Log message:
pkgconf: update to 3.0.5.

Changes from 3.0.4 to 3.0.5:
----------------------------

* Correctness fixes:
  - Shell quoting and backslash escapes in pc(5) properties are now consumed
    once, after variable substitution, instead of while splitting the property
    beforehand.  Quoting arriving from a variable is therefore treated like
    quoting written inline, --variable reports a value as the .pc file spells
    it, and fragments are escaped exactly once when rendered.  This supersedes
    the 3.0.4 fix, which unescaped whitespace at parse time and so hid the
    escaping from consumers such as cmake's FindPkgConfig.
    See https://github.com/pkgconf/pkgconf/issues/575 and
    https://github.com/pkgconf/pkgconf/issues/579.
  - Metadata queries no longer consult Conflicts rules between the modules named
    on the command line, as reporting metadata does not combine them into a
    build.  This covers --license, --license-file, --modversion, --path,
    --print-provides, --print-requires, --print-requires-private,
    --print-variables, --source and --variable.  --cflags, --libs and --exists
    are unaffected.
    See https://github.com/pkgconf/pkgconf/issues/580.
  - ${pc_sysrootdir} is now injected into the path taken by every -isystem and
    -idirafter flag in a fragment list, rather than only the first.
  - -isystem and -idirafter written joined to their path, as in `-isystem/opt`,
    are split into the flag and the path it takes, so that the path is subject
    to the same sysroot injection and deduplication as the separated spelling.
  - Sysroot injection is decided by reading the fragment's path instead of
    remembering whether ${pc_sysrootdir} was expanded, so a path which already
    lies under the sysroot never acquires a doubled prefix.

* Performance:
  - The package cache and the fragment deduplication index are kept sorted and
    searched with bsearch() rather than re-sorted or scanned linearly.
  - Variable keys and fragment text are stored with the structures they belong
    to, and buffers are rewound and reused rather than reallocated.
  - Escaping, fragment rendering and path relocation write into their
    destination buffer directly.
  Resolving a graph of roughly forty modules is about six times faster than
  3.0.4, and a small graph such as gio-2.0 about twice as fast.

* Build and portability fixes:
  - Fix the pkgconf-lite build, which failed to link because the dependency list
    renderer had come to depend on tracing machinery that pkgconf-lite omits.
  - Fix the test runner failing to build on MinGW, where the mkdtemp(3) fallback
    was compiled only for MSVC builds.
    See https://github.com/pkgconf/pkgconf/issues/582.
  - The meson build now defines HAVE_DECL_READLINKAT, so readlinkat(2) is used
    where it is available instead of always falling back to readlink(2).
  The MinGW and readlinkat fixes are by moi15moi.

* New libpkgconf API additions:
  - pkgconf_argv_split_raw: splits a string into an argument vector like
    pkgconf_argv_split, but leaves the quoting it reads in place.
  - pkgconf_fragment_filter_splice: like pkgconf_fragment_filter, but moves the
    matching fragments to the destination list instead of copying them.
  - pkgconf_charset_from_spans: compiles a span list into a byte set.
  - pkgconf_buffer_escape_charset: escapes a buffer against such a byte set.
  - pkgconf_buffer_rewind: empties a buffer while keeping its allocation.
  - pkgconf_list_splice: moves the contents of one list onto the end of another.

Log message:
pkgconf: updated to 3.0.4

Changes from 3.0.3 to 3.0.4:

* Fix a crash (stack overflow) triggered by a crafted .pc file containing a
  self-referential fragment variable, such as `x=$${x}` referenced from Cflags.
  Fragment variables are now evaluated only once while re-splitting.  Found
  through fuzzing.

* Fix over-escaping of variable values containing backslash-escaped whitespace,
  such as paths quoted with `printf %q`.  Such a value was stored with its
  escapes intact and then escaped a second time when rendered into a fragment,
  producing output like `-L/a\\\ dir`.  This broke meson's test suite, which
  uses paths with spaces to stay Windows-safe.

* Fix mangled and duplicated -L/-I paths on Windows when PKG_CONFIG_SYSROOT_DIR
  and PKG_CONFIG_LIBDIR are set.  Path separators are now normalized to forward
  slashes for all runtime-injected paths (sysroot, build root, search paths and
  pcfiledir), so that sysroot matching and injection operate on a consistent
  basis.

* Fix `--define-prefix` dropping a path separator when the redefined prefix ends
  with a trailing slash, and only rewrite a package's directories when they match
  the original prefix on a path component boundary.

* Fix single-package queries returning results drawn from more than the requested
  module, by restoring the package limit that was lost during a refactor of the
  query builder.

Log message:
pkgconf: updated to 3.0.3

Changes from 3.0.2 to 3.0.3:

* Restore correct handling of sysroots when emulating legacy pkg-config, and
  add explicit regression tests for this case.

* Fix references to bomtool in spdxtool --help.
  Patch by Pierre Pronchery.

* Fix various typos in the source code.
  Patch by Christian Clauss.

Log message:
pkgconf: update to 3.0.2.

Changes from 3.0.1 to 3.0.2:
----------------------------

* Fix build on systems where readlinkat(2) is missing, such as Illumos when
  built without appropriate CFLAGS.

* Fix detection of readlinkat(2) on systems where it is gated behind
  _ATFILE_SOURCE, such as on certain builds of Illumos.

Log message:
pkgconf: update to 3.0.1.

Changes from 3.0.0 to 3.0.1:
----------------------------

* Various Meson-related fixes and improvements.
  Patches by Benjamin Gilbert.

Changes from 2.5.1 to 3.0.0:
----------------------------

* DEPRECATION: The autotools build system will be dropped after the 3.0 release.
  Building pkgconf with muon is recommended for early bootstrap and meson in later
  stages of bootstrap.
  Alternatively users can use pkgconf-lite for early bootstrap.
  Continuous integration now exercises both the muon and pkgconf-lite builds.
  See https://github.com/pkgconf/pkgconf/issues/481 for rationale and discussion.

* DEPRECATION: Support for setting `PKG_CONFIG_PATH` from the Windows registry
  is slated for removal in 3.1.  It is recommended `PKG_CONFIG_PATH` be set from
  the environment on Windows.
  See https://github.com/pkgconf/pkgconf/issues/546 for rationale and discussion.

* SPDX Software Bill of Materials (SBOM) generation:
  - New spdxtool(1) utility which generates SPDX Lite 3.0.1 SBOM files.  Initial
    implementation by Tuukka Pasanen, sponsored by The FreeBSD Foundation, and
    substantially improved since, with major contributions by Elizabeth Ashford
    and additional patches by Joshua Watt and Pierre Pronchery.
  - bomtool now supports a --output option, which writes the generated SBOM to
    a file instead of standard output, and --define-variable, as the pkgconf CLI
    does.  The --define-variable support is by Tuukka Pasanen.
  - bomtool now supports a --creation-time option, like spdxtool, which sets the
    SBOM creation timestamp (in ISO 8601 format) instead of using the current
    time, and no longer embeds the pkgconf version in its output.  Both changes
    allow for reproducible SBOM generation.
  - bomtool now honors the SOURCE_DATE_EPOCH environment variable, deriving the
    SBOM creation timestamp from it when --creation-time is not given, for
    reproducible builds.
  - bomtool: improved SPDX conformance.  Mandatory PackageCopyrightText and
    PackageLicenseConcluded fields are emitted as NOASSERTION when unavailable,
    a Created timestamp is included, invalid PackageVerificationCode output was
    removed, the package identifier charset was corrected,
    PackageDownloadLocation is derived from the Source tag, and SPDX 2.3 package
    names are used.  Patches by Stéphane Rochoy and Tuukka Pasanen.

* New pccritic(1) utility which scores the quality of pc(5) files.  Each module
  or .pc file is graded from A to F based on findings across several categories:
  required and recommended metadata, version sanity, relocatability of libdir
  and includedir, Cflags and Libs hygiene, the Requires relationship, the NTIA
  SBOM minimum elements, and file-formatting style.  Supports --quiet for a
  one-line score per target, --min-score for use as a CI gate, and colorized
  output.

* New test and I/O framework.
  - kyua is no longer required to run tests.
  - Declarative configuration for integration tests, C unit tests for functional \ 
tests.
  - Tests now run on Windows.
  - .pc and personality files are now opened in binary mode, and the line reader
    was reworked to correctly handle LF, CRLF and lone-CR line endings, including
    on non-seekable streams.  Binary-mode handling by moi15moi.
  Major contributions by Elizabeth Ashford.

* New pc(5) features:
  - Source tag: a URI which describes where a given package may be downloaded.
  - License.file tag: a path to a license file that is on disk.
  - Requires.shared tag: like Requires.private, except a list of dependencies \ 
only used
    when building in shared mode.
  - Cflags.shared tag: like Cflags.private, except a list of CFLAGS only used \ 
when building
    in shared mode.
  - Libs.shared tag: like Libs.private, except a list of LIBS only used when building
    in shared mode.
  - Link.ABI tag: a comma-separated list of tags describing the application binary
    interfaces a consumer must link a package against, such as c++ or fortran.
    Tags are case-insensitive and normalized to lowercase, and may be queried
    with --link-abi.
  The Source and License.file tags are by Tuukka Pasanen; additional patches by
  Elizabeth Ashford.

* Windows support has been significantly improved.
  - pkgconf can now be built and tested with Visual Studio and clang-cl.
  - Windows on ARM builds are supported, and MSI installers are produced for
    x86, x64 and arm64 using MSVC.
  - The console code page is set to UTF-8 and non-ASCII entries in
    PKG_CONFIG_PATH are now handled correctly.
  The clang-cl support, MSI installers and UTF-8 console handling are by
  moi15moi.

* Portability:
  - pkgconf is now built and tested in continuous integration on NetBSD,
    FreeBSD, OpenBSD, Haiku, OmniOS, macOS and Cygwin in addition to Linux and
    Windows.
  - pkgconf now falls back to readlink(2) on systems which lack readlinkat(2).
  - A fallback is provided for platforms without nl_langinfo_l, and xlocale.h is
    included where needed to build on macOS.
  - Fixed -Werror=format build failures on MinGW caused by the PRIu64 macro
    expanding to an MSVCRT format specifier that the GNU format-string checker
    rejects; serial and identifier values are now printed with %llu.
  The expanded platform CI and the nl_langinfo_l/xlocale.h fallbacks are by
  moi15moi.

* Security hardening:
  - Variable substitution is now guarded against denial-of-service inputs,
    including billion-laughs style expansion and excessively complex bytecode
    programs.
  - Dependency traversal is now limited to 256 levels by default to prevent
    stack exhaustion from excessively deep graphs.  A depth of -1 explicitly
    enables unlimited traversal.
  - Bytecode validation now uses overflow-safe bounds checks and rejects
    truncated, oversized and otherwise malformed programs.
  - Dynamic buffers now reject overlapping source and destination storage and
    guard allocation-size arithmetic against overflow.
  - LLVM libFuzzer targets were added for the pc(5) parser and the solver, and
    the numerous out-of-memory and crash paths they surfaced were hardened.
  - Allocation failures are now propagated through parsing, rendering, output
    and SBOM generation instead of silently producing partial results.
  - Dropped use of strlcpy, strlcat and other silently truncating string
    functions.

* CLI changes:
  - New --newlines option, which separates emitted fragments with newlines
    instead of spaces.
  - New --print-digraph-query-nodes option, which annotates the --digraph
    output with the nodes that were part of the original query.
  - --list-all and --list-package-names now include synthesized virtual
    packages provided via the Provides tag.
  - Variables can now be overridden using PKG_CONFIG_MODULENAME_VARIABLENAME
    environment variables.  This was formally specified but never implemented
    in pkgconf.
  - PKG_CONFIG_LOG is now appended to rather than overwritten.
  - --dump-personality output is now consistent with the
    pkgconf-personality(5) format and additionally reports WantDefaultPure and
    WantDefaultStatic.
  - The vestigial --relocate=path option, which existed only for the old test
    suite, has been removed.
  - pccritic --min-score now strictly accepts integer values from 0 through 100.

* Build system changes:
  - The meson build gained a with-pkg-config-dir option to override the default
    package search path, matching the autotools --with-pkg-config-dir option.

* pkg.m4 changes:
  - PKG_WITH_MODULES now properly quotes its action arguments (serial 16).
    Patch by Antonin Décimo.
  - The macros no longer direct users to the freedesktop pkg-config project.

* Correctness fixes:
  - The built-in pkg-config and pkgconf packages are now constructed from the
    configured personality instead of being hardcoded, so their reported data
    reflects the active personality.  They are also exposed as proper versioned
    virtual packages.
  - ${pc_sysrootdir} now defaults to an empty string instead of '/'.
  - Variable substitution was reimplemented using a bytecode engine, which
    tracks whether special variables such as ${pc_sysrootdir} have already been
    applied so that they are not substituted more than once.
  - The solver now re-checks the final solution for conflicts before returning
    success, and tracks the origin of conflict rules.
  - Requires.internal is now treated as a weaker form of Requires.private: its
    dependency nodes need not be satisfied when link libraries are not
    requested.
  - pkgconf now warns about .pc files that duplicate a dependency-list field,
    whose behavior is inconsistent across pkg-config implementations.
  - Version comparison was reworked to use a structured algorithm modeled on
    apk-tools.
  - Newline folding behavior when parsing multi-line fields has been adjusted.
  - Bare variable expansions inside fragment lists are now re-parsed so that any
    flags they expand to are tokenized correctly.
  - ${pc_sysrootdir} is now only injected when it matches a complete path
    boundary, and obviously bogus sysroot_dir definitions are ignored, fixing
    incorrect sysroot injection.
  - Arguments are now combined when a flag is expected to carry a separate
    value, such as -I dir or -framework name.
  - SPDX license expressions in the License field are now properly parsed and
    validated.  Patches by Tuukka Pasanen.

* The libpkgconf API and ABI were substantially reworked, breaking both API and
  ABI compatibility.  Consumers will need source changes as well as a rebuild.
  The libpkgconf soversion is now 8.
  - An abstract pkgconf_buffer_t type is now used throughout libpkgconf in place
    of fixed-size stack buffers, removing a class of truncation bugs.
  - A new pkgconf_output API abstracts all output, allowing the output stream to
    be set per-client and redirected (pkgconf_client_set_output,
    pkgconf_output_file_fmt and friends).
  - The pkgconf_tuple_parse API has been removed; variables are now evaluated
    via pkgconf_variable_eval (backed by the new bytecode engine).
  - The fragment rendering API was reworked around pkgconf_buffer_t, and the old
    pkgconf_fragment_render API has been removed.  Fragment renderer callbacks
    and pkgconf_fragment_render_buf now return bool so allocation and rendering
    failures can be reported.
  - pkgconf_license_render now returns bool so allocation failures can be
    reported.
  - The package copyright field was migrated to a bufferset.
  - Environment variable lookups can now be mocked via pkgconf_client_getenv.
  - Client construction gained an options-based API: pkgconf_client_init_with_options
    and pkgconf_client_new_with_options accept a pkgconf_client_options_t \ 
struct, with
    the original pkgconf_client_init and pkgconf_client_new retained as \ 
wrappers.  The
    unveil handler may now be supplied directly as a client option.
  - New pkgconf_variable_eval_name API, which evaluates a named variable and
    applies sysroot fixups to the result.
  - The pkgconf_pkg_traverse_func_t callback gained a trailing iter_flags
    argument carrying per-traversal state (PKGCONF_PKG_ITERF_*), replacing the
    removed PKGCONF_PKG_PKGF_ITER_PKG_IS_PRIVATE client flag.

Log message:
pkgconf: updated to 2.5.1

Changes from 2.5.0 to 2.5.1:

* Fix processing of empty dependency lists.

Changes from 2.4.3 to 2.5.0:

* Added a manual page for bomtool.

* Add support for preloaded packages.
  These are modules which are preloaded into the package database
  and preferred over searching the module search path when present.

* Refactor Windows registry PKG_CONFIG_PATH support so that it
  augments the main directory search list instead of being treated
  as a special case.

* Processing of `--with-path` arguments by the pkgconf CLI is
  now deferred until libpkgconf is fully initialized, effectively
  aligning behavior with PKG_CONFIG_PATH processing.

* Fix several minor memory safety bugs which were identified by
  the GCC 15 static analyzer.

* Added support for pledge(2) and unveil(2) on systems where
  this functionality is available.

* Significant improvements to pkgconf's manual pages.
  Patches by Ingo Schwarze and Jonathan Gray (OpenBSD).

* Remove questionable default-static assumption on Windows that
  was inherited from the original pkg-config.  Most distributions
  of pkgconf on Windows were already patching this out.
  Patch by Kai Pastor.

* Add -D_POSIX_C_SOURCE=200809L to the build definitions, which
  is needed for readlinkat on glibc.
  Patch by Filipe Laíns.

Log message:
pkgconf: fix build on SCO/Xinuos UnixWare 7

Using upstream patch, via PR 59556 by Egor.

Log message:
pkgconf: Linux (at least ArchLinux) installs some pkgconfig files in
/usr/share/pkgconfig so add it to the search path.