linux/meta-openembedded.git/meta-oe/recipes-devtools, branch scarthgap

exiftool: ignore CVE-2026-7580

2026-05-21T03:27:44+00:00

The impacted function mentioned in the nvd[1] was introduced in v12.82[2], hence we can ignore this CVE. [1]https://nvd.nist.gov/vuln/detail/CVE-2026-7580 [2]https://github.com/exiftool/exiftool/commit/280a7f0db71b5887be492d57723723cb196ad2f9 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

php: upgrade 8.2.30 -> 8.2.31

2026-05-21T03:27:43+00:00

This is a security release. Changelog: https://www.php.net/ChangeLog-8.php#8.2.31 Signed-off-by: Jason Schonberg Signed-off-by: Anuj Mittal

abseil-cpp: Add CVE_PRODUCT to support product name

2026-05-21T03:27:42+00:00

- Set CVE_PRODUCT to align with the NVD CPE and ensure correct CVE reporting. Signed-off-by: Het Patel Signed-off-by: Khem Raj (cherry picked from commit a428ea90c08fc93ce5e39612974323aad26d1ef3) Signed-off-by: Himanshu Jadon Signed-off-by: Anuj Mittal

jq: Stick to C17 until next release

2026-05-05T01:27:17+00:00

Patches are sprinkled in master branch of jq but the backports regresses tests, so its better to keep it at C17 for now. Backport: changed from += to :append to apply to all target, native and nativesdk builds. Signed-off-by: Khem Raj Cc: Martin Jansa Signed-off-by: Mikko Rapeli Signed-off-by: Anuj Mittal

jq: patch CVE-2026-39979

2026-04-29T04:44:29+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-39979 Ptests passed: root@qemux86:~# ptest-runner jq START: ptest-runner 2026-04-26T11:09 BEGIN: /usr/lib/jq/ptest PASS: optionaltest PASS: mantest PASS: jqtest PASS: onigtest PASS: shtest PASS: utf8test PASS: base64test === Test Summary === TOTAL: 7 PASSED: 7 FAILED: 0 SKIPPED: 0 DURATION: 44 END: /usr/lib/jq/ptest 2026-04-26T11:10 STOP: ptest-runner TOTAL: 1 FAIL: 0 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

jq: patch CVE-2026-33948

2026-04-29T04:44:29+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-33948 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

jq: patch CVE-2026-33947

2026-04-29T04:44:29+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-33947 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

jq: patch CVE-2026-32316

2026-04-29T04:44:29+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-32316 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

jq: fix CVE-2026-40164

2026-04-29T04:44:29+00:00

Backport patch to fix CVE-2026-40164. Signed-off-by: Daniel Turull Signed-off-by: Anuj Mittal

grpc: set status for CVE-2026-33186

2026-04-15T08:42:18+00:00

CPE per NVD report is for "go", while this is C++ component: * cpe:2.3:a:grpc:grpc:*:*:*:*:*:go:*:* Also the link to adisory within NVD report says "grpc-go": * https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3 Signed-off-by: Peter Marko Signed-off-by: Anuj Mittal