linux/meta-openembedded.git/meta-oe/recipes-devtools/protobuf, branch scarthgap

protobuf: ignore CVE-2026-0994

2026-03-24T03:22:02+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-0994 The vulnerability impacts only the python bindings of protobuf, which is in a separate recipe (python3-protobuf, where it is patched). Ignore this CVE in this recipe due to this. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit 398fa05aa8bf7ce17dc40ed99edfc6a88feeb541) Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

protobuf 4.25.8: Mark CVE-2024-7254 as patched

2025-09-12T00:15:13+00:00

Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2024-7254 Type: Security Fix CVE: CVE-2024-7254 Score: 8.7 Patch: https://github.com/protocolbuffers/protobuf/commit/850fcce9176e Analysis: The original fix [1] for CVE-2024-7254 is listed in the NVD security tracker (https://nvd.nist.gov/vuln/detail/CVE-2024-7254) and was subsequently backported to the v4.25.8 version via commit [2]. Hence, this CVE is considered patched in the current source. Reference: [1] https://github.com/protocolbuffers/protobuf/commit/cc8b3483a558 [2] https://github.com/protocolbuffers/protobuf/commit/850fcce9176e (v4.25.8) Signed-off-by: Deepak Rathore Signed-off-by: Anuj Mittal

protobuf: upgrade from 4.25.3 to 4.25.8

2025-07-06T23:46:40+00:00

0001-Add-recursion-check-when-parsing-unknown-fields-in-J.patch is dropped because it has been in new version. This upgrade also fixes CVE-2025-4565. The fix commit is as below: d31100c91 Manually backport recursion limit enforcement to 25.x Signed-off-by: Chen Qi Signed-off-by: Armin Kuster

protobuf: fix CVE-2024-7254

2024-12-15T19:00:50+00:00

Backport patch with adjustments for the current version to fix CVE-2024-7254. Signed-off-by: Chen Qi Signed-off-by: Armin Kuster

protobuf: upgrade 4.25.2 -> 4.25.3

2024-02-20T16:46:27+00:00

Changelog: =========== Remove use of mach_absolute_time [ObjC] Use a local to avoid warnings in 32bit builds. Bump python version to 3.9 for gcloud 460.0.0 Update Ruby GHA to test against Ruby 3.3. Pin bundler version to 2.4.22 for Ruby 2.7 support. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

protobuf: upgrade 4.23.4 -> 4.25.2

2024-01-19T17:51:07+00:00

Signed-off-by: Clément Péron Signed-off-by: Khem Raj

protobuf-c: change branch to master

2024-01-19T17:51:04+00:00

This was forgotten during update to tagged version. Signed-off-by: Peter Marko Signed-off-by: Khem Raj

protobuf-c: upgrade 1.4.1 -> 1.5.0

2024-01-04T19:17:26+00:00

Current hash pointed to version with code already indentical to v1.5.0, it was just missing three formal release commits: a15d80a Bump copyright years to 2023 6600fd5 Bump version to 1.5.0 8c201f6 CHANGELOG.md: 1.5.0 License-Update: copyright years refreshed Signed-off-by: Peter Marko Signed-off-by: Khem Raj

protobuf: stage protoc binary to sysroot

2023-11-13T18:49:42+00:00

If protoc is enabled for the build, recipes using protobuf will fail when protoc is not available in the recipe sysroot: | The imported target "protobuf::protoc" references the file | | ".../recipe-sysroot/usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-pokysdk-linux/usr/bin/protoc-3.21.5.0" | | but this file does not exist. Possible reasons include: | | * The file was deleted, renamed, or moved to another location. | | * An install or uninstall procedure did not complete successfully. | | * The installation package was faulty and contained | | ".../recipe-sysroot/usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-pokysdk-linux/usr/lib/cmake/protobuf/protobuf-targets.cmake" | | but not all the files it references. Use SYSROOT_DIRS to stage the binary to sysroot so it's always available for other recipes. Signed-off-by: Samuli Piippo Signed-off-by: Khem Raj

Revert "protobuf: stage protoc binary to sysroot"

2023-10-04T23:40:05+00:00

This reverts commit a0557fe5433620717eeb00d3b16801711337b1a4. As said by Ross[Ø]: "Putting the _target_ protoc into the sysroot for executation at _build_ time isn't useful because even if it has the right architecture, the tune might be incompatible. Recipes which want protoc should just depend on protobuf-native." This has been reverted recently by Samuli[1]: "If protoc is enabled for the build, recipes using protobuf will fail when protoc is not available in the recipe sysroot" Be the revert is incorret as This is an issue coming from qtgrpc other recipes that use protobuf or gRPC compiler, proplery looks for the binary in the correct sysroot folder. Qtgrpc recipe should fix this issue at the recipe level, for example this is what I've done for "etcd-cpp-apiv3" recipe[2] that doesn't need this patch to properly compile. So keeping this hack doesn't seems to be a correct fix. Note that qtgrpc recipe isn't available on meta-oe nor any other public layers. 0: https://patchwork.yoctoproject.org/project/oe/patch/20230904161230.377450-1-ross.burton@arm.com/ 1: https://patchwork.yoctoproject.org/project/oe/patch/20230927051101.3088498-1-samuli.piippo@qt.io/ 2: https://github.com/etcd-cpp-apiv3/etcd-cpp-apiv3/commit/47f0d9e0326f3cc31c801a0ecf7312d1049ece3e CC: Samuli Piippo CC: Ross Burton Signed-off-by: Clément Péron Signed-off-by: Khem Raj