linux/meta-openembedded.git/meta-oe/recipes-extended, branch scarthgap

flatpak: add PACKAGECONFIG for dconf

2026-04-03T09:30:48+00:00

Disable by default to avoid a requirement for meta-gnome Signed-off-by: Markus Volk Signed-off-by: Khem Raj Signed-off-by: Anuj Mittal

nativesdk-pistache: dependency with brotli

2026-03-24T03:22:07+00:00

Building of nativesdk-pistache aborted due to missing dependency with brotli. Fixed by extending brotli recipe to build nativesdk Signed-off-by: Christos Gavros Signed-off-by: Khem Raj (cherry picked from commit cf95ee0ff541289c9423e463b1ee607b642ad1f0) Signed-off-by: Deepak Rathore Signed-off-by: Anuj Mittal

polkit: Switch PAM files to common-*

2026-02-25T05:07:54+00:00

Add a new OS option to polkit meson: "openembedded" and use this to set PAM include to common-* which matches OE-Core libpam. This also may fix a non-reproducibility since polkit meson system tried to detect the host (compiling) OS and changed PAM config from the detected value. Fixes: https://github.com/openembedded/meta-openembedded/issues/860 Signed-off-by: Yoann Congal Signed-off-by: Khem Raj (cherry picked from commit 9bdff5feb60994d4ed3a0123b9977c6c6643a242) Signed-off-by: Anuj Mittal

redis: ignore CVE-2025-46686

2026-01-26T04:34:44+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-46686 Upstream disputes that it is a security violation, and says that implementing a mitigation for this would negatively affect the rest of the application, so they elected to ignore it. See Github advisory about the same vulnerability: https://github.com/redis/redis/security/advisories/GHSA-2r7g-8hpc-rpq9 Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit 868b4b2959c1f6be13693e31eae5b27a1fa697e6) Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

boinc-client: mark CVE-2013-2018 patched

2026-01-19T06:45:47+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2013-2018 According to oss-security email[1], version 7.0.45 included the fixes[2][3][4] [1]: https://www.openwall.com/lists/oss-security/2013/04/29/11 [2]: https://github.com/BOINC/boinc/commit/6e205de096da83b12ffb2f0183b43e51261eb0c4 [3]: https://github.com/BOINC/boinc/commit/e8d6c33fe158129a5616e18eb84a7a9d44aca15f [4]: https://github.com/BOINC/boinc/commit/ce3110489bc139b8218252ba1cb0862d69f72ae3 Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit 2a78ad8813845677132ad0f1552fcaa4961c3e15) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

boinc-client: set CVE_PRODUCT

2026-01-19T06:45:46+00:00

The relevant CVEs are tracked with underscore in their name. See CVE db query: sqlite> select vendor, product, count(*) from PRODUCTs where product like '%boinc%' group by 1, 2; berkeley|boinc_client|2 berkeley|boinc_forum|1 universityofcalifornia|boinc_client|165 universityofcalifornia|boinc_server|5 Set the CVE_PRODUCT accordingly. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit 31de060b48c57194ea2e6c6844d746eb59a0d056) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

boinc-client: fix hostname reproducibility

2026-01-19T06:45:46+00:00

The generated svn_version.h contains the hostname which makes it non-reproducible. Fix this by removing the hostname from the file. Signed-off-by: Yoann Congal Signed-off-by: Khem Raj (cherry picked from commit f23543fb6e8dc8af1f50058ed5739c4419e462db) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

minio: ignore irrelevant CVEs

2025-12-30T01:38:03+00:00

The minio umbrella covers multiple projects. The recipe itself builds "minio client", which is a set of basic tools to query data from "minio server" - like ls, mv, find... The CVEs were files against minio server. Looking at the go mod list, this recipe doesn't use minio server even as a build dependency - so ignore the CVEs. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit df462075be855c60117af661dbce1836c652fc16) Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

p7zip 16.02: Fix CVE-2022-47069

2025-12-30T01:37:59+00:00

Upstream Repository: https://sourceforge.net/projects/p7zip/ Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2022-47069 Type: Security Fix CVE: CVE-2022-47069 Score: 7.8 Note: - Commit [1] updates complete p7zip archive source for v17 and includes changes that fixes CVE-2022-47609, adapted fix related changes in current p7zip v16.02. - Similar changes via [2] have been integrated into the upstream 7zip package, which replaced p7zip 16.02 in OE-Core master. For the testing: - Verified fix using steps mentioned at [3], trace not observed. - Validated against known malicious ZIP samples [3] References: [1] https://github.com/p7zip-project/p7zip/commit/d7a903ff13c2 [2] https://github.com/ip7z/7zip/commit/f19f813537c7 [3] https://sourceforge.net/p/p7zip/bugs/241/ [4] https://bugzilla.suse.com/show_bug.cgi?id=CVE-2022-47069 Signed-off-by: Vrushti Dabhi Signed-off-by: Anuj Mittal

redis: Refine CVE-2022-0543 status description

2025-12-22T02:19:04+00:00

Refine the CVE_STATUS description for CVE-2022-0543 to provide a more precise explanation of this Debian-specific vulnerability. The vulnerability originates from Debian's packaging methodology, which loads system-wide Lua libraries (lua-cjson, lua-cmsgpack), enabling Lua sandbox escape. Upstream Redis builds, including those built by Yocto/OpenEmbedded, utilize embedded Lua from the deps/ directory and are therefore not affected by this issue. It is also fixed in Debian with this commit: https://salsa.debian.org/lamby/pkg-redis/-/commit/c7fd665150dc4769402cae97d1152b3c6e4366f0 References: - https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce - https://nvd.nist.gov/vuln/detail/CVE-2022-0543 Signed-off-by: Deepak Rathore Signed-off-by: Khem Raj (cherry picked from commit 7675392aa7c1bf27b8993d08936bc4bc84d1508d) Signed-off-by: Deepak Rathore Signed-off-by: Anuj Mittal