Give data version the new format <major>.<minor>, so that
the version can be incremented with the introduction of new
features without bumping the major version.
Add support for loading instrumentation JSON queries of unknown
data versions without error.
Issue: #27833
The instrumentation docs were unclear about the difference between API
and Data version, with the hierarchy of the table of contents being
particularly misleading.
Rework `cmake-instrumentation` manual and `cmake_instrumentation` command
documentation to be more clear.
- Change default CPS install path on Windows from `cps` to `cps/<name>`,
per community recommendation that only paths containing the package name
should be considered as "officially" supported search locations (see
https://github.com/cps-org/cps/issues/79#issuecomment-2831102822).
- Change `export` to write to a subdirectory that allows the build
tree to be used as a search root.
- Change SBOM destinations to be consistent with the preceding.
Issue: #27785
Also, correct the documentation added in commit 98f9874703 (cmake:
Add per-language link flags for all target types, 2025-12-17) by
placing the variables in the proper section of cmake-variables(7).
Issue: #21934
In commit 51f39a0f32 (Help: Fix install(SBOM) argument typo, 2026-02-27,
v4.3.0-rc2~8^2) the typo was fixed in the wrong signature. Revert that
and fix the correct signature.
Try to be a bit more consistent about:
- Placing angle brackets around text which serves as a placeholder
rather than being literal.
- Using curly brackets rather than angle brackets to denote groups where
one of the options is required.
- Describing optional list arguments like `<x>...` rather than
`[<x>...]`. (Instances of lists not associated with keywords are
intentionally left as-is, however.)
Also, teach our CMake lexer to understand curly braces used as above
(prior uses were only in parsed literals without syntax highlighting),
and to highlight them (and remaining uses of angle braces) as the type
Punctuation rather than the type Operator, for consistency with square
braces.
Add explicit cross-references for commands which optionally take an
output variable (otherwise modifying their input in-place) for clarity.
Note that `cmake_path` should not be used to modify variables reserved
by CMake.
Improve references to the "CMake-style" semicolon-separated lists, and
apply those corresponding changes to the `file` command page.
Remove basic CPS import and export from 'experimental' status. Update
documentation and tests accordingly.
Note that mapped exports (CMAKE_EXPERIMENTAL_MAPPED_PACKAGE_INFO) are
still experimental.
Previously, `CMAKE_<LANG>_LINK_FLAGS` was an undocumented variable used
for linking executables only. Re-spell that variable mirroring the
existing spellings for shared and module libraries, and add policy
CMP0210 to preserve compatibility.
Then, repurpose `CMAKE_<LANG>_LINK_FLAGS` to provide a variable to be
used for per-language link flags for all target types, along with a
per-configuration variant. These are added to the `<LINK_FLAGS>` rule
placeholder in the generators.
Fixes: #21934
Relates: #25620
Co-authored-by: Brad King <brad.king@kitware.com>
Add security flags to libarchive extraction to prevent path traversal
(Zip Slip) and absolute path attacks:
- ARCHIVE_EXTRACT_SECURE_NODOTDOT: Block ".." path components
- ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS: Block absolute paths
- ARCHIVE_EXTRACT_SECURE_SYMLINKS: Block symlinks escaping extract dir
This hardens both `cmake -E tar` and `file(ARCHIVE_EXTRACT)` against
malicious archives that attempt to write files outside the intended
extraction directory.
Martin Duffy
Brad King
Matthew Woehlke
Tyler Yankee
AJIOB
Peter Kokot
Nuno Nobre
Tom Osika
Christoph Grüninger
Vito Gamberini
Marc Chevrier
Leslie P. Polzer