Time Nick Message 09:05 red-001 CI seems to hang a lot 09:10 red-001 https://stackoverflow.com/questions/66335225/how-to-cancel-previous-runs-in-the-pr-when-you-push-new-commitsupdate-the-curre 09:10 red-001 that with github.sha instead of github.ref could perhaps work? 09:11 red-001 would at least cancel CI actions on PRs when a new commit is pushed, reduce resource usage a bit 09:12 sfan5 if you want to fix something please fix caching the the msvc run 09:18 sfan5 planning to push https://github.com/sfan5/luanti/commit/7045deb6a884d8d1ad75a019ca95810b00ad8927 later 09:18 sfan5 (the random edits are to match the string changes we pushed to weblate last time, since that included an unmerged PR) 09:27 red-001 what's the issue with caching, it seems to be disabled 09:27 sfan5 it used to work in some magic transparent way, no longer does 09:29 red-001 doNotCache is true that I think just impacts vcpkg itself? the documentation for this action is not particularly well written 09:31 sfan5 there's this in the log 09:31 sfan5 > %VCPKG_BINARY_SOURCES%: warning: The 'x-gha' binary caching backend has been removed. Consider using a NuGet-based binary caching provider instead, see extended documentation at https://learn.microsoft.com/vcpkg/users/binarycaching?WT.mc_id=vcpkg_inproduct_cli. 09:32 sfan5 [2026-06-13 22:01:55] fixing the caching in the msvc workflow (broken caching is the reasong it 09:32 sfan5 currently takes 1h) is supposedly not that hard, in case anyone wants to bother: https://x0.at/lP8F.txt 09:32 sfan5 [2026-06-13 22:02:02] (AI output, in case it's not obvious) 09:32 sfan5 ^ might help 09:32 red-001 yeah I saw that as well, vcpkg is very confusing however so not sure if this actually matter or not, but work looking into that angle too 10:32 red-001 Tried setting up a cache manually 10:34 red-001 LLM assisted cause no-one sane is going to write powershell 10:38 red-001 https://github.com/red-001/minetest/actions/runs/32238050297/job/96022319578 10:38 red-001 I guess I should rename the repo 10:38 red-001 wrong action run, https://github.com/red-001/minetest/actions/runs/32242791681/job/96036813862 10:39 red-001 I guess check that in a few hours and see if it cached 11:43 red-001 https://github.com/red-001/minetest/actions/runs/32248824307/job/96055122854 11:43 red-001 sfan5 it seems to work what was the issue with this before that a custom action was used instead of just caching? 11:43 red-001 I can't know what I don't know here 11:48 sfan5 i didn't set this up either 11:54 red-001 https://github.com/luanti-org/luanti/pull/17470/changes 11:55 red-001 seems to be ~10 minutes faster on a first build even, but that might just be jitter (1h 5min vs 1h 15min) 11:56 red-001 cache key is based on the vcpkg manifest thing 12:00 red-001 and obviously it fails on a PR 12:07 red-001 nvm it works just need the right merge target 12:13 red-001 it would be nice to review it quickly since without merging it, the PRs can't pull from a shared cache 12:13 red-001 would probably make github rate limit other CI less 16:00 sfan5 PSA: meeting in 2 hours 16:01 sfan5 by the way I will be busy on friday and the weekend so if we want a release quick it will have to be tomorrow 18:00 Krock Meeting! ping to those who reacted sfan5 @luatic -- Meeting points https://github.com/orgs/luanti-org/discussions/175#discussioncomment-18070550 18:00 MTDiscord henlo 18:00 sfan5 hello 18:01 Krock waiting 2 minutes for others to tune in 18:01 sfan5 ping rubenwardy, nore, @cx384 perhaps 18:02 rubenwardy Hello 18:03 Krock > #16896 18:03 ShadowBot https://github.com/luanti-org/luanti/issues/16896 -- Severe rendering regression when array textures are used 18:03 MTDiscord seeing as there has been no response for a while now, can probably just deprioritize it and hope someone runs the debug branch eventually 18:03 sfan5 personally I'm ready to say "if nobody responds, we can stop carrying the hotfix" 18:04 sfan5 (it would have to be reapplied and is not in master current, to be clear) 18:04 Krock mhm. nobody has reported anything during the test period 18:04 Krock I don't really mind whether the workaround is applied or not 18:04 MTDiscord for something low-risk we should do for this release, maybe throw in a TEST_GL_ERROR(Driver) after the call to GL.TexSubImage3D() 18:05 sfan5 there's one? 18:05 sfan5 nvm, not in upload2DArrayTexture 18:06 sfan5 yeah I agree 18:06 sfan5 you would put it inside the for-loop, right? 18:06 MTDiscord yes 18:07 sfan5 ok let's do that. next. 18:07 sfan5 #17348 18:07 ShadowBot https://github.com/luanti-org/luanti/issues/17348 -- GUIChatConsole: Fix (smooth) scrolling by arrows by SmallJoker 18:08 sfan5 does anyone think it's important for this release? 18:09 MTDiscord it's nice but not necessary 18:10 Krock about the previous: who's doing that? 18:10 Krock about the chat console: remove from milestone for simplicity 18:10 sfan5 (I will push the gl error test thing) 18:11 Krock thanks :) 18:11 sfan5 next is: https://github.com/orgs/luanti-org/discussions/171 18:11 Krock (moved the PR and issue to 5.18.0) 18:11 sfan5 do you want to do the write-protect part too? 18:12 sfan5 my opinion: doesn't hurt 18:12 Krock (switching to staff for a quick question) 18:13 Krock I'd be in favour of that, yes. 18:14 Krock low risk, and better safe than sorry. I can update the diff. 18:14 sfan5 sure, thx 18:15 sfan5 i think we can think about when to push the commit once the release date is clear 18:15 sfan5 next: https://github.com/orgs/luanti-org/discussions/174 18:15 MTDiscord yes we can ignore that 18:15 sfan5 IMO this needs to be postponed to later. there's no clear path to a fix or even clarify if this is a real issue 18:15 sfan5 clarity* 18:16 sfan5 okay next: https://github.com/luanti-org/luanti/security/advisories/GHSA-24fm-82f9-hc6m 18:16 sfan5 I only briefly looked at the patch, didn't test it 18:16 sfan5 but looks like the right approach 18:17 sfan5 and this looks important for this release (unfortunately) 18:17 MTDiscord agreed 18:17 red-001 sorry :/ 18:17 red-001 can't help when it was found 18:17 Krock I strongly believe that discussion 174 issue is real. We do AFAIK not verify these strings. 18:18 MTDiscord it's real but we probably have lots of bugs like it; they aren't really critical and worth postponing a release over. 18:18 Krock makes sense 18:18 Krock about GHSA-... is there a corresponding PR already? I lost track. 18:19 MTDiscord to my knowledge know, only a few patches by red in that advisory 18:19 Krock (yes/no suffices) 18:19 MTDiscord s/know/no 18:19 red-001 https://github.com/user-attachments/files/31123327/0001-CLear-pointer-from-userdata-during-GC.patch no PR but there is a patch 18:19 Krock --> open PR, review, merge. 18:19 red-001 ack 18:19 sfan5 please do that then 18:21 Krock so after that's done, we'll be ready for the merge. hopefully that can be done in the next few days. or are there any other points missing? 18:21 Krock seems like this was the last point on the list 18:21 sfan5 yeah 18:21 sfan5 >decide release date 18:21 sfan5 tomorrow seems doable? 18:21 sfan5 and would fit my schedule as mentioned previously 18:21 MTDiscord i also have time tomorrow 18:22 Krock I'd also be available so, yes. Let's aim for that. 18:22 red-001 https://github.com/luanti-org/luanti/pull/17472 18:23 Krock it's probably best to disclose the relevant fixes ordered, so I will yet only include a placeholder in the changelog 18:23 sfan5 alright 18:23 sfan5 Krock: IMO we can merge the fix for 171 now then 18:23 Krock please give me a few minutes to test this in the wild 18:24 red-001 CLear lol 18:27 red-001 luatic what did you mean by what you suggested the wording should be on GHSA-5cp9-g6f5-xv8p I'm not sure what other memory safety issues got reported and their radius so wrote a generic copy and one more based on the impact concerns raised there 18:32 MTDiscord hmm you're probably right. in total what we have are: the uafs, various mesh loader problems (including uafs and virtually unlimited heap oob writes), and the same for the zip loader. 18:34 MTDiscord probably best to keep your advisory focused on the serverside mod sandbox escape (via the uafs) then. so that would favor the first version. 18:34 MTDiscord the mesh loaders and zip vulnerabilities should get different advisories as they have different attack vectors and their exploitability is not known yet (though somewhat likely) 18:35 red-001 it might be somewhat harder, without discussing it too much here I tried to make the case for why I think the server sandbox bug is a particularly bad class for this 18:36 MTDiscord yes and i agree with that 18:36 MTDiscord so let's just go with the first version and nevermind my comment? 18:37 red-001 there's the client UAF in corresponding client subsystem that has a me worried about understating it 18:37 red-001 but I think attacking that would still be 1 or 2 classes of difficulty up 18:42 red-001 oh nvm your comment was still helpful it seems I already revised that draft (even version 1) to not make a client safety claim 18:43 red-001 https://github.com/luanti-org/luanti/security/advisories/GHSA-5cp9-g6f5-xv8p that's ready to move to draft 18:44 red-001 if everyone is happy to have a GHSA for that issue 18:44 red-001 https://github.com/luanti-org/luanti/security/advisories/GHSA-24fm-82f9-hc6m I think can be closed, the fix for that can be added to the patch list for https://github.com/luanti-org/luanti/security/advisories/GHSA-5cp9-g6f5-xv8p 18:46 red-001 https://github.com/luanti-org/luanti/security/advisories/GHSA-5373-9cjp-qfmg title says singleplayer, technically this is SP or host server, I edited the copy I hope no-one minds, but I can't think of a better way to describe it in the title that's not awkward 18:49 sfan5 why is it not possible to remove the cvss after the fact 18:49 sfan5 is github stupid 18:49 red-001 it is, but if you touch it even once it will keep resetting 18:50 sfan5 well I edit the Severity, immediately submit the form and it doesn't save 18:50 red-001 which one? 18:50 sfan5 last one you linked 18:50 sfan5 well setting it to low works 18:50 sfan5 but if you then reset it to critical the old cvss value just comes back 18:51 red-001 yes they come back whenever you edit it 18:51 red-001 oh 18:51 red-001 wait did that work? I tried switching CVSS versions 18:52 sfan5 ok I managed to fix it by first scoring it as "low" using cvss and then changing back to critical 18:52 sfan5 if I had to guess the reason is: github still stores the cvss data and will show it *if* it agrees with the manually set score 18:52 red-001 I take it we don't want CVSS scoring on these? 18:53 sfan5 🤷 18:54 red-001 I kinda like CVSS but it's very silly as a concept 18:54 red-001 scale of 1 to 100 is just a lot 18:59 Krock sfan5: tool the liberty to edit your comment (rendering issue + meeting comment) to include the notes 18:59 Krock s/tool/took/ 19:00 sfan5 thx 23:32 MTDiscord #17473 is a 10/10 23:32 ShadowBot https://github.com/luanti-org/luanti/issues/17473 -- Entities duplicate themselves (including guid) in on_activate crash.