linux/meta-openembedded.git/meta-oe/recipes-devtools, branch stable/kirkstone-nut

suiteparse: Adapt to upstream branch name changes

2023-11-03T14:49:44+00:00

meta-oe master branch already made this change. Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster

nodejs: fix CVE-2022-25883

2023-09-04T15:59:59+00:00

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range. References: https://nvd.nist.gov/vuln/detail/CVE-2022-25883 Upstream patches: https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441 Signed-off-by: Archana Polampalli Signed-off-by: Armin Kuster

nlohmann-json: Avoid usage of nobranch=1

2023-08-30T17:41:52+00:00

The usage of nobranch=1 in SRC_URI allows using unprotected branches. This change updates the real branch name in place of nobranch=1. Signed-off-by: Sourav Kumar Pramanik Signed-off-by: Armin Kuster

rapidjson: Avoid usage of nobranch=1

2023-08-30T17:41:52+00:00

The usage of nobranch=1 in SRC_URI allows using unprotected branches. This change updates the real branch name in place of nobranch=1. Signed-off-by: Sourav Kumar Pramanik Signed-off-by: Armin Kuster

php: upgrade 8.1.16 -> 8.1.22

2023-08-25T14:39:46+00:00

Upgrade php to 8.1.22 Security fixes: CVE-2023-3824 CVE-2023-3823 CVE-2023-3247 https://www.php.net/ChangeLog-8.php#8.1.22 Signed-off-by: Archana Polampalli Signed-off-by: Armin Kuster

nodejs: upgrade 16.20.1 -> 16.20.2

2023-08-11T14:32:04+00:00

This release contains bug fixes only. The following CVEs have been addressed: CVE-2023-32002 CVE-2023-32006 CVE-2023-32559 $ git log --oneline v16.20.1..v16.20.2 dadbde963f (tag: v16.20.2) 2023-08-09, Version 16.20.2 'Gallium' (LTS) d8ccfe9ad4 policy: handle Module.constructor and main.extensions bypass 242aaa0caa policy: disable process.binding() when enabled 40c3958a5a deps: update archs files for OpenSSL-1.1.1v a9ac9da89a deps: fix openssl crypto clean 362d4c7494 deps: upgrade openssl sources to OpenSSL_1_1_1v 7447de2794 Working on v16.20.2 https://github.com/nodejs/node/releases/tag/v16.20.2 Signed-off-by: Archana Polampalli Signed-off-by: Armin Kuster

yasm: fix CVE-2023-31975

2023-08-03T20:47:53+00:00

yasm v1.3.0 was discovered to contain a memory leak via the function yasm_intnum_copy at /libyasm/intnum.c. References: https://nvd.nist.gov/vuln/detail/CVE-2023-31975 https://github.com/yasm/yasm/issues/210 Upstream patches: https://github.com/yasm/yasm/commit/b2cc5a1693b17ac415df76d0795b15994c106441 Signed-off-by: Archana Polampalli Signed-off-by: Armin Kuster

nodejs: upgrade 16.19.1 -> 16.20.1

2023-07-16T19:30:53+00:00

Drop the gcc13.patch as it has been merged in 16.20.1 56cbc7fdda deps: V8: cherry-pick c2792e58035f The list of the CVEs are fixed in this relase: CVE-2023-30581 CVE-2023-30585 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590 https://nodejs.org/en/blog/release/v16.20.0 https://nodejs.org/en/blog/release/v16.20.1 Signed-off-by: Archana Polampalli Signed-off-by: Armin Kuster

yajl: CVE-2023-33460 memory leak in yajl_tree_parse function

2023-07-02T15:19:22+00:00

Upstream-Status: Backport from https://github.com/openEuler-BaseService/yajl/commit/23a122eddaa28165a6c219000adcc31ff9a8a698 Signed-off-by: Hitendra Prajapati Signed-off-by: Armin Kuster

grpc: ignore CVE-2023-32732

2023-07-02T15:17:52+00:00

It was introduced in in v1.53.0 and not backported to v1.46.x branch. NVD references PR which intrioduces the vulnerability: https://github.com/grpc/grpc/pull/32309#issuecomment-1589561295 Signed-off-by: Peter Marko Signed-off-by: Armin Kuster