2026-11-10  github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

	* NEWS, configure.ac: release: v2.6.5

2026-11-10  Will Estes <westes@reground.org>

	* .github/workflows/release.yml: ci: build the release from the
	commit the tag names For a final release the workflow makes two commits, and the second
	adds the empty placeholder header for the next release. The build
	ran at the second commit, so make releasecheck failed on the
	placeholder, and the tarballs would have been built from a tree that
	is not the one the tag points at.  Check out the first release commit before building in
	.github/workflows/release.yml. For a release candidate there is only
	one commit, so nothing changes.

2026-11-10  Will Estes <westes@reground.org>

	* tools/make-announcement: ci: count announcement commits without
	git's author filter With the git in the CI image (2.34), combining --author and --grep
	with --invert-grep did not leave out release commits or bots, so the
	counts were too high and a bot was thanked.  Make tools/make-announcement list the author and subject of each
	commit and leave out release commits and bots itself.

2026-11-10  Will Estes <westes@reground.org>

	* .github/workflows/release.yml, tools/Makefile.am,
	tools/make-announcement, tools/test-make-announcement.sh: ci:
	generate the release announcement Each release needs an announcement for flex-announce, and writing
	one by hand means looking up counts, hashes, sizes and tool versions
	for every release.  Add tools/make-announcement, which writes the whole post from the
	git history, the release files and the NEWS section, and a test for
	it. The counts and the thanks list cover the commits since the last
	final release, never a release candidate, and leave out release
	commits and bots. The release workflow records the tool versions in
	the build job, writes the announcement in the publish job before it
	pushes anything, so a problem there releases nothing, and attaches
	it to the release as announcement.txt.

2026-11-10  Will Estes <westes@reground.org>

	* NEWS: doc: wording touch up in NEWS

2026-11-09  Will Estes <westes@reground.org>

	* NEWS: docs: add a NEWS entry for the signed releases Say that releases are made and signed by the workflow, and give the
	fingerprint of the new key, since it is not connected to the one
	that signed 2.6.4.

2026-11-09  Will Estes <westes@reground.org>

	* .github/workflows/release.yml: ci: add the release workflow A push to master that holds a fix, a feat or a breaking change makes
	a signed release. A manual run can make a dry run, a release
	candidate, or a release with the version given.  Keep the signing key away from the build: the job that builds has no
	secrets, and the job that signs and pushes runs in the release
	environment, which is limited to master. A push starts a release
	only while the AUTO_RELEASE variable is true, so the workflow can be
	tried by hand before it is turned on.

2026-11-09  Will Estes <westes@reground.org>

	* README.md: docs: put the release key fingerprint in the README Releases from 2.6.5 on are signed with a new key that is not
	connected to the one that signed 2.6.4, so users have nothing they
	already trust to check it against.  Give the fingerprint in README.md, and say where else it is
	published.

2026-11-09  Will Estes <westes@reground.org>

	* .github/dependabot.yml, .github/workflows/ci-image.yml: ci:
	rebuild the CI image weekly Rebuild the image every Monday instead of monthly, so package
	updates reach it sooner. Dependabot checks the base image in the
	Dockerfile on Mondays at 05:00 UTC; the rebuild runs at 09:17, after
	it.

2026-11-09  github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

	* .github/ci-image-ref: chore(ci): use the rebuilt CI image The build workflow passed in

	ghcr.io/westes/flex-ci@sha256:89a63cd98e8c377a3041278518a1043084e0c08509100cfb9c4e651155ca5303.

2026-11-09  Will Estes <westes@reground.org>

	* .github/ci-image-ref, .github/dependabot.yml,
	.github/workflows/build.yml, .github/workflows/ci-image-ref.yml,
	.github/workflows/ci-image.yml,
	.github/workflows/codeql-analysis.yml,
	.github/workflows/nightly.yml, .github/workflows/website.yml: ci:
	keep the CI image reference in one file and update it automatically The four workflows that run in the CI image each pinned its digest,
	so every rebuild meant editing all four by hand. Put the digest in
	.github/ci-image-ref and have the workflows read it through a small
	reusable workflow, ci-image-ref.yml, which passes it to container:
	or, in nightly.yml, to docker run.  The image workflow now tests what it builds. After pushing the image
	it runs build.yml in it, gcc and clang, and only if that passes does
	it open a pull request that changes .github/ci-image-ref. The file
	is outside .github/workflows, so the default token may change it. A
	pull request from that token starts no workflow runs of its own,
	which is why the test runs inside the image workflow. The file is
	also outside .github/ci-image/, so merging that pull request does
	not rebuild the image again.  Also rebuild monthly, to pick up operating system updates, and let
	Dependabot watch the base image in the Dockerfile.

2026-11-09  dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

	* .github/workflows/codeql-analysis.yml: build(deps): bump the
	github-actions group with 2 updates Bumps the github-actions group with 2 updates:
	[github/codeql-action/init](https://github.com/github/codeql-action)
	and

	[github/codeql-action/analyze](https://github.com/github/codeql-action).Updates `github/codeql-action/init` from 4.39.1 to 4.39.3 - [Release notes](https://github.com/github/codeql-action/releases) -

	[Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)-

	[Commits](https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...33d7b85da1a04171e211befe2c739303b9a4c066)Updates `github/codeql-action/analyze` from 4.39.1 to 4.39.3 - [Release notes](https://github.com/github/codeql-action/releases) -

	[Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)-

	[Commits](https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...33d7b85da1a04171e211befe2c739303b9a4c066)--- updated-dependencies: - dependency-name: github/codeql-action/init   dependency-version: 4.39.3   dependency-type: direct:production   update-type: version-update:semver-patch   dependency-group: github-actions - dependency-name: github/codeql-action/analyze   dependency-version: 4.39.3   dependency-type: direct:production   update-type: version-update:semver-patch   dependency-group: github-actions ...  Signed-off-by: dependabot[bot] <support@github.com>

2026-11-09  Will Estes <westes@reground.org>

	* .github/workflows/nightly.yml: fix(ci): check out the full history
	in the nightly build The checkout fetches only the latest commit by default, so the
	ChangeLog in the nightly tarball built on 2026-11-09 listed that one
	commit and nothing else. Fetch the whole history, which the
	ChangeLog is made from.

2026-11-09  Will Estes <westes@reground.org>

	* .github/workflows/nightly.yml, Makefile.am: fix(build): pipe git
	log into git2cl in the ChangeLog rule The ChangeLog target is phony, so every make dist rewrites the file
	by running git2cl with no input. Without a terminal git2cl cannot
	tell that it should run git log itself and writes an empty file, so
	the nightly tarball built on 2026-11-09 still had a ChangeLog of 0
	bytes, even though the workflow had already written a good one.  Run git log in the source directory and pipe it in, the same command
	git2cl runs for itself.  Also check the ChangeLog inside the nightly tarball, after the
	build, instead of the file the workflow wrote before it. The build
	writes the file again, so only the tarball shows what ships.

2026-11-09  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entries for the ChangeLog fixes The ChangeLog in the nightly tarballs was empty, and the one git2cl
	writes mixed two character encodings. Both are fixed.

2026-11-09  Will Estes <westes@reground.org>

	* tools/Makefile.am, tools/git2cl, tools/test-git2cl.sh: fix(build):
	write author names in the ChangeLog as UTF-8 git2cl put the author name through strftime, which hands back
	decoded characters in a UTF-8 locale. Names with characters up to
	U+00FF, such as Grüninger, were printed as single Latin-1 bytes,
	and names with higher ones, such as Pluciński, drew a "Wide
	character in print" warning. The rest of the file is UTF-8, so the
	ChangeLog mixed two encodings.  Print the name outside the strftime format so it stays as it came
	from git log. Add tools/test-git2cl.sh, which feeds the script two
	such names and checks the output and stderr. It is skipped without
	perl.

2026-11-09  Translation Project <robot@translationproject.org>

	* po/lv.po: chore(po): update lv translation from the translation
	project

2026-11-09  Will Estes <westes@reground.org>

	* .github/workflows/nightly.yml: fix(ci): pipe git log into git2cl
	in the nightly build git2cl decides whether it is being piped by checking whether
	standard input is readable. With no terminal, as in the nightly
	workflow, it guesses wrong and writes an empty file. The ChangeLog
	in the latest nightly tarball is 0 bytes.  Feed it the log explicitly, and fail the step if the ChangeLog comes
	out empty so it cannot go unnoticed again.

2026-11-07  Will Estes <westes@reground.org>

	* po/zh_CN.po: chore(po): use the zh_CN team's term for start
	condition in message 94 The machine translation of the message about multiple rules for a
	start condition said "state" where the rest of the file says
	"condition".

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the zh_CN machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/zh_CN.po: chore(po): machine-translate missing and fuzzy zh_CN
	messages Fill or redo the 75 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in zh_CN.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the vi machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/vi.po: chore(po): machine-translate missing and fuzzy vi
	messages Fill or redo the 76 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in vi.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the tr machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/tr.po: chore(po): machine-translate missing and fuzzy tr
	messages Fill or redo the 81 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in tr.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the sr machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/sr.po: chore(po): machine-translate missing and fuzzy sr
	messages Fill or redo the 74 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in sr.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the ru machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/ru.po: chore(po): machine-translate missing and fuzzy ru
	messages Fill or redo the 74 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in ru.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the pt_BR machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/pt_BR.po: chore(po): machine-translate missing and fuzzy pt_BR
	messages Fill or redo the 75 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in pt_BR.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the ko machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/ko.po: chore(po): machine-translate missing and fuzzy ko
	messages Fill or redo the 99 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in ko.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the ka machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/ka.po: chore(po): machine-translate missing and fuzzy ka
	messages Fill or redo the 128 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in ka.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the hr machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/hr.po: chore(po): machine-translate missing and fuzzy hr
	messages Fill or redo the 111 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in hr.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the ga machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/ga.po: chore(po): machine-translate missing and fuzzy ga
	messages Fill or redo the 75 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in ga.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the fi machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/fi.po: chore(po): machine-translate missing and fuzzy fi
	messages Fill or redo the 75 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in fi.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the es machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/es.po: chore(po): machine-translate missing and fuzzy es
	messages Fill or redo the 74 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in es.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the eo machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/eo.po: chore(po): machine-translate missing and fuzzy eo
	messages Fill or redo the 74 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in eo.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the de machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/de.po: chore(po): machine-translate missing and fuzzy de
	messages Fill or redo the 74 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in de.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the da machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/da.po: chore(po): machine-translate missing and fuzzy da
	messages Fill or redo the 75 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in da.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the ca machine translation

2026-11-07  Will Estes <westes@reground.org>

	* po/ca.po: chore(po): machine-translate missing and fuzzy ca
	messages Fill or redo the 75 messages that the Translation Project has not
	translated or has left fuzzy, so the release is complete in ca.
	Each is marked as machine translated and not reviewed by a native
	speaker, and a note at the top of the file says the same.
	Last-Translator is unchanged. The next fetch from the Translation
	Project replaces this file.

2026-11-08  Will Estes <westes@reground.org>

	* .github/workflows/build.yml: ci: build and test with both gcc and
	clang Run the build workflow once with CC set to gcc and once with clang,
	using the matching C++ compiler, so the whole test suite runs under
	both.  The jobs are now named build (gcc) and build (clang). A
	failure under one no longer cancels the other.  This needs the CI image to contain clang, so update its digest in
	the workflows first.

2026-11-08  Will Estes <westes@reground.org>

	* .github/workflows/build.yml,
	.github/workflows/codeql-analysis.yml,
	.github/workflows/nightly.yml, .github/workflows/website.yml: ci:
	use the rebuilt CI image Point the workflows that run in the CI image at the image rebuilt
	with clang, in build.yml, codeql-analysis.yml, nightly.yml and
	website.yml.

2026-11-08  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the fall-through attribute Generated scanners now mark their fall-through with the attribute
	where the compiler supports it.

2026-11-08  Will Estes <westes@reground.org>

	* tests/Makefile.am, tests/fallthrough.ft: test: check that
	generated scanners mark fall-through Compile scanners from the default, reentrant, c99 and C++ back ends
	with every gcc and clang found, under several language standards,
	with -Wimplicit-fallthrough and -pedantic. Fail if a compiler
	complains about the fall-through marking.  A compiler is used only if it can compile a trivial file and warns
	about an unmarked fall-through, so a clean result means something.
	The test is skipped when none qualifies. Add it to tests/Makefile.am
	as a new .ft test type, passing it the C and C++ compilers configure
	found.

2026-11-08  Will Estes <westes@reground.org>

	* src/c99-flex.skl, src/cpp-flex.skl: fix(skel): mark fall-through
	without pedantic warnings Since gcc reports __has_c_attribute(fallthrough) as true even under
	-std=c99 and -std=c11, preferring [[fallthrough]] made every
	generated C scanner draw -Wpedantic warnings at each end-of-file
	case. A case label followed directly by an attribute also counts as
	a label before a declaration, which -Wpedantic complains about as
	well.  Put the fall-through marking in one hook, M4_HOOK_FALLTHROUGH, in
	src/c99-flex.skl and src/cpp-flex.skl. It tries
	__attribute__((fallthrough)) first and uses [[fallthrough]] only
	where that is not available, with an empty statement before it so
	the label is followed by a statement. The end-of-file hook now
	expands to it, and so does the fall-through in yyinput(), which was
	still only a comment that clang ignores.

2025-07-18  Luca Bacci <luca.bacci982@gmail.com>

	* src/c99-flex.skl, src/cpp-flex.skl: [c99, cpp]: Use fallthrough
	attribute Fixes https://github.com/westes/flex/issues/427

2025-07-19  Luca Bacci <luca.bacci982@gmail.com>

	* src/main.c: Avoid case fallthrough before case terminate

2026-11-08  Will Estes <westes@reground.org>

	* .github/ci-image/Dockerfile: ci: add clang to the CI image The CI image had only gcc, so nothing in CI checked that flex and
	the scanners it generates build and pass the tests under clang.  Install clang in .github/ci-image/Dockerfile, and make the Ubuntu
	base image a build argument, UBUNTU_IMAGE, whose default is the same
	pinned 22.04 image as before. That lets us build the image on
	another Ubuntu release to try newer compilers.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the UTF-8 conversion of
	translations

2026-11-07  Will Estes <westes@reground.org>

	* po/update_linguas.sh: chore(po): convert non-UTF-8 translations to
	UTF-8 when updating Some Translation Project files arrive in older encodings, such as
	ISO-8859-1 (da) and EUC-KR (ko). Convert them with msgconv after the
	fetch, so every .po file in the tree is UTF-8. Files that are
	already UTF-8 are not touched.

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the legacy input and unput macros
	fix A scanner that defines YY_NO_INPUT or YY_NO_UNPUT has them honored
	again, as in 2.6.4.

2026-10-29  Christoph Grüninger <foss@grueninger.de>

	* src/cpp-flex.skl, tests/.gitignore, tests/Makefile.am,
	tests/no_input_unput_r.l: fix(skel): Honor the legacy YY_NO_INPUT
	and YY_NO_UNPUT macros Commit 721622e renamed the macros that suppress the input and unput
	functions to YY_NO_YYINPUT and YY_NO_YYUNPUT. Scanners that define
	the old names in section 1, which flex 2.6.4 honored, now get
	yyinput() and yyunput_r() anyway and with them unused-function
	warnings.  Map the old names to the new ones in the default back end, at the
	point after which section 1 definitions may override skeleton
	macros.  Add the no_input_unput_r test, which defines the old names and fails
	to compile if the functions are still generated.  Refs: 721622e

2026-11-07  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the user-defined ECHO fix A scanner that defines its own ECHO has it used again, as it was in
	2.6.4.

2026-10-29  Christoph Grüninger <foss@grueninger.de>

	* src/cpp-flex.skl, tests/.gitignore, tests/Makefile.am,
	tests/echo_override_r.l: fix(skel): Honor a user-defined ECHO in the
	default back end Since commit 76affdf the default back end defines ECHO
	unconditionally as yyecho(), and the default rule calls yyecho()
	directly. A scanner that defines ECHO itself, as flex 2.6.4 allowed
	through #ifndef ECHO, now gets a macro redefinition warning, and
	both its ECHO actions and the default rule write to yyout instead of
	running the user's ECHO.  Define ECHO only when the user has not, and when the user has
	defined ECHO but not yyecho(), make the default yyecho() use it.
	ECHO stays a deprecated legacy interface; defining yyecho() takes
	precedence.  Add the echo_override_r test, which defines ECHO and checks that
	both an ECHO action and the default rule use it.  Refs: 76affdf

2026-11-05  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the user-defined input fix A scanner with its own YY_INPUT or yyread() can again fill a buffer
	that has no FILE, as it could in 2.6.4.

2026-10-29  Christoph Grüninger <foss@grueninger.de>

	* src/cpp-flex.skl, tests/.gitignore, tests/Makefile.am,
	tests/user_input_r.l: fix(scanner): Fill buffers without a FILE when
	input is user-defined Commit 4581ecc made yy_init_buffer() disable filling of any buffer
	whose FILE is NULL. That keeps the default input routine from
	reading a NULL yyin, but a scanner that defines its own YY_INPUT or
	yyread() does not read the FILE at all, and such scanners may create
	their buffers with yy_create_buffer(NULL, size). With flex 2.6.4
	those buffers were filled through the user's input routine; now the
	scanner sees end of input immediately and returns no tokens.  Apply the NULL check only when flex's own YY_INPUT and yyread() are
	in use, signalled by a new YY_INPUT_IS_OURS macro like the existing
	YY_DECL_IS_OURS, and fill the buffer otherwise as before.  Add the user_input_r test, which scans through a user-defined
	YY_INPUT from a buffer created with a NULL FILE. It scans no words
	without this fix. The yywrap_r.i3 test for #525 still passes.  Refs: 4581ecc, #525

2026-11-05  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the header section 3 fix

2026-10-29  Christoph Grüninger <foss@grueninger.de>

	* src/cpp-flex.skl, src/filter.c, tests/header_nr_scanner.l,
	tests/header_r_scanner.l: fix(skel): keep section 3 out of the
	header file Section 3 of a scanner belongs only in the scanner, not in the
	header.  Since the skeleton ended header mode before section 3 was
	copied, the header got its function definitions and preprocessor
	conditionals after the include guard, and a file including that
	header no longer compiled.  End header mode in filter_tee_header() in src/filter.c, after all
	input has been copied, as flex 2.6.4 did. We keep it there so that
	nothing copied later can end up in the header.

2026-10-31  Translation Project <robot@translationproject.org>

	* po/pl.po: chore(po): update pl translation from the translation
	project

2026-10-31  Will Estes <westes@reground.org>

	* NEWS, doc/flex.texi: docs: add NEWS entry for the scan length
	checks Say in the manual that yy_scan_string() and yy_scan_bytes() take
	their length as an int, and what happens when it does not fit. Input
	longer than an int can hold was never supported; the checks turn
	heap corruption into a fatal error, which is all #446 and #664 asked
	to have fixed.  fixes #446 fixes #664

2026-10-31  Will Estes <westes@reground.org>

	* tests/.gitignore, tests/Makefile.am, tests/scan_length.direct.l,
	tests/scan_length.h, tests/scan_length_c99.l: test: check the length
	given to yy_scan_string and yy_scan_bytes Add scan_length.direct and scan_length_c99, which check that a
	negative length and a string too long for an int each stop with the
	expected fatal error, and that ordinary input still scans. The
	helpers are shared in scan_length.h.  The long string is built by mapping the same 1 MiB of 'a' over 4 GiB
	of address space, so the test needs about 1 MiB of memory. A system
	without mmap() or a 64-bit size_t skips that part.

2026-10-29  anshal ossaimi <anshal@medios.digiscrypt.com>

	* src/c99-flex.skl, src/cpp-flex.skl, src/go-flex.skl: fix(skel):
	check the length in yy_scan_string and yy_scan_bytes yy_scan_string() passed (int) strlen(yystr) to yy_scan_bytes(),
	which truncates a string of 2 GiB or more. A 4294967295-byte string
	becomes -1, so yy_scan_bytes() allocated _yybytes_len + 2 = 1 byte
	and then wrote the two EOB characters at buf[-1] and buf[0]. A
	negative length passed to yy_scan_bytes() directly has the same
	effect, and INT_MAX - 1 or INT_MAX overflows the int addition.  Reject a strlen that does not fit in an int in yy_scan_string(),
	reject a negative length in yy_scan_bytes(), and compute the
	allocation size in yy_size_t, in all three skeletons.  Refs: #446, #664

2026-10-31  Translation Project <robot@translationproject.org>

	* po/nl.po: chore(po): update nl translation from the translation
	project

2026-10-30  Will Estes <westes@reground.org>

	* NEWS: docs: add NEWS entry for the lv translation

2026-10-30  Translation Project <robot@translationproject.org>

	* po/LINGUAS, po/lv.po: chore(po): new lv translation from the
	translation project

2026-10-30  Will Estes <westes@reground.org>

	* .github/workflows/website.yml, README.md, doc/site/index.html: 
	Upload the manual to flexlexer.org and point readers at the blog and
	list The website workflow now also uploads the manual to the
	flexlexer.org host with a deploy key limited to that site's
	directory. The rest of the site is built from a separate repository,
	so only the manual and the one-page manual are sent, and the delete
	is limited to the manual directory. The gh-pages publish stays as it
	was.  README.md and the landing page now mention the blog and the
	flex-announce sign-up page.

2026-10-29  Translation Project <robot@translationproject.org>

	* po/ro.po: chore(po): update ro translation from the translation
	project

2026-10-29  Translation Project <robot@translationproject.org>

	* po/zh_TW.po: chore(po): update zh_TW translation from the
	translation project

2026-10-28  Translation Project <robot@translationproject.org>

	* po/fr.po: chore(po): update fr translation from the translation
	project

2026-10-28  Translation Project <robot@translationproject.org>

	* po/uk.po: chore(po): update uk translation from the translation
	project

2026-10-28  Translation Project <robot@translationproject.org>

	* po/bg.po: chore(po): update bg translation from the translation
	project

2026-10-28  Will Estes <westes575@gmail.com>

	* .github/workflows/build.yml: ci: print the log of failed tests When a test fails in the make check step, automake writes the
	details to a log file on the runner and the job output only says
	which test failed.  Run make check with VERBOSE=1 in build.yml, so the log of each
	failed test is printed in the job output.

2026-10-28  Will Estes <westes575@gmail.com>

	* NEWS, tools/Makefile.am, tools/make-release,
	tools/test-make-release.sh: build: add a script that makes the
	release commits The release job has to put the version and date in the NEWS header
	and the version in configure.ac, then leave a fresh placeholder
	header for the next release.  Add tools/make-release, which makes those two commits and refuses to
	run unless NEWS is ready, checking its own result with
	check-release. With -r it makes a single release candidate commit
	instead. It does not tag or push, so the workflow can decide what to
	do with the commits. Add a test.

2026-10-28  Translation Project <robot@translationproject.org>

	* po/sv.po: chore(po): new sv translation from the translation
	project

2026-10-28  Will Estes <westes575@gmail.com>

	* src/skeletons.c: fix(skel): free the old prefix before the
	skeleton sets it The default prefix is now allocated, so replacing it with the prefix
	property from the skeleton leaked the old value.  Free ctrl.prefix in backend_by_name() before it is replaced.

2026-10-26  Christoph Grüninger <foss@grueninger.de>

	* src/main.c, src/parse.y: fix(scanner): free option values when set
	again Each string %option stored a fresh copy of its value without freeing
	the old one, so repeating an option, as tests/bison_nr_scanner.l
	does with prefix, leaked the earlier value.  Freeing needs every value to be heap-owned, but the command-line
	forms pointed into argv and the default prefix was a string literal.
	Copy the command-line arguments and allocate the default prefix,
	then free the old value before each assignment.

2026-10-28  Translation Project <robot@translationproject.org>

	* po/pt.po: chore(po): new pt translation from the translation
	project

2026-10-27  Will Estes <westes575@gmail.com>

	* .github/workflows/website.yml, NEWS, README.md, doc/README.md,
	doc/flex.texi, doc/site/index.html, doc/site/style.css: build:
	publish the website from release tags The gh-pages branch was a hand-made copy of the manual from 2016,
	with no landing page, and nothing kept it current.  Add .github/workflows/website.yml. On a v* tag, or when run by hand,
	it builds the manual in split and single-page form, adds a landing
	page from doc/site/, and replaces gh-pages with a single commit. The
	build and the push are separate jobs, so only the push job can write
	to the repository.  Point to the site from README.md and a new doc/README.md, and note
	it in NEWS.  Declare the Top node in flex.texi without explicit links. Its links
	to (dir) became dead links in the HTML manual, since there is no info
	directory on the web. The Info output no longer has a redundant Prev
	link on that node and is otherwise the same.

2026-10-27  Will Estes <westes575@gmail.com>

	* tests/state_buf_push.direct.l: tests: don't read stdin in
	state_buf_push The first yylex() call in state_buf_push.direct.l read the default
	input, which is stdin. Run from a terminal, make check sat waiting
	for input there. It only finished unattended because most harnesses
	give tests an empty stdin.  Scan a string for the first call instead. It still allocates the
	reject state buffer at its default size, which is what the test
	needs before the push.

2026-10-27  Will Estes <westes575@gmail.com>

	* configure.ac: build: set the version to 2.6.5-rc1 Translators need a template that matches the current messages. The
	Translation Project still serves the 2.6.4 one from 2017. Give the
	pre-release its own version so the template header and the tarball
	name cannot be mistaken for the 2.6.4 release.

2026-10-27  Will Estes <westes575@gmail.com>

	* examples/manual/Makefile.examples, examples/manual/eof_rules.lex,
	examples/manual/expr.lex, examples/manual/expr.y,
	examples/manual/front.y, examples/manual/j2t.lex,
	examples/manual/numbers.lex, examples/manual/pas_include.lex,
	examples/manual/string1.lex, examples/manual/string2.lex: 
	fix(examples): build the manual examples on current systems Most of the programs in examples/manual no longer built.
	Makefile.examples linked with -ll, which most systems do not have,
	and it had no recipe for seven examples that can be built. Several
	sources also used old interfaces: a <malloc.h> include, %lf for a
	long double, functions called before they were declared, and <<EOF>>
	actions that began on the line after the pattern. In the two include
	examples the <<EOF>> rule deleted the parent buffer rather than the
	finished one.  Earlier commits already brought some of the examples up to the newer
	interfaces. This finishes the ones that still did not build.  Link with -lfl, add the missing recipes, and fix the sources. Leave
	pascal.lex out, since there is no grammar for it here.  fixes #419

2026-10-27  Will Estes <westes575@gmail.com>

	* src/scan.l: fix(scanner): detect yyreject() without %option reject CHECK_YYREJECT passed the whole matched text, parentheses included,
	to all_lower, which is never true for it. A scanner that used
	yyreject() had to say %option reject or it failed to compile. The
	tests all do.  Compare the name instead of the whole text.

2026-10-27  Will Estes <westes575@gmail.com>

	* src/cpp-flex.skl: fix(skel): honor %option extra-type in the C
	skeleton When the define for the extra type was renamed in main.c, the two
	uses in cpp-flex.skl were not changed with it. The option was parsed
	and then ignored, so YY_EXTRA_TYPE stayed void * and yyget_extra
	returned the wrong type.  Test M4_MODE_EXTRA_TYPE in cpp-flex.skl, as c99-flex.skl already
	does.

2026-10-27  Will Estes <westes575@gmail.com>

	* po/bg.po, po/ca.po, po/da.po, po/de.po, po/eo.po, po/es.po,
	po/fi.po, po/fr.po, po/ga.po, po/hr.po, po/ka.po, po/ko.po,
	po/nl.po, po/pl.po, po/pt.po, po/pt_BR.po, po/ro.po, po/ru.po,
	po/sr.po, po/sv.po, po/tr.po, po/uk.po, po/vi.po, po/zh_CN.po,
	po/zh_TW.po: chore(po): merge the current template into the .po
	files Many messages have been reworded or marked for translation since the
	.po files were last merged, so their line references and message ids
	were out of date.  Run msgmerge on each .po file against the current flex.pot.
	Translations whose English changed are marked fuzzy for translators
	to review, and new messages are untranslated. No translation was
	edited by hand.

2026-10-27  Will Estes <westes575@gmail.com>

	* po/POTFILES.in: fix(po): list flexdef.h in POTFILES.in The fatal internal error messages are written in macros in
	flexdef.h, and xgettext does not follow macros into the files that
	use them. They were never in flex.pot, so translators could not see
	them.  List src/flexdef.h in po/POTFILES.in so xgettext reads the messages
	where they are written.

2026-10-27  Will Estes <westes575@gmail.com>

	* src/dfa.c, src/main.c, src/scan.l: fix(i18n): keep option names
	out of translatable text Many messages in main.c and scan.l had option names such as -Cf and
	%option written inside the sentence, and nothing told translators to
	leave them alone. The backup report in dfa.c marked its labels with
	leading and trailing spaces, and the count of backing up states had
	no plural form.  Pass option names as arguments, so messages that differ only by the
	option now share one string. Print the spacing around the labels in
	dfa.c from the code, not from the strings. Use ngettext for the
	count in main.c, since languages differ in how they form plurals.  fixes #64

2026-10-27  Will Estes <westes575@gmail.com>

	* src/filter.c, src/parse.y: fix(i18n): mark the remaining messages
	for translation Some warnings and errors in parse.y and filter.c were never marked
	with _(). The functions that print them do not translate their
	argument, so each string has to be marked where it is written.  Mark them. Pass the keywords they mention, such as <<EOF>>, as
	arguments so translators do not have to keep them intact. The system
	call failures in filter.c share one message, with the call as the
	argument.  fixes #63

2026-10-27  Will Estes <westes575@gmail.com>

	* src/main.c, tests/Makefile.am, tests/header_file_error.hfe: fix:
	report a header file that cannot be written We open the header file in a forked child, where the only error we
	could give was a generic "fatal internal error" with no file name or
	reason, and flex exited by signal rather than with an error status.  Open the file once in initialize_output_filters() in main.c before
	the filters are forked, so a failure is reported as "can't open
	FILE: REASON", reusing the existing message. Add
	tests/header_file_error.hfe to check the message, the exit status
	and that no output file is left.  fixes #532

2026-10-27  Will Estes <westes575@gmail.com>

	* .github/workflows/nightly.yml: ci: keep only the latest nightly
	build Each nightly build uploads four files named for the commit and date,
	so the old ones were never replaced and the nightlies release grew
	by four files per build. After the upload, delete every other file
	in the release. It first checks that all four new files are there,
	and deletes nothing if they are not.

2026-10-27  Will Estes <westes575@gmail.com>

	* NEWS: docs: add NEWS entry for the gettext 0.23 requirement

2026-10-27  Will Estes <westes575@gmail.com>

	* INSTALL.md, configure.ac, po/Makevars: build: require gettext 0.23
	and allow parallel builds in po/ The .NOTPARALLEL line in po/Makevars worked around a race in the
	Makefile.in.in that gettext 0.21 installs. gettext fixed it in 0.23,
	and flex now builds with gettext 1.0, so require 0.23 in
	configure.ac and drop the line. Five parallel distchecks in a row
	passed.  The workflows install gettext 0.21 from Ubuntu 22.04, so they need
	the new CI image before autogen.sh will pass there.

2026-10-27  Will Estes <westes575@gmail.com>

	* po/update_linguas.sh: build(po): add a missing Language header
	after fetching The Translation Project's ko.po and tr.po have no Language header
	field, and po-fetch warns about it. Add the field in
	update_linguas.sh after the fetch, taken from the file name, so the
	fetched files are complete.

2026-10-27  Will Estes <westes575@gmail.com>

	* .github/workflows/build.yml,
	.github/workflows/codeql-analysis.yml,
	.github/workflows/nightly.yml: ci: run the workflows in the CI image The image has gettext 1.0, which Ubuntu 22.04 does not package, and
	the other tools the workflows installed with apt on every run. Run
	the build and CodeQL jobs in it and drop their apt steps.  The nightly job also needs git and gh on the runner, so it keeps
	running there and runs only its build step in the image, as the
	runner user.

2026-10-27  Will Estes <westes575@gmail.com>

	* .github/workflows/ci-image.yml: ci: add a workflow to build and
	publish the CI image Build .github/ci-image/Dockerfile and push it to the GitHub
	container registry as ghcr.io/westes/flex-ci, tagged latest and with
	the commit hash. It runs when the Dockerfile or tools/bootstrap-flex
	changes on master, and on request.

2026-10-27  Will Estes <westes575@gmail.com>

	* .github/ci-image/Dockerfile: ci: add a Dockerfile for the CI build
	image The workflows install their tools with apt on every run. That gives
	them gettext 0.21, and they only work because the hosted runner
	image happens to have flex and other tools preinstalled.  Add .github/ci-image/Dockerfile. It starts from a pinned Ubuntu
	22.04, installs the same tools, builds gettext 1.0 from its signed
	tarball, and installs the previous flex release with
	tools/bootstrap-flex. The workflows do not use it yet.

2026-10-27  Will Estes <westes575@gmail.com>

	* INSTALL.md, NEWS, tools/Makefile.am, tools/bootstrap-flex: build:
	add a script to bootstrap flex from a release A git checkout has no scan.c, and generating it takes a flex that is
	already installed. Someone whose system has none had to build a
	release by hand first.  Add tools/bootstrap-flex, which downloads the previous release,
	checks it against a pinned SHA-256, and installs it in a prefix.
	List it in tools/Makefile.am, and point INSTALL.md at it. Add a NEWS
	entry.

2026-10-27  Will Estes <westes575@gmail.com>

	* po/.gitignore, po/update_linguas.sh: build(po): fetch translations
	with po-fetch update_linguas.sh fetched the PO files with rsync and rebuilt
	LINGUAS by hand. gettext 1.0 has po-fetch for this, so we use it.  Replace the rsync and LINGUAS code in po/update_linguas.sh with
	`po-fetch TP flex`. It drops the generated English quoting variants
	from LINGUAS, so the script puts them back. It no longer merges the
	PO files, because `make update-po` stopped doing that in gettext
	1.0.  Ignore po/fetch-po and po/insert-header.sed, which autopoint
	installs.

2026-10-27  Will Estes <westes575@gmail.com>

	* NEWS: docs: add NEWS entry for option values passed to m4

2026-10-27  Will Estes <westes575@gmail.com>

	* src/filter.c, src/main.c, src/misc.c, src/parse.y,
	tests/Makefile.am, tests/m4_injection.inj: fix(scanner): quote
	option values passed to m4 Rejecting brackets does not cover every way an option value reaches
	m4. The values of yydecl, user-init, pre-action and post-action were
	passed as unquoted macro arguments, and the output and header file
	names were stored in macros that m4 expands a second time. Text such
	as m4_syscmd(...) in any of them ran while flex was running, even
	when it contained no brackets.  We quote those values one level further, so that m4 passes them
	through as text. We also reject brackets in user-init, which the
	parser had missed, and in -o, --header-file, --yyclass and -P, which
	come from the command line and never reach the parser. The prefix
	check moves up in readin() so that it runs before anything is sent
	to m4. The new tests/m4_injection.inj tries each value, in the
	scanner file and on the command line.  fixes #728

2026-04-29  MarkLee131 <kaixuan.li@ntu.edu.sg>

	* src/flexdef.h, src/misc.c, src/parse.y: parser: reject [ and ] in
	%option= values to prevent m4-quote injection The OPTION-state quoted-string rule at src/scan.l:480 accepts
	arbitrary non-quote, non-newline bytes, including [ and ]. Those
	values are later interpolated into m4 input as
	`m4_define([[NAME]],[[%s]])` in filter.c and main.c. A `]]` inside
	the value breaks out of m4's quoting and lets a .l file run
	arbitrary m4 builtins (m4_syscmd / m4_esyscmd / m4_include) during
	`flex foo.l`.  PR #81 (7528bc0, 2016) added ESCAPED_QSTART / ESCAPED_QEND escaping
	for action and code-block contexts, but the same fix was never
	extended to %option= values. Only `prefix=` had a brackets-rejection
	guard.  Apply the same guard to all eight %option= values that flow into m4:
	outfile, header-file, yydecl, yyclass, extra-type, pre-action,
	post-action, yyterminate. (prefix already had the check; the helper
	replaces the inline one.) Verified each value rejects [ and ] with a clear error message, and
	a normal .l file still builds.

2026-10-27  Will Estes <westes575@gmail.com>

	* po/LINGUAS: fix(po): add ka to LINGUAS The ka translation was added to po/ but never listed in po/LINGUAS,
	so it was not being built or installed.  List ka in po/LINGUAS, in its sorted place between hr and ko.

2026-10-26  dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

	* .github/workflows/codeql-analysis.yml: chore(deps): bump the
	github-actions group with 2 updates Bumps the github-actions group with 2 updates:
	[github/codeql-action/init](https://github.com/github/codeql-action)
	and

	[github/codeql-action/analyze](https://github.com/github/codeql-action).Updates `github/codeql-action/init` from 4.37.4 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) -

	[Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)-

	[Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...9b3254085494b55a0f7c4c2b3d2d52cc712ce370)Updates `github/codeql-action/analyze` from 4.37.4 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) -

	[Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)-

	[Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...9b3254085494b55a0f7c4c2b3d2d52cc712ce370)--- updated-dependencies: - dependency-name: github/codeql-action/init   dependency-version: 4.39.1   dependency-type: direct:production   update-type: version-update:semver-minor   dependency-group: github-actions - dependency-name: github/codeql-action/analyze   dependency-version: 4.39.1   dependency-type: direct:production   update-type: version-update:semver-minor   dependency-group: github-actions ...  Signed-off-by: dependabot[bot] <support@github.com>

2026-10-26  Will Estes <westes575@gmail.com>

	* src/yylex.c: Remove unused global no_section3_escape from yylex.c The 2020 namespace rename moved this flag into the ctrl structure
	and left a same-named global behind in yylex.c. Nothing reads or
	writes it; every use is ctrl.no_section3_escape.

2026-10-26  Will Estes <westes575@gmail.com>

	* NEWS, src/main.c, tests/Makefile.am, tests/skel_option.skel: 
	fix(main): make the -S option read its skeleton file A 2020 change moved the skeleton file handle into the env structure,
	and the code that copies the skeleton now reads it from there.
	main.c kept opening the file into its own global, so env.skelfile
	stayed NULL and flex silently used the built-in skeleton whatever -S
	said.  Open and close env.skelfile in main.c, and remove the unused global.
	Add a test that gives -S a skeleton with a marker line and checks
	the marker reaches the output, and that a missing file is an error.
	Add a NEWS entry.

2026-10-26  Will Estes <westes575@gmail.com>

	* NEWS: docs: add NEWS entry for the yypush_buffer_state REJECT fix Refs: #752

2026-10-26  Will Estes <westes575@gmail.com>

	* tests/.gitignore: build(tests): ignore the state_buf_push.direct
	build products The new test builds a scanner and a program, and neither was listed
	in tests/.gitignore, so both showed up as untracked after a build.  Refs: #752

2026-10-16  anshal ossaimi <anshal@medios.digiscrypt.com>

	* src/c99-flex.skl, src/cpp-flex.skl, src/go-flex.skl,
	tests/Makefile.am, tests/state_buf_push.direct.l,
	tests/state_buf_push.direct.txt: fix(skel): Grow reject state buffer
	in yypush_buffer_state yyrestart() and yy_switch_to_buffer() resize the per-character
	reject state buffer to the active input buffer, but
	yypush_buffer_state() did not. Pushing a buffer larger than
	YY_BUF_SIZE and then scanning a long token wrote past the end of
	yy_state_buf. Copy the same resize block into yypush_buffer_state in
	all three skeletons, and add a regression test.

2026-10-26  Will Estes <westes575@gmail.com>

	* NEWS: docs: add NEWS entry for the C++ REJECT state buffer fix Refs: #751

2026-10-16  anshal ossaimi <anshal@medios.digiscrypt.com>

	* src/cpp-flex.skl, tests/.gitignore, tests/Makefile.am,
	tests/cxx_reject.ll, tests/cxx_reject.txt: fix(skel): allocate C++
[--snip--]
