v2026.10.0-src

The upstream source trees, their MANIFESTs and the build recipe of release 2026.10.0. Its binaries are in release v2026.10.0.

2026.10.0 (2026-10-22)

The first release. 1,381 OSS-Fuzz projects, 427 of them available, with 2,148 harnesses; 8,578 binaries attached and 0 withheld. 20,164 statements: 138 proved, 229 blocked by the model, 0 withheld; the other 19,797 are open.

The 138 proved statements cover 60 fuzz targets in 25 projects. Their proofs were made from proofs that Anthropic licensed under the Apache License 2.0 or the MIT licence, ported to this release's binaries; each such file says so in a line under its licence header. Two projects, mariadb and wazuh, are held from this release because their only binary combines an Apache-2.0 harness with GPL-2.0-only code.

v2026.10.0

2026.10.0 (2026-10-22)

The first release. 1,381 OSS-Fuzz projects, 427 of them available, with 2,148 harnesses; 8,578 binaries attached and 0 withheld. 20,164 statements: 138 proved, 229 blocked by the model, 0 withheld; the other 19,797 are open.

The 138 proved statements cover 60 fuzz targets in 25 projects. Their proofs were made from proofs that Anthropic licensed under the Apache License 2.0 or the MIT licence, ported to this release's binaries; each such file says so in a line under its licence header. Two projects, mariadb and wazuh, are held from this release because their only binary combines an Apache-2.0 harness with GPL-2.0-only code.

Source code (GPL/LGPL binaries)

Source code for the released binaries that contain GPL or LGPL code.

The binaries are those of oss-fuzz-theorems release 2026.10.0-rc.2. For each project below, <project>-src.tar.zst holds the upstream source the binaries were built from (every file is an object of the named upstream git tree; <project>-src.MANIFEST.tsv lists the trees and commits), and recipe.tar.zst holds the build scripts, the driver and the patches. toolchain-src.tar.zst holds the source of the toolchain parts linked into every binary: musl, the LLVM runtimes and the static AddressSanitizer patches. sysroot-src.tar.zst holds the source of the builder image's libraries that two of these binaries link (ncurses 6.5 and protobuf 3.21.12 in mosh, GLib 2.82.5 in ostree), with the script that rebuilds them; its README gives the comparison with the builder image's archives.

project	entry point	licence of the program
bluez	fuzz_hci	GPL-2.0-or-later
hunspell	parserfuzzer	MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later
igraph	basic_properties_directed	GPL-2.0-or-later
knot-dns	fuzz_dname_from_str, fuzz_dname_to_str	GPL-2.0-or-later
lzma	lzma2dec_fuzzer	GPL-3.0-or-later (harness); LZMA SDK public domain
mosh	terminal_fuzzer	GPL-3.0-or-later
mpv	fuzzer_json	LGPL-2.1-or-later
opensips	fuzz_uri_parser	GPL-2.0-or-later
ostree	fuzz-rfc2616-date	LGPL-2.0-or-later
powerdns	fuzz_target_dnslabeltext_parseRFC1035CharString	GPL-2.0-only
tcpreplay	fuzz_services	GPL-3.0-only

Each proof's provenance/PROVENANCE.md says which of these files rebuild its binaries.