the wrong window.
Solution:
Call refresh() only if the current buffer is attached. This keeps the
initial highlighting behavior while avoiding making incorrect request.
Problem:
emmylua reports `unresolved-require` for `require('test.testutil')` and
friends, and a file under `test/` cannot even resolve its own siblings.
This happens because `test/.emmyrc.json` and `test/.luarc.json`, cause
vim.lsp to root the workspace at `test/` instead of the repo top-level.
Solution:
Drop the nested configs:
src/.luarc.json
test/.luarc.json
test/.emmyrc.json
Outcomes:
- No "libraries" needed: luv types come from `runtime/lua/uv/_meta.lua`,
not `${3rd}/luv` (which would only duplicate them).
- Drop `test/` from the root `.luarc.json` `ignoreDir` so its modules are
resolvable by LuaLS/Emmylua.
- Note: this means that LuaLS diagnostics will now be reported for
`test/`, but that is not a bad thing...
Problem:
When 'shellslash' is set, exepath() returns forward-slashed paths.
Passing that path to vim.system() can prevent cmd.exe from launching.
Solution:
Convert the resolved executable path to native separators before spawning.
Add a Windows regression test for cmd.exe with 'shellslash' enabled.
Problem:
The magic globals `it`, `describe`, etc., are more trouble than they are
worth.
- Hooking into `after_each` requires `getfenv()` hacks.
- They confuse luals/emmylua, because the top-level `.luarc.json` isn't
merged with `test/.luarc.json` (apparently a luals limitation?)
- They totally defeat discoverability because the user just has to
"know" about the various magic symbols.
So they harm DX, which means they serve no purpose at all.
Solution:
- Expose the test API from `testutil`, so tests can call `t.it()`,
`t.describe()`, etc., in the conventional way.
- Drop `getfenv()` hacks.
- Drop the `setfenv()` injection in `load_chunk`.
- Drop `test/_meta.lua`.
Problem:
Generated API bindings for Lua contain unused jump labels when the API
function has a non-KeyDict (e.g., Array) param after a KeyDict param, causing
the build to fail.
Solution:
Don't output a label when the current parameter is not a KeyDict but the
previous one is.
vim-patch:9.2.0807: MS-Windows: ellipsis character is garbled
vim-patch:9.2.0816: GTK4: Memory leak in gui_gtk_set_dnd_targets()
vim-patch:8.2.0142: possible to enter popup window with CTRL-W p
vim-patch:8.2.0743: can move to another buffer from a terminal in popup window
vim-patch:8.2.0745: crash on exit when not all popups are closed
vim-patch:8.2.1729: endless loop when ":normal" feeds popup window filter
vim-patch:8.2.1997: window changes when using bufload() while in a terminal popup
vim-patch:8.2.2183: Vim9: value of 'edcompatible' and 'gdefault' are used
vim-patch:8.2.2519: Vim9: no reason to keep strange Vi behavior
vim-patch:8.2.2527: Vim9: lambda return type is not determined at script level
vim-patch:9.2.0797: Memory leak in get_qfline_items() on alloc failure
vim-patch:9.2.0800: Memory leak in call_func() on alloc failure
vim-patch:9.2.0803: Memory leak on alloc failure with taglist/gettagstack()
vim-patch:9.2.0808: getregionpos: double-free on alloc failure
vim-patch:9.2.0809: getframelayout() uses wrong function to free lists
vim-patch:9.2.0810: add_llist_tags() uses wrong function to free dict
Problem: Deeply nested regexp groups can cause uncontrolled recursion
in the regexp compiler and exhaust the C stack.
Solution: Limit recursive regexp parsing depth in both the backtracking
and NFA compilers (lipengyu)
closes: vim/vim#20731a79cd6bfc3
Co-authored-by: lipengyu <lipengyu@kylinos.cn>
Problem: dict_add_func() references the function only after a
successful dict_add(), on failure dictitem_free()
calls func_unref() without a matching func_ref(), corrupting
the reference count of a lambda or numbered function.
Solution: Take the reference before dict_add() so the unref on the
failure path is balanced (Yasuhiro Matsumoto).
related: vim/vim#20668
closes: vim/vim#207424a403b48c6
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Problem: :argdelete with pattern leads to wrong argidx().
Solution: Correct argidx() in both branches of ex_argdelete(). Also use
ARGCOUNT macro in two more places (zeertzjq).
related: patch 7.4.1119
related: neovim/neovim#40564
closes: vim/vim#206973b40a14a46
Problem:
The existing `showmode` overlay can immediately cover messages emitted while
Visual mode is active, including the `g CTRL-G` word count.
Solution:
Protect Visual mode messages with the existing message delay and temporarily
hide the previous last-line overlay until it is restored.
Problem:
The title is combined with window's attributes only if the title is a
string (which implies the FloatTitle / FloatFooter highlight groups),
but not when the title is text-hl chunks.
Solution:
Combine specified highlight group with window-local Normal highlight as
well.
Problem:
FAILED …/cursorhold_spec.lua @ 73: CursorHold is not triggered after only K_EVENT on startup
Expected values to be equal.
Expected:
1
Actual:
0
stack traceback:
…/cursorhold_spec.lua:79: in function <…/cursorhold_spec.lua:73>
Solution:
Retry instead of hardcoding sleep(50).
Problem:
LSP hover erroneously drops blank lines before a 4-space-indented
codeblock, which is not valid Markdown. This causes incorrect parsing
and wrong display.
Solution:
Fix `split_lines` so that it doesn't drop the blank line just before
a 4-space-indented codeblock.
fix https://github.com/neovim/neovim/issues/40860
Problem:
w_float_is_info conflates a window's role with its floating layout,
which are orthogonal properties.
Solution:
Replace w_float_is_info with a w_kind enum for the window's role.
Problem:
`vim.diagnostic.handlers.underline.show` throws `E565: Index out of bounds` when
it tries to underline a diagnostic whose `lnum` is past the end of the buffer.
This happens with stale diagnostics set on an unloaded buffer (e.g. via
`bufadd()`) that are drawn only after the buffer is loaded: by then the file on
disk can be shorter than the `lnum` the diagnostic carried. File pickers
(snacks.nvim) that open files via `bufadd` + `:buffer` hit this whenever an LSP
server has already emitted diagnostics for that URI.
Solution:
Skip diagnostics with an out-of-range `lnum` in the underline handler.
Other handlers `M.virtual_text.show()`, `M.signs.show()`, have a similar condition.
