[pull] master from OSGeo:master

.github/workflows/android_cmake.yml

@@ -29,7 +29,7 @@ jobs:
         uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
 
       - name: Cache
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
         id: cache
         with:
           path: |

.github/workflows/cifuzz.yml

@@ -32,7 +32,7 @@ jobs:
         fuzz-seconds: 600
         dry-run: false
     - name: Upload Crash
-      uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
       if: failure() && steps.build.outcome == 'success'
       with:
         name: artifacts

.github/workflows/clang_static_analyzer.yml

@@ -1,4 +1,4 @@
-name: CLang Static Analyzer
+name: Clang Static Analyzer
 
 on:
     push:

.github/workflows/cmake_builds.yml

@@ -37,7 +37,7 @@ jobs:
     - name: Checkout GDAL
       uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
     - name: Setup cache
-      uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
       id: cache
       with:
           path: ${{ github.workspace }}/.ccache
@@ -218,6 +218,8 @@ jobs:
         export LD_LIBRARY_PATH=$GITHUB_WORKSPACE/install-gdal/lib
         $GITHUB_WORKSPACE/install-gdal/bin/gdalinfo --version
         PYTHONPATH=$GITHUB_WORKSPACE/install-gdal/lib/python3.8/site-packages python3 -c "from osgeo import gdal;print(gdal.VersionInfo(None))"
+        # Test fix for https://github.com/conda-forge/gdal-feedstock/issues/995
+        PYTHONWARNINGS="error" PYTHONPATH=$GITHUB_WORKSPACE/install-gdal/lib/python3.8/site-packages python3 -c "from osgeo import gdal"
         PYTHONPATH=$GITHUB_WORKSPACE/install-gdal/lib/python3.8/site-packages python3 $GITHUB_WORKSPACE/scripts/check_doc.py
     - name: CMake with rpath
       run: |
@@ -330,7 +332,7 @@ jobs:
             mingw-w64-x86_64-libgeotiff mingw-w64-x86_64-libpng mingw-w64-x86_64-libtiff mingw-w64-x86_64-openjpeg2
             mingw-w64-x86_64-python-pip mingw-w64-x86_64-python-numpy mingw-w64-x86_64-python-pytest mingw-w64-x86_64-python-setuptools mingw-w64-x86_64-python-lxml mingw-w64-x86_64-swig mingw-w64-x86_64-python-psutil mingw-w64-x86_64-blosc mingw-w64-x86_64-libavif
       - name: Setup cache
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
         id: cache
         with:
           path: ${{ github.workspace }}\.ccache
@@ -355,6 +357,7 @@ jobs:
           python -m pip install -r autotest/requirements.txt
       # Disable mySQL since C:/mysql/lib/mysqlclient.lib (unrelated to msys) is found, which causes linking issues
       # Set explicitly CMAKE_C|CXX_COMPILER otherwise C:/ProgramData/chocolatey/bin/gcc.exe would be used
+      # Disable GDAL_ENABLE_DRIVER_HDF5 because of https://github.com/OSGeo/gdal/issues/11181
       - name: Configure
         run: |
           cmake -S . -B build -G "${generator}" -Werror=dev \
@@ -367,7 +370,8 @@ jobs:
             -DCMAKE_PREFIX_PATH=/mingw64 \
             -DCMAKE_INSTALL_PREFIX=$PWD/install-gdal \
             "-DCMAKE_UNITY_BUILD=${CMAKE_UNITY_BUILD}" \
-            -DGDAL_USE_MYSQL:BOOL=OFF
+            -DGDAL_USE_MYSQL:BOOL=OFF \
+            -DGDAL_ENABLE_DRIVER_HDF5=OFF
         working-directory: ${{ github.workspace }}
       - name: Build
         run: cmake --build build -j 3
@@ -417,7 +421,6 @@ jobs:
     - uses: conda-incubator/setup-miniconda@a4260408e20b96e80095f42ff7f1a15b27dd94ca # v3.0.4
       with:
         activate-environment: gdalenv
-        miniforge-variant: Mambaforge
         miniforge-version: latest
         use-mamba: true
         auto-update-conda: true
@@ -432,7 +435,7 @@ jobs:
             cfitsio freexl geotiff libjpeg-turbo libpq libspatialite libwebp-base pcre pcre2 postgresql \
             sqlite tiledb zstd cryptopp cgal doxygen librttopo libkml openssl xz \
             openjdk ant qhull armadillo blas blas-devel libblas libcblas liblapack liblapacke blosc libarchive \
-            arrow-cpp pyarrow libaec libheif libavif cmake
+            arrow-cpp pyarrow libaec libheif libavif cmake fsspec
     - name: Check CMake version
       shell: bash -l {0}
       run: |
@@ -525,7 +528,6 @@ jobs:
     - uses: conda-incubator/setup-miniconda@a4260408e20b96e80095f42ff7f1a15b27dd94ca # v3.0.4
       with:
         activate-environment: gdalenv
-        miniforge-variant: Mambaforge
         miniforge-version: latest
         use-mamba: true
         auto-update-conda: true
@@ -604,11 +606,11 @@ jobs:
     - name: Setup xcode
       uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
       with:
-        xcode-version: 14.3
+        xcode-version: '15.4.0'
     - name: Checkout GDAL
       uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
     - name: Setup cache
-      uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
       id: cache
       with:
           path: ${{ github.workspace }}/.ccache

.github/workflows/code_checks.yml

@@ -65,6 +65,40 @@ jobs:
           cd build
           ../scripts/cppcheck.sh
 
+  cppcheck_master:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+
+      - name: Install Requirements
+        run: |
+          sudo apt update
+          sudo apt install -y git libsqlite3-dev ccache sqlite3 libproj-dev cmake g++ make
+
+      - name: Build cppcheck
+        run: |
+          git clone https://github.com/danmar/cppcheck
+          cd cppcheck
+          mkdir build
+          cd build
+          cmake .. -DCMAKE_BUILD_TYPE=Release
+          make -j$(nproc)
+          sudo make install
+          cd ../..
+
+      - name: Run cmake
+        run: |
+          mkdir build
+          cd build
+          cmake ..
+
+      - name: Run cppcheck test
+        run: |
+          cd build
+          # Do not fail the job. This is just used as a tool to monitor how we are regarding recent cppcheck
+          ../scripts/cppcheck.sh || /bin/true
+
   code_quality_checks:
     runs-on: ubuntu-latest
     steps:
@@ -119,7 +153,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
-      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
       - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
 
   doxygen:
@@ -143,7 +177,8 @@ jobs:
       - name: Install Requirements
         run: |
             sudo apt install python3-pip wget
-            sudo pip3 install cffconvert
+            # ruamel.yaml.clib 0.2.9 throws a 'TypeError: a string or stream input is required' when running cffconvert --validate
+            sudo pip3 install cffconvert "ruamel.yaml.clib<0.2.9"
 
       - name: Validate citation file
         run: |
@@ -159,7 +194,7 @@ jobs:
     - name: Checkout
       uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
     - name: Set up Python
-      uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
+      uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
       with:
         python-version: 3.8
     - name: Install lint tool

.github/workflows/codeql.yml

@@ -109,7 +109,7 @@ jobs:
     # We do that after running CMake to avoid CodeQL to trigger during CMake time,
     # in particular during HDF5 detection which is terribly slow (https://github.com/OSGeo/gdal/issues/9549)
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
+      uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -129,6 +129,6 @@ jobs:
         cmake --build build -j$(nproc)
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
+      uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/conda.yml

@@ -45,14 +45,13 @@ jobs:
       if: matrix.platform == 'windows-latest'
 
     - name: Cache Conda Environment
-      uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
       with:
         path: ~/conda_pkgs_dir
         key: ${{ runner.os }}-${{ steps.get-date.outputs.today }}-conda-${{ env.CACHE_NUMBER }}
 
     - uses: conda-incubator/setup-miniconda@a4260408e20b96e80095f42ff7f1a15b27dd94ca # v3.0.4
       with:
-        #miniforge-variant: Mambaforge
         miniforge-version: latest
         use-mamba: true
         channels: conda-forge
@@ -75,7 +74,7 @@ jobs:
           source ../ci/travis/conda/compile.sh
       working-directory: ./gdal-feedstock
 
-    - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+    - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
       with:
         name: ${{ matrix.platform }}-conda-package
         path: ./gdal-feedstock/packages/

.github/workflows/coverity_scan/build.sh

@@ -22,10 +22,33 @@ cmake ${GDAL_SOURCE_DIR:=..} \
 
 /tmp/cov-analysis-linux64/bin/cov-build --dir cov-int make "-j$(nproc)"
 tar czf cov-int.tgz cov-int
-curl \
-    --form token=$COVERITY_SCAN_TOKEN \
-    --form email=$COVERITY_SCAN_EMAIL \
-    --form file=@cov-int.tgz \
-    --form version=master \
-    --form description="`git rev-parse --abbrev-ref HEAD` `git rev-parse --short HEAD`" \
-    https://scan.coverity.com/builds?project=GDAL
+
+apt-get update -y
+apt-get install -y jq
+
+## Below from https://scan.coverity.com/projects/gdal/builds/new
+
+# Initialize a build. Fetch a cloud upload url.
+curl -X POST \
+  -d version=master \
+  -d description="$(git rev-parse --abbrev-ref HEAD) $(git rev-parse --short HEAD)" \
+  -d token=$COVERITY_SCAN_TOKEN \
+  -d email=$COVERITY_SCAN_EMAIL \
+  -d file_name="cov-int.tgz" \
+  https://scan.coverity.com/projects/749/builds/init \
+  | tee response
+
+# Store response data to use in later stages.
+upload_url=$(jq -r '.url' response)
+build_id=$(jq -r '.build_id' response)
+
+# Upload the tarball to the Cloud.
+curl -X PUT \
+  --header 'Content-Type: application/json' \
+  --upload-file cov-int.tgz \
+  $upload_url
+
+#  Trigger the build on Scan.
+curl -X PUT \
+  -d token=$COVERITY_SCAN_TOKEN \
+  https://scan.coverity.com/projects/749/builds/$build_id/enqueue

.github/workflows/fedora_rawhide/build.sh

@@ -10,7 +10,17 @@ cmake ${GDAL_SOURCE_DIR:=..} \
   -DCMAKE_CXX_FLAGS="-std=c++20 -Werror -O1 -D_FORTIFY_SOURCE=2" \
   -DCMAKE_SHARED_LINKER_FLAGS="-lstdc++" \
   -DUSE_CCACHE=ON \
+  -DEMBED_RESOURCE_FILES=ON \
   -DCMAKE_INSTALL_PREFIX=/usr \
   -DWERROR_DEV_FLAG="-Werror=dev"
 make -j$(nproc)
 make -j$(nproc) install DESTDIR=/tmp/install-gdal
+
+ctest -V -j $(nproc)
+
+rm -rf data
+cmake ${GDAL_SOURCE_DIR:=..} \
+  -DUSE_ONLY_EMBEDDED_RESOURCE_FILES=ON
+rm -rf /tmp/install-gdal
+make -j$(nproc)
+make -j$(nproc) install DESTDIR=/tmp/install-gdal