linux/meta-openembedded.git/meta-multimedia, branch whinlatter

libdvdnav: use https for fetching code

2026-04-24T15:43:21+00:00

Signed-off-by: Markus Volk Signed-off-by: Khem Raj (cherry picked from commit b50fbdd66b5d93fed47e62271048372bd97b18f3) Signed-off-by: Anuj Mittal

libdvdcss: use https for fetching code

2026-04-24T15:43:21+00:00

Signed-off-by: Markus Volk Signed-off-by: Khem Raj (cherry picked from commit ae92a2993cb1d9289ed45859c9891b810c62c1dc) Signed-off-by: Anuj Mittal

libde265: patch CVE-2026-33165

2026-04-21T03:27:47+00:00

Backport the commit mentioned in the NVD Details: https://nvd.nist.gov/vuln/detail/CVE-2026-33165 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

bluealsa: fix QA issue staticdev

2026-03-26T05:01:48+00:00

When building bluealsa with building static libraries NOT disabled, you get the following error: ERROR: bluealsa-4.3.0-r0 do_package_qa: QA Issue: non -staticdev package contains static .a library: bluealsa path '/usr/lib/alsa-lib/libasound_module_pcm_bluealsa.a' [staticdev] ERROR: bluealsa-4.3.0-r0 do_package_qa: QA Issue: non -staticdev package contains static .a library: bluealsa path '/usr/lib/alsa-lib/libasound_module_ctl_bluealsa.a' [staticdev] ERROR: bluealsa-4.3.0-r0 do_package_qa: Fatal QA errors were found, failing task. Fix this by explicitly putting these files in the -staticdev package. Signed-off-by: Matthias Proske Signed-off-by: Khem Raj (cherry picked from commit 1a9744b3cabd440ff0cece448a3b9717da8cfd97) Signed-off-by: Anuj Mittal

libde265: patch CVE-2025-61147

2026-03-26T04:59:24+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-61147 Backport the patch referenced by the NVD advisory. Note that this is a partial backport - only the parts that are used by the application, and without pulling in c++17 headers. Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

pipewire: update 1.4.9 -> 1.4.10

2026-03-09T11:44:03+00:00

PipeWire 1.4.10 (2026-01-16) This is a small bugfix release that is API and ABI compatible with previous 1.x releases. Highlights - Fix a regression in restoring volumes on nodes. - Clean up timed out stream on pulse-server. - Backport filter-graph channel support. - More small fixes and improvements. PipeWire - Backport the timer queue from 1.5. modules - Fix module leak in module-eq. (#5045) - Fix profiling of multiple drivers when profile.interval.ms is set. (#5061) - Allow both sink and source pulse tunnels with the same name. (#5079) SPA - Emit props events in all cases. (#4610) - Backport some filter-graph changes to make it adapt better to the number of channels of the stream. - Fix some port errors in filter-graph. (#4700) - Avoid a memcpy in the convolver. - Handle some DBus errors better instead of crashing. - Fix AVX2 functions and flags. (#5072) - Limit resampler phases to avoid crashes (#5073) - Support some more channel downmix positions. pulse-server - Clean up timed out streams. (#4901) - Add message to force mono mixdown. GStreamer - Avoid scaling overflow in the clock. Signed-off-by: Markus Volk Signed-off-by: Khem Raj (cherry picked from commit b7bd06e9b4ff1bf55b5ba8943c2547ec8ff6dba7) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

libmediaart-2.0: upgrade 1.9.6 -> 1.9.7

2026-03-09T11:44:03+00:00

This is a bugfix release, fixing some memory leaks and compiler warning (and it also has a couple of commits related to the project's own CI system, which doesn't affect the application) Changelog: https://gitlab.gnome.org/GNOME/libmediaart/-/blob/master/NEWS Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit 3f6b25f18a00e46bc3b0a72fb8c2f39b28e191a3) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

libde265: upgrade 1.0.15 -> 1.0.16

2026-03-09T11:43:59+00:00

Also included tag in the SRC_URI. This release fixes some rare decoding errors and some build issues. Changelog: https://github.com/strukturag/libde265/compare/v1.0.15...v1.0.16 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 625a2be8a8fff0ff8705bf35a858f832e5a27660) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

streamripper: ignore CVE-2020-37065

2026-03-09T02:19:31+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2020-37065 The vulnerability is about a 3rd party Windows-only GUI frontend for the streamripper library, and not for the CLI application that the recipe builds. Due to this ignore this CVE. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit 1571c1a8e5e876db9db744d0a3e3256ac585242b) Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

libheif: patch CVE-2025-68431

2026-03-09T02:19:30+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-68431 Backport the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal