Update stacked: fontconfig 2.18.2 + pango 1.58.0 by bryan-minimal · Pull Request #493 · gominimal/pkgs

bryan-minimal · 2026-07-21T16:02:47Z

Bundles #488 and #487, which turn out to be each other's blocker.

Why #488 fails

minimal build fails on both arches. The check run has no output (infra#316), and run.jsonl doesn't carry it either — the error is only in the per-build log (59.jsonl, "Project name: pango"):

../pango/pangofc-fontmap.c: In function 'pango_fc_font_map_add_font_file':
../pango/pangofc-fontmap.c:4010:8: error: implicit declaration of function
    'FcFreeTypeQueryAll' [-Wimplicit-function-declaration]
 4010 |   if (!FcFreeTypeQueryAll ((const FcChar8 *) filename, -1, NULL, NULL, set))

FcFreeTypeQueryAll is a fontconfig API. 2.18.2 stops declaring it where pango 1.56.4 expects it, and pango compiles with -Werror=implicit, so a missing declaration is fatal rather than a warning.

Why neither PR can land alone

PR	change	CI	why
#487	pango 1.56.4 → 1.58.0	✅	still builds against fontconfig 2.17.1, where the declaration exists
#488	fontconfig 2.17.1 → 2.18.2	❌	pango 1.56.4 can't compile against it

Each is green or red purely because of the other's absence. Merging #488 breaks the tree; merging #487 alone leaves fontconfig blocked. Same shape as #485 (node + c-ares) — pairing the dependent with its dependency was the fix there too.

Versions and checksums taken unmodified from #487 and #488.

This is a hypothesis, and the gate should decide it

I have not verified against pango's source that 1.58.0 drops or re-guards the FcFreeTypeQueryAll call — the combination has never been built anywhere. It's the obvious candidate (1.58.0 postdates fontconfig 2.18), but if CI fails here then pango 1.58.0 is not the fix, and fontconfig needs a patch or a newer pango.

If this goes green, #487 and #488 can close in favour of it.

Note

#488's body also flags 5 new pkgscan signals, risk score 10.0 on the fontconfig bump. That's independent of the build failure and still wants a look before merge.

🤖 Generated with Claude Code

Summary by CodeRabbit

Updates
- Updated Fontconfig to version 2.18.2.
- Updated Pango to version 1.58.0.
- Refreshed source package verification data for both libraries.

Bundles #488 and #487, which are each other's blocker. #488 (fontconfig 2.17.1 -> 2.18.2) fails `minimal build` on both arches because pango 1.56.4 no longer compiles against it: ../pango/pangofc-fontmap.c:4010:8: error: implicit declaration of function 'FcFreeTypeQueryAll' [-Wimplicit-function-declaration] FcFreeTypeQueryAll is a fontconfig API; 2.18.2 stops declaring it where pango 1.56.4 expects, and pango builds with -Werror=implicit, so a missing declaration is fatal rather than a warning. #487 (pango 1.56.4 -> 1.58.0) passes on its own only because it still builds against fontconfig 2.17.1, where the declaration is present. So each PR is green or red depending on the other's absence, and neither can land first: merging #488 breaks the tree, and merging #487 alone leaves the fontconfig CVE-relevant bump blocked. Landing them together is the fix, and it is the same shape as #485 (node + c-ares), where pairing the dependent with its dependency resolved an identical break. Versions and checksums are taken unmodified from #487 and #488. This is a hypothesis the build gate should confirm: pango 1.58.0 is expected to have dropped or re-guarded the FcFreeTypeQueryAll call, but that has NOT been verified against pango's source — the combination has never been built. If CI fails here, pango 1.58.0 is not the fix and fontconfig needs a patch or a newer pango instead. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

coderabbitai · 2026-07-21T16:03:04Z

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 42 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 34841247-f501-4c2b-b6ca-629c7f9ec9e2

📥 Commits

Reviewing files that changed from the base of the PR and between a6907a1 and 345ba72.

📒 Files selected for processing (1)

packages/fontconfig/build.ncl

📝 Walkthrough

Walkthrough

Fontconfig is updated to 2.18.2 and Pango to 1.58.0. Their build specifications now use the corresponding source archive SHA-256 checksums.

Changes

Package version updates

Layer / File(s)	Summary
Source version and checksum updates `packages/fontconfig/build.ncl`, `packages/pango/build.ncl`	Fontconfig and Pango use newer upstream versions with matching source archive checksums.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the combined fontconfig and pango version updates in the PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch bundle-fontconfig-pango

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/fontconfig/build.ncl`:
- Line 21: Update the upstream URL comment in the fontconfig build configuration
so its directory version matches the fetched fontconfig-2.18.2 archive,
replacing the stale 2.17.1 component with 2.18.2.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d283ebc9-952b-46bc-805d-92485eeff7c8

📥 Commits

Reviewing files that changed from the base of the PR and between b6254d4 and a6907a1.

📒 Files selected for processing (2)

packages/fontconfig/build.ncl
packages/pango/build.ncl

The upstream URL comment read .../fontconfig/2.17.1/fontconfig-2.18.2.tar.xz — the filename was bumped but the release-directory component was not, so the comment points at a URL that doesn't exist. Inherited unmodified from #488, i.e. generated by pkgmgr's updater rather than introduced here. The same defect is on main in ocaml (5.3.0 vs 5.5.0), yojson (2.2.2 vs 3.0.0) and dune (3.20.2 vs 3.24.0), all of the form .../download/<OLD>/<name>-<NEW>.ext. Fixing the updater is tracked separately; this just corrects the file in flight. Caught by CodeRabbit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

coderabbitai Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread packages/fontconfig/build.ncl Outdated

twitchyliquid64 approved these changes Jul 21, 2026

View reviewed changes

This was referenced Jul 21, 2026

Update pango to 1.58.0 #487

Closed

Update fontconfig to 2.18.2 #488

Closed

bryan-minimal mentioned this pull request Jul 21, 2026

ocaml, yojson, dune: fix 404 provenance comment URLs #494

Merged

bryan-minimal added this pull request to the merge queue Jul 21, 2026

Merged via the queue into main with commit 9f884a1 Jul 21, 2026
9 of 10 checks passed

bryan-minimal deleted the bundle-fontconfig-pango branch July 21, 2026 17:00

bryan-minimal mentioned this pull request Jul 21, 2026

Update stacked: cabal 3.18.1.0 + vim 9.2.0818 #496

Merged

Navigation Menu

Uh oh!

Update stacked: fontconfig 2.18.2 + pango 1.58.0 - #493

Update stacked: fontconfig 2.18.2 + pango 1.58.0#493
bryan-minimal merged 2 commits into
mainfrom
bundle-fontconfig-pango

bryan-minimal commented Jul 21, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

bryan-minimal commented Jul 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why #488 fails

Why neither PR can land alone

This is a hypothesis, and the gate should decide it

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bryan-minimal commented Jul 21, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading