This is clearer to both readers and analysis tools like CodeChecker, squashing
the following (false positive) warning:

  [MEDIUM] lib/dotgen/dotinit.c:366:1: Potential leak of memory pointed to by
    'ps' [unix.Malloc]
  }
  ^

This also aligns more with how `ND_pos` is used in the rest of Graphviz.

Reported-by: CodeChecker 6.26.2

CodeChecker says:

  [LOW] plugin/xlib/gvdevice_xlib.c:594:5: Value stored to 'ret' is never read
    [deadcode.DeadStores]
      ret = inotify_rm_watch(inotify_fd, wd);
      ^

If this call fails, it is not clear what the caller can do beyond continuing, so
we ignore the return value.

Reported-by: CodeChecker 6.26.2

CodeChecker says:

  [LOW] lib/sfdpgen/Multilevel.c:277:3: Value stored to 'cgrid' is never read
    [deadcode.DeadStores]
    cgrid = Multilevel_establish(cgrid, ctrl);
    ^

Pulling the thread on this reveals the return value of `Multilevel_establish`
gives no new information to the caller.

Reported-by: CodeChecker 6.26.2

CodeChecker says:

  [LOW] lib/pack/ccomps.c:522:3: Value stored to 'n' is never read
    [deadcode.DeadStores]
    n = agfstnode(g);
    ^

The last use of this was removed in ddce1a6a.

Reported-by: CodeChecker 6.26.2

This should hopefully prevent issues like that fixed in the previous commit
being reintroduced in future.

pack etc: CodeChecker-driven improvements

See merge request !4662

Feel authored Sep 30, 2025 and Matthew Fernandez committed Nov 28, 2025

This squashes other commits:
  • man dot for neato -n3
  • neato -n3: minor fixes
  • neato -n3: code style

Style in these files is not particularly consistent, but I would like to at
least not go backwards.

Gitlab: closes #2736

neato -n3

Closes #2736

See merge request !4671

CodeChecker says:

  [LOW] lib/sparse/SparseMatrix.c:482:3: Value stored to 'a' is never read
    [deadcode.DeadStores]
    a = A->a;
    ^

Reported-by: CodeChecker 6.26.2

The earlier `switch` will have caused any control flow that would have reached
these points to already return.

This should hopefully avoid issues like the dead store previously removed from
being reintroduced in future. This also makes `a` const to reflect it is
unmodified in this context.

This should give better diagnostics if any of these cases are hit.

This function always returns its input, providing no extra information to the
caller.

`SparseMatrix_general_new` always returns non-null.

`SparseMatrix_new` always returns non-null.

`SparseMatrix_new` always returns non-null.

`SparseMatrix_new` always returns non-null.

This is the equivalent of 7328b53d but applied
to `SparseMatrix_multiply3`.

`x + 1 <= x` is not an appropriate way to check whether `x + 1` overflows.
Signed integer overflow is Undefined Behavior for which the compiler is allowed
to emit anything, most likely collapsing this expression into the constant
`false`.

`x + 1 <= x` is not an appropriate way to check whether `x + 1` overflows.
Signed integer overflow is Undefined Behavior for which the compiler is allowed
to emit anything, most likely collapsing this expression into the constant
`false`.

sparse: more CodeChecker-driven improvements

See merge request !4663

David Fyfe authored Oct 16, 2025 and Matthew Fernandez committed Nov 29, 2025

Implements rounded corner support for orthogonal edge routing with
opt-in behavior to maintain backward compatibility.

Features:
- Supports radius=N attribute for explicit radius control
  eg. `edge [radius=5];`
- Detects orthogonal corners by analyzing direction changes
- Truncates edge segments at corners by the radius distance
- Supports mixed rounded and square corners in same graph
  eg. `A1 -> B3 [color=red,radius=12];`

Backward compatibility:
- Radius defaults to 0 (square corners) maintaining existing behavior
- Only applies rounding when radius > 0 is set
- No behavior change for existing graphs without rounded style

Add radius attribute for rounded corners on orthogonal edges

See merge request !4672

When `php` was available, building of the PHP bindings would be enabled,
unconditional on whether `php-config` had been found. The result of this would
be that compilation failed, as none of the paths needed to build the PHP
bindings had been detected.

This appears to have been a mistake in 4129afb8.

This change leaves `php` discovery in place because this is used in a test
target. The test target is not currently run but may be resurrected in future.

Build system support for the PHP bindings has had a rocky history. It is
suspected this is not the last bug that will be discovered in this logic.

Gitlab: fixes #2788
Reported-by: FeRD (Frank Dana) <ferdnyc@gmail.com>

Autotools: fix: do not build PHP bindings when 'php-config' is not found

Closes #2788

See merge request !4665

When trying to add Ubuntu 25.10 CI jobs, it was discovered that Smyrna
dependencies are not packaged for Ubuntu 25.10 which will probably require
conditional syntax in debian/graphviz.install that in turn requires
compatibility level 13.¹ This change is a step towards upgrading to
compatibility level 13.

The short options to `dh_*` are expanded due to this point in the upgrade
advice:²

  All debhelper like tools based on the official debhelper library (including
  `dh` and the official `dh_*` tools) no longer accepts abbreviated command
  parameters. At the same time, `dh` now optimizes out calls to redundant `dh_*`
  helpers even when passed long command line options.

The `dh_missing` invocation gained `--list-missing` due to this point in the
upgrade advice:²

  The `dh_missing` command will now default to `--fail-missing`. This can be
  reverted to a non-fatal warning by explicitly passing `--list-missing` like it
  was in compat 12.

¹ https://manpages.debian.org/trixie/debhelper/debhelper.7.en.html#Substitutions_in_debhelper_config_files
² https://manpages.debian.org/trixie/debhelper/debhelper-compat-upgrade-checklist.7.en.html#v13

debian: upgrade Debian compatibility level 12 → 13

See merge request !4664

Given the allocation of this array was incorrect in the past (see
e5a5360c), it seems a good idea to remove
assumptions about the maximum size of this array from this code.

During testing this change, it was discovered that the “reposition children”
loop was actually processing unset (but zeroed) boxes beyond the end of the list
in some circumstances. Hence why this change also changes the bounds check of
this loop.

osage layout: remove manual memory management of 'gs'

See merge request !4666

This removes the need to cast as well as making this code more locally
understandable.

CodeChecker says:

  [LOW] lib/sfio/sfvscanf.c:198:3: Value stored to 'n' is never read
    [deadcode.DeadStores]
      n = ++argn;
      ^

It seems this became unused in 1d3e1bd0, but the
prolific reuse of this variable made it difficult for humans and compilers to
spot this.

Reported-by: CodeChecker 6.26.2

CodeChecker says:

  [LOW] lib/sfio/sfvscanf.c:240:3: Value stored to 'n' is never read
    [deadcode.DeadStores]
      n = ++argn;
      ^

It seems this became unused in 1d3e1bd0, but the
prolific reuse of this variable made it difficult for humans and compilers to
spot this.

Note that this change also makes `argn` unused, so we can remove it too.

Reported-by: CodeChecker 6.26.2

This is a step towards reducing the scope of `n`, making it more likely
compilers are able to catch issues like those addressed in the previous commits.

This is a step towards reducing the scope of `n`, making it more likely
compilers are able to catch issues like those addressed in the previous commits.

This was most likely an optimization to avoid multiple memory reads when
dereferencing `form`. This is no longer a concern on contemporary compilers that
are able to de-dupe these reads themselves.

This is a step towards reducing the scope of `n`, making it more likely
compilers are able to catch issues like those addressed in the previous commits.

This should hopefully make it more likely compilers will spot redundant code
involving this variable, like that fixed in previous commits.

Forum: https://forum.graphviz.org/t/how-to-make-graphviz-use-config-fontconfig-fonts-conf-by-default/3227/42
Reported-by: forum user decision-making-mike

Forum: https://forum.graphviz.org/t/how-to-make-graphviz-use-config-fontconfig-fonts-conf-by-default/3227/42
Reported-by: forum user decision-making-mike

sfio: more CodeChecker-driven improvements

See merge request !4668

chore(deps): update ubuntu:25.10 docker digest to 5922638

See merge request !4677

This change corrects a wart observed in 2f1c189b
that, during a release merge bubble in the history, the commit pre-merge
believes itself to be part of the _next_ development series (commit
0748394b in the diagram from
2f1c189b). All commits during normal operation
should now derive a correct version.

As we are now (hopefully) in a state where versioning is correct for all future
commits, the full list of past recent commits that derive incorrect versions is:
  1. 72100dec – derives 14.0.4~dev… instead of
     14.0.3~dev…
  2. de821c98 – on Cygwin, derives 14.0.4~dev…
     instead of 14.0.3
  3. fbdbf648 – derives 14.0.5~dev… instead of
     14.0.4~dev…
  4. b606b2e6 – on MinGW, derives 14.0.4 instead
     of 14.0.5~dev…
  5. 3ccdcd46 – on MinGW, derives 14.0.4 instead
     of 14.0.5~dev…
  6. 37938ce9 – on MinGW, derives 14.0.4 instead
     of 14.0.5~dev…
  7. d0a45ec6 – on MinGW, derives 14.0.4 instead
     of 14.0.5~dev…
  8. bc7e5487 – derives 14.0.6~dev… instead of
     14.0.5~dev…

Gitlab: #2733, #2785, #2789

gen_version: fix: make release commit pre-merge have the correct version

See merge request !4669

Note that this removes a use of `maxcnt`, more tightly bounding this allocation.

Gitlab: #2558

Gitlab: #2558

Gitlab: #2558

Note that this removes use of `maxcnt`, more tightly bounding these allocations.

Gitlab: #2558

neatogen: more CodeChecker-driven improvements

See merge request !4670

This appears to be silently failing in CI on all Debian-based platforms (Ubuntu
22.04, 24.04, 25.04) because all have PHP > 5. It is mysterious to me why
4e7a9007 hard coded this for PHP 5 as the top
level configure.ac has never had its equivalent hard coded to PHP 5.

As far as I can tell, this has been done correctly ever since debian/rules was
added in 4e7a9007.

88d7477c made this file preprocessed. So only
part of this item is still TODO.

debian: fix PHP extension directory discovery

See merge request !4673

This function is not used outside of its containing file.

Analyzing code paths into this logic reveals it is only ever possible to
construct a matrix with one of the other known types.

sparse: remove 'MATRIX_TYPE_UNKNOWN'

See merge request !4674

This is a safeguard against some upcoming changes to the code of this feature.

This avoids having to think about the total number of points exceeding what fits
in an `int`, despite how unlikely this may be.

This avoids having to think about the total number of points exceeding what fits
in an `int`, despite how unlikely this may be.

The remaining logic already has this effect.

This removes an error opportunity for `corners` and `num_corners` to get out of
sync. This also adds debug range checks to indexing accesses.

This is slightly simpler for humans and compilers to reason about.

This code apparently already assumes `seg_pt_count >= 2` as the preceding logic
writes ≥ 2 elements into a `seg_pt_count`-sized array. The logic preceding this
appears to deterministically set `seg_pt_count` ≥ 2.

This removes an error opportunity for `seg_pts` and `seg_pt_count` to get out of
sync. This also adds debug range checks to indexing accesses. We can also avoid
looping twice to figure out the number of points in advance, and instead
discover this as we go.

minor improvements to radius code

See merge request !4675

Stable Release 14.1.0

See merge request !4676