Problem: runtime(tar): missing path traversal checks in tar#Extract()
Solution: Add check for leading slash, however gnu tar should already
detect this (q1uf3ng)
tar#Extract() did not check for ../ sequences or absolute paths,
unlike zip#Extract() which was patched in recent commits. Add the
same checks: ../ (relative traversal), leading slash (Unix), drive
letter and UNC/leading slash (Windows).
closes: vim/vim#19981490b737f3e
Co-authored-by: q1uf3ng <q1uf3ng@protone.me>
zip#Write(): the Windows path check did not match a single leading
slash (/path), which resolves to the current drive root on Windows.
Simplify the regex to match any leading slash or backslash.
zip#Extract(): add absolute path checks for both Unix and Windows,
matching the existing checks in zip#Write().
closes: vim/vim#19976351a16c88f
Co-authored-by: q1uf3ng <q1uf3ng@protone.me>
Problem:
The window opened by `vim.lsp.util.open_floating_preview()`
allows its buffer to be switched. Presumably that only happens
by accident and is disorienting.
Solution:
Set 'winfixbuf' in the open_floating_preview() window.
continues d0af4cd909.
This commit renames positional parameters. This is only "cosmetic", but
is intended to make it extra clear which name is preferred, since people
often copy existing code despite the guidelines in `:help dev-naming`.
Problem:
To support `collapsedText`, which allows the LSP server to determine the
content of the foldtext, we provided `vim.lsp.foldtext()`. However, such
content does not have highlighting.
Solution
Treat the filetype of `collapsedText` as the filetype of the corresponding
buffer and use tree-sitter to highlight it.
In 3a4a66017b, 4d3a67cd62, df8d98173c we renamed "buffer" to "buf"
in dict parameters and return-values.
This commit renames positional parameters. This is only "cosmetic", but
is intended to make it extra clear which name is preferred, since people
often copy existing code despite the guidelines in `:help dev-naming`.
Extract the diagnostic implementation from
runtime/lua/vim/diagnostic.lua into focused internal modules covering
config, display, float rendering, jump/list helpers, namespace and
storage management, severity/shared utilities, and statusline support.
Move the builtin handlers into runtime/lua/vim/diagnostic/handlers/ and
keep runtime/lua/vim/diagnostic.lua as the public facade that lazily
dispatches to the split modules. This preserves the external
vim.diagnostic API while making the implementation easier to navigate
and reason about.
AI-assisted: Codex
Replace the busted-based Lua test runner with a repo-local harness.
The new harness runs spec files directly under `nvim -ll`, ships its own
reporter and lightweight `luassert` shim, and keeps the helper/preload
flow used by the functional and unit test suites.
Keep the file boundary model shallow and busted-like by restoring `_G`,
`package.loaded`, `package.preload`, `arg`, and the process environment
between files, without carrying extra reset APIs or custom assertion
machinery.
Update the build and test entrypoints to use the new runner, add
black-box coverage for the harness itself, and drop the bundled
busted/luacheck dependency path.
AI-assisted: Codex
Problem: Wrong cursor position when entering command line window
Solution: Add check_cursor() command to verify the cursor position
(Hirohito Higashi).
When opening the command-line window with CTRL-F after typing a command
that fills the screen width, the cursor was placed past the end of the
line. Add check_cursor() after setting State to MODE_NORMAL so the
cursor is adjusted to the last character.
Also fix the cmdwin prefix character (e.g. ':') being drawn on wrapped
continuation rows. Draw an empty space instead so that the text
alignment is preserved.
closes: vim/vim#19964c4fe1e958a
Cherry-pick Test_wildmenu_pum() changes from patch 9.1.1995.
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Problem: potential buffer underrun when settings statusline like option
(q1uf3ng)
Solution: Validate that p > out before accessing p[-1]
closes: vim/vim#1996191b402f575
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: tests: test_clientserver may fail on slower systems
Solution: Wait for argc() before checking argv() (James McCoy).
On slower systems, the argv() check may run before the server has
populated the arg list.
Add a wait for argc() to be 3 to be more tolerant of such systems
closes: vim/vim#199749d95410aa4
Co-authored-by: James McCoy <jamessan@jamessan.com>
Problem: tests: test_excmd.vim leaves swapfiles behind
Solution: Close open buffer using :bw!
related: vim/vim#19975c922202ea2
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: Wrong autoformatting with 'autocomplete'.
Solution: Don't trigger autoformatting when ending autocompletion
without selecting an item (zeertzjq).
fixes: vim/vim#19954closes: vim/vim#19970efbd482116
Problem:
`gf` and `<cfile>` treat `file:/absolute/path` as a literal path and
open `file:/...` instead of the local file.
Solution:
Strip the local `file:` prefix before path resolution in the hyperlink
path code.
Problem: The cursor shape is changed to indicate when it is behind an
unfocused floating window (since a2b92a5e). This behavior
cannot be controlled by a floating window that doesn't want
to dim the cursor.
Solution: Assign a zindex-offset of 50 to the zindex of the current
window. To not dim the cursor when creating a floating window
on top of the current window one can assign the zindex
accordingly.
Problem:
clang-analyzer-security.PointerSub reports "Subtraction of two pointers
that do not point into the same array is undefined behavior" in the
HIKEY2SFT macro. Computing the offset of a flexible array member by
subtracting pointers from a dummy static object, is technically UB.
Solution:
Use standard `offsetof()` instead.
Co-Authored-By: Claude
Problem: clang 21 added core.FixedAddressDereference, which reports
"dereference of a fixed address (loaded from variable 'r')" in regexp.c
after xmalloc(). The analyzer doesn't model xmalloc as always returning
a valid heap pointer (it aborts on failure), so it constructs impossible
paths.
Solution: Suppress globally in the clang-analyzer cmake target.
Co-Authored-By: Claude
Problem:
clang 21 promoted alpha.security.ArrayBoundV2 to security.ArrayBound
(stable). This new check reports false-positive "out of bound access"
errors in drawline.c and vimscript.c, where the analyzer constructs
impossible paths (e.g. concealed line with draw_text=false yet ptr
advanced past the NUL terminator, or root AST node with a "next"
sibling).
Per-line NOLINT suppression doesn't work because the analyzer finds
multiple paths to the same false positive.
Solution:
Disable clang-analyzer-security.ArrayBound globally in the
clang-analyzer cmake target until the check matures.
Co-Authored-By: Claude
Problem:
On Windows, when installing nightly build via winget, often
encounter "Installer hash does not match".
Solution:
use `Invoke-WebRequest` to download the msi package, then install
it via `msiexec`.
Problem: using `vim.fs.rm(dir_path, { force = true, recursive = true })`
can result in an error on Windows if the process has a handle to it.
Solution: Use `n.rmdir()` helper in cases when its possible side effects
(like changing working directory) does not matter.
Problem: Attempting to emit cmdline_block event with NULL cmdbuff after
<C-\><C-N> in Ex-mode.
Solution: Don't emit cmdline_block event when cmdbuff is NULL.
Problem:
- Not obvious which _meta/ are generated and which should be edited
manually.
- The require guard (`error('Cannot require a meta file')`) is not
consistently present in all meta files.
Solution:
- Update headers.
- Add require() guard to all meta files.
- Rename generated meta files with `.gen.lua`.
Problem:
- Lots of redundant text in options docs for "not allowed in
a modeline", even though we already have a flag that indicates that.
- `deny_in_modelines` is an old vestigial flag only used by 'encoding'
(which never changes).
Solution:
- Generate docs based on the `secure` flag.
- Remove the `deny_in_modelines` flag (`kOptFlagNoML`).
Problem: compl_preselect_match is set even when completeopt doesn't
include preselect.
Solution: Check kOptCotFlagPreselect in ins_compl_add before setting
compl_preselect_match.
Problem: MS-Windows: executable not found when running individual test.
Solution: Also look for vimd.exe. (Christopher Plewright, closesvim/vim#11525)
d55bfcaa9b
Co-authored-by: Christopher Plewright <chris@createng.com>
Problem: MS-Windows: starting a python server for test sometimes fails.
Solution: Increase the waiting time for the port.
a906e8e1ab
Co-authored-by: Bram Moolenaar <Bram@vim.org>
Problem: nfa_regmatch() allocates and frees two list buffers on every
call, causing unnecessary memory allocation overhead for
frequently used patterns.
Solution: Cache the list buffers in the regprog struct and reuse them
on subsequent top-level calls. Recursive calls still allocate
their own buffers. Free cached buffers in nfa_regfree()
(Yasuhiro Matsumoto).
Benchmark: 10K lines, `:%s` x50 iterations
| Pattern | Before | After | Improvement |
|---|---|---|---|
| `\<\(\w\+\%(ing\|tion\|ed\|ly\)\|\w\{3,}\)\>` (many matches) | 4.384s | 4.299s | -2% |
| `\(foo\|bar\|baz\)\{3,}\(qux\|quux\|corge\)\{2,}...` (no match, high nstate) | 16.927s | 3.015s | -82% |
closes: vim/vim#19956105d65e29b
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Problem:
The retry on Windows doesn't seem to actually work, as the test still
occasionally fails on Windows. Meanwhile the test can fail on Linux as
well:
FAILED test/functional/terminal/channel_spec.lua @ 123: chansend sends lines to terminal channel in proper order
test/functional/terminal/channel_spec.lua:131: retry() attempts: 1
test/functional/terminal/channel_spec.lua:134: Failed to match any screen lines.
Expected (anywhere): "echo "hello".*echo "world""
Actual:
|^ech$ o "hello" |
|echo "world" |
|hello |
|$ world |
|$ |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
|term://~/work/neovim/neovim/build/Xtest_xdg_terminal//32516:sh [-] |
| |
Solution:
Use a wait before the chansend() instead.
Problem:
Neovim's Node.js provider does not support the Bun package manager.
PR #26829 attempted to add this but used a hardcoded path and was abandoned.
Solution:
- Use `bun pm bin -g` to dynamically locate the global binary directory.
- Update `health.lua` to recognize bun installations.
