linux/meta-openembedded.git/meta-oe/recipes-devtools, branch scarthgap-next

jq-1.7.1: Backport multiple CVE fixes

2025-07-11T00:23:11+00:00

CVE: CVE-2024-23337 CVE: CVE-2024-53427 CVE: CVE-2025-48060 Patches CVE-2024-23337.patch and CVE-2024-53427.patch are backported from jq-1.8.0, and CVE-2025-48060.patch is backported from jq-1.8.1. Signed-off-by: Roland Kovacs Signed-off-by: Armin Kuster

protobuf: upgrade from 4.25.3 to 4.25.8

2025-07-06T23:46:40+00:00

0001-Add-recursion-check-when-parsing-unknown-fields-in-J.patch is dropped because it has been in new version. This upgrade also fixes CVE-2025-4565. The fix commit is as below: d31100c91 Manually backport recursion limit enforcement to 25.x Signed-off-by: Chen Qi Signed-off-by: Armin Kuster

nodejs: backport a patch to prevent brotli crashing nodejs

2025-05-17T18:11:15+00:00

Brotli can crash nodejs (on ARM), because the memory allocated for brotli wasn't properly aligned. https://github.com/google/brotli/issues/1159 https://github.com/nodejs/node/commit/dc035bbc9b310ff8067bc0dad22230978489c061 Signed-off-by: Jeroen Hofstee Signed-off-by: Armin Kuster

php: Upgrade 8.2.26 -> 8.2.28

2025-04-17T00:33:53+00:00

Includes fix for - CVE-2025-1219, CVE-2025-1736, CVE-2025-1861, CVE-2025-1734 and CVE-2025-1217 Changelog: https://www.php.net/ChangeLog-8.php#8.2.28 Signed-off-by: Soumya Sambu Signed-off-by: Armin Kuster

perfetto: Fix contains reference to TMPDIR [buildpaths] warning

2025-04-17T00:30:23+00:00

WARNING:perfetto-31.0-r0 do_package_qa: QA Issue: File /usr/bin/.debug/tracebox in package perfetto-dbg contains reference to TMPDIR [buildpaths] Signed-off-by: alperak Signed-off-by: Khem Raj Signed-off-by: Armin Kuster

ldns: Fix buildpaths QA issues

2025-04-17T00:30:23+00:00

MJ: Backported from 'ldns: Upgrade to 1.8.4' commit without the upgrade. Fix buildpaths QA errors while here Signed-off-by: Khem Raj Signed-off-by: Martin Jansa Signed-off-by: Armin Kuster

abseil-cpp: upgrade 20240116.2 -> 20240116.3

2025-03-03T13:05:48+00:00

This upgrade include security fix for CVE-2025-0838, refer: https://github.com/abseil/abseil-cpp/releases?page=1 git log: 54fac219 (tag: 20240116.3) Fix potential integer overflow in hash container create/resize (#1812) d7aaad83 (tag: 20240116.2) Abseil LTS Branch, Jan 2024, Patch 2 (#1650) 2f9e432c (tag: 20240116.1) Prepare 20240116.1 patch for Apple Privacy Manifest (#1623) Signed-off-by: Changqing Li Signed-off-by: Armin Kuster

sip: Fix homepage and license

2025-03-03T12:56:57+00:00

After the migration from Mercurial to GitHub the homepage has changed and SIP has been licensed under the BSD-2-Clause license since Feb 9, 2024, including for release 6.8.6. This work was sponsored by GOVCERT.LU. License-Update: SIP is licensed under the BSD-2-Clause license. Signed-off-by: Leon Anavi Signed-off-by: Armin Kuster

modejs: upgrade 20.18.0 -> 20.18.2

2025-02-04T23:04:57+00:00

Below list of CVEs are addressed in this release CVE-2025-23083 CVE-2025-23084 CVE-2025-23085 CVE-2025-22150 Changelog: https://github.com/nodejs/node/releases/tag/v20.18.2 https://github.com/nodejs/node/releases/tag/v20.18.1 Signed-off-by: Archana Polampalli Signed-off-by: Armin Kuster

nodejs: upgrade 20.17.0 -> 20.18.0

2025-02-04T23:04:53+00:00

License checksum change due to whitespace changes. https://github.com/nodejs/node/commit/1dfd238781 libatomic.patch change due to changes in node.gyp https://github.com/nodejs/node/commit/25c788009f1fa7a392af51cb97d0a55f0f4a6983 Changelog : https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.18.0 Signed-off-by: Jason Schonberg Signed-off-by: Khem Raj Signed-off-by: Archana Polampalli Signed-off-by: Armin Kuster