- update `docker/build-push-action` from 7.3.0 to 7.4.0
- update `github/codeql-action/analyze` from 4.37.8 to 4.38.2
- update `github/codeql-action/init` from 4.37.8 to 4.38.2
Closes#2634
- update `docker/login-action` from 4.5.1 to 4.6.0
- update `github/codeql-action/analyze` from 4.37.3 to 4.37.8
- update `github/codeql-action/init` from 4.37.3 to 4.37.8
Closes#2570
- update `actions/checkout` from 7.0.0 to 7.0.1
- update `docker/build-push-action` from 7.2.0 to 7.3.0
- update `docker/login-action` from 4.2.0 to 4.5.1
- update `docker/metadata-action` from 6.1.0 to 6.2.0
- update `github/codeql-action/analyze` from 4.36.2 to 4.37.3
- update `github/codeql-action/init` from 4.36.2 to 4.37.3
Closes#2477
- update `actions/cache` from 5.0.5 to 6.1.0
- update `actions/checkout` from 6.0.2 to 7.0.0
- update `github/codeql-action/analyze` from 4.36.0 to 4.36.2
- update `github/codeql-action/init` from 4.36.0 to 4.36.2
- update `msys2/setup-msys2` from 2.31.1 to 2.32.0
Closes#2167
Keep ubuntu-24.04 for Linux jobs using system packages for more
variation.
Also bump clang-tidy jobs to v22 (from v20, also up from the default v21
preinstalled on ubuntu-26.04.)
Closes#2078
- update `docker/build-push-action` from 7.1.0 to 7.2.0
- update `docker/login-action` from 4.1.0 to 4.2.0
- update `docker/metadata-action` from 6.0.0 to 6.1.0
- update `github/codeql-action` from 4.35.2 to 4.36.0
Closes#1963
- update `actions/cache` from 5.0.4 to 5.0.5
- update `actions/upload-artifact` from 7.0.0 to 7.0.1
- update `docker/build-push-action` from 7.0.0 to 7.1.0
- update `docker/login-action` from 4.0.0 to 4.1.0
- update `github/codeql-action` from 4.31.9 to 4.35.2
- update `msys2/setup-msys2` from 2.31.0 to 2.31.1
Closes#1922
The mbedTLS API is not one API but distinctly incompatible APIs
depending on its version. 2.x is largely incompatible with 3.x, and 4.x
is largely incompatible with 3.x, also dropping certain legacy crypto
primitives.
Following the release of 3.x in 2021, libssh2 added support for 3.x in
2022. 4.x was released in October 2025, and it makes using the PSA
Crypto API mandatory, after adding it in 3.x.
Supporting 2.x while also supporting the PSA Crypto API would mean
supporting 3 different crypto backends meshed together in a single
source file, with various overlapping and per-version parts, with
different features and separate needs to test.
2.x is also no longer maintained, supported, or security patched, as
written in its latest, and final, release notes on 2025-03-24:
https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.10
The mbedTLS project recommends upgrading to an upper major version.
To allow adding support for the PSA Crypto API and the 4.x series, and
to avoid an unmaintained 2.x major version, this patch drops support for
mbedTLS 2.x.
Also:
- GHA: update CI jobs to either use Linuxbrew mbedtls 3.x, or build from
source and cache it.
- Require 3.1.0 minimum (instead of 3.0.0), because libssh2 never built
with 3.0.0 due the use of API `mbedtls_cipher_info_get_key_bitlen()`.
Nobody complained since the initial commit introducing it.
Refs:
https://github.com/Mbed-TLS/TF-PSA-Crypto/blob/tf-psa-crypto-1.0.0/docs/1.0-migration-guide.mdhttps://github.com/Mbed-TLS/TF-PSA-Crypto/blob/tf-psa-crypto-1.0.0/docs/psa-transition.md#asymmetric-cryptographyCloses#1727
- update `actions/checkout` from 6.0.0 to 6.0.1
- update `msys2/setup-msys2` from 2.29.0 to 2.30.0
- update `actions/cache` from 4.3.0 to 5.0.1
- update `cross-platform-actions/action` from 0.30.0 to 0.32.0
- update `actions/upload-artifact` from 5.0.0 to 6.0.0
- update `github/codeql-action` from 4.30.8 to 4.31.9
- update `docker/metadata-action` from 5.8.0 to 5.10.0
- update `actions/checkout` from 5.0.0 to 6.0.0
- update `cross-platform-actions/action` from 0.29.0 to 0.30.0
- update pip package `reuse` from 6.1.2 to 6.2.0
Closes#1755Closes#1756
To avoid littering the Actions cache.
Another, libssh2-specific issue is that the cache is bound to codeql
version, master commit hash and platform. But in libssh2 we buidl 4
different configurations on Linux, which caused these caching failures:
```
C (OpenSSL) Failed to save: Unable to reserve cache with key codeql-trap-1-2.23.0-cpp-5bd1baed82ada192a2ae7e9801882813853e4d87, another job may be creating this cache.
C (wolfSSL) Failed to save: Unable to reserve cache with key codeql-trap-1-2.23.0-cpp-5bd1baed82ada192a2ae7e9801882813853e4d87, another job may be creating this cache.
C (mbedTLS) Failed to save: Unable to reserve cache with key codeql-trap-1-2.23.0-cpp-5bd1baed82ada192a2ae7e9801882813853e4d87, another job may be creating this cache.
```
Ref: https://github.com/libssh2/libssh2/actions/runs/17744827522
It's probably something to fix, because it suggests that it's unexpected
to build multiple configs in a matrix. Perhaps it's better to build them
after each other in the build step. Though it's not yet clear how
the CodeQL engine is considering coverage for different build
configurations of the same codebase.
Ref: https://github.com/curl/curl/pull/18613
Ref: 9618c337d1
