2026-07-24 Release

What's Changed

• Update vcpkg-tool-release-process. by @BillyONeal in #2070
• Use canonical vcpkg PURLs in dependency snapshots by @JamieMagee in #2072
• Add Git tree gitoids to SPDX SBOMs by @JamieMagee in #2074
• Fix dependency snapshot relationships and correlators by @JamieMagee in #2073
• Fix Qt plugins deployment with z-applocal by @vicroms in #2048
• Add "min-version" to vcpkg-tools.json. by @BillyONeal in #2067
• Fix CopyOptions::update_existing creating a 0 byte file when the destination is nonexistent. by @BillyONeal in #2068
• Fix unreplaced CMake variables in SBOMs. by @BillyONeal in #2075

Full Changelog: 2026-07-13...2026-07-24

2026-07-13 Release

What's Changed

• Fix collide on shared .partial extraction directory on POSIX by @Erik-White in #2036
• Sanitize DESTDIR on non-Windows platforms by @BillyONeal in #2039
• Update NPM dependencies. by @BillyONeal in #2047
• Support CURL_CA_BUNDLE like the curl command line tool by @Matus-p in #2042
• [curl] Add VCPKG_SSL_REVOKE_BEST_EFFORT to fix Schannel proxy revocation errors by @sdn9002 in #2043
• Change GITHUB_SERVER_URL to GITHUB_API_URL to allow submission of dependency graph data again by @rwindegger in #2056
• [z-applocal] Only log dependency deployment details with --verbose by @ricardoofnl in #2052
• Emit a PURL in generated SPDX SBOMs by @JamieMagee in #2049
• Add vcpkg print-usage + hueristic affirmation by @BillyONeal in #2045
• Update scripts SHA 2026-07-10. by @BillyONeal in #2061
• Do not abort when stdout is a broken pipe by @ricardoofnl in #2059
• Fix network isolation. by @BillyONeal in #2062

New Contributors

• @Erik-White made their first contribution in #2036
• @Matus-p made their first contribution in #2042
• @sdn9002 made their first contribution in #2043
• @rwindegger made their first contribution in #2056
• @ricardoofnl made their first contribution in #2052

Full Changelog: 2026-05-27...2026-07-13

2026-05-27 Release

What's Changed

• Accept libcurl.so as a provider of curl. by @podsvirov in #1984
• Add arm64 CMake presets, delete MSI extraction. by @BillyONeal in #1995
• Ignore HTTPS_PROXY and NO_PROXY if env variable is set to empty value by @TobiasFunk in #1988
• x-add-version: Regenerate baseline on --all. by @BillyONeal in #2003
• integrate install: Remove VS2015 integration. by @BillyONeal in #2011
• Fix empty vs. unset environment variables on Windows. by @BillyONeal in #1997
• Fix self-cascade bug in feature test baseline checking by @BillyONeal in #2017
• x-download: more output, error if no asset cache configured for --store by @autoantwort in #2014
• Nuget warning when using binary cache by @TobiasFunk in #2000
• Add OHOS (OpenHarmony / HarmonyOS) platform support by @jobor in #2004
• Update 1espt baselines by @BillyONeal in #2025
• install: Add switch to skip installation if packages exist in cache by @autoantwort in #1981
• Fix end to end tests on arm64-windows. by @BillyONeal in #2029
• [vcpkg-artifacts] Note that artifacts will be removed after July 1. by @BillyONeal in #2030

New Contributors

• @TobiasFunk made their first contribution in #1988
• @jobor made their first contribution in #2004

Full Changelog: 2026-04-08...2026-05-27

2026-04-08 Release

What's Changed

• Add manifest support to depend-info command by @dg0yt in #1909
• Add locks to buildtrees and packages. by @BillyONeal in #1979

Full Changelog: 2026-04-06...2026-04-08

2026-04-06 Release

What's Changed

• Move the install locking file to "installed" rather than VCPKG_ROOT. by @BillyONeal in #1938
• Update Component Governance manifest. by @BillyONeal in #1940
• Make z-applocal command cross-platform for PE dependency analysis by @zynfly in #1910
• Update vulnerable npm dependencies. by @BillyONeal in #1953
• [ci] Treat feature supports as 'top level'. by @BillyONeal in #1955
• [artifacts] Use JSON.parse rather than require for locale loading. by @BillyONeal in #1952
• [ci] Down with 'exclude', up with 'skip'. by @BillyONeal in #1956
• Use more recent curl headers when building for non-amd64. by @BillyONeal in #1957
• Bump picomatch from 2.3.1 to 2.3.2 in /vcpkg-artifacts by @dependabot[bot] in #1960
• Bump yaml from 2.8.0 to 2.8.3 in /vcpkg-artifacts by @dependabot[bot] in #1962
• Update SPDX license lists. by @BillyONeal in #1966
• Localized file check-in by OneLocBuild Task: Build definition ID 15684: Build ID 13679423 by @embeddedbot in #1967
• Update fmt and fix no-PCH builds. by @BillyONeal in #1965
• Update NPM dependencies. by @BillyONeal in #1971
• Complete shell escaping. by @BillyONeal in #1970
• Fix --skip-failures feature set divergence between PR and CI. by @BillyONeal in #1958
• Adopt libfuzzer to replace AFL. by @BillyONeal in #1951
• Bump lodash from 4.17.23 to 4.18.1 in /vcpkg-artifacts by @dependabot[bot] in #1972
• Update scripts sha 2026-04-02. by @BillyONeal in #1973
• Update the signed build lab and suppress fmt warning. by @BillyONeal in #1975

Full Changelog: 2026-03-04...2026-04-06

2026-03-04 Release

What's Changed

• Fix mismatched VCPKG_ROOT warnings when Visual Studio has vcpkg installed by @BillyONeal in #1931
• Add copilot /init output. by @BillyONeal in #1930
• Group feature test results by port. by @BillyONeal in #1933
• Accept tags in portsdiff and z-changelog. by @BillyONeal in #1935
• Bump minimatch in /vcpkg-artifacts by @dependabot[bot] in #1934
• Allow Terrapin Retrieval Tool env vars. by @BillyONeal in #1936
• Update scripts SHA 2026-03-04. by @BillyONeal in #1937

Full Changelog: 2026-02-21...2026-03-04

2026-02-21 Release

What's Changed

• Disable metrics for vcpkg-in-vcpkg. by @BillyONeal in #1925

Full Changelog: 2026-02-17...2026-02-21

2026-02-17 Release

What's Changed

• Upgrade CodeQL and disable on macos-ci. by @BillyONeal in #1893
• Test/fix internal dependencies in top level manifest. by @dg0yt in #1890
• dependencies.cpp optimizations by @dg0yt in #1891
• Deduplicate is_empty() calls and add {}s. by @BillyONeal in #1895
• Switch default Ninja minimal version to a reasonable value by @cqundefine in #1897
• Install files in parallel, redux by @BillyONeal in #1896
• Automate minting the release notes table. by @BillyONeal in #1903
• Bump lodash from 4.17.21 to 4.17.23 in /vcpkg-artifacts by @dependabot[bot] in #1905
• Add CMAKE_EXPORT_COMPILE_COMMANDS by @BillyONeal in #1904
• [tools] Fix missing executable permission on downloaded tools for Unix by @zynfly in #1911
• Use libcurl rather than curl command line by @BillyONeal in #1906
• Deduplicate "additional_file" in abi info. by @BillyONeal in #1914
• Remove optionality in ActionPlan and Summary by @BillyONeal in #1894
• Replace all Optional<T&> with T*. by @BillyONeal in #1898
• Update scripts sha 2026-02-12. by @BillyONeal in #1917
• Clamp invalid elapsed time instead of crashing in track_elapsed_us by @clee704 in #1918
• Suppress BinSkim errors in the Windows SDK. by @BillyONeal in #1920
• Fix BinSkim again by @BillyONeal in #1921
• Update scripts SHA 2026-02-17 by @BillyONeal in #1923
• More BinSkim suppressions. by @BillyONeal in #1924

New Contributors

• @zynfly made their first contribution in #1911
• @clee704 made their first contribution in #1918

Full Changelog: 2025-12-16...2026-02-17

2025-12-16 Release

What's Changed

• Plumb DiagnosticContext into ToolCache / download / caching. by @BillyONeal in #1842
• Delete VCPKG_PUBLIC_ABI_OVERRIDE and PlanTypes. by @BillyONeal in #1874
• Fix arm64 macOS GitHub Actions. by @BillyONeal in #1884
• Update vcpkg-scripts SHA 2025-12-16. by @BillyONeal in #1888

Full Changelog: 2025-12-05...2025-12-16

2025-12-05 Release

What's Changed

• Bump js-yaml from 4.1.0 to 4.1.1 in /vcpkg-artifacts by @dependabot[bot] in #1847
• Bump glob from 10.4.5 to 10.5.0 in /vcpkg-artifacts by @dependabot[bot] in #1857
• Test parent hashes without actual build by @dg0yt in #1870
• Fix qualified PackageSpec parse hang. by @BillyONeal in #1872
• Test --skip-failures and fix "static" cascade by @dg0yt in #1871
• Update scripts SHA 2025-12-03 and update github actions runners. by @BillyONeal in #1873

Full Changelog: 2025-11-19...2025-12-05