Bump index state to get new hackage-security

[Mikolaj]

Template B: This PR does not modify behaviour or interface

E.g. the PR only touches documentation or tests, does refactorings, etc.

Include the following checklist in your PR:

• Patches conform to the coding conventions.
• Is this a PR that fixes CI? If so, it will need to be backported to older cabal release branches (ask maintainers for directions).

[mergify]

Queued — the merge queue status continues in this comment ↓.

[Mikolaj]

@mergify rebase

[mergify]

rebase

🛑 The pull request rule doesn't match anymore

Details

This action has been cancelled.

[Mikolaj]

Something is borked in the dogfooding jobs after the Hackage index bump. I'm restarting the CI repeatedly, but no improvement. No clear error message as far as I can see, so we'd need to try to reproduce this locally. If it can't be reproduced, we may bump dog-fooding to GHC 9.12, though it's a shame, 9.10 is not that old yet.

[Mikolaj]

Yes, the only error I'm getting is the following, which I think means that cabal segfault.

Failed with exit code -11 after 19.77s: ./cabal-head/cabal build --jobs=2 --with-compiler=ghc --builddir=dist-newstyle-validate-ghc-9.10.3 --project-file=cabal.validate.project Cabal Cabal-hooks cabal-testsuite Cabal-tests Cabal-QuickCheck Cabal-tree-diff Cabal-described cabal-install-solver cabal-install cabal-install-solver cabal-benchmarks"

An alternative to switching to GHC 9.12 is to bisect and find the offending version bump of a dependency that caused it and forbid that version. It's a pity, because then we ban a dependency for all GHCs possibly due to a bug exclusively in GHC 9.10 and already fixed elsewhere, but at least other users won't be getting similar segfaults.

[Mikolaj]

Uh, it's only macos-latest segfaulting every time, so it may not be possible to reproduce locally. Let me bump GHC to 9.12 so that we see what's going on and I can also try disabling macos dogfooding to see if other OSes pass tests with GHC 9.10 and 9.12.

[Bodigrim]

Something is borked in the dogfooding jobs after the Hackage index bump. I'm restarting the CI repeatedly, but no improvement.

I've seen the same CI failures in #12006, a sufficient number of restarts made it green eventually. Thus this is not related to index-state, something is broken already and it would be nice to figure what exactly instead of sweeping the issue under the carpet by disabling the job.

[Mikolaj]

@Bodigrim: thank you for the tip. On your word, I will restart a few more times.

Meanwhile, my experiments indicate the segfault vanishes with GHC 9.12.4 and on 9.10.3 it doesn't affect Linux nor Windows. I don't have a Mac, so that makes reproducing hard for me. We'd need to ask somebody with a Mac to investigate, but currently we are rather in search for volunteers to carry on 3.18 release tasks, though maybe these two don't compete. GHC people also have more pressing things on their plates than a segfault with GHC 9.10 on Mac without a small reproducer. Ideas?

[Bodigrim]

I did try it on Mac locally, but could not reproduce. I built a fresh cabal-install and ran on in itself successfully, although, to be precise, this is not exactly what CI is doing.

[Mikolaj]

You are right, now the dogfooding job passed. Maybe it's going to pass as long as the cache is not invalidated (it was invalidated by the index bump). Let's see how this develops.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-06-28 06:53 UTC · Rule: default · triggered by @zlonast with the merge queue checkbox
• ✅ Checks passed · on draft merge queue: checking master (d64d329) and [#12010 + #12016 + #12012] together #12047
• ✅ Merged — 2026-06-28 08:37 UTC · at 26730b5befed58fdde82bc15f1d7e424c91eb7dc · merge

This pull request spent 1 hour 44 minutes 17 seconds in the queue, including 1 hour 43 minutes 34 seconds running CI.

Required conditions to merge

• #approved-reviews-by >= 2 [🛡 GitHub branch protection]
  • Bump index state to get new hackage-security #12010
  • chore(cabal-install): Bump open-browser dependency to allow 0.5 #12012
  • Bump copyright years #12016
• #review-threads-unresolved = 0 [🛡 GitHub branch protection]
  • Bump index state to get new hackage-security #12010
  • chore(cabal-install): Bump open-browser dependency to allow 0.5 #12012
  • Bump copyright years #12016
• any of [🛡 GitHub branch protection]:
  • check-success = Doctest Cabal
  • check-neutral = Doctest Cabal
  • check-skipped = Doctest Cabal
• any of [🛡 GitHub branch protection]:
  • check-success = Meta checks
  • check-neutral = Meta checks
  • check-skipped = Meta checks
• any of [🛡 GitHub branch protection]:
  • check-success = docs/readthedocs.org:cabal
  • check-neutral = docs/readthedocs.org:cabal
  • check-skipped = docs/readthedocs.org:cabal
• any of [🛡 GitHub branch protection]:
  • check-success = Validate post job
  • check-neutral = Validate post job
  • check-skipped = Validate post job
• any of [🛡 GitHub branch protection]:
  • check-success = fourmolu
  • check-neutral = fourmolu
  • check-skipped = fourmolu
• any of [🛡 GitHub branch protection]:
  • check-success = hlint
  • check-neutral = hlint
  • check-skipped = hlint
• any of [🛡 GitHub branch protection]:
  • check-success = Bootstrap post job
  • check-neutral = Bootstrap post job
  • check-skipped = Bootstrap post job
• any of [🛡 GitHub branch protection]:
  • check-success = whitespace
  • check-neutral = whitespace
  • check-skipped = whitespace
• any of [🛡 GitHub branch protection]:
  • check-success = Check sdist post job
  • check-neutral = Check sdist post job
  • check-skipped = Check sdist post job
• any of [🛡 GitHub branch protection]:
  • check-success = Changelogs
  • check-neutral = Changelogs
  • check-skipped = Changelogs

[Mikolaj]

@mergify backport 3.18

[mergify]

backport 3.18

✅ Backports have been created

Details

• #12060 Backport #12010: Bump index state to get new hackage-security has been created for branch 3.18