chore: prepare v23.1.8 release

.github/workflows/label-merge-conflicts.yml

@@ -11,11 +11,12 @@ on:
 permissions:
   contents: read
   pull-requests: write
+  # issues: write is required so the action can manage labels and post comments on PRs
+  issues: write
   # Enforce other not needed permissions are off
   actions: none
   checks: none
   deployments: none
-  issues: none
   #metadata: read
   packages: none
   repository-projects: none
@@ -27,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: check if prs are dirty
-        uses: eps1lon/actions-label-merge-conflict@releases/2.x
+        uses: eps1lon/actions-label-merge-conflict@v3.1.0
         with:
           dirtyLabel: "needs rebase"
           repoToken: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/merge-check.yml

@@ -1,7 +1,10 @@
 name: Check Merge Fast-Forward Only
 
 permissions:
+  contents: read
   pull-requests: write
+  # Required so we can apply labels to PRs (labels go through the issues API)
+  issues: write
 
 on:
   push:
@@ -42,11 +45,16 @@ jobs:
           fi
 
       - name: add labels
-        uses: actions-ecosystem/action-add-labels@v1
-        if: failure()
+        uses: actions/github-script@v8
+        if: failure() && github.event.pull_request
         with:
-          labels: |
-            needs rebase
+          script: |
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              labels: ['needs rebase']
+            });
 
       - name: comment
         uses: mshick/add-pr-comment@v2

.github/workflows/release_docker_hub.yml

@@ -33,7 +33,7 @@ jobs:
         echo "build_tag=${TAG#v}" >> $GITHUB_OUTPUT
 
     - name: Set suffix
-      uses: actions/github-script@v6
+      uses: actions/github-script@v8
       id: suffix
       with:
         result-encoding: string

.github/workflows/semantic-pull-request.yml

@@ -12,7 +12,7 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

configure.ac

@@ -2,7 +2,7 @@ AC_PREREQ([2.69])
 dnl Don't forget to push a corresponding tag when updating any of _CLIENT_VERSION_* numbers
 define(_CLIENT_VERSION_MAJOR, 23)
 define(_CLIENT_VERSION_MINOR, 1)
-define(_CLIENT_VERSION_BUILD, 7)
+define(_CLIENT_VERSION_BUILD, 8)
 define(_CLIENT_VERSION_IS_RELEASE, true)
 define(_COPYRIGHT_YEAR, 2026)
 define(_COPYRIGHT_HOLDERS,[The %s developers])

contrib/containers/ci/ci-slim.Dockerfile

@@ -81,7 +81,6 @@ RUN uv pip install --system --break-system-packages \
     flake8==5.0.4 \
     jinja2 \
     lief==0.13.2 \
-    multiprocess \
     mypy==0.981 \
     pyzmq==24.0.1 \
     vulture==2.6

contrib/containers/guix/scripts/setup-sdk

@@ -15,6 +15,35 @@ XCODE_RELEASE="${XCODE_RELEASE:-15A240d}"
 XCODE_ARCHIVE="Xcode-${XCODE_VERSION}-${XCODE_RELEASE}-extracted-SDK-with-libcxx-headers"
 XCODE_AR_PATH="${SDK_SOURCES}/${XCODE_ARCHIVE}.tar.gz"
 
+# actions/upload-artifact rejects paths containing characters that are not
+# portable across filesystems (notably ':'). The Xcode SDK ships thousands of
+# Perl man pages under usr/share/man with '::' in the filename
+# (e.g. APR::Base64.3pm). Compilation only needs headers/libs/tbd files; man
+# pages are unused by depends/mac and guix darwin builds. Strip them after
+# extract so CI can hand the prepared SDK tree to downstream jobs as an
+# artifact (and so cache entries stay portable) without packaging changes in
+# the pull_request_target caller workflows (which resolve from the default
+# branch and cannot be fixed from a release-branch PR head alone).
+sanitize_sdk_for_artifacts() {
+    local sdk_root="$1"
+    local man_dir="${sdk_root}/usr/share/man"
+
+    if [ -d "${man_dir}" ]; then
+        echo "Removing SDK man pages incompatible with actions/upload-artifact..."
+        rm -rf "${man_dir}"
+    fi
+
+    # Belt-and-suspenders: drop any remaining files whose names contain the
+    # characters upload-artifact rejects, in case a future SDK adds more.
+    # See: https://github.com/actions/upload-artifact/issues/546
+    if [ -d "${sdk_root}" ]; then
+        find "${sdk_root}" \( -type f -o -type l \) \
+            \( -name '*:*' -o -name '*"*' -o -name '*<*' -o -name '*>*' \
+               -o -name '*|*' -o -name '*\**' -o -name '*\?*' \) \
+            -print -delete 2>/dev/null || true
+    fi
+}
+
 if [ ! -d "${SDK_PATH}/${XCODE_ARCHIVE}" ]; then
     if [ ! -f "${XCODE_AR_PATH}" ]; then
         echo "Downloading macOS SDK..."
@@ -24,4 +53,9 @@ if [ ! -d "${SDK_PATH}/${XCODE_ARCHIVE}" ]; then
     echo "Extracting macOS SDK..."
     mkdir -p "${SDK_PATH}"
     tar -C "${SDK_PATH}" -xf "${XCODE_AR_PATH}"
+    sanitize_sdk_for_artifacts "${SDK_PATH}/${XCODE_ARCHIVE}"
+else
+    # Existing tree (e.g. restored from an older cache that still has man
+    # pages): ensure it is safe to re-upload if a later step packages it.
+    sanitize_sdk_for_artifacts "${SDK_PATH}/${XCODE_ARCHIVE}"
 fi