linux/meta-openembedded.git/meta-oe/recipes-extended, branch walnascar-next

minifi-cpp: patch spdlog CVE-2025-6140

2025-07-27T18:35:10+00:00

Same patch as in spdlog recipe. Signed-off-by: Peter Marko Signed-off-by: Armin Kuster

libblockdev: fix CVE-2025-6019

2025-07-06T23:23:22+00:00

CVE-2025-6019: A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system. Refer: https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt Signed-off-by: Changqing Li Signed-off-by: Armin Kuster

canutils: use https instead of git protocol

2025-07-06T23:23:22+00:00

The git server at git.pengutronix.de no longer supports the git protocol, so switch to https. Signed-off-by: Bastian Krause Signed-off-by: Armin Kuster

libsocketcan: use https instead of git protocol

2025-07-06T23:23:22+00:00

The git server at git.pengutronix.de no longer supports the git protocol, so switch to https. Signed-off-by: Bastian Krause Signed-off-by: Armin Kuster

valkey: upgrade 8.1.0 -> 8.1.1

2025-06-20T14:46:50+00:00

ChangeLog: https://github.com/valkey-io/valkey/releases/tag/8.1.1 Security fixes (CVE-2025-21605) Limit output buffer for unauthenticated clients Bug fixes Fix the build on less common platforms in zmalloc.c Fix: add samples to stream object consumer trees Fix crash during TLS handshake with I/O threads Fix cluster slot stats assertion during promotion of replica Fix panic in primary when blocking shutdown after previous block with timeout Ignore stale gossip packets that arrive out of order Fix incorrect lag reported in XINFO GROUPS Fix engine crash on module client blocking during keyspace events Avoid shard id update of replica if not matching with primary shard id Only enable defrag for vendored jemalloc Allow scripts to support null characters again Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj Signed-off-by: Yi Zhao Signed-off-by: Armin Kuster

redis: upgrade 6.2.16 -> 6.2.18

2025-06-20T14:46:50+00:00

Changelog: https://github.com/redis/redis/releases/tag/6.2.17 https://github.com/redis/redis/releases/tag/6.2.18 Security fixes ============== * (CVE-2024-46981) Lua script commands may lead to remote code execution * (CVE-2025-21605) An unauthenticated client can cause an unlimited growth of output buffers Signed-off-by: Vijay Anusuri Signed-off-by: Armin Kuster

redis: upgrade 7.2.7 -> 7.2.8

2025-06-20T14:46:50+00:00

ChangeLog: https://github.com/redis/redis/releases/tag/7.2.8 Update urgency: SECURITY: There are security fixes in the release. Security fixes ================== * (CVE-2025-21605) An unauthenticated client can cause an unlimited growth of output buffers Bug fixes ================= * #12817, #12905 Fix race condition issues between the main thread and module threads * #13863 RANDOMKEY - infinite loop during client pause * #13877 ShardID inconsistency when both primary and replica support it Signed-off-by: Vijay Anusuri Signed-off-by: Armin Kuster

cmatrix: Improve reproducibility patch to handle libdir!=/usr/lib

2025-04-12T18:27:20+00:00

The upstream code basically hard-code libdir to /usr/lib. This was hidden by the upstream non-reproducible path existence check. Improve the reproducibility patch to use the cmake variables derived from $libdir and $datadir : CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_DATAROOTDIR. Signed-off-by: Yoann Congal Reported-by: Martin Jansa Signed-off-by: Khem Raj

enscript: fix error with gcc-15

2025-04-08T15:22:05+00:00

* Imported the submitted patch from: https://savannah.gnu.org/bugs/?66845 to fix: http://errors.yoctoproject.org/Errors/Details/851187/ ../../enscript-1.6.6/compat/regex.c:3565:13: error: too many arguments to function 're_match_2_internal'; expected 0, have 8 3565 | val = re_match_2_internal (bufp, string1, size1, string2, size2, | ^~~~~~~~~~~~~~~~~~~ ~~~~ * Modified the Upstream-Status since the same content as 0001-getopt-Include-string.h-for-strcmp-stcncmp-functions.patch is already in the backport. Signed-off-by: mark.yang Signed-off-by: Khem Raj

bit7z: add ptest support

2025-04-07T19:21:23+00:00

Main problem with ptest for this component is that it uses cmake's FetchContent and CPM to get dependencies. This adds lot of ugly code to the recipe including conditional patch. Second big problem is that tests need BIT7Z_DISABLE_USE_STD_FILESYSTEM which uses test library. This means that when building with ptests, the code is significantly different than when building without it. But in production case we don't want to use testing library... This is known at upstream and will be fixed eventually as github CI is failing on this too when submitting unrelated patches upstream. Other considerations: * created patch for new cmake option to pass path to test data on target * created patch for new cmake option to pass path to lib7zip on target * skipped test which consumes too much RAM (it passes if machine has plenty of RAM) * testdata contains files for other architectures, so INSANE_SKIP is needed for ptest package * created patch for tests failing with musl Tests usually take 9s on my build machine so added them to fast ptests. However since the dependency 7zip recipe does not build on 64-bit architectures, I could not add it to PTESTS_FAST_META_OE. Signed-off-by: Khem Raj