v5.1.7

• 🔧 Platforms, build and packaging:
  • honour --root ROOT when installing
  • better install prefix detection
  • fix OpenBSD dependency and CUPS paths, and omit systemd files on BSD
  • recognize OpenBSD in operating system names and platform icons
  • RPM packages could lack the cairo typelib required by Gtk and Rsvg
  • X11 window tests failed to import on Python 3.6
  • verify deb packages before copying to the repo
  • stop building DEBs on any failure
  • Fedora 45 package list
  • almalinux build failures and rockylinux
  • missing default build list - unused arm64 list
  • RHEL builds need our private openh264 and CentOS
  • Python 3.6 syntax compatibility
  • no pyopengl to build here
  • Ubuntu Stonking packaging
  • googlesource downloads are not reliable
  • macOS: always enable logging to file when spawned from the GUI
  • macOS menu fixes
  • restore Python 3.6+ compatibility
  • xserver-xorg-video-dummy failed on Debian arm64
  • ignore cython generated shared objects in source tree
  • recognize OpenBSD platform names
  • OpenBSD build paths
  • is_arm should match all 64-bit arm
  • enable speaker forwarding on arm
  • oudated raspbian workaround
  • don't start Xorg if its config file is missing
  • failure to build due to missing libfakeXinerama dependency in some RPM builds
  • RHEL 10 and clones must use weston+Xwayland as vfb command
  • macOS 27 window transparency issue
  • macOS: use the bundled GIO module directory
• 📦 RPM:
  • RPM dependency fixes
  • prevent version conflicts
  • pytools 2026.1.1, 2022.1.12 for RHEL 8 + build dependencies on RHEL8:
  • typing-extensions 4.1.1
  • platformdirs 2.4.0
  • siphash24 1.6 + update build lists
  • libfakeXinerama build flags and license
  • pylsqpack 0.3.23, 0.3.16 on RHEL8
  • pyu2f 0.1.5
  • uinput 1.0.1
  • wheel 0.41.3
  • openh264 2.7.0
  • pycuda missing package dependencies
• ⚠️ Major:
  • mistimed early packets could cause clients to disconnect
  • don't leave the client waiting when an authentication module raises
  • prevent an endless window info lookup when a parent window disappears
  • numeric list options could return a single integer instead of the converted list
  • clients failed to connect to shadow servers because the server's hello packet could not be encoded
  • drag-and-drop can get wedged and stop working
  • Gtk clients fail to restack a window above or below another window
  • don't reconfigure monitors unless required
  • resizing desktop sessions has no effect on Xvfb displays
  • X11 error callbacks could use Python state without holding the GIL
  • X11 events could stop being routed after unmatched filter cleanup or shared filter use
  • X11 32-bit sign extension of property values
  • handle duplicated mode attribute in session files
  • allow upgrades on displays where no window manager is left
  • chunked file transfer early rejection errors out
  • wheel events may land in the wrong location
  • misnamed X11 atoms
  • macOS client crash with audio enabled or speaker state changes
  • nvenc: choose a profile matching the chroma format
  • remove AES-CFB
  • crashes with sharing and disconnections
  • paint issues when pointer overlay and border are used together
  • misplaced transient windows with desktop scaling
  • child reaper detects the wrong exit code
  • X11 configure requests mishandled when only one axis is modified
  • weston+Xwayland vfb option left processes behind and was racy
  • proxy server compatibility with newer display forms
• ⊞ MS Windows:
  • SBOM generation failed when Python was installed outside Python312
  • SBOM: skip empty licenses
  • builds and server socket tests failed to parse on Python 3.6 / 3.7
  • builds don't need the service tool
  • try harder to find nvcc
  • remove obsolete soup and croco dependencies, gnutls and crypto++
  • remove unused GStreamer video codecs
  • console commands redirected their output to a log file
  • object leak querying desktop name
  • object leak querying cursors
  • avoid using comtypes
  • mmap uses unavailable API calls
  • clipboard memory handle bugs
  • don't forward the ssh agent
• 🌈 Encodings:
  • auto-refresh is delayed too long
  • load the libcuda runtime soname
  • cuda context free race crash
  • cuda context stays locked on errors
  • validate jpeg and vpx dimensions and strides decoded from untrusted systems
  • unreliable GStreamer video decoders were enabled by default
  • nvenc: set hevc level
  • nvenc: only advertise YUV444 output when the device supports it for h264 / h265
  • ARGB conversions reported the wrong bytes-per-pixel value
  • damage cancellation could free images while they were still being encoded
  • concurrent damage could start multiple encode threads
  • lossy updates could miss their auto-refresh
  • Cython CSC validation, conversion rounding, 30-bit issues
  • invalid scroll rectangles emitted when the damage region moves
  • BGRX must use opaque alpha
  • swapped colour channels, miscalculated rowstride
  • prefer BGRX / BGRA by default
  • cairo: discard alpha from 32-bit data when needed
  • remove unused avif decoder in pillow
  • encoders that subsample are lossy
  • grayscale video fails
• 📬 Notifications:
  • swapped RGB channels
  • only forward icon theme names as app_icon
  • remove images and links from the body
  • escape the notification summary in Gtk fallback notifier
  • strip unsafe markup
  • dbus retry loop
  • forget notifications closed by the client
  • detect loops via the service name
  • try the next notifier backend when one fails
  • skip notification warnings during cleanup
• 🖧 Network:
  • socket leaks when the proxy connection fails
  • don't mask exceptions raised without arguments
  • don't block forever on a websocket upgrade that never completes
  • don't leak the client socket when the tcp connection setup fails
  • don't busy-loop when the server closes the connection during the websocket upgrade
  • limit the time clients have to send their http request headers
  • stop reading the websocket upgrade response at the end of its headers
  • check the http status of the websocket upgrade response
  • don't send an http error after the websocket upgrade response
  • accept websocket subprotocol lists with spaces
  • fix default HTTP headers directory for WebSocket errors
  • don't drop clients that are slow to send their first packet
  • socket fast read timeout handling on older Python
  • paramiko: try ssh keys in the same order as openssh
  • expose the real hostname via mDNS
  • socket lookup race during server startup
  • socket activation error handler bug
• SSL:
  • ssl upgrade must override defaults
  • clients could remain stuck after an SSL upgrade failed or the server closed the connection during the upgrade
  • ssl retry needs a brand new socket
  • download ssl certificate using the same connection path, same configuration options
  • warn when the certificate no longer matches the one accepted previously
  • changed self-signed certificates were not reported with OpenSSL 3.0
  • fix SSL upgrade verification overrides
  • don't wait forever for the client's TLS handshake to complete
  • don't let SSL connections wait past their deadline
  • apply a timeout to every TLS handshake
  • fail the SSL handshake when the peer closes the connection
  • close the ssl connection when the server side handshake fails
  • don't leave failed SSL connections dangling
  • don't pass encrypted peek data to the protocol after an SSL upgrade
  • silence macOS legacy SSL warnings
• ⌨ Keyboard:
  • keyboard layout group could be wrong after a keymap or keyboard state reset
  • unicode keysyms parsing
  • comma-separated keyboard layouts were parsed as individual characters
  • cython compilation warning
• 📋 Clipboard:
  • fail the requests waiting on an incremental transfer which times out
  • give incremental transfers longer than CONVERT_TIMEOUT to complete
  • test must wait for synchronization to occur
  • test all selections
  • detailed test errors
  • honour debugging flag in tests
  • simultaneous large and small clipboard transfers no longer mix their contents or time out
  • clipboard requests could be left unanswered when a client reset
  • raw atoms cause connection to drop
  • blinking for every pending transfer is excessive
  • don't ask the server for progress updates
  • send empty replies to pending requests on cleanup
  • remove unused root events
• Mmap:
  • confine client-named files to the server mmap directory and reject symlinks
  • use the actual mmap area size
  • validate control header pointers and disconnect clients that corrupt them
  • validate chunks supplied by the peer
  • validate chunks before freeing data for a window that is gone
  • reject missing server mmap tokens
  • limit is actually 4GB
  • validate the token location and size
• OpenGL:
  • verify the rgb buffer size
  • Gtk X11 clients errors
  • don't request contexts with depth or stencil buffers
  • OpenGL pixel upload format
  • discard alpha padding in RGBX uploads
  • include unit test
• Minor:
  • fully transparent opacity is not unset
  • busy loop while waiting for the X11 server to start
  • PulseAudio failed to start in read-only containers
  • read-only Gtk clients failed to resize windows
  • Gtk window move and resize requests failed with an undefined warning handler
  • unknown X11 event names caused errors with Cython 3.3
  • out of bounds access when comparing monitor configurations
  • apply the new DPI before resizing the display
  • don't leave _NET_ACTIVE_WINDOW pointing at a window that is gone
  • uinput device matching
  • don't hold on to an encoder that has been replaced or closed
  • prevent UI thread watcher race conditions
  • window-icon timers could raise warnings after firing
  • VPX bitrate and RandR refresh rates were truncated by Cython integer division
  • zero is a valid uid / gid
  • allow lookup of session names starting with a digit
  • X11 diagnostics queried invalid window ID zero
  • stale partial refresh regions could be replayed after a full repaint
  • popup windows could prevent regular modal windows from regaining their modal state
  • scaled cursors could be distorted or disappear when clamped to a maximum size
  • GStreamer initialization failed with newer PyGObject versions
  • runtime directory creation could race concurrent server starts
  • video maximum-size overrides ignored the requested height
  • dangling SSH agent symlinks were left behind on session cleanup
  • xpra clean-sockets could skip every socket
  • clean dead ssh agent symlinks
  • always point the ssh agent symlink at a client
  • clamp the shadow server refresh rate
  • validate port numbers ourselves
  • IPv6 socket warnings
  • potential UI watcher errors
  • UI watcher resume never fires
  • drop audio removesilence since it never worked properly
  • cursor logging errors
  • missing type conversion
  • windows can disappear as we inspect them
  • error picking an audio monitor device
  • error picking a default printer
  • convert all buffer types to bytes
  • client properties wrongly reset
  • proxy server warnings
  • win32 build test
• 💄 Cosmetic:
  • incorrect library versions reported
  • skip video warnings for clients without video support
  • HTTP request timeouts were logged as errors before Python 3.10
  • proxy destination regression test
  • indentation
  • share the refresh-rate conversion
  • document limitations of cert data authenticity with older Python versions
  • Gtk clipboard replies and timeouts could raise errors
  • Gtk clients can send duplicate scroll events
  • cleanup pam config
  • keyboard option parsing type mismatch
  • consistent attribute initialization
  • remove unavailable test commands
  • fix ignored test
  • X11 tests failed due to invalid xauth cookie
  • tests now stop the dbus-daemons left behind
  • newer servers expose multiple desktop entries with the same name
  • accept SVG files starting with a doctype
  • missing session icon for default desktop sessions