linux/meta-openembedded.git, branch scarthgap

nginx: fix CVE-2026-28753

2026-04-15T08:42:18+00:00

As per the advisory[1] mentioned in NVD[2], version 1.28.3 contains the fix. Backport the commit[3] from 1.28.3 changelog matching the description. [1] https://my.f5.com/manage/s/article/K000160367 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-28753 [3] https://github.com/nginx/nginx/commit/6a8513761fb327f67fcc6cfcf1ad216887e2589f Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

nginx: fix CVE-2026-27654

2026-04-15T08:42:18+00:00

As per the advisory[1] mentioned in NVD[2], version 1.28.3 contains the fix. Backport the commit[3] from 1.28.3 changelog matching the description. [1] https://my.f5.com/manage/s/article/K000160382 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-27654 [3] https://github.com/nginx/nginx/commit/a1d18284e0a173c4ef2b28425535d0f640ae0a82 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

nginx: fix CVE-2026-27651

2026-04-15T08:42:18+00:00

As per the advisory[1] mentioned in NVD[2], version 1.28.3 contains the fix. Backport the commit[3] from 1.28.3 changelog matching the description. [1] https://my.f5.com/manage/s/article/K000160383 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-27651 [3] https://github.com/nginx/nginx/commit/0f71dd8ea94ab8c123413b2e465be12a35392e9c Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

grpc: set status for CVE-2026-33186

2026-04-15T08:42:18+00:00

CPE per NVD report is for "go", while this is C++ component: * cpe:2.3:a:grpc:grpc:*:*:*:*:*:go:*:* Also the link to adisory within NVD report says "grpc-go": * https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3 Signed-off-by: Peter Marko Signed-off-by: Anuj Mittal

python3-werkzeug: ignore CVE-2026-27199

2026-04-15T08:42:18+00:00

Vvulnerability affects Windows application and can be ignored. Details: https://nvd.nist.gov/vuln/detail/CVE-2026-27199 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

python3-tornado: fix CVE-2026-35536

2026-04-15T08:42:18+00:00

Backport the commit[1] from version 6.5.5 which fixes this vulnerability according to the NVD[2]. [1] https://github.com/tornadoweb/tornado/commit/24a2d96ea115f663b223887deb0060f13974c104 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-35536 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

python3-flask: upgrade 3.0.2 -> 3.0.3

2026-04-15T08:42:18+00:00

License Update: File renamed as txt[1] Release Notes: https://github.com/pallets/flask/releases/tag/3.0.3 [1] https://github.com/pallets/flask/commit/87d5f5b9a9697434e6d972b021201105eabb54e6 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

python3-ecdsa: fix CVE-2026-33936

2026-04-15T08:42:18+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-33936 Ptests passed: root@qemux86:~# ptest-runner python3-ecdsa START: ptest-runner 2026-04-11T08:04 BEGIN: /usr/lib/python3-ecdsa/ptest ... ... Testsuite summary # TOTAL: 1978 # PASS: 1974 # SKIP: 4 # XFAIL: 0 # FAIL: 0 # XPASS: 0 # ERROR: 0 DURATION: 386 END: /usr/lib/python3-ecdsa/ptest 2026-04-11T08:10 STOP: ptest-runner TOTAL: 1 FAIL: 0 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

python3-django: upgrade 4.2.29 -> 4.2.30

2026-04-15T08:42:18+00:00

Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.30/ Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

nmap: rename enum PCAP_SOCKET

2026-04-15T08:42:18+00:00

The enum PCAP_SOCKET conflicts with the PCAP_SOCKET macro introduced in libpcap 1.10.5. Use ifdefs to handle both old and new libpcap versions, renaming the enum to NM_PCAP_SOCKET when the PCAP_SOCKET macro is defined. Signed-off-by: Jinfeng Wang Signed-off-by: Anuj Mittal