linux/meta-openembedded.git/meta-oe/recipes-devtools, branch kirkstone-next

jq: Fix CVEs

2025-07-13T18:36:35+00:00

Adds backported patches to fix CVE-2024-23339, CVE-2024-53427, and CVE-2025-48060. Signed-off-by: Colin Pinnell McAllister Change-Id: Ibc2db956b7fd5d0388dbed1a81ddf9aa58431fb1 Signed-off-by: Armin Kuster

protobuf: fix CVE-2025-4565

2025-07-03T00:36:42+00:00

Backport patch with adjustments for 3.19.6 version to fix CVE-2025-4565. Signed-off-by: Chen Qi Signed-off-by: Armin Kuster

protobuf: fix ptest with python PACKAGECONFIG enabled

2025-07-03T00:36:36+00:00

1. RDEPENDS on python3-protobuf instead of python-protobuf. The latter is not available anywhere. 2. Use use python3 interpreter. 3. Fix run-ptest to avoid test failure. An extra '\n' is needed to break out the loop. Signed-off-by: Chen Qi Signed-off-by: Armin Kuster

lapack: upgrade 3.10.0 -> 3.10.1

2025-03-08T00:18:02+00:00

Changelog: http://netlib.org/lapack/lapack-3.10.1.html Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj Signed-off-by: Piotr Lewicki Signed-off-by: Armin Kuster

abseil-cpp: fix CVE-2025-0838

2025-03-06T14:48:36+00:00

Backport a patch to fix CVE-2025-0838 CVE-2025-0838: There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not impose an upper bound on their size argument. As a result, it was possible for a caller to pass a very large size that would cause an integer overflow when computing the size of the container's backing store, and a subsequent out-of-bounds memory write. Subsequent accesses to the container might also access out-of-bounds memory. We recommend upgrading past commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1 Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-0838 Signed-off-by: Changqing Li Signed-off-by: Armin Kuster

glade: fix CVE-2020-36774

2025-01-23T00:13:03+00:00

CVE-2020-36774: plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash). Reference: [https://nvd.nist.gov/vuln/detail/CVE-2020-36774] Upstream patches: [https://gitlab.gnome.org/GNOME/glade/-/commit/7acdd3c6f6934f47b8974ebc2190a59ea5d2ed17] Signed-off-by: Zhang Peng Signed-off-by: Armin Kuster

meta-oe: Remove True option to getVar calls

2025-01-23T00:12:54+00:00

getVar() now defaults to expanding by default, thus remove the True option from getVar() calls with a regex search and replace. Signed-off-by: Akash Hadke Signed-off-by: Armin Kuster

php: upgrade 8.1.30 -> 8.1.31

2024-12-31T14:00:02+00:00

Includes fix for CVE-2024-8929, CVE-2024-11236, CVE-2024-11234 and CVE-2024-11233 Changelog: https://www.php.net/ChangeLog-8.php#8.1.31 Signed-off-by: Vijay Anusuri

protobuf: fix CVE-2024-7254

2024-12-08T20:04:02+00:00

Backport patch with tweaks for the current version to fix CVE-2024-7254. Signed-off-by: Chen Qi Signed-off-by: Armin Kuster

php: upgrade 8.1.29 -> 8.1.30

2024-12-08T20:03:33+00:00

Includes fix for CVE-2024-8925, CVE-2024-8926, CVE-2024-8927 and CVE-2024-9026 Changelog: https://www.php.net/ChangeLog-8.php#8.1.30 Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster