Buildstream

Latest version: v2.4.0

Safety actively analyzes 710445 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 3 of 6

1.95.1

==================

o Fixed issue loading refs from project.refs files in subprojects (1655)

o Fixed `bst artifact checkout` on machines which do not support the
artifact's build architecture (1352)

o Rebuild protos to support newer grpc versions (1665)

o Support the RISC-V machine architecture name (1577)

o Record date and buildstream version in all build logs (184)

o Updated internals to be compliant with REAPI v2.2 (1676)

o Avoid adding unnecessary data to CAS (1677, 1678)

o Disable unneeded gRPC fork support which sometimes causes crashes (1679)

o Added runtime version checks against buildbox-casd (1189)

o Resolve variables in include files in the context of their project (1485)

o Retry failed builds in non-strict mode (1460)

o Optimize staging of sources (1680)

o Fixed `bst artifact delete` in non-strict mode (1461)

o Allow conditional statements in toplevel of project.conf (1683)

o Fix crashes related to cross-project includes / plugin loading (1686)

o Fix addressing of subproject elements on command line (1455)

o Ensure CAS does not get corrupted on systems without buildbox-fuse (1700)

o Optimization when importing files to/from CAS (1697, 1698)

o Print errors in advance of the interactive prompt (1394)

o Fixed Source.set_ref() code to behave as documented (1685)

o Updated installation instructions (1705, 1710)

o Support interactive build shells with all elements (1263)

o Reduce information encoded in cache keys for elements which do not use the sandbox (1687)


==================

1.95.0

Not secure
==================

Core
----
o BuildStream now requires Python >= 3.7 and also supports Python 3.10.


API
---
o BREAKING CHANGE: Removed SandboxFlags from public API, replaced this
with a `root_read_only` boolean parameter to relevant Sandbox APIs.


Format
------
o BREAKING CHANGE: Element names must now bare the `.bst` suffix and not
contain invalid characters, as was already documented. Now the warning
is replaced by an unconditional error.

o User configuration now has the ability to override source mirrors defined
by project configuration.

o User configuration now has fetch source and track source configurations to
control what mirrors/URIs can be accessed to obtain sources.

CLI
---
o BREAKING CHANGE: Removed `--deps plan` from all commands

o The `--pull` option is removed from the `bst shell` and `bst artifact checkout`
commands, which will now unconditionally try to pull required artifacts.

o BREAKING CHANGE: Now the artifact commands only accept element names if specified
with a `.bst` suffix (including wildcard expressions), and otherwise assumes the
command means to specify an artifact name.


==================

1.93.6

==================

Format
------
o The `script` element no longer has a `layout` configuration directly, and now
exposes a new `location` dependency configuration instead.

o The BuildElement now has a new `location` dependency configuration, allowing
BuildElement plugins to also stage dependencies into custom locations in
the sandbox.

o BREAKING CHANGE: Stack element dependencies are now hard required to be
both build and runtime dependencies.

o BREAKING CHANGE: The old and deprecated "remote-execution" configuration style
is no longer supported, one must now specify the "execution-service" block
and cannot specify a "url" in the "remote-execution" dictionary anymore.

o BREAKING CHANGE: Full redesign of remote cache configurations, junction
configurations related to artifact pulling/pushing policies have been
removed, users will need to view the new documentation and update
cache configuration accordingly.

Core
----

o BuildStream now also supports Python 3.9.

o BREAKING CHANGE: Changed API signatures to remove Scope type from the API
- Element.dependencies()
- Element.stage_dependency_artifacts()
- Element.search()
Elements now can only ever see dependencies in their build scope.

* BREAKING CHANGE: Changed ScriptElement.layout_add() API to take Element instances
in place of Element names

CLI
---

o BREAKING CHANGE: `bst shell --use-buildtree` is now a boolean flag.
`--use-buildtree=ask` and `--use-buildtree=try` are no longer supported.

o BREAKING CHANGE: `--remote` options removed, replaced by `--artifact-remote` or `--source-remote`

o BREAKING CHANGE: All old obsolete/deprecated commands removed, including:
- bst fetch (now bst source fetch)
- bst track (now bst source track)
- bst checkout (now bst artifact checkout)
- bst pull (now bst artifact pull)
- bst push (now bst artifact push)


==================

1.93.5

==================

Format
------

o BREAKING CHANGE: Some project.conf keys are no longer allowed to be specified outside
of the project.conf file (they cannot be specified in an include file), these include:
- name
- element-path
- min-version
- plugins

CLI
---

o Add `bst source push` subcommand. This command pushes element sources to a
remote source cache.
o `bst source track` now also accepts "build" and "run" as inputs.

Artifacts
---------

o BREAKING CHANGE: Use Remote Asset API for remote artifact and source caches.
Existing artifact servers are not compatible and need to be updated to the
latest version which will then allow them to be repopulated with new
artifacts.

Plugins
-------

o tar: filter out 'dev' nodes from the tar archives when extracting them

o `buildstream.testing` module now requires pytest >= 6.0.1.


==================

1.93.4

==================

Core
----

o The bwrap sandboxing backend and the SafeHardlinks FUSE filesystem
have been dropped. buildbox-run is now the only sandboxing backend.


CLI
---

o `bst shell --build` will now automatically fetch missing sources.
o `bst build --deps` now also accepts "build" as an input.
o `bst source fetch --deps` now also accepts "build" and "run" as inputs.
o `bst artifact pull --deps` now also accepts "build" and "run" as inputs.
o `bst artifact push --deps` now also accepts "build" and "run" as inputs.
o Full paths can now be used to address elements across multiple junction boundaries


Format
------

o BREAKING CHANGE: Now deprecation warnings are suppressed using the `allow-deprecated`
configuration with the plugin origins in project.conf, instead of on the
source/element overrides section (See issue 1291)
o BREAKING CHANGE: The `target` option of junctions has been completely removed,
Use `link` elements instead.
o Variables from an element can now be used in source configurations
o Full paths can now be used to address elements across multiple junction boundaries
o A new "junction" plugin origin allows loading of plugins across junction boundaries
o Support buildstream2.conf as a user configuration, allowing parallel installation
of bst 1 & bst 2


Plugins
-------

o Cache keys will change for all elements that have defined the
`command-subdir` variable. This is the result of fixing a bug where this
variable was not included in the cache key correctly.
o The `pip` element has been removed. Please use the one from bst-plugins-experimental
o Introduced new `link` element which can be used as a symbolic link to other
elements or junctions, in the local project or in subprojects.
o The DownloadableFileSource is now public API

API
---

o `Element.node_subst_vars` and `Element.node_subst_sequence_vars` are now deprecated
and will get removed in the next version. All config entries are now resolved so there
is no need to use them anymore.


==================

1.93.3

==================

o BREAKING CHANGE: Removed BST_REQUIRED_VERSION_[MAJOR/MINOR] from plugin base class,
this is now replaced with BST_MIN_VERSION which is now a hard requirement.

o BREAKING CHANGE: Removed BST_FORMAT_VERSION from plugin base class, this is no
longer supported.

o buildbox-run is now the default sandbox backend on all platforms


==================

Page 3 of 6

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.