Mirror of git.openembedded.org/meta-openembedded https://git.enea.com/cgit/linux/meta-openembedded.git/atom?h=kirkstone 2026-05-04T13:59:37+00:00 2026-05-04T13:59:37+00:00 Gyorgy Sarvari skandigraun@gmail.com 2026-05-04T13:59:37+00:00 urn:sha1:ce8539c941f6fcbecaca4d16640ac105c0595589 The latest Python upgrade in oe-core has broken some ptests. This backported patch fixes them, they should work with both the latest and previous versions. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> 2026-05-01T14:01:07+00:00 Naman Jain namanj1@kpit.com 2026-04-27T06:33:33+00:00 urn:sha1:1da9d7f2f941e81e51829d3ee0cd6ec3e4cc00b8 ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue. This is a minimal patch required for this cve. Signed-off-by: Naman Jain <namanj1@kpit.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> 2026-04-23T18:22:41+00:00 Hitendra Prajapati hprajapati@mvista.com 2026-04-22T11:57:01+00:00 urn:sha1:1c0f533c21079163a6b324151ec7b53490c61eaa As per the advisory[1] mentioned in NVD[2], version 1.28.3 contains the fix. Backport the commit[3] from 1.28.3 changelog matching the description. [1] https://my.f5.com/manage/s/article/K000160366 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-32647 [3] https://github.com/nginx/nginx/commit/a172c880cb51f882a5dc999437e8b3a4f87630cc Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> 2026-04-23T18:20:04+00:00 Hitendra Prajapati hprajapati@mvista.com 2026-04-21T05:57:56+00:00 urn:sha1:e4faf10eb14d89f59f12b0ffb6178b6fcf43333b Pick up patch from NVD report. More details : [1]: https://nvd.nist.gov/vuln/detail/CVE-2026-27651 [2]: https://nvd.nist.gov/vuln/detail/CVE-2026-27654 [3]: https://nvd.nist.gov/vuln/detail/CVE-2026-28753 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Debian links, referencing these commits: https://security-tracker.debian.org/tracker/CVE-2026-27651 https://security-tracker.debian.org/tracker/CVE-2026-27654 https://security-tracker.debian.org/tracker/CVE-2026-28753 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> 2026-04-23T18:14:07+00:00 Gyorgy Sarvari skandigraun@gmail.com 2026-04-20T15:49:15+00:00 urn:sha1:9839ca14b5ac72e277baed016de9bc917bd122b3 The old one stopped working. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> 2026-04-23T18:13:56+00:00 Gyorgy Sarvari skandigraun@gmail.com 2026-04-20T15:49:14+00:00 urn:sha1:4c87c798b2f27881099e4f783ce04a2538bbe515 The unicode license changed slightly once again (copyright year updated), which makes the do_fetch task to fall back to a mirror. Update the hashes. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> 2026-04-23T18:13:44+00:00 Gyorgy Sarvari skandigraun@gmail.com 2026-04-20T15:49:13+00:00 urn:sha1:6b8a7a37f5c797cbcb3e387770c2a12b6073c29b It seems the project's git repo doesn't allow anonymous ssh fetch anymore. Switch to https. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> 2026-04-23T18:13:33+00:00 Gyorgy Sarvari skandigraun@gmail.com 2026-04-20T15:49:12+00:00 urn:sha1:0fbebc0f50af348e73387f66fd95384a22a87022 The previous one stopped working. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> 2026-04-23T18:13:23+00:00 Gyorgy Sarvari skandigraun@gmail.com 2026-04-20T15:49:11+00:00 urn:sha1:d4c1325afe2c38d1901ad632069d3a1e4d2dd0f9 The previous one stopped working. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> 2026-04-23T18:13:11+00:00 Gyorgy Sarvari skandigraun@gmail.com 2026-04-20T15:49:10+00:00 urn:sha1:a9c7197dea534d66cfc63280f398ad98ee764ed4 The tarball was moved to a subfolder on the source server. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>