…2666)

Summary:
The Mac workflow pinned DEVELOPER_DIR to /Applications/Xcode_16.2.app, which GitHub has since rotated off the macOS runner image, so xcrun fails ("missing DEVELOPER_DIR path") before any build starts. The job also uses Homebrew LLVM, which always pulls the newest clang, so pinning an old SDK against an ever-newer compiler is the fragile combination that caused the earlier libc++ header mismatches; a newer default SDK pairs better.

Point DEVELOPER_DIR at /Applications/Xcode.app/Contents/Developer (the runner's default-selected Xcode symlink), which survives image rotations. Updated in the generated workflow, the getdeps workflow_generator that emits it, and the golden-file test fixture so they stay consistent.

Pull Request resolved: #2666

Reviewed By: sandarsh

Differential Revision: D110202021

Pulled By: afrind

fbshipit-source-id: c121cfaa33c5a7d791b0405aaf5b62c7c3a4dc11

Summary:
Two independent CI failures on `main`, both fixed in this PR.

### 1. macOS wheels: `delocate DelocationError`

**Root cause:** cmake 3.31.x / scikit-build-core 0.12.x silently drops `LC_RPATH` entries from MODULE and SHARED targets on macOS arm64. The built `_rebalancer.cpython-*.so` and `_lib/librebalancer.dylib` have empty `LC_RPATH`, so delocate-wheel 0.13.0 raises `DelocationError` when it can't resolve `rpath/libfolly.*.dylib` and `rpath/librebalancer.dylib`.

**Fix:** New `tools/wheels/repair_macos.sh` (`CIBW_REPAIR_WHEEL_COMMAND_MACOS`) that patches the missing rpaths before handing off to `delocate-wheel`:
1. Adds `loader_path/_lib` to `_rebalancer.cpython-*.so` so delocate can walk the dep chain to `librebalancer.dylib`
2. Adds each getdeps/brew prefix `lib/` dir (from `.cmake_prefix_path`) to `_lib/librebalancer.dylib` so delocate can find and bundle transitive deps (`libfolly`, `libglog`, `libfmt`, …) into `.dylibs/`

### 2. linux-sdk: `test_solve: No such file or directory`

**Root cause:** `build_linux_sdk.sh` passed `PACKAGING_TEST=ON` via `--extra-cmake-defines`, but getdeps silently excludes `--extra-cmake-defines` from its build-cache key. When a cached build exists (from a prior CI run), getdeps reuses the cached ninja graph which predates `PACKAGING_TEST` and omits `test_solve`. The SDK artifact is uploaded without the binary; the deb smoke test then fails with exit 127.

**Fix 1 (primary):** Move `PACKAGING_TEST=ON` into the manifest `[cmake.defines]` block — manifest defines ARE part of the cache key, so getdeps always builds `test_solve`.

**Fix 2 (belt-and-suspenders):** `build_linux_sdk.sh` now detects absence of `test_solve` after the getdeps build and compiles it directly from the installed headers/library using clang, so the artifact is always complete even against a stale cache primed before this manifest change.

X-link: facebook/rebalancer#39

Reviewed By: kvelakur

Differential Revision: D110218346

Pulled By: r-barnes

fbshipit-source-id: fcb57f9ef51870a1c9ce38d3457ff8ef8e8d0b02

Summary: with clang 21, header units with values returned in lambdas have issues. Tweak Conv.h to avoid the returned value being dropped. Log output example here: https://www.internalfb.com/intern/everpaste/?handle=GH-kWCUQuyFjyH8HAJ2urzob_hEBbswMAAAz from D109588369

Reviewed By: skrueger

Differential Revision: D109888758

fbshipit-source-id: e1d554acababbbaf8575e1f92dd0fcca58eb74fb

…uard in runTask

Reviewed By: kunalspathak

Differential Revision: D110114377

fbshipit-source-id: 77e0c917851b9c5ac45bef4bf508e9ea892ecdb2

…timebound]]

Summary:
Adds [[clang::lifetimebound]] to EvictingCacheMap::get and getWithoutPromotion so the compiler
(-Wdangling / -Wreturn-stack-address) catches consumers that hold a reference into a cached value
across an operation (set/insert/prune) that can evict and free it.

The returned reference points into the map's owned Node; promotion only splices the intrusive LRU
list (never reallocates), so binding the return's lifetime to the map is correct.

No current call site dangles fleet-wide (full CI green) -- this is a preventive guard against
future use-after-free, in the same spirit as the folly::observer Snapshot accessor annotations.

#buildall

Reviewed By: r-barnes

Differential Revision: D109977875

fbshipit-source-id: 64a0471290a5a0bbb913f9c0fae770947a09a795

…in next()

Reviewed By: kunalspathak

Differential Revision: D110110619

fbshipit-source-id: 842f007ff5987e0711446daa52dc5239c63aa660

Summary:
$(cat <<'ENDOFSUMMARY'
Annotates `dynamic::at()`, `dynamic::operator[]`, and `dynamic::getString()` — the `const&` and `&` reference-returning overloads — with `[[clang::lifetimebound]]`.

**Why:** `[[clang::lifetimebound]]` on ref/pointer-returning accessors causes Clang to emit `-Wdangling` when the returned reference is bound to a temporary (e.g., `const auto& v = getDynamic()["key"]`), a pattern that silently produces a use-after-free. This annotation is purely additive: no runtime behaviour change, no ABI change.

The fleet [DO NOT LAND] probe (this diff) ran full CI and found **zero** genuine consumer regressions — all warnings were pre-existing linker OOM on code-coverage builds and an unrelated namespace ambiguity, none triggered by the annotation.
ENDOFSUMMARY
)

#buildall

Reviewed By: r-barnes

Differential Revision: D110008399

fbshipit-source-id: 8ac990f3b7333843b739a69fbb58e2f3b83ec575