The Cabal team is happy to announce the release of cabal-install 3.18.1.0 and its related libraries. You can get cabal-install:
- From our website. The binaries are signed by “Francesco Ariis fa-ml@ariis.it” (fingerprint:
DAFB 4D8A F684 1435 18D5 051F A9AF 0AAA 6B87 EC51; the key is hosted on keyserver.ubuntu.com). - From GHCup (the main channel).
- Compiling it yourself with
cabal update && cabal install cabal-install-3.18.1.0.
The full changelog for the tool and the libraries are available on GitHub. Below we provide highlights of this release.
Security fix
This release fixes a vulnerability (HSEC-2026-0006): Cabal used to delete C header files that duplicate autogen-includes, which on Windows could be exploited to remove arbitrary files on the system. Cabal now issues a warning instead of deleting anything.
What’s new?
Builds go straight through the Cabal library
In most circumstances cabal-install now calls Cabal library functions directly instead of going through the Setup interface, so we no longer re-run the whole configure step for information the solver already knows. --act-as-setup is gone, and build-type: Hooks packages are built through the library too (via an external hooks executable). Two more changes push in the same direction: cabal-install keeps a running InstalledPackageIndex instead of shelling out to ghc-pkg per package, and the compiler program database (ghc, ghc-pkg, haddock, ar, ld, …) is configured once for the whole project. There should be no outward-facing change in behaviour beyond the speed-up.
A new cabal.project parser
The legacy parser has been replaced by a parsec-based one built on the same infrastructure as the .cabal file parser, so error messages are more accurate and now include line and column. The new --project-file-parser=<legacy|default|parsec|fallback|compare> flag selects the parser; the default falls back to the legacy parser if the new one fails. We plan to remove the legacy parser in the next release, so please report any discrepancies you run into.
Recursive globs
File monitoring now understands foo/**/*.hs. As elsewhere in Cabal, ** is limited to the last directory component, so foo/bar/**/*.txt is valid but foo/**/bar/*.txt is not.
Library Bytecode
A new flag to build bytecode libraries (--enable-library-bytecode ) next to the usual object and shared artifacts, useful when asking GHCi to use bytecode for library dependencies (-fprefer-byte-code). Requires GHC 10 or newer; ignored on older compilers. This implements the bytecode objects and libraries proposal.
Reinstalling base and template-haskell
These are now allowed for GHC 9.14 and later, since the reasons for forbidding it have been lifted. ghc and ghc-internal still cannot be reinstalled.
GHC semaphore (-jsem) protocol v2
On Linux and other POSIX platforms, the --semaphore jobserver now uses Unix domain sockets rather than POSIX named semaphores, whose ABI varies between C libraries. Previously, the semaphore mechanism broke whenever cabal-install and ghc were built against different libc libraries. Now, cabal-install detects a protocol mismatch with the selected GHC ahead of time, warns, and falls back to its in-process coordinator instead of failing. Windows is unaffected.
build-type: Make is decommissioned
It has been non-functional since at least 3.4; now packages declaring cabal-version: 3.18 or newer reject it outright, Distribution.Make is gone from Cabal, and the failure mode is a clear message instead of a cryptic Unrecognised flags error mid-build.
Nix integration has been removed
It was deprecated previously; see the community survey.
Compatibility
Cabal now builds with GHC 9.4 and newer only (the support window narrowed from 5 to 3 years), though cabal-install remains able to drive older compilers. Support for targets below GHC 8.0.0 / base 4.9.0.0 / Cabal 1.24.0.0 has been dropped. Extensions from GHC 9.14 (ExplicitLevelImports, ImplicitStagePersistence) and GHC 10.0 (Modifiers, QualifiedStrings) are recognised.
For library users
The biggest change is that Verbosity now carries the handles used for logging: the old type is called VerbosityFlags, and Verbosity pairs it with VerbosityHandles. Signatures of functions like createDirectoryIfMissingVerbose are textually unchanged, but custom Setup scripts and SetupHooks will need a small compatibility shim. The Cabal release notes spell one out. ShortText is now a synonym for Data.Text.Text, UTF-8 en/decoding is delegated to text, and several Distribution.Compat.* modules have been retired.
Known issues
Upgrading from cabal-install 3.16.0.0 might give an error about the Cabal package not being visible when building an auto-generated Setup.hs (#11416). Running cabal build --enable-tests works around it.
Check the release notes for cabal-install 3.18.1.0 and Cabal 3.18.1.0 for the full changelogs.
If you are upgrading from an older cabal-install, you might also want to check the changelogs for cabal-install 3.16.1.0 and cabal-install 3.16.0.0.
Who contributed
The release manager for 3.18.1.0 is Artem Pelenitsyn.
Code contributions by:
Aditya Singh, Andrea Bedini, Artem Pelenitsyn, Benjamin McRae, Bodigrim, Brandon Chinn, Bryan Richter, Edmund Noble, Emily Pillmore, Erik de Castro Lopo, Francesco Ariis, Francesco Gazzetta, Hécate Kleidukos, Ilia Baryshnikov, Ilya Baryshnikov, JMCT, Jappie Klooster, Jens Petersen, Julian Ospald, Léana 江, Markus Läll, Matt Parsons, Matthew Pickering, Matthías Páll Gissurarson, Mike Pilgrem, Mikolaj Konarski, Omar Jatoi, Phil de Joux, Philipp Middendorf, Rafał Kuźnia, Samuel Thibault, Sean D Gillespie, Sean Gillespie, Sergey Vinokurov, Simon Hengel, Teo Camarasu, Tobias Dammers, Tom Smeding, Tommy Bidne, Troels Henriksen, Yvan Sraka, Zubin Duggal, amesgen, brandon s allbery kf8nh, jgotoh, mangoiv, rm41339, sheaf, suno lili So
Many thanks to reviewers, Quality Assurance testers, devops and everyone who made this release possible.
Feedback
For feedback, questions, help, you can find us:
- In our GitHub repository.
- In our Matrix channel.
— Cabal release team (Artem, Francesco, Mikołaj)