core: update ChangeLog (#2325)

bound the configured proxy username and password before they are copied into the fixed stack buffer in network_pass_socks5proxy, otherwise a login longer than the buffer (a long password or token) overruns it while building the SOCKS5 auth request.

.github/workflows/ci.yml

@@ -131,7 +131,7 @@ jobs:
         sudo apt-get update -qq
         sudo apt-get --yes --no-install-recommends install ${{ env.CHECK_DEPS_UBUNTU }}
         pipx install msgcheck ruff
-        cargo install --version 0.0.10 poexam
+        cargo install --version 0.0.11 poexam
 
     - name: Check gettext files (msgcheck)
       run: msgcheck po/*.po

.poexam/poexam.toml

@@ -7,9 +7,11 @@ select = [
     "checks",
 ]
 ignore = [
+    "acronyms",
     "brackets",
     "double-quotes",
     "double-words",
+    "functions",
     "html-tags",
     "paths",
     "unchanged",

CHANGELOG.md

@@ -16,22 +16,38 @@ SPDX-License-Identifier: GPL-3.0-or-later
 
 ### Added
 
+- relay/api: add resource `GET /api/scripts`
 - relay: add option relay.network.unix_socket_permissions ([#2317](https://github.com/weechat/weechat/issues/2317))
+- script: add info "script_languages"
 
 ### Fixed
 
 - core: fix option weechat.look.color_real_white not applied when color is "white" on 16+ colors terminals ([#1742](https://github.com/weechat/weechat/issues/1742))
+- core: fix buffer overflow in connection to SOCKS5 proxy ([#2325](https://github.com/weechat/weechat/issues/2325))
 - api: fix infinite loop in function string_replace when the search string is empty
 - irc: fix tag in message with list of names when joining a channel
 - fset: remove error displayed in core buffer when clicking with the mouse below the last option displayed
 - irc: limit size of data received from the server to prevent memory exhaustion
 - irc: fix out-of-bounds read on incoming DCC command with a quoted filename ending the message ([#2322](https://github.com/weechat/weechat/issues/2322))
-- relay: limit size of decompressed websocket frame with permessage-deflate to prevent memory exhaustion ([GHSA-v2v4-45wm-5cr3](https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3))
+- relay: limit size of decompressed websocket frame with permessage-deflate to prevent memory exhaustion ([GHSA-v2v4-45wm-5cr3](https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3), [CVE-2026-53524](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53524))
+- relay: limit size of received websocket frame and HTTP body to prevent memory exhaustion
+- relay: limit size of partial message received while reading an HTTP request to prevent memory exhaustion
+- relay: fix timing attack on password authentication ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc), [CVE-2026-53525](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53525))
+- relay: fix out-of-bounds read in dump of data ([#2324](https://github.com/weechat/weechat/issues/2324))
+- api, relay: fix timing attack on TOTP validation ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc), [CVE-2026-53525](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53525))
+- xfer: replace directory separator in remote nick by underscore in download filename to prevent writing the file outside the download directory ([#2321](https://github.com/weechat/weechat/issues/2321))
+- xfer: fix out-of-bounds read when receiving empty line in DCC chat ([#2323](https://github.com/weechat/weechat/issues/2323))
+
+## Version 4.9.2 (2026-06-07)
+
+### Fixed
+
+- api: fix infinite loop in function string_replace when the search string is empty
+- irc: limit size of data received from the server to prevent memory exhaustion
+- irc: fix out-of-bounds read on incoming DCC command with a quoted filename ending the message ([#2322](https://github.com/weechat/weechat/issues/2322))
 - relay: limit size of received websocket frame and HTTP body to prevent memory exhaustion
 - relay: limit size of partial message received while reading an HTTP request to prevent memory exhaustion
-- relay: fix timing attack on password authentication ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc))
 - relay: fix out-of-bounds read in dump of data ([#2324](https://github.com/weechat/weechat/issues/2324))
-- api, relay: fix timing attack on TOTP validation ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc))
 - xfer: replace directory separator in remote nick by underscore in download filename to prevent writing the file outside the download directory ([#2321](https://github.com/weechat/weechat/issues/2321))
 - xfer: fix out-of-bounds read when receiving empty line in DCC chat ([#2323](https://github.com/weechat/weechat/issues/2323))
 
@@ -41,9 +57,9 @@ SPDX-License-Identifier: GPL-3.0-or-later
 
 - core: fix option weechat.look.color_real_white not applied when color is "white" on 16+ colors terminals ([#1742](https://github.com/weechat/weechat/issues/1742))
 - irc: fix tag in message with list of names when joining a channel
-- relay: limit size of decompressed websocket frame with permessage-deflate to prevent memory exhaustion ([GHSA-v2v4-45wm-5cr3](https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3))
-- relay: fix timing attack on password authentication ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc))
-- api, relay: fix timing attack on TOTP validation ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc))
+- relay: limit size of decompressed websocket frame with permessage-deflate to prevent memory exhaustion ([GHSA-v2v4-45wm-5cr3](https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3), [CVE-2026-53524](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53524))
+- relay: fix timing attack on password authentication ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc), [CVE-2026-53525](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53525))
+- api, relay: fix timing attack on TOTP validation ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc), [CVE-2026-53525](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53525))
 
 ## Version 4.9.0 (2026-03-29)
 

doc/en/weechat_relay_api.en.adoc

@@ -1179,6 +1179,51 @@ HTTP/1.1 200 OK
 ]
 ----
 
+[[resource_scripts]]
+=== Scripts
+
+Return loaded scripts (all languages).
+
+Endpoint:
+
+----
+GET /api/scripts
+----
+
+Request example:
+
+[source,shell]
+----
+curl -L -u 'plain:secret_password' 'https://localhost:9000/api/scripts'
+----
+
+Response:
+
+[source,http]
+----
+HTTP/1.1 200 OK
+----
+
+[source,json]
+----
+[
+    {
+        "name": "highmon.pl",
+        "version": "2.7",
+        "description": "Highlight Monitor",
+        "author": "KenjiE20",
+        "license": "GPL3"
+    },
+    {
+        "name": "go.py",
+        "version": "3.1.1",
+        "description": "Quick jump to buffers",
+        "author": "Sébastien Helleu <flashcode@flashtux.org>",
+        "license": "GPL3"
+    }
+]
+----
+
 [[resource_input]]
 === Input
 
@@ -1510,6 +1555,7 @@ Body types that can be returned:
 * `nick_group` (object)
 * `nick` (object)
 * `hotlist` (object)
+* `scripts` (array)
 * `ping` (object)
 
 [TIP]

doc/fr/weechat_relay_api.fr.adoc

@@ -1191,6 +1191,51 @@ HTTP/1.1 200 OK
 ]
 ----
 
+[[resource_scripts]]
+=== Scripts
+
+Retourner la liste des scripts chargés (tous les langages).
+
+Point de terminaison :
+
+----
+GET /api/scripts
+----
+
+Exemple de requête :
+
+[source,shell]
+----
+curl -L -u 'plain:secret_password' 'https://localhost:9000/api/scripts'
+----
+
+Réponse :
+
+[source,http]
+----
+HTTP/1.1 200 OK
+----
+
+[source,json]
+----
+[
+    {
+        "name": "highmon.pl",
+        "version": "2.7",
+        "description": "Highlight Monitor",
+        "author": "KenjiE20",
+        "license": "GPL3"
+    },
+    {
+        "name": "go.py",
+        "version": "3.1.1",
+        "description": "Quick jump to buffers",
+        "author": "Sébastien Helleu <flashcode@flashtux.org>",
+        "license": "GPL3"
+    }
+]
+----
+
 [[resource_input]]
 === Entrée
 
@@ -1530,6 +1575,7 @@ Les types de corps qui peuvent être retournés :
 * `nick_group` (objet)
 * `nick` (objet)
 * `hotlist` (objet)
+* `scripts` (tableau)
 * `ping` (objet)
 
 [TIP]

doc/sr/weechat_relay_api.sr.adoc

@@ -1181,6 +1181,53 @@ HTTP/1.1 200 OK
 ]
 ----
 
+// TRANSLATION MISSING
+[[resource_scripts]]
+=== Scripts
+
+// TRANSLATION MISSING
+Return loaded scripts (all languages).
+
+Крајња тачка:
+
+----
+GET /api/scripts
+----
+
+Пример захтева:
+
+[source,shell]
+----
+curl -L -u 'plain:secret_password' 'https://localhost:9000/api/scripts'
+----
+
+Одговор:
+
+[source,http]
+----
+HTTP/1.1 200 OK
+----
+
+[source,json]
+----
+[
+    {
+        "name": "highmon.pl",
+        "version": "2.7",
+        "description": "Highlight Monitor",
+        "author": "KenjiE20",
+        "license": "GPL3"
+    },
+    {
+        "name": "go.py",
+        "version": "3.1.1",
+        "description": "Quick jump to buffers",
+        "author": "Sébastien Helleu <flashcode@flashtux.org>",
+        "license": "GPL3"
+    }
+]
+----
+
 [[resource_input]]
 === Input
 
@@ -1510,6 +1557,7 @@ GUID `258EAFA5-E914-47DA-95CA-C5AB0DC85B11` (SHA-1 се кодира у base64).
 * `nick_group` (објекат)
 * `nick` (објекат)
 * `hotlist` (објекат)
+* `scripts` (низ)
 * `ping` (објекат)
 
 [TIP]

po/cs.po

@@ -23,7 +23,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:01+0200\n"
 "Last-Translator: Ondřej Súkup <mimi.vx@gmail.com>\n"
 "Language-Team: Czech <weechat-dev@nongnu.org>\n"
@@ -16068,6 +16068,10 @@ msgstr "načteny %s skripty:"
 msgid "script name with extension"
 msgstr "seznam skriptů"
 
+#, fuzzy
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "čárkami oddělený seznam slovníků, které použít pro tento buffer"
+
 #, fuzzy
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr "jméno serveru (zástupný znak \"*\" je povolen) (volitelné)"

po/de.po

@@ -29,8 +29,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
-"PO-Revision-Date: 2026-05-30 14:01+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
+"PO-Revision-Date: 2026-06-09 10:41+0200\n"
 "Last-Translator: Nils Görs <weechatter@arcor.de>\n"
 "Language-Team: German - Germany <weechat-dev@nongnu.org>\n"
 "Language: de\n"
@@ -17510,6 +17510,11 @@ msgstr "1 falls Skript geladen wurde"
 msgid "script name with extension"
 msgstr "Skriptname mit Erweiterung"
 
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr ""
+"durch Kommata getrennte Liste von Erweiterungen: Endung mit unterstützen "
+"Sprachen"
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
 "Name des Skriptes, mit Dateierweiterung (Platzhalter \"*\" kann verwendet "

po/es.po

@@ -24,7 +24,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:01+0200\n"
 "Last-Translator: Santiago Forero <santiago@forero.xyz>\n"
 "Language-Team: Spanish - Spain <weechat-dev@nongnu.org>\n"
@@ -16346,6 +16346,11 @@ msgstr "scripts en %s cargados:"
 msgid "script name with extension"
 msgstr "lista de scripts"
 
+#, fuzzy
+#| msgid "comma separated list of file name extensions for plugins"
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "lista separada por comas de extensiones de archivo para plugins"
+
 #, fuzzy
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""

po/fr.po

@@ -23,8 +23,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
-"PO-Revision-Date: 2026-05-30 14:01+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
+"PO-Revision-Date: 2026-06-08 23:14+0200\n"
 "Last-Translator: Sébastien Helleu <flashcode@flashtux.org>\n"
 "Language-Team: French - France <weechat-dev@nongnu.org>\n"
 "Language: fr\n"
@@ -17182,6 +17182,9 @@ msgstr "1 si le script est chargé"
 msgid "script name with extension"
 msgstr "nom du script avec l'extension"
 
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "liste de extension:extension_fichier avec les langages supportés"
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
 "nom du script avec extension (le caractère joker \"*\" est autorisé) "

po/hu.po

@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-03-08 08:59+0100\n"
 "Last-Translator: Andras Voroskoi <voroskoi@frugalware.org>\n"
 "Language-Team: Hungarian <weechat-dev@nongnu.org>\n"
@@ -15314,6 +15314,9 @@ msgstr "FIFO cső bezárva\n"
 msgid "script name with extension"
 msgstr "Aliaszok listája:\n"
 
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr ""
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
 

po/it.po

@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:02+0200\n"
 "Last-Translator: Esteban I. Ruiz Moreno <exio4.com@gmail.com>\n"
 "Language-Team: Italian <weechat-dev@nongnu.org>\n"
@@ -16432,6 +16432,11 @@ msgstr "script %s caricati:"
 msgid "script name with extension"
 msgstr "elenco degli script"
 
+#, fuzzy
+#| msgid "comma separated list of file name extensions for plugins"
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "elenco separato da virgole di estensioni dei nomi file per i plugin"
+
 #, fuzzy
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""

po/ja.po

@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:02+0200\n"
 "Last-Translator: AYANOKOUZI, Ryuunosuke <i38w7i3@yahoo.co.jp>\n"
 "Language-Team: Japanese <weechat-dev@nongnu.org>\n"
@@ -16996,6 +16996,11 @@ msgstr "ロードされた %s スクリプト:"
 msgid "script name with extension"
 msgstr "スクリプトの拡張子のリスト"
 
+#, fuzzy
+#| msgid "comma separated list of file name extensions for plugins"
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "プラグインのファイル拡張子のコンマ区切りリスト"
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
 "拡張子を含めたスクリプト名 (ワイルドカード \"*\" を使うことができます) (任意)"

po/pl.po

@@ -24,7 +24,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:02+0200\n"
 "Last-Translator: Krzysztof Korościk <soltys@soltys.info>\n"
 "Language-Team: Polish <weechat-dev@nongnu.org>\n"
@@ -16747,6 +16747,11 @@ msgstr "1 jeśli skrypt jest załadowany"
 msgid "script name with extension"
 msgstr "nazwa skryptu z rozszerzeniem"
 
+#, fuzzy
+#| msgid "comma separated list of file name extensions for plugins"
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "oddzielona przecinkami lista rozszerzeń nazw plików dla wtyczek"
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
 "nazwa skryptu z rozszerzeniem (wildcard \"*\" jest dozwolony) (opcjonalne)\""

po/pt.po

@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:02+0200\n"
 "Last-Translator: Vasco Almeida <vascomalmeida@sapo.pt>\n"
 "Language-Team: Portuguese - Portugal <weechat-dev@nongnu.org>\n"
@@ -16869,6 +16869,11 @@ msgstr "scripts %s carregados:"
 msgid "script name with extension"
 msgstr "lista de extensões de script"
 
+#, fuzzy
+#| msgid "comma separated list of file name extensions for plugins"
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "lista de extensões de ficheiros separadas por vírgula para os plugins"
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
 "nome do script com extensão (o caráter universal \"*\" é permitido) "

po/pt_BR.po

@@ -46,7 +46,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:02+0200\n"
 "Last-Translator: Érico Nogueira <ericonr@disroot.org>\n"
 "Language-Team: Portuguese - Brazil <weechat-dev@nongnu.org>\n"
@@ -15838,6 +15838,10 @@ msgstr "scripts %s carregados:"
 msgid "script name with extension"
 msgstr "list de scripts"
 
+#, fuzzy
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "lista de dicionários (separados por vírgula) para uso neste buffer"
+
 #, fuzzy
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""

po/ru.po

@@ -23,7 +23,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-03-08 08:59+0100\n"
 "Last-Translator: Aleksey V Zapparov AKA ixti <ixti@member.fsf.org>\n"
 "Language-Team: Russian <weechat-dev@nongnu.org>\n"
@@ -15367,6 +15367,9 @@ msgstr "FIFO pipe закрыт\n"
 msgid "script name with extension"
 msgstr "Список сокращений:\n"
 
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr ""
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
 

po/sr.po

@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:02+0200\n"
 "Last-Translator: Ivan Pešić <ivan.pesic@gmail.com>\n"
 "Language-Team: Serbian <weechat-dev@nongnu.org>\n"
@@ -16695,6 +16695,11 @@ msgstr "1 ако је скрипта учитана"
 msgid "script name with extension"
 msgstr "име скрипте са екстензијом"
 
+#, fuzzy
+#| msgid "comma separated list of file name extensions for plugins"
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "листа екстензија имена фајлова за додатке раздвојених запетама"
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr "име скрипте са екстензијом (дозвољен је џокер „*”) (није обавезно)"
 

po/tr.po

@@ -23,7 +23,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2026-05-30 14:02+0200\n"
 "Last-Translator: Emir SARI <emir_sari@icloud.com>\n"
 "Language-Team: Turkish <weechat-dev@nongnu.org>\n"
@@ -17120,6 +17120,11 @@ msgstr "Hiçbir betik yüklenmedi"
 msgid "script name with extension"
 msgstr "betik uzantılarının listesi"
 
+#, fuzzy
+#| msgid "comma separated list of file name extensions for plugins"
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr "eklentiler için dosya adı uzantılarının virgülle ayrılmış listesi"
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr "betik adı, uzantı ile (\"*\" jokerine izin verilir) (isteğe bağlı)"
 

po/weechat.pot

@@ -23,7 +23,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2026-05-30 14:00+0200\n"
+"POT-Creation-Date: 2026-06-08 22:23+0200\n"
 "PO-Revision-Date: 2014-08-16 10:27+0200\n"
 "Last-Translator: Sébastien Helleu <flashcode@flashtux.org>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -14018,6 +14018,9 @@ msgstr ""
 msgid "script name with extension"
 msgstr ""
 
+msgid "comma-separated list of plugin:extension with supported languages"
+msgstr ""
+
 msgid "script name with extension (wildcard \"*\" is allowed) (optional)"
 msgstr ""
 

src/core/core-network.c

@@ -582,7 +582,13 @@ network_pass_socks5proxy (struct t_proxy *proxy, int sock, const char *address,
                           int port)
 {
     struct t_network_socks5 socks5;
-    unsigned char buffer[288];
+    /*
+     * buffer must be large enough for the username/password authentication
+     * request, which is the longest message sent/received here; according to
+     * RFC 1929 it is: version (1) + username length (1) + username (max 255)
+     * + password length (1) + password (max 255)
+     */
+    unsigned char buffer[2 + 255 + 1 + 255];
     int username_len, password_len, addr_len, addr_buffer_len;
     unsigned char *addr_buffer;
     char *username, *password;
@@ -631,6 +637,18 @@ network_pass_socks5proxy (struct t_proxy *proxy, int sock, const char *address,
         username_len = strlen (username);
         password_len = strlen (password);
 
+        /*
+         * username and password length are each stored on a single byte
+         * (RFC 1929), so they cannot exceed 255 bytes: reject longer values,
+         * otherwise the memcpy calls below would overflow the buffer
+         */
+        if ((username_len > 255) || (password_len > 255))
+        {
+            free (username);
+            free (password);
+            return 0;
+        }
+
         /* make username/password buffer */
         buffer[0] = 1;
         buffer[1] = (unsigned char) username_len;

src/plugins/relay/api/relay-api-msg.c

@@ -848,3 +848,40 @@ relay_api_msg_hotlist_to_json (struct t_gui_hotlist *hotlist)
 
     return json;
 }
+
+/*
+ * Create a JSON object with a script.
+ */
+
+cJSON *
+relay_api_msg_script_to_json (struct t_hdata *hdata, void *script, const char *extension)
+{
+    cJSON *json;
+    void *pointer;
+    const char *ptr_string;
+    char name[1024];
+
+    if (!hdata)
+        return NULL;
+
+    pointer = script;
+
+    json = cJSON_CreateObject ();
+    if (!json)
+        return NULL;
+
+    if (!script)
+        return json;
+
+    snprintf (name, sizeof (name),
+              "%s.%s",
+              weechat_hdata_string (hdata, script, "name"),
+              extension);
+    MSG_ADD_STR_BUF("name", name);
+    MSG_ADD_HDATA_STR("version", "version");
+    MSG_ADD_HDATA_STR("description", "description");
+    MSG_ADD_HDATA_STR("author", "author");
+    MSG_ADD_HDATA_STR("license", "license");
+
+    return json;
+}

src/plugins/relay/api/relay-api-msg.h

@@ -58,5 +58,7 @@ extern cJSON *relay_api_msg_nick_group_to_json (struct t_gui_nick_group *nick_gr
                                                 enum t_relay_api_colors colors);
 extern cJSON *relay_api_msg_completion_to_json (struct t_gui_completion *completion);
 extern cJSON *relay_api_msg_hotlist_to_json (struct t_gui_hotlist *hotlist);
+extern cJSON *relay_api_msg_script_to_json (struct t_hdata *hdata, void *script,
+                                            const char *extension);
 
 #endif /* WEECHAT_PLUGIN_RELAY_API_MSG_H */

src/plugins/relay/api/relay-api-protocol.c

@@ -764,6 +764,64 @@ RELAY_API_PROTOCOL_CALLBACK(hotlist)
     return RELAY_API_PROTOCOL_RC_OK;
 }
 
+/*
+ * Callback for resource "scripts".
+ *
+ * Routes:
+ *   GET /api/scripts
+ */
+
+RELAY_API_PROTOCOL_CALLBACK(scripts)
+{
+    cJSON *json;
+    char *info_languages, **languages, hdata_name[256], *pos;
+    int num_languages, i;
+    struct t_hdata *ptr_hdata;
+    void *ptr_script;
+
+    json = cJSON_CreateArray ();
+    if (!json)
+        return RELAY_API_PROTOCOL_RC_MEMORY;
+
+    info_languages = weechat_info_get ("script_languages", NULL);
+    if (info_languages)
+    {
+        languages = weechat_string_split (info_languages, ",", NULL,
+                                          WEECHAT_STRING_SPLIT_STRIP_LEFT
+                                          | WEECHAT_STRING_SPLIT_STRIP_RIGHT
+                                          | WEECHAT_STRING_SPLIT_COLLAPSE_SEPS,
+                                          0, &num_languages);
+        if (languages)
+        {
+            for (i = 0; i < num_languages; i++)
+            {
+                pos = strchr (languages[i], ':');
+                if (pos)
+                {
+                    pos[0] = '\0';
+                    snprintf (hdata_name, sizeof (hdata_name),
+                              "%s_script", languages[i]);
+                    ptr_hdata = weechat_hdata_get (hdata_name);
+                    ptr_script = weechat_hdata_get_list (ptr_hdata, "scripts");
+                    while (ptr_script)
+                    {
+                        cJSON_AddItemToArray (
+                            json,
+                            relay_api_msg_script_to_json (ptr_hdata, ptr_script, pos + 1));
+                        ptr_script = weechat_hdata_move (ptr_hdata, ptr_script, 1);
+                    }
+                }
+            }
+            weechat_string_free_split (languages);
+        }
+        free (info_languages);
+    }
+
+    relay_api_msg_send_json (client, RELAY_HTTP_200_OK, NULL, "scripts", json);
+    cJSON_Delete (json);
+    return RELAY_API_PROTOCOL_RC_OK;
+}
+
 /*
  * Callback for resource "input".
  *
@@ -1286,6 +1344,7 @@ relay_api_protocol_recv_http (struct t_relay_client *client)
         { "GET",     "version",    1,    0,  0,  RELAY_API_CB(version)    },
         { "GET",     "buffers",    1,    0,  3,  RELAY_API_CB(buffers)    },
         { "GET",     "hotlist",    1,    0,  3,  RELAY_API_CB(hotlist)    },
+        { "GET",     "scripts",    1,    0,  0,  RELAY_API_CB(scripts)    },
         { "POST",    "input",      1,    0,  0,  RELAY_API_CB(input)      },
         { "POST",    "completion", 1,    0,  0,  RELAY_API_CB(completion) },
         { "POST",    "ping",       1,    0,  0,  RELAY_API_CB(ping)       },

src/plugins/relay/api/relay-api.h

@@ -26,7 +26,7 @@ struct t_relay_client;
 enum t_relay_status;
 
 #define RELAY_API_VERSION_MAJOR 0
-#define RELAY_API_VERSION_MINOR 5
+#define RELAY_API_VERSION_MINOR 6
 #define RELAY_API_VERSION_PATCH 0
 #define RELAY_API_VERSION_NUMBER                                        \
     ((RELAY_API_VERSION_MAJOR << 16)                                    \

src/plugins/relay/api/weechat-relay-api.yaml

@@ -17,7 +17,7 @@ info:
   license:
     name: CC BY-NC-SA 4.0
     url: https://creativecommons.org/licenses/by-nc-sa/4.0/
-  version: 0.5.0
+  version: 0.6.0
 
 externalDocs:
   url: https://weechat.org/doc/
@@ -32,6 +32,7 @@ tags:
   - name: version
   - name: buffers
   - name: hotlist
+  - name: scripts
   - name: input
   - name: completion
   - name: ping
@@ -96,7 +97,7 @@ paths:
     get:
       tags:
         - version
-      description: Get the WeeChat and API versions
+      description: Get the WeeChat and API versions.
       parameters:
         - $ref: '#/components/parameters/totp'
       operationId: getVersion
@@ -531,7 +532,7 @@ paths:
     get:
       tags:
         - hotlist
-      description: Get hotlist
+      description: Get hotlist.
       operationId: getHotlist
       parameters:
         - $ref: '#/components/parameters/totp'
@@ -564,6 +565,37 @@ paths:
                 $ref: '#/components/schemas/Error'
       security:
         - password: []
+  /scripts:
+    get:
+      tags:
+        - scripts
+      description: Get list of loaded scripts.
+      operationId: getScripts
+      parameters:
+        - $ref: '#/components/parameters/totp'
+      responses:
+        '200':
+          description: Successful operation
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/Script'
+        '401':
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+        '503':
+          description: Out of memory
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+      security:
+        - password: []
   /input:
     post:
       tags:
@@ -1336,6 +1368,31 @@ components:
         - date
         - buffer_id
         - count
+    Script:
+      type: object
+      properties:
+        name:
+          type: string
+          description: script name
+          example: 'go.py'
+        version:
+          type: string
+          example: '3.1.1'
+        description:
+          type: string
+          example: 'Quick jump to buffers'
+        author:
+          type: string
+          example: 'Sébastien Helleu <flashcode@flashtux.org>'
+        license:
+          type: string
+          example: 'GPL3'
+      required:
+        - name
+        - version
+        - description
+        - author
+        - license
     Completion:
       type: object
       properties:

src/plugins/script/script-info.c

@@ -159,6 +159,37 @@ script_info_info_script_loaded_cb (const void *pointer, void *data,
     return NULL;
 }
 
+/*
+ * Return script info "script_languages".
+ */
+
+char *
+script_info_info_languages_cb (const void *pointer, void *data,
+                               const char *info_name,
+                               const char *arguments)
+{
+    char **output;
+    int i;
+
+    /* make C compiler happy */
+    (void) pointer;
+    (void) data;
+    (void) info_name;
+    (void) arguments;
+
+    output = weechat_string_dyn_alloc (256);
+    for (i = 0; i < SCRIPT_NUM_LANGUAGES; i++)
+    {
+        if (i > 0)
+            weechat_string_dyn_concat (output, ",", -1);
+        weechat_string_dyn_concat (output, script_language[i], -1);
+        weechat_string_dyn_concat (output, ":", -1);
+        weechat_string_dyn_concat (output, script_extension[i], -1);
+    }
+
+    return weechat_string_dyn_free (output, 0);
+}
+
 /*
  * Return script infolist "script_script".
  */
@@ -235,6 +266,11 @@ script_info_init (void)
         N_("1 if script is loaded"),
         N_("script name with extension"),
         &script_info_info_script_loaded_cb, NULL, NULL);
+    weechat_hook_info (
+        "script_languages",
+        N_("comma-separated list of plugin:extension with supported languages"),
+        NULL,
+        &script_info_info_languages_cb, NULL, NULL);
 
     /* infolist hooks */
     weechat_hook_infolist (

tests/unit/plugins/irc/test-irc-protocol.cpp

@@ -305,7 +305,7 @@ TEST_GROUP(IrcProtocolWithServer)
 
     void server_recv (const char *command)
     {
-        char str_command[4096];
+        char str_command[8192];
 
         record_start ();
         arraylist_clear (sent_messages);

tests/unit/plugins/relay/api/test-relay-api-msg.cpp

@@ -23,13 +23,18 @@
 
 #include "CppUTest/TestHarness.h"
 
+#include "tests.h"
+
 extern "C"
 {
+#include <string.h>
 #include <time.h>
 #include <sys/time.h>
 #include <cjson/cJSON.h>
 #include "src/core/core-hdata.h"
+#include "src/core/core-hook.h"
 #include "src/core/core-util.h"
+#include "src/core/weechat.h"
 #include "src/gui/gui-buffer.h"
 #include "src/gui/gui-chat.h"
 #include "src/gui/gui-color.h"
@@ -653,3 +658,63 @@ TEST(RelayApiMsg, HotlistToJson)
 
     gui_hotlist_remove_buffer (gui_buffers, 1);
 }
+
+/*
+ * Test functions:
+ *   relay_api_msg_script_to_json
+ */
+
+TEST(RelayApiMsg, ScriptToJson)
+{
+    struct t_hdata *ptr_hdata;
+    void *ptr_script;
+    cJSON *json, *json_obj;
+    char path_testapigen[PATH_MAX], path_testapi[PATH_MAX];
+    char *test_scripts_dir, str_command[(PATH_MAX * 2) + 128];
+    const char *ptr_test_scripts_dir;
+
+    POINTERS_EQUAL(NULL, relay_api_msg_script_to_json (NULL, NULL, NULL));
+
+    ptr_hdata = hook_hdata_get (NULL, "python_script");
+
+    json = relay_api_msg_script_to_json (ptr_hdata, NULL, NULL);
+    CHECK(json);
+    CHECK(cJSON_IsObject (json));
+    cJSON_Delete (json);
+
+    /* load a python script for this test */
+    ptr_test_scripts_dir = getenv ("WEECHAT_TESTS_SCRIPTS_DIR");
+    test_scripts_dir = strdup (
+        (ptr_test_scripts_dir) ?
+        ptr_test_scripts_dir : "./scripts/python");
+    snprintf (path_testapigen, sizeof (path_testapigen),
+              "%s%s%s",
+              test_scripts_dir,
+              DIR_SEPARATOR,
+              "testapigen.py");
+    snprintf (path_testapi, sizeof (path_testapi),
+              "%s%s%s",
+              test_scripts_dir,
+              DIR_SEPARATOR,
+              "testapi.py");
+    snprintf (str_command, sizeof (str_command),
+              "/script load %s", path_testapigen);
+    run_cmd (str_command);
+
+    ptr_script = hdata_get_list (ptr_hdata, "scripts");
+    CHECK(ptr_script);
+    json = relay_api_msg_script_to_json (ptr_hdata, ptr_script, "py");
+    CHECK(json);
+    CHECK(cJSON_IsObject (json));
+    WEE_CHECK_OBJ_STR("testapigen.py", json, "name");
+    WEE_CHECK_OBJ_STR("0.1", json, "version");
+    WEE_CHECK_OBJ_STR("Generate scripting API test scripts", json, "description");
+    WEE_CHECK_OBJ_STR("Sébastien Helleu <flashcode@flashtux.org>", json, "author");
+    WEE_CHECK_OBJ_STR("GPL3", json, "license");
+    cJSON_Delete (json);
+
+    /* unload script */
+    snprintf (str_command, sizeof (str_command),
+              "/script unload -q weechat_testapi.py");
+    run_cmd (str_command);
+}

tests/unit/plugins/relay/api/test-relay-api-protocol.cpp

@@ -23,6 +23,7 @@
 
 #include "CppUTest/TestHarness.h"
 
+#include "tests.h"
 #include "tests-record.h"
 
 extern "C"
@@ -34,6 +35,7 @@ extern "C"
 #include "src/core/core-string.h"
 #include "src/core/core-util.h"
 #include "src/core/core-version.h"
+#include "src/core/weechat.h"
 #include "src/gui/gui-buffer.h"
 #include "src/gui/gui-chat.h"
 #include "src/gui/gui-hotlist.h"
@@ -611,6 +613,65 @@ TEST(RelayApiProtocolWithClient, CbHotlist)
     gui_hotlist_remove_buffer (gui_buffers, 1);
 }
 
+/*
+ * Test functions:
+ *   relay_api_protocol_cb_scripts
+ */
+
+TEST(RelayApiProtocolWithClient, CbScripts)
+{
+    cJSON *json, *json_obj;
+    char path_testapigen[PATH_MAX], path_testapi[PATH_MAX];
+    char *test_scripts_dir, str_command[(PATH_MAX * 2) + 128];
+    const char *ptr_test_scripts_dir;
+
+    /* get scripts (no scripts loaded) */
+    test_client_recv_http ("GET /api/scripts", NULL, NULL);
+    WEE_CHECK_HTTP_CODE(200, "OK");
+    CHECK(json_body_sent[0]);
+    CHECK(cJSON_IsArray (json_body_sent[0]));
+    LONGS_EQUAL(0, cJSON_GetArraySize (json_body_sent[0]));
+
+    /* load a python script for this test */
+    ptr_test_scripts_dir = getenv ("WEECHAT_TESTS_SCRIPTS_DIR");
+    test_scripts_dir = strdup (
+        (ptr_test_scripts_dir) ?
+        ptr_test_scripts_dir : "./scripts/python");
+    snprintf (path_testapigen, sizeof (path_testapigen),
+              "%s%s%s",
+              test_scripts_dir,
+              DIR_SEPARATOR,
+              "testapigen.py");
+    snprintf (path_testapi, sizeof (path_testapi),
+              "%s%s%s",
+              test_scripts_dir,
+              DIR_SEPARATOR,
+              "testapi.py");
+    snprintf (str_command, sizeof (str_command),
+              "/script load %s", path_testapigen);
+    run_cmd (str_command);
+
+    /* get scripts (one loaded) */
+    test_client_recv_http ("GET /api/scripts", NULL, NULL);
+    WEE_CHECK_HTTP_CODE(200, "OK");
+    CHECK(json_body_sent[0]);
+    CHECK(cJSON_IsArray (json_body_sent[0]));
+    LONGS_EQUAL(1, cJSON_GetArraySize (json_body_sent[0]));
+    json = cJSON_GetArrayItem (json_body_sent[0], 0);
+    CHECK(json);
+    CHECK(cJSON_IsObject (json));
+    WEE_CHECK_OBJ_STR("testapigen.py", json, "name");
+    WEE_CHECK_OBJ_STR("0.1", json, "version");
+    WEE_CHECK_OBJ_STR("Generate scripting API test scripts", json, "description");
+    WEE_CHECK_OBJ_STR("Sébastien Helleu <flashcode@flashtux.org>", json, "author");
+    WEE_CHECK_OBJ_STR("GPL3", json, "license");
+
+    /* unload script */
+    snprintf (str_command, sizeof (str_command),
+              "/script unload -q weechat_testapi.py");
+    run_cmd (str_command);
+}
+
 /*
  * Test functions:
  *   relay_api_protocol_cb_completion

version.sh

@@ -41,7 +41,7 @@
 #     devel-number   the devel version as hex number ("0x04010000" for "4.1.0-dev")
 #
 
-weechat_stable="4.9.1"
+weechat_stable="4.9.2"
 weechat_devel="4.10.0-dev"
 
 stable_major=$(echo "${weechat_stable}" | cut -d"." -f1)