Release of PCRE2 10.48

[Nicholas Wilson]

Hello everyone!

I am happy to announce the release of 10.48.

This is a regular release, incorporating security fixes along with small improvements and fixes to library behaviour.

https://github.com/PCRE2Project/pcre2/releases

Please see the NEWS and ChangeLog files for further details:

https://github.com/PCRE2Project/pcre2/blob/pcre2-10.48/NEWS
https://github.com/PCRE2Project/pcre2/blob/pcre2-10.48/ChangeLog

This release is available as before as a (signed) Git tag, or alternatively as a (signed) tarball of the Git tag.


=== NEW: BACKPORTS ===

As well as the tarball and Git tag for this release, there are detailed instructions for backporting security and correctness fixes, for the last five years of releases.

Especially as this release contains some security fixes, I would encourage distributors to upgrade to 10.48, or, to make use of the provided security backports.

My suggestion is that you should make use of the commits from the old release branches, which have conflict resolutions pre-applied. However, you are welcome to take the commits from 10.48 and backport them yourselves.

If you have a Git-driven workflow, you can merge the release branch, which contains the backports as additional commits on top of the original release tag.

For example, if you distribute PCRE2 10.47, fetch and merge "release/pcre2-10.47" to obtain the backported fixes.

If you have a tarball-based workflow, I suggest you use git format-patch to extract those commits and apply them on top of the tarball.


As always, please do let me know of any issues, or suggestions.

All the best,
Nick Wilson

[Matthew Vernon]

Hi,

Thanks for the 10.48 release :)

The release Assets are all called 10.48-RC1 (rather than just 10.48); I
don't know if that's possible to fix now or if that'll mess things up.

Regards,

Matthew

[Matthew Vernon]

Hi,

> https://github.com/PCRE2Project/pcre2/releases

Sorry, my previous message was incorrect - the problem is that the
Release Assets for this release are in fact still the 10.48-RC1 assets
again.

e.g. in both cases the .tar.gz file is
sha256:1a3fdd9cbfe91bc59a8c3cfff1e0ea194d1a14ddc05f3f1758e1f99a72e5cc73

Regards,

Matthew

[Nicholas Wilson]

Dear all,

I have fixed it now.

I did indeed upload the incorrect files. What a mess!

Nick