Addresses the "multiple @ param documentation sections" warnings are caused by the interaction of three things:
1. MACRO_EXPANSION = YES with EXPAND_ONLY_PREDEF = NO in Doxyfile.in
2. Versioned API macros in H5version.h like:
\def documentation in APIVersions.dox like:
3. \def H5Tarray_create \api_vers_2{H5Tarray_create,H5Tarray_create1,H5Tarray_create2}
Because Doxygen expands all macros, it sees H5Tarray_create as an alias for H5Tarray_create1. It then associates documentation from both the \def block (for the macro) and the function's own doc block (with \param entries) with the same function — resulting in "multiple @ param documentation sections."
* Update Doxygen version from 1.16.0 to 1.16.1
Use Doxygen 1.16.1 for all platforms. This version includes the latest
bug fixes and improvements while maintaining compatibility with our
documentation format.
* Fix Windows Doxygen installation for version 1.16.1
Handle different Windows binary naming conventions across Doxygen versions:
- 1.16.1 uses: doxygen-VERSION.windows.x64.bin.zip
- 1.16.0 uses: doxygen-VERSION.x64.bin.zip
Try the newer naming convention first, then fall back to the older one
if the download fails. This ensures compatibility across versions.
* Use ssciwr/doxygen-install in setup-doxygen action
Replace direct installation of official Doxygen binaries with
ssciwr/doxygen-install action. This avoids Java documentation parsing
errors that occur with official binaries but not with distribution
builds.
The setup-doxygen action now serves as a thin wrapper around
ssciwr/doxygen-install@f13be16c83 (v1),
using commit hash for security and reproducibility.
* Remove redundant version specification from workflows
The setup-doxygen action already has a default version (1.16.1),
so explicit version specification in workflows is unnecessary.
This follows DRY principles and makes version updates simpler.
* Advance version to 2.1.1 after creating release branch for 2.1.0
release.
* Update develop branch version to 2.2.0
Clean 2.1.0 entries from CHANGELOG.md
* Add notice for removing alternate release tag to CHANGELOG.md.
Fix typo.
* Fix typo
* Reorder AGE and REVISION for consistent order for all libraries.
* Temporarily remove develop branch restrictions from workflows.
* Revert "Temporarily remove develop branch restrictions from workflows."
This reverts commit abc7039fc5.
When building Fortran parallel examples without MPI wrappers, the
compiler couldn't find mpi.mod because MPI_Fortran_INCLUDE_DIRS
was not populated. This occurred because find_package(MPI) was only
called for C, not Fortran.
Added enable_language(Fortran) and find_package(MPI REQUIRED
COMPONENTS Fortran) to properly configure MPI for Fortran examples,
ensuring MPI include directories and libraries are correctly set.
User report:
When a file is corrupted such that an array datatype's size, the number of elements,
and the element size are not in agreement, it can trigger an out of bounds read.
(private GH issue: GHSA-gh44-7wpq-622f)
Added a validation to ensure the above are in agreement.
Ubuntu Clang tests had problems when using KyleMayes/install-llvm-action to install Clang 18.1 on Ubuntu 24.04, because the Clang that it installed needed libtinfo5 not present in the Ubuntu 24.04 image. However, Clang 18.1.3 is part of the Ubuntu 24.04 image and is used when CMAKE_C_COMPILER and CMAKE_CXX_COMPILER are set to "clang" and "clang++".
Update CI workflows to use symbolic links instead of copying files to re-enable GitHub daily tests.
Workflows:
Update analysis.yml, cygwin.yml, and par-script.yml to use symbolic links instead of copying CTestScript.cmake and HDF5config.cmake.
Update par-source.yml and script.yml similarly to use symbolic links for the same files.
Commands:
Replace cp with ln -s in Linux workflows.
Replace Copy-Item with New-Item -ItemType SymbolicLink in Windows workflows.
Purpose:
Re-enable GitHub daily tests: linked HDF5config.cmake allows CMake to find the HDF5VersionParsing.cmake file to get the HDF5 version.
Also updated runs-on: ubuntu-22.04 to ubuntu-latest.
Fixes security issue by treating non-NULL buffer with size 0 as length-only query in get_name API functions.
Behavior:
Modify get_name API functions to treat (buffer != NULL, size == 0) as length-only queries, preventing undefined behavior.
Fix applied to H5Aget_name, H5Aget_name_by_idx, H5Fget_name, H5Gget_objname_by_idx, H5Iget_name, H5Lget_name_by_idx, H5Rget_file_name, H5Rget_obj_name, H5Rget_attr_name, and 8 other functions.
Tests:
Update test/links.c, test/tattr.c, test/tfile.c, test/titerate.c, and test/trefer.c to verify new behavior with non-null buffer and size 0.
Documentation:
Update comments in H5A.c, H5F.c, H5Gdeprec.c, H5I.c, H5L.c, H5R.c, and H5Rdeprec.c to reflect new behavior.t]@users.noreply.github.com>
Scope Safety: Refactored parse_hdf5_version from a Macro to a Function to prevent variable namespace pollution.
Implemented a helper macro (_parse_version_component) to handle repetitive regex logic, significantly reducing code size and complexity.
Updated HDF5config.cmake to calculate paths dynamically using REALPATH relative to CMAKE_CURRENT_LIST_FILE, fixing issues with symlinks and execution context.
Decoupled the parsing logic from scope promotion; the helper now parses to a local variable, and the function explicitly handles the PARENT_SCOPE assignment.
* Replace last link with version directory path on support site.
Links for downloading doxygen.zip files will be to the GitHub HDF5
releases page.
* Update config/README.md.cmake.in
* Enable data sieving for chunks that can't be cached
Fixed an issue that prevented use of a data sieve buffer for I/O on dataset
chunks when those chunks couldn't be cached by the library. This issue
could result in worst-case behavior of I/O on a single data element at a
time when chunks are non-contiguous with respect to memory layout.
Added a test to attempt to catch performance regressions in I/O on dataset
chunks that are non-contiguous with respect to memory layout
Updated the External File List logic to set the data sieve buffer size to
the smaller of the dataset size and the size set in the FAPL, similar to
the logic elsewhere in the library
* Fix Release Progress badges and workflow
- Fix update-progress.py to output blocker/mustdo counts in correct format
The workflow expects blocker_done=, blocker_total=, mustdo_done=, mustdo_total=
output lines but the script was only outputting human-readable format
- Update README badge links to point to project view 24 instead of base project
This fixes the workflow failures where BLOCKER_DONE and the related environment
variables were not being set, causing badge updates to fail.
The badges were pointing to old unmaintained gists under user X.
Updated to use the gist automatically maintained by the Release Progress
workflow (gist ID: 0ad2eabb63b28eb90d69f5e5b2c1496f).
The workflow now successfully updates these badges every 4 hours with
current release blocker and must-do progress.
The script now auto-detects the HDF5 version from src/H5public.h and
filters release blockers/must-do items by milestone matching that version.
Changes:
- Added get_hdf5_version_from_header() to read version from H5public.h
- Updated GraphQL query to fetch milestone information from issues
- Added milestone filtering logic to only count items for the target release
- Made validation more lenient when using milestone filter (allows 0/0)
- Added MILESTONE_FILTER environment variable for manual override
For develop branch with version 2.1.0 in H5public.h, this will now only
count items with milestone containing "2.1" (e.g., "2.1.0", "HDF5 2.1").
* Add version number to badge labels
The badges now display the version (e.g., "2.1 Release Blockers" instead
of just "Release Blockers") when filtering by milestone.
Changes:
- Python script outputs version to GitHub Actions
- Workflow passes version to badge generation script
- Badge script includes version in label if available
- Labels show "X.Y Release Blockers" / "X.Y Release Must Do"
The three badges now track:
1. Release Blockers - Critical issues that must be resolved
2. Release Must Do - Important items for the release
3. Release Nice to Have - Optional improvements for the release
All three badges show version prefix (e.g., "2.1") and support 0/0
display when no items exist for a milestone.
---------
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
- Fix update-progress.py to output blocker/mustdo counts in correct format
The workflow expects blocker_done=, blocker_total=, mustdo_done=, mustdo_total=
output lines but the script was only outputting human-readable format
- Update README badge links to point to project view 24 instead of base project
This fixes the workflow failures where BLOCKER_DONE and related environment
variables were not being set, causing badge updates to fail.
Update version to 2.1 and derive version information from H5public.h, removing h5vers script and updating CMake and Java configurations.
Versioning:
Update version to 2.1 in H5public.h.
Derive version strings in H5public.h using macros.
CMake:
Extract version from H5public.h in HDF5config.cmake and HDF5AsSubdirMacros.cmake.
Configure README.md and CHANGELOG.md using CMakeLists.txt.
Java:
Generate H5Version.java from H5public.h for version consistency.
Update H5.java to use H5Version for version constants.
Removals:
Delete bin/h5vers script, previously used for version management.
Removed code to set JAVA_HOME to a specific directory, which seemed to cause a conflict between the Java version used to compile and the runtime Java version.
It is considered best practice for cmake package configuration files to use "find_dependency" instead of "find_package".
This is because it can propagate flags properly, gives more clear error messages and is able to avoid duplicate dependency include issues.
This change fixes an issue I am seeing in some external cmake projects when including hdf5. As per issue report here https://github.com/HDFGroup/hdf5/issues/6107
* switched from always verbose ctest output to ONLY on test failures
* Windows and macOS builds will skip clang-format check before building documentation
* resolved Doxygen warnings by adding H5G_link_t=H5L_type_t to the DOXYGEN_PREDEFINED list, by adding the macro definition, Doxygen now knows to treat H5G_link_t as H5L_type_
Adds CodeQL workflow for C/C++ analysis with scheduled, manual, and branch-specific triggers, including dependency setup, HDF5 configuration, and SARIF handling.
Adds predefined datatypes for FP6 data in E2M3 and E3M2 formats
Does not add support for any native FP6 types; datatype conversions are performed in software
Setup:
Add JDK 21 setup using actions/setup-java@v5 in arm-main.yml for Windows 11 ARM.
CMake Configuration:
Enable Java build with -DHDF5_BUILD_JAVA=ON in arm-main.yml for Windows 11 ARM.
Fixed#5677
Corrects error return values from 0 to FAIL in H5Z__scaleoffset_decompress_one_byte(), H5Z__scaleoffset_decompress_one_atomic(), and H5Z__scaleoffset_decompress() in H5Zscaleoffset.c
A malformed file can cause the scale-offset filter to have too little input data causing a heap buffer overflow. Additional checks on the maximum buffer length are required during the decompression.
This PR fixes CVE-2025-2308.
A malformed file can trigger bit field type conversions that can (due to missing boundary checks in the conversion step) cause a heap buffer overflow. This PR adds a check on the defined conversion to ensure it does not read beyond the size of a single bit field element. Thus, H5T__bit_copy does not result in a buffer overflow. There are several other calls to H5T__bit_copy which might be subject to a similar issue.
This PR fixes CVE-2025-2309.
Scot Breitenfeld
Gerd Heber
bmribler
Larry Knox
SY Wang
Neil Fortner
H. Joe Lee
jhendersonHDF
Matt L
efferre79
dependabot[bot]
malcolm-vivosa
christian-wojek
William Allen