1.2.0

Added

• Versioning:
  • Semantic versioning defines for major, minor and patch version in unarr.h
  • UNARR_VERSION version string define
  • UNARR_VERSION_CHECK macro for version checks against UNARR_API_VERSION
  • Functions to query UNARR_VERSION and UNARR_API_VERSION at runtime
• CMake:
  • New unarr::unarr alias target for easier importing

Changed

• CMake:
  • Increase minimum CMake version to 3.25
  • Disable test and fuzzer build options if unarr is used as a CMake subproject
  • Improved build flags for fuzzer target
  • Disable C extensions (enforce pure C99)
  • Use FILE_SET instead of PUBLIC_HEADER for header export
  • More modern CMake
• Versioning:
  • Genereate UNARR_API_VERSION from semantic versioning constants
  • Use a packed hexadecimal format for UNARR_API_VERSION, e.g., 0xMMmmPP where MM indicates the major, mm the minor and PP the patch version.
• LZMA SDK: Update to v26.05

Fixed

• Rar:
  • Fix stale filter pointer after filter reset in rar_run_filters
• libunarr.pc pkg-config:
  • Detect and use bzip2.pc if available
  • Don't use "-I" flags in Libs.private
  • Strip whitespace
• build:
  • Don't use "--no-undefined" compiler flag in OpenBSD
  • Remove srcdir references

Security

• rar:
  • Fix OOB read in rar_conv_unicode_to_utf8 (CVE-TBD, GHSA-3pwm-h93f-p4qh - reported by
    Tristan Madani (@TristanInSec))
  • Prevent heap overflow when copying filters into RAR VM (CVE-TBD, GHSA-r5fr-9636-6xpp Identified during investigation of #32. Thanks to @Nero22k for reporting and providing the PoC.)
• zip:
  • Fix off-by-3 heap out-of-bounds read in ZIP64 extra field parser (cve-2026-111274, first reported by Tristan Madani (@TristanInSec) in GHSA-qm4g-jf39-jwjj)
• Tar: Fix off-by-1 heap overflow in tar_get_name when concatenating USTAR filename and prefix at full length
  (CVE-2026-111273, first reported by Sumit Chakraborty (@Sumit-2004) in GHSA-fj4h-mpx9-46qj)