* src/printf.c (STRTOX): Add a call to quote when printing the ignored
characters.
* tests/printf/printf.sh: Adjust an existing test case. Add another
quoting test case.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-I9I24ON7.
* src/nl.c (check_section): Add a check for a zero section delimiter
length.
* tests/nl/nl.sh: Add a test case.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-PDYYNTYZ.
* src/cksum (valid_digits): Use '=' to disambiguate hex and base64.
(split_3): Likewise.
(digest_check): Likewise.
* tests/cksum/cksum-base64-untagged.sh: Add a test case.
* NEWS: Mention the fix.
* src/cksum.c (digest_check): Reset the detection flag per file.
* tests/cksum/cksum-c.sh: Add a test case.
* tests/cksum/md5sum-bsd.sh: Likwise.
* NEWS: Mention the fix.
It's not a usual case, but for consistency "-a sha2" should support
e.g. untagged checksums that are a mix of sha256sum and sha512sum.
* src/cksum.c (split_3): Reset the sha2 variant search if
the generic sha2 is specified. It's ok to reset the global
CKSUM_ALGORITHM as its subsequent use is conflicting with
the specific chosen variant.
* tests/cksum/cksum-c.sh: Add test cases.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-83HIODH2.
Discovered by SecBuddyF (with Hy4-preview) of Tencent KeenSecurityLab.
These signals are used by timeout(1) itself, so need special handling.
Since commit v8.13-11-g80a1aca0d we incorrectly ignored them,
which was exacerbated by commit v8.26-39-g2f69dba5d which caused
the -sCHLD case to hang upon child exit.
* src/timeout.c (send_sig): Don't ignore SIGHLD, and discard
the self sent SIGALRM, and rearm the handler.
* tests/timeout/timeout.sh: Add test cases.
* NEWS: Mention the fixes.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-2EQL2L05.
* NEWS: Adjust to mention that -k without -f is resilient to blocking.
* src/timeout.c (cleanup): Unblock SIGALRM when diagnosing, so
an armed --kill-after is honored.
* tests/timeout/timeout.sh: Add a test case.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-GV4Z4T3T.
In the edge case where --verbose diagnostics might block
or induce signals, ensure we always timeout the monitored command
and do not loop diagnosing diagnostic induced signals.
* NEWS: Mention the bug fix.
* src/timeout.c (cleanup): Avoid diagnosing SIGPIPE and SIGXFSZ.
Also send the signal before diagnosing to ensure command is timed out.
* tests/env/env-signal-handler.sh: Run timeout(1) with -f to ensure
the SIGKILL is diagnosed.
* tests/timeout/timeout.sh: Likewise. Also add test cases for
SIGPIPE and SIGXFSZ.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-GV4Z4T3T.
* README: List the corresponding email address on the first
line of each sections.
Note README is shown on the github project front page.
* .github/ISSUE_TEMPLATE.txt: Adjust similarly.
* .github/PULL_REQUEST_TEMPLATE.txt: Likewise.
* src/od.c (format_address_std): Add an affirm call to check that the
address is positive or equal to zero, which would have caused a
descriptive assertion in this case instead of a SIGSEGV.
(offset_add): New function.
(dump): Use it to diagnose overflows.
(dump_strings): Likewise.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-EZXPB4TK.
* src/cp.c (make_dir_parents_private): Quote the names of the directory
and the source.
* tests/cp/verbose-parents-quote.sh: New file
* tests/local.mk (all_tests): Add the new test.
* NEWS: Mention the bug.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-JJG3V3T9.
* src/chown-core.c (change_file_owner): Set the pointer to NULL if
fstatat fails.
* tests/chgrp/verbose-dangling-symlink.sh: New file.
* tests/chown/verbose-dangling-symlink.sh: New file.
* tests/local.mk (all_tests): Add the new tests.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-YYGC42VE.
* src/selinux.c (restorecon_private): Open the file with O_NOCTTY and
O_NONBLOCK.
* tests/misc/selinux.sh: Add a test case.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-L5GJ7M7X.
This adds a test for the bug fixed by commit 9192fd32e (date: bring back
-u complexity with putenv, 2026-10-22).
* tests/date/date-set.sh: New file.
* tests/local.mk (all_tests): Add the new test.
* NEWS: Mention the bug fix.
splice_cat can leave open file descriptors around. This breaks the
valgrind testsuite with --track-fds=yes. This is fairly innocent, like
still reachable memory, but does need a new suppression when tracking
file descriptor handling. Introduce a new splice_cat_close function
that can be used on error from splice_cat and before exiting main.
* src/cat.c (splice_cat): Move static pipefd and pipefd_pipe_size to
file level, guarded by HAVE_SPLICE. Move pipefd close and cleanup from
error handler to...
(splice_cat_close): New function. Empty if we don't HAVE_SPLICE.
(main): Call splice_cat_close before exit.
* tests/cp/link-no-deref.sh: Use printf rather than echo, as echo
unconditionally interprets backslashes in dash. Also use %q in
printf to decouple from the shell escaping implementation.
Also refactor strace usage to its own function, and avoid
a false failure in case strace didn't intercept the chown.
* src/copy.c (copy_internal): Add a missing quoteaf call.
* tests/cp/link-no-deref.sh: Invoke getlimits_ and uses_strace_. Inject
an error using 'strace' to verify the name of the destination is quoted
in the error message.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-3M3N6L8K.
* doc/coreutils.texi (dircolors invocation): Use an absolute path when
checking whether a user's .dircolors file exists in $HOME and when
loading it. Don't define a variable.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-HB2T3LWR.
* src/factor.c (mulredc2): Add the carry to p1, which is the high word
of a two-word integer created by summing two single-word integers and is
therefore unable to overflow, instead of using a low word r0, which may
wrap around by adding the carry.
* tests/factor/mulredc2-infloop.sh: New file.
* tests/local.mk (all_tests): Add the new test.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-CFUR0JKW.
Before:
$ cksum --length -1 -a sha2 /dev/null
cksum: invalid length: ‘-1’: Value too large for defined data type
After:
$ cksum --length -1 -a sha2 /dev/null
cksum: invalid length: ‘-1’
cksum: digest length for ‘SHA2’ must be 224, 256, 384, or 512
* src/cksum.c: Avoid EOVERFLOW for negative numbers
(similarly to commit v9.5-71-gf2c84fe63).
Link: https://github.com/coreutils/coreutils/issues/386
* src/tail.c (tail_forever_inotify): Fallback to polling upon overlow.
* tests/tail/inotify-overflow.sh: Add a new test.
* tests/local.mk: Reference the new test.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-UUNT73BK.
This reverts my commit b64f9bfe4f
dated 2026-04-02. I forgot that posixtime cares whether
-u has been specified, and gets that info via TZ.
It also uses xsetenv rather than the old putenv.
This fixes ANT-2026-LR8TONF4.
* configure.ac (LOCALTIME_CACHE): Bring this back.
* src/date.c (TZSET): Bring this back.
(main): Bring back setting TZ="UTC0" in the environment.
However, use xsetenv rather than putenv, as that’s simpler.
* src/basenc.c (base32hex_decode_ctx_wrapper): Ensure we don't
accept base32 only characters for base32hex.
* tests/basenc/basenc.pl: Ensure negative base32hex tests have the
appropriate number of characters to test character validation
rather than just input size validation.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-EP1XO2G4.
* src/factor.c (strtouuint): Return LONGINT_OVERFLOW only if all of the
characters are digits; otherwise, return LONGINT_INVALID.
* tests/factor/factor.pl: Add two test cases.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-IZ8PFQ7Q.
stty currently fails like:
$ stty 9600
$ saved=$(stty -g)
$ stty 19200 "$saved" # Sets 9600 but reports failure
stty: 'standard input': unable to perform all requested operations
Whereas these work fine:
$ stty 19200 9600
$ stty "$saved" 19200
* NEWS: Mention the bug fix.
* src/speedgen (cbaud_to_speed): Determine the speed
from the control flag encoding.
* src/stty.c (recover_mode): If no separate speed specified,
update the speed from the specified control flags.
* tests/stty/stty-save-speed.sh: Add test cases.
Collin Funk