File yara-x.changes of Package yara-x
-------------------------------------------------------------------
Thu Nov 20 11:45:32 UTC 2025 - Martin Hauke <mardnh@gmx.de>
- Update to version 1.10.0
* New yr fix warnings command.
* Generate more efficient WASM code for some expressions,
reducing the size of compiled rules.
* Improve the API for traversing the AST in DFS order.
* Raise invariant_expr warning in some for loops that can't be
true (#499).
-------------------------------------------------------------------
Mon Nov 3 12:13:49 UTC 2025 - Martin Hauke <mardnh@gmx.de>
- Update to version 1.9.0
* Add function for scanning files by path to the C and Go APIs.
* Add version number to the Rust API.
* Add osabi field to elf module.
* Avoid verifying patterns when the file size is not in the
range specified in the rule condition.
* Avoid emitting code that invokes search_for_patterns if not
necessary.
* Implement DFS iterator for AST.
* BUGFIX: Check if AddressOfFunctions is zero while parsing
PE files.
-------------------------------------------------------------------
Tue Oct 7 19:14:50 UTC 2025 - Martin Hauke <mardnh@gmx.de>
- Update to version 1.8.1
* BUGFIX: don't mangle the C API function yrx_finalize and
include it in the header files.
* BUGFIX: fix some issues and edge cases in block scanning.
-------------------------------------------------------------------
Mon Oct 6 14:49:06 UTC 2025 - Martin Hauke <mardnh@gmx.de>
- Update to version 1.8.0
* Implement block scanning API for Rust and C.
* Implement Golang and C APIs for setting global variables of
type array and structure.
* Add iterator for Rules object in Python.
* BUGFIX: Inconsistency with legacy YARA in PE certificate
subjects.
-------------------------------------------------------------------
Fri Sep 19 13:37:25 UTC 2025 - Martin Hauke <mardnh@gmx.de>
- Update to version 1.7.1
* BUGFIX: fix compilation in 32-bits platforms (#453).
-------------------------------------------------------------------
Wed Sep 17 17:48:48 UTC 2025 - Martin Hauke <mardnh@gmx.de>
- Update to version 1.7.0
* New warning suggesting the use of none of them instead of 0 of
them.
* Added option --max-matches-per-pattern to the CLI and the
max_matches_per_pattern method to the Python API.
* New yrx_finalize function to the C API that allows dynamically
unloading the YARA-X library.
* Add yrx_compiler_add_include_dir function to the C API.
* Replace the Formatter::ident_spaces method with
Formatter::indentation.
* BUGFIX: Indentation issues in code formatter.
* BUGFIX: Inconsistencies in code formatter with empty lines at
the end of the code.
* BUGFIX: High memory consumption while parsing some PE files.
* BUGFIX: Prevent panic when assertions like \b and \B are used
in Unicode regexps.
-------------------------------------------------------------------
Thu Sep 11 14:50:39 UTC 2025 - Martin Hauke <mardnh@gmx.de>
- Update to version 1.6.0
* Implement --no-mmap option for disabling the use of
memory-mapped files (9ff675f).
* Support relative includes for compatibility with YARA.
* Support metadata validation using regular expressions (#434).
* Added support for global variables of type dict in the
Python API (#433).
* BUGFIX: Detect circular includes and raise an error instead of
panicking (624429f).
* BUGFIX: Issue in hoisting algorithm causing false-positive in
some with statements (f0f5b0a).
* BUGFIX: Multiple issues with Python stub file yara_x.pyi.
- Update to version 1.5.0
* Implement the crx module for parsing Chrome Extension files.
* Allow underscores in integer and float literals.
* Adopt Anomali's symhash algorithm for Mach-O files.
* Support boolean type in console.log() (#406).
* Allow specifying include directories in the C, Go and Python
APIs (45a03c6).
* Improvements while parsing imports and exports in Mach-O files.
* Improve performance for patterns with the xor modifier. The
performance gain can be noticeable for certain rules (0122fa9).
* Return an error with rules that can have arbitrarily long
prefixes (c8bbede).
* BUGFIX: Fix misleading help text in text_as_hex warning.
* BUGFIX: Minor formatting issues in yr fmt command (43fbdc5).
* BUGFIX: Fix panic when a rule contains an invalid regexp and
the rule name is reused (a50f3db).
* BUGFIX: Fix panic with regular expressions that contain too
many alternatives (7ad6d8f).
* BUGFIX: Make some functions in cuckoo module
backward-compatible with YARA (#424).
-------------------------------------------------------------------
Fri Jul 11 16:04:32 UTC 2025 - Martin Hauke <mardnh@gmx.de>
- Update to version 1.4.0
* Allow suppressing warnings using // suppress: warning_id
comments (#398).
* Implement built-in functions float32, float64, float32be and
float64be (#396).
* BUGFIX: fix wrong text_as_hex warning (0baf08b, #397).
* BUGFIX: false positive in wide regular expressions
(5fd5015, #395).
-------------------------------------------------------------------
Sun Jul 6 15:49:45 UTC 2025 - Martin Hauke <mardnh@gmx.de>
- Update to version 1.3.0
* Add span information to Event::Begin and Event::End (f4259f0).
* Add support for private patterns. Private patterns were being
accepted but ignored. (21a9090).
* BUGFIX: add YRX_ prefix to constants in the C API to avoid
name collisions (#382).
* BUGFIX: increase MAX_ATOMS_PER_REGEXP from 8192 to 10000.
- Update to version 1.2.1
* BUGFIX: regression introduced in #368.
* BUGFIX: more robust LNK file parsing than handles maliciously
crafted files (7e1c8b3, #379).
-------------------------------------------------------------------
Wed Jun 18 10:51:30 UTC 2025 - Martin Hauke <mardnh@gmx.de>
- Update to version 1.2.0
* Allow disabling specific warnings via the configuration file.
* BUGFIX: Another JSON encoding issue (1a41075, #376).
* BUGFIX: Return a proper error message when passing invalid
metadata to a module (#368).
- Update to version 1.1.0
* Add the yrx_scanner_set_module_data function to the C API.
* Show warnings when comparing the result of intXX and uintXX
functions with values outside their valid ranges.
* BUGFIX: Less strict schema for Cuckoo reports (#369).
* BUGFIX: CLI reports UTF-8 encoding errors instead of ignoring
them silently (2372d68).
* BUGFIX: Fix issue in the Python API while parsing JSON data.
-------------------------------------------------------------------
Wed Jun 4 15:13:53 UTC 2025 - Martin Hauke <mardnh@gmx.de>
- Update to version 1.0.0
* Raise warning when loops can have too many iterations (#352).
* Raise warning when comparing a string that is known to be
lowercase (like the result of hash.md5) with a string that
contains uppercase characters (150500b).
* Better handling of raw bytes and timestamps when decoding
module outputs from Python.
-------------------------------------------------------------------
Wed May 21 19:41:05 UTC 2025 - Martin Hauke <mardnh@gmx.de>
- Update to version 0.15.0
* Implement include statements.
* Add module invoke support to Python API.
* BUGFIX: Parsing aborted when too many rules had the global or
private modifiers.
- Update to version 0.14.0
* Parse LC_DYLD_EXPORTS_TRIE in Mach-O files.
* Parse chained fixup imports via LC_DYLD_CHAINED_FIXUPS in
Mach-O files.
* Implement tag linter.
* Implement regex anchors ^ and $ in multi-line mode.
* Add support for 32-bits targets.
* Improve performance by memoizing some function calls.
* Open source the vt module..
* BUGFIX: Do not abort parsing when .NET file has a table with
more than MAX_ROWS_PER_TABLE.
* BUGFIX: Prevent infinite loop due to cycles in certificate
chain.
-------------------------------------------------------------------
Mon Feb 3 18:20:39 UTC 2025 - Martin Hauke <mardnh@gmx.de>
- Update to version 0.13.0
* Implemented basic linting via the check command.
* Refactor the format of JSON output.
* Parse Mach-O certificates.
* Allow using previously defined variables in with statements.
* BUGFIX: prevent the fmt command from modifying binary files
accidentally.
* BUGFIX: fix panic when path starts with.
* BUGFIX: reduce consumption of process address space.
- Update to version 0.12.0
* The macho module now parses and exposesLC_LINKER_OPTION
commands.
* Raise warning with some patterns that have too many 2-byte
atoms and are potentially slow.
* Extract more information from the SpcSpOpusInfo structure
contained in PE signatures.
* BUGFIX: add missing MEAN_BYTES constant to math module.
* BUGFIX: panic when calling dylib_hash in some corrupted
Mach-O files.
-------------------------------------------------------------------
Fri Nov 29 19:07:30 UTC 2024 - Martin Hauke <mardnh@gmx.de>
- Update to versino 0.11.1
* BUGFIX: large memory consumption while parsing corrupted
PE files.
-------------------------------------------------------------------
Tue Nov 26 19:14:04 UTC 2024 - Martin Hauke <mardnh@gmx.de>
- Update to version 0.11.0
* Added JSON as a new output format.
* Added the --profiling option to the scan command.
* Implement loop-invariant code motion (hoisting).
* Implement sym_hash() function for macho module.
* Allow larger jumps in hex patterns.
* BUGFIX: issue with undefined expression in with statements.
-------------------------------------------------------------------
Tue Nov 5 20:24:20 UTC 2024 - Martin Hauke <mardnh@gmx.de>
- Initial package, version 0.10.0
