From d310173160badce183bb52b18b27d10261d466af Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 8 Apr 2026 00:42:58 +0000 Subject: [PATCH 1/3] CI: Bump the github-actions group across 3 directories with 2 updates Bumps the github-actions group with 1 update in the / directory: [actions/upload-artifact](https://github.com/actions/upload-artifact). Bumps the github-actions group with 1 update in the /.github/actions/test_macvim_artifacts directory: [actions/upload-artifact](https://github.com/actions/upload-artifact). Bumps the github-actions group with 1 update in the /.github/actions/universal-package directory: [actions/cache](https://github.com/actions/cache). Updates `actions/upload-artifact` from 6 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v6...v7) Updates `actions/upload-artifact` from 4 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v6...v7) Updates `actions/cache` from 4 to 5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/cache dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/actions/test_macvim_artifacts/action.yml | 2 +- .github/actions/universal-package/action.yml | 4 ++-- .github/workflows/macvim-buildtest.yaml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/actions/test_macvim_artifacts/action.yml b/.github/actions/test_macvim_artifacts/action.yml index a0ec557045..e4c150a847 100644 --- a/.github/actions/test_macvim_artifacts/action.yml +++ b/.github/actions/test_macvim_artifacts/action.yml @@ -13,7 +13,7 @@ runs: using: "composite" steps: - name: Upload failed tests - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: # Name of the artifact to upload. name: ${{ format('GH-{0}-{1}-{2}-{3}-{4}-failed-macvim-tests', diff --git a/.github/actions/universal-package/action.yml b/.github/actions/universal-package/action.yml index 0ea6df8532..24d6f885d0 100644 --- a/.github/actions/universal-package/action.yml +++ b/.github/actions/universal-package/action.yml @@ -76,7 +76,7 @@ runs: - name: Restore keg cache id: cache-keg-restore - uses: actions/cache/restore@v4 + uses: actions/cache/restore@v5 with: path: ${{ steps.setup-formula.outputs.brew_prefix }}/Cellar/${{ inputs.formula }} key: ${{ inputs.formula }}-homebrew-cache-custom-unified-prefix${{ steps.setup-formula.outputs.brew_prefix }}-xcode${{ steps.setup-formula.outputs.xcode_version }}-${{ hashFiles(format('{0}.rb', inputs.formula)) }} @@ -120,7 +120,7 @@ runs: - name: Save keg cache id: cache-keg-save - uses: actions/cache/save@v4 + uses: actions/cache/save@v5 # We always save the generated artifact even if the whole run # fails due to other issues. This helps debugging build # failure issues faster if the cache doesn't already exist as diff --git a/.github/workflows/macvim-buildtest.yaml b/.github/workflows/macvim-buildtest.yaml index 0a421be5ed..d45cd251dc 100644 --- a/.github/workflows/macvim-buildtest.yaml +++ b/.github/workflows/macvim-buildtest.yaml @@ -435,7 +435,7 @@ jobs: # and add pictures to make them look nice. - name: Upload MacVim image if: inputs.publish && (startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/master') - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: MacVim${{ inputs.publish_postfix }}.dmg path: src/MacVim/build/Release/MacVim${{ inputs.publish_postfix }}.dmg From 091e120ada5e19b60969181dda09377d0a73abc2 Mon Sep 17 00:00:00 2001 From: Yee Cheng Chin Date: Tue, 7 Apr 2026 19:24:01 -0700 Subject: [PATCH 2/3] ci: Don't use GNU iconv for legacy builds We are only using GNU iconv instead of native one because in newer macOS versions the system iconv is buggy. This isn't an issue for older macOS versions. Building with GNU iconv makes the build chain more complicated for self-hosted VMs and it also increases binary size so we don't want to do this unless it's necessary. --- .github/workflows/macvim-buildtest.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/macvim-buildtest.yaml b/.github/workflows/macvim-buildtest.yaml index d45cd251dc..26f62ae81c 100644 --- a/.github/workflows/macvim-buildtest.yaml +++ b/.github/workflows/macvim-buildtest.yaml @@ -89,10 +89,10 @@ jobs: xcode-select -p xcodebuild -version - # Set up, install, and cache GNU libiconv library to work around Apple iconv issues. + # Set up, install, and cache GNU libiconv library to work around Apple iconv issues in newer macOS versions. - name: Set up libiconv - if: inputs.publish + if: inputs.publish && !inputs.legacy uses: ./.github/actions/universal-package with: formula: libiconv @@ -106,7 +106,7 @@ jobs: with: formula: gettext contents: lib/libintl.a,lib/libintl.dylib - gnuiconv: true # gettext needs to match MacVim in using the same version of iconv + gnuiconv: ${{ inputs.legacy == false }} # gettext needs to match MacVim in using the same version of iconv # Set up, install, and cache libsodium library for encryption. @@ -232,7 +232,7 @@ jobs: sed -i.bak -f ci/config.mk.optimized.sed src/auto/config.mk fi - if ${{ inputs.publish == true }}; then + if ${{ inputs.publish == true && inputs.legacy == false }}; then # Use Homebrew GNU libiconv since Apple iconv has been broken since macOS 14 sed -i.bak -f ci/config.mk.brew-libiconv.sed src/auto/config.mk fi @@ -286,7 +286,7 @@ jobs: echo 'Found external dynamic linkage!'; false fi - if ${{ inputs.publish == true }}; then + if ${{ inputs.publish == true && inputs.legacy == false }}; then # Make sure we are not using system iconv, which has been buggy since macOS 14. if otool -L ${VIM_BIN} | grep '^\s*/usr/lib/libiconv'; then echo 'Using system iconv! We should be linking against GNU iconv instead.'; false From b0e4e533e7fb8ca3daef0d9c06e7ed11c147ad9f Mon Sep 17 00:00:00 2001 From: Yee Cheng Chin Date: Tue, 7 Apr 2026 22:28:52 -0700 Subject: [PATCH 3/3] MacVim r183 Note that release notes are now written in a separate file under the new release-notes folder. This helps keep commit messages brief and makes it easier to inspect old release notes. --- src/MacVim/Info.plist | 2 +- src/MacVim/release-notes/r183.md | 45 ++++++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 src/MacVim/release-notes/r183.md diff --git a/src/MacVim/Info.plist b/src/MacVim/Info.plist index 50a6cd916d..5f5ed71ee2 100644 --- a/src/MacVim/Info.plist +++ b/src/MacVim/Info.plist @@ -1255,7 +1255,7 @@ CFBundleVersion - 182.1 + 183 LSApplicationCategoryType public.app-category.productivity NSAppTransportSecurity diff --git a/src/MacVim/release-notes/r183.md b/src/MacVim/release-notes/r183.md new file mode 100644 index 0000000000..cc7661f4ee --- /dev/null +++ b/src/MacVim/release-notes/r183.md @@ -0,0 +1,45 @@ +Updated to Vim 9.2.0321 + +Vim 9.2 was released in February 2026! See [announcement](https://www.vim.org/vim-9.2-released.php). This update syncs up to Vim 9.2, which also contains important security fixes. + +This release note does not come with the normal "New Vim Features" section. The next MacVim release will cover both releases to highlight new Vim features. + +Security Fixes +==================== + +There were numerous security fixes in Vim itself between the last release (9.1.1887) and 9.2.0321. Below are some some high severity ones that were fixed in the latest release: + +* [CVE-2025-66476](https://github.com/vim/vim/security/advisories/GHSA-g77q-xrww-p834) +* [CVE-2026-34714](https://github.com/vim/vim/security/advisories/GHSA-2gmj-rpqf-pxvh) +* [CVE-2026-34982](https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9) + +General +==================== + +- Sparkle (updater for MacVim) is now updated to 2.9.1. The updater will now also verify that the update feed is cryptographically signed. #1637 #1638 +- Binary release is now built using GNU iconv instead of the system built-in iconv. This slightly increases binary size, but makes MacVim work more consistently when dealing with non-Unicode files (e.g. JIS). #1626 + +Fixes +==================== + +- What's New page will no longer leave behind unnecessary persistent files in ~/Library #1619 + +Scripting +==================== + +- Scripting languages versions: + - Ruby is now built against 4.0, up from 3.4. + - Lua is now built against 5.5, up from 5.4. + +Compatibility +==================== + +Requires macOS 10.9 or above. (10.9 - 10.12 requires downloading a separate legacy build) + +Script interfaces have compatibility with these versions: + +- Lua 5.5 +- Perl 5.34 +- Python2 2.7 +- Python3 3.9 or above +- Ruby 4.0