[dependabot]

Bumps github.com/swiftlang/swift-subprocess from 0.4.0 to 1.0.1.

Release notes

Sourced from github.com/swiftlang/swift-subprocess's releases.

Subprocess 1.0.1 is a bug fix release with no API changes. Its biggest change is under the hood: on Linux and FreeBSD, Subprocess now launches processes with posix_spawn instead of fork/exec wherever the C library supports it, which makes launching a process cheaper, especially from a large, multithreaded process. This release also fixes a file descriptor leak in streamed output, closes a descriptor-inheritance race, and makes supplementaryGroups: [] do what it says.

---

posix_spawn is now preferred on every Unix platform (#365)

Through 1.0.0, Subprocess used posix_spawn only on Darwin. Every other Unix platform used fork followed by exec, in a second, near-duplicate implementation with its own copy of the executable search loop, the transient-failure retry, the file descriptor bookkeeping, and the error mapping. 1.0.1 merges the two into one shared implementation that prefers posix_spawn everywhere and falls back to fork/exec only for configurations posix_spawn can't express.

Using posix_spawn improves performance significantly when spawning child processes with a large memory footprint. fork() duplicates the calling process's entire address space. posix_spawn avoids that work by using clone(CLONE_VM | CLONE_VFORK) on Glibc and rfork(RFSPAWN) on FreeBSD.

Bug Fixes & Behavior Changes

• Close .sequence output and error pipes when the body closure stops reading early (#369). SubprocessOutputSequence closed its pipe only when a read reached end-of-file, so breaking out of a for try await loop early leaked one file descriptor per run() call, without bound. run() now closes each .sequence stream exactly once after the body closure returns or throws, whether or not the stream was drained.
• Create pipes and duplicate descriptors with close-on-exec set atomically (#373). Subprocess used to mark its pipes close-on-exec with a separate fcntl() after creating them, so a process launched from another thread in between could inherit a descriptor that wasn't marked yet. Pipes now come from pipe2(O_CLOEXEC) on Linux, Android, FreeBSD, and OpenBSD, and duplicates from F_DUPFD_CLOEXEC everywhere; Darwin keeps creating pipes the old way until its SDK declares pipe2.
• supplementaryGroups: [] now drops inherited supplementary groups (#384). An empty array used to behave exactly like nil, so the new process kept the caller's supplementary groups; any non-nil value now calls setgroups(), and [] drops them all. This is a behavior change: an unprivileged process that sets supplementaryGroups = [] now fails with .spawnFailed (EPERM), as it already did for a non-empty list. Resolves #381.
• Report the correct errno when posix_spawnattr setup fails on Darwin (#368). The thrown SubprocessError carried a leftover success code from an earlier call instead of the error from the failing posix_spawnattr_* call.
• Make the CMake build suitable for Swift toolchain builds (#376). Prepare Subprocess to be used as a dependency in CMake builds.

Detailed Change Log

• Fix the build and a test on OpenBSD by @​jakepetroules in swiftlang/swift-subprocess#361
• Use neutral phrasing in README by @​broken-circle in swiftlang/swift-subprocess#360
• Document Darwin SDK requirement in Swift Versions table by @​broken-circle in swiftlang/swift-subprocess#364
• Update workflow versions in pull_request.yml by @​madrob in swiftlang/swift-subprocess#366
• Close .sequence output/error pipes even when the consumer stops early by @​jakepetroules in swiftlang/swift-subprocess#369
• Fix misreported errno when posix_spawnattr configuration fails on Darwin by @​jakepetroules in swiftlang/swift-subprocess#368
• Bump the swiftlang-actions group with 2 updates by @​dependabot[bot] in swiftlang/swift-subprocess#370
• Replace AmazonLinux 2 qemu test profiles with Ubuntu+AlmaLinux by @​cmcgee1024 in swiftlang/swift-subprocess#372
• pipe2/dup3 O_CLOEXEC by @​jakepetroules in swiftlang/swift-subprocess#373
• Subprocess: apply shaping per constant by @​compnerd in swiftlang/swift-subprocess#377
• Make the CMake build suitable for toolchain builds by @​jakepetroules in swiftlang/swift-subprocess#376
• Prefer posix_spawn over fork/exec on every Unix platform by @​jakepetroules in swiftlang/swift-subprocess#365
• Emit the swiftmodule at the nested path via CMake's own module properties by @​jakepetroules in swiftlang/swift-subprocess#379
• Drop inherited supplementary groups when supplementaryGroups is [] by @​jakepetroules in swiftlang/swift-subprocess#384
• Enable API breakage and macOS swiftly CI checks by @​jakepetroules in swiftlang/swift-subprocess#383

New Contributors

• @​madrob made their first contribution in swiftlang/swift-subprocess#366

Full Changelog: swiftlang/swift-subprocess@1.0.0...1.0.1

Subprocess 1.0.0

Subprocess 1.0 is here. 🎉 This release marks an important milestone for this package: the advent of source stability!

Subprocess is a cross-platform package for spawning processes in Swift, supporting macOS, Linux, Windows, FreeBSD, OpenBSD, and Android. It was first pitched as SF-0007 and shipped as a public beta in spring 2025. A year of community feedback later, SF-0037 reviewed the accumulated API changes, and this release makes them final.

This note has two parts. If you last looked at Subprocess when it went through Swift Evolution, start with What Changed Since SF-0007. If you're already on 1.0.0-beta.1, skip to What Changed Since 1.0.0-beta.1.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.