From 9e804202b6d66c6d9f0d824c03a6728a8101b748 Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Mon, 2 Mar 2026 08:38:23 +0000
Subject: [PATCH 1/4] Fix memory leak, from Emmanuel Ugwu in GitHub issue 4900.

---
 menu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/menu.c b/menu.c
index e4f79dec..0df6fb47 100644
--- a/menu.c
+++ b/menu.c
@@ -90,6 +90,7 @@ menu_add_item(struct menu *menu, const struct menu_item *item,
 	else
 		s = format_single(qitem, item->name, c, NULL, NULL, NULL);
 	if (*s == '\0') { /* no item if empty after format expanded */
+		free(s);
 		menu->count--;
 		return;
 	}

From e80e0c761a82fe36a1452ad40ed54a0c09887412 Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Mon, 2 Mar 2026 08:39:44 +0000
Subject: [PATCH 2/4] Fix incorrect placement of It Xo, from Dane Jensen.

---
 tmux.1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tmux.1 b/tmux.1
index f89e6ee5..f5be9a8e 100644
--- a/tmux.1
+++ b/tmux.1
@@ -2245,7 +2245,6 @@ Same as
 .Ic scroll-down
 but also exit copy mode if the cursor reaches the bottom.
 .It Xo
-.It Xo
 .Ic scroll-exit-on
 .Xc
 Turn on exiting copy mode when scrolling to the end of the buffer.
@@ -2257,6 +2256,7 @@ Turn off exiting copy mode when scrolling to the end of the buffer.
 .Ic scroll-exit-toggle
 .Xc
 Toggle exiting copy mode when scrolling to the end of the buffer.
+.It Xo
 .Ic scroll-middle
 (vi: z)
 .Xc

From e603549563b585966431c9dac324639113e3a30a Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Mon, 2 Mar 2026 08:41:43 +0000
Subject: [PATCH 3/4] Do not leak active/all strings in format_loop_windows;
 from Huihui Huang in GitHub issue 4898.

---
 format.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/format.c b/format.c
index 48629d38..b1f64034 100644
--- a/format.c
+++ b/format.c
@@ -4429,6 +4429,9 @@ format_loop_sessions(struct format_expand_state *es, const char *fmt)
 		free(expanded);
 	}
 
+	free(active);
+	free(all);
+
 	return (value);
 }
 

From f33b14bda64a4bd1fc97fd719430970f2ed145ca Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Mon, 2 Mar 2026 08:48:57 +0000
Subject: [PATCH 4/4] Revert r1.343 for the moment since it breaks behaviour
 (#() in status-left) that we need to keep.

---
 format.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/format.c b/format.c
index b1f64034..dd4ce542 100644
--- a/format.c
+++ b/format.c
@@ -5224,13 +5224,11 @@ format_replace(struct format_expand_state *es, const char *key, size_t keylen,
 done:
 	/* Expand again if required. */
 	if (modifiers & FORMAT_EXPAND) {
-		format_copy_state(&next, es, FORMAT_EXPAND_NOJOBS);
-		new = format_expand1(&next, value);
+		new = format_expand1(es, value);
 		free(value);
 		value = new;
 	} else if (modifiers & FORMAT_EXPANDTIME) {
-		format_copy_state(&next, es, FORMAT_EXPAND_TIME|
-		    FORMAT_EXPAND_NOJOBS);
+		format_copy_state(&next, es, FORMAT_EXPAND_TIME);
 		new = format_expand1(&next, value);
 		free(value);
 		value = new;