Release: v2.64.1 by CarterLi · Pull Request #2370 · fastfetch-cli/fastfetch · GitHub

Checklist

I have tested my changes locally.

…tants

…ackage managers from the build entirely

Not up to standards ⛔

🔴 Issues 3 critical

Alerts:
⚠ 3 issues (≤ 0 issues of at least minor severity)

Results:
3 new issues

Category Results

Security 3 critical

View in Codacy

🟢 Metrics 0 complexity

Metric Results

Complexity 0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

TIP This summary will be updated as you push new changes.

Pull Request Overview

The PR is currently not up to standards due to 3 new quality issues and significant gaps in implementation that could break the build and compromise security.

A critical issue was identified in CMakeLists.txt where an empty package manager disable list causes a syntax error in the C header. Additionally, a high-severity security risk (CWE-126) exists in src/common/impl/format.c, where strlen is used on string arguments that may not be null-terminated.

Several acceptance criteria regarding the new recursion depth limit and CMake conditional compilation lack corresponding unit or regression tests. These issues should be resolved before merging.

About this PR

No unit tests or regression tests were included for the new recursion depth check or the CMake conditional compilation logic. These are critical for verifying the maintenance release's stability.
The PR description is sparse and lacks details on the actual logic changes. Furthermore, the recursion depth limit of 15 in lua.c is hardcoded; consider if this should be configurable or if it might be too restrictive for certain nested data structures.

Test suggestions

Verify that building with -DPACKAGES_REMOVE_DISABLED=ON excludes the detection code for managers disabled via -DPACKAGES_DISABLE_<NAME>.
Verify that json_encode in Lua correctly throws an error when a table exceeds a nesting depth of 15.
Verify that json_encode handles circular references gracefully without crashing.
Successful compilation and runtime verification using Lua 5.3.
Verification that Base64 decoding remains functional after making init_decode_table static.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that building with `-DPACKAGES_REMOVE_DISABLED=ON` excludes the detection code for managers disabled via `-DPACKAGES_DISABLE_<NAME>`.
2. Verify that `json_encode` in Lua correctly throws an error when a table exceeds a nesting depth of 15.
3. Verify that `json_encode` handles circular references gracefully without crashing.
4. Successful compilation and runtime verification using Lua 5.3.
5. Verification that Base64 decoding remains functional after making `init_decode_table` static.

TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback

🔴 HIGH RISK

This definition will cause a compilation error if PACKAGES_DISABLE_LIST is empty. You should ensure it defaults to a valid integer value or a bitmask flag that represents 'none' (e.g., FF_PACKAGES_FLAG_NONE) when the list is empty.

Try running the following prompt in your coding agent:

Update CMakeLists.txt to set PACKAGES_DISABLE_LIST to FF_PACKAGES_FLAG_NONE if it is empty before calling target_compile_definitions.

🔴 HIGH RISK

Replacing the internal string handler with strlen introduces a dependency on null-termination that might not be guaranteed for all FF_ARG_TYPE_STRING inputs. Try running the following prompt in your IDE agent:

Since lua_pushstring is no longer available in the FFLuaData struct, review the usage of strlen in src/common/impl/format.c at line 194. Ensure all string arguments are null-terminated or update the FFformatarg structure to carry an explicit length for string types to avoid potential buffer over-reads.

See Issue in Codacy

⚪ LOW RISK

Use sizeof for constant literals to provide the length at compile time.

Suggested change

      
                    lua_pushlstring(L, "yyjson: yyjson_mut_doc_new() failed", strlen("yyjson: yyjson_mut_doc_new() failed"));
          
                    lua_pushlstring(L, "yyjson: yyjson_mut_doc_new() failed", sizeof("yyjson: yyjson_mut_doc_new() failed") - 1);

See Issue in Codacy

⚪ LOW RISK

Suggestion: Remove the leading colon from the error string for cleaner output (standard Lua errors do not start with a colon). Additionally, use sizeof for constant literals to calculate length at compile time rather than using strlen at runtime.

Suggested change

      
                    lua_pushlstring(
          
                        L, ": recursion depth exceeded; possible circular reference",
          
                        strlen(": recursion depth exceeded; possible circular reference")
          
                    );
          
                        sizeof(" recursion depth exceeded; possible circular reference") - 1

Pull request overview

Release bump to v2.64.1, combining a small build-time optimization for package detection, Lua/yyjson robustness + compatibility fixes, and macOS codec build compatibility adjustments.

Changes:

Add PACKAGES_REMOVE_DISABLED / FF_PACKAGES_REMOVE_DISABLED to compile out detection code for package managers disabled at build time.
Improve Lua integration: fix Lua 5.3 compatibility and harden json_encode against deep/circular tables.
Fix older macOS SDK build issues by removing JPEG XL codec handling and using FourCC literals for Apple codec mappings.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
CMakeLists.txt	Bumps project version; adds PACKAGES_REMOVE_DISABLED option and wires FF_PACKAGES_* compile definitions.
CHANGELOG.md	Adds 2.64.1 release notes for the new option and fixes.
src/modules/packages/option.h	Makes FFPackagesFlags explicitly UINT64_C-based and conditionally removes disabled from options.
src/modules/packages/packages.c	Conditionally compiles JSON parsing/config emission of disabled; initializes disabled defaults only when supported.
src/detection/packages/packages.h	Introduces FF_PACKAGES_IS_ENABLED() abstraction (runtime vs compile-time depending on FF_PACKAGES_REMOVE_DISABLED).
src/detection/packages/packages_linux.c	Switches per-manager checks to FF_PACKAGES_IS_ENABLED().
src/detection/packages/packages_windows.c	Switches per-manager checks to FF_PACKAGES_IS_ENABLED().
src/detection/packages/packages_apple.c	Switches per-manager checks to FF_PACKAGES_IS_ENABLED().
src/detection/packages/packages_bsd.c	Switches per-manager checks to FF_PACKAGES_IS_ENABLED().
src/detection/packages/packages_obsd.c	Switches per-manager checks to FF_PACKAGES_IS_ENABLED().
src/detection/packages/packages_nbsd.c	Switches per-manager checks to FF_PACKAGES_IS_ENABLED().
src/detection/packages/packages_sunos.c	Switches per-manager checks to FF_PACKAGES_IS_ENABLED().
src/detection/packages/packages_haiku.c	Switches per-manager checks to FF_PACKAGES_IS_ENABLED().
src/detection/codec/codec.h	Removes FF_CODEC_TYPE_JPEG_XL and updates FF_CODEC_TYPE_MAX.
src/modules/codec/codec.c	Removes JPEG XL string mapping (consistent with enum removal).
src/detection/codec/codec_apple.c	Uses FourCC literals to avoid relying on newer SDK constants; removes JPEG XL mapping.
src/common/lua.h	Adjusts dynamically-loaded Lua symbol set and wrappers.
src/common/impl/lua.c	Adds recursion-depth guard for json_encode and updates error paths to use lua_error.
src/common/impl/format.c	Replaces lua_pushstring usage with lua_pushlstring for loaded-symbol consistency.
src/common/impl/base64.c	Makes init_decode_table() static.

CarterLi added 4 commits June 4, 2026 10:48

Common (Lua): optimises code; fixes incompatibility against lua 5.3

72cb64a

Codec (macOS): removes usage of JPEG XL; replaces enums with raw cons…

de95a62

…tants

Packages: adds option PACKAGES_REMOVE_DISABLED to remove disabled p…

3b56200

…ackage managers from the build entirely

Common (Base64): adds static to internal functions

b34e2a4

Copilot AI review requested due to automatic review settings June 4, 2026 11:28

Copilot started reviewing on behalf of CarterLi June 4, 2026 11:28 View session

codacy-production Bot reviewed Jun 4, 2026

View reviewed changes

Copilot AI reviewed Jun 4, 2026

View reviewed changes

Comment thread src/common/impl/lua.c

Comment on lines +11 to +14

lua_pushlstring(

L, ": recursion depth exceeded; possible circular reference",

strlen(": recursion depth exceeded; possible circular reference")

);

CarterLi added 2 commits June 4, 2026 20:15

Common (Lua): detects circular reference in encode_json

54792e6

Release: v2.64.1

9787b56

CarterLi force-pushed the dev branch from 50d84b1 to 9787b56 Compare June 4, 2026 12:16

CarterLi merged commit 021ece1 into master Jun 4, 2026
47 of 48 checks passed

                   list(JOIN PACKAGES_DISABLE_LIST " | " PACKAGES_DISABLE_LIST)
               endif()
-              target_compile_definitions(libfastfetch PRIVATE FF_PACKAGES_DISABLE_LIST=${PACKAGES_DISABLE_LIST})
+              target_compile_definitions(libfastfetch PRIVATE "FF_PACKAGES_DISABLE_LIST=${PACKAGES_DISABLE_LIST}")

                                   break;
                               case FF_ARG_TYPE_STRING:
-                                  lua_pushstring(L, (const char*) arg->value);
+                                  lua_pushlstring(L, (const char*) arg->value, strlen((const char*) arg->value));

-                  if (!doc) {
-                      return luaL_error(L, "failed to create yyjson document");
+                  if (__builtin_expect(!doc, false)) {
+                      lua_pushlstring(L, "yyjson: yyjson_mut_doc_new() failed", strlen("yyjson: yyjson_mut_doc_new() failed"));

Release: v2.64.1 by CarterLi · Pull Request #2370 · fastfetch-cli/fastfetch · GitHub

Uh oh!

Uh oh!

Release: v2.64.1 - #2370

Release: v2.64.1#2370
CarterLi merged 6 commits into
masterfrom
dev

CarterLi commented Jun 4, 2026

Uh oh!

codacy-production Bot commented Jun 4, 2026 •
edited
Loading

Uh oh!

Uh oh!

codacy-production Bot left a comment

Uh oh!

codacy-production Bot Jun 4, 2026

Uh oh!

codacy-production Bot Jun 4, 2026

Uh oh!

codacy-production Bot Jun 4, 2026

Uh oh!

codacy-production Bot Jun 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	lua_pushlstring(L, "yyjson: yyjson_mut_doc_new() failed", strlen("yyjson: yyjson_mut_doc_new() failed"));
	lua_pushlstring(L, "yyjson: yyjson_mut_doc_new() failed", sizeof("yyjson: yyjson_mut_doc_new() failed") - 1);

Release: v2.64.1 by CarterLi · Pull Request #2370 · fastfetch-cli/fastfetch · GitHub

Uh oh!

Uh oh!

Release: v2.64.1 - #2370

Release: v2.64.1#2370CarterLi merged 6 commits intomasterfastfetch-cli/fastfetch:masterfrom devfastfetch-cli/fastfetch:devCopy head branch name to clipboard

Conversation

CarterLi commented Jun 4, 2026

Checklist

Uh oh!

codacy-production Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Not up to standards ⛔

Uh oh!

codacy-production Bot left a comment

Choose a reason for hiding this comment

Pull Request Overview

About this PR

Test suggestions

Uh oh!

codacy-production Bot Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Release: v2.64.1#2370
CarterLi merged 6 commits into
masterfrom
dev

codacy-production Bot commented Jun 4, 2026 •
edited
Loading