webkitgtk3: upgrade 2.48.7 -> 2.50.5

Includes fixes for CVE-2025-13502, CVE-2025-13947, CVE-2025-43421,
CVE-2025-43458 and CVE-2025-66287.

Drop libsoup2 support. Even though this particular version still supports
it, this is the last major version that is not libsoup3-only. Starting
with version 2.52 (which is only 3-4 weeks away at the time of writing this
message) upstream is dropping libsoup2 support completely[1].

This is a proactive removal of this feature, the sooner users start the
migration, the better.

Made opengl a mandatory DISTRO_FEATURE: libepoxy requires it, which is both
a direct dependency, and an indirect one from gtk+3.

Changelogs:
https://webkitgtk.org/2026/02/09/webkitgtk2.50.5-released.html
https://webkitgtk.org/2025/12/16/webkitgtk2.50.4-released.html
https://webkitgtk.org/2025/12/04/webkitgtk2.50.3-released.html
https://webkitgtk.org/2025/11/19/webkitgtk2.50.2-released.html
https://webkitgtk.org/2025/10/10/webkitgtk2.50.1-released.html
https://webkitgtk.org/2025/09/17/webkitgtk2.50.0-released.html

[1]: https://webkitgtk.org/2025/10/07/webkitgtk-soup2-deprecation.html

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>

2 files changed, 15 insertions, 14 deletions

diff --git a/meta-oe/recipes-support/webkitgtk/webkitgtk3/no-musttail-arm.patch b/meta-oe/recipes-support/webkitgtk/webkitgtk3/no-musttail-arm.patch
index 367e6b8342..411164433a 100644
--- a/meta-oe/recipes-support/webkitgtk/webkitgtk3/no-musttail-arm.patch
+++ b/meta-oe/recipes-support/webkitgtk/webkitgtk3/no-musttail-arm.patch
@@ -23,12 +23,12 @@ diff --git a/Source/WTF/wtf/Compiler.h b/Source/WTF/wtf/Compiler.h
 index 16e416d..68dd9a0 100644
 --- a/Source/WTF/wtf/Compiler.h
 +++ b/Source/WTF/wtf/Compiler.h
-@@ -293,7 +293,7 @@
- #if COMPILER(CLANG)
- #if __SIZEOF_POINTER__ == 8
- #if !defined(MUST_TAIL_CALL) && defined(__cplusplus) && defined(__has_cpp_attribute)
--#if __has_cpp_attribute(clang::musttail) && !defined(__powerpc__) && !defined(_WIN32)
-+#if __has_cpp_attribute(clang::musttail) && !defined(__powerpc__) && !defined(_WIN32) && !defined(__arm__)
+@@ -290,7 +290,7 @@
+ // written for 64-bit may fail to tail call on 32-bit.
+ // It also doesn't work on ppc64le: https://github.com/llvm/llvm-project/issues/98859
+ // and on Windows: https://github.com/llvm/llvm-project/issues/116568
+-#if !defined(MUST_TAIL_CALL) && COMPILER(CLANG) && __SIZEOF_POINTER__ == 8 && defined(__cplusplus) && COMPILER_HAS_CPP_ATTRIBUTE(clang::musttail) && !defined(__powerpc__) && !defined(_WIN32)
++#if !defined(MUST_TAIL_CALL) && COMPILER(CLANG) && __SIZEOF_POINTER__ == 8 && defined(__cplusplus) && COMPILER_HAS_CPP_ATTRIBUTE(clang::musttail) && !defined(__powerpc__) && !defined(_WIN32) && !defined(__arm__)
  #define MUST_TAIL_CALL [[clang::musttail]]
  #define HAVE_MUST_TAIL_CALL 1
  #endif
diff --git a/meta-oe/recipes-support/webkitgtk/webkitgtk3_2.48.7.bb b/meta-oe/recipes-support/webkitgtk/webkitgtk3_2.50.5.bb
index 118592d42b..9be30506d6 100644
--- a/meta-oe/recipes-support/webkitgtk/webkitgtk3_2.48.7.bb
+++ b/meta-oe/recipes-support/webkitgtk/webkitgtk3_2.50.5.bb
@@ -23,14 +23,14 @@ SRC_URI = "https://www.webkitgtk.org/releases/webkitgtk-${PV}.tar.xz \
            file://0001-CMake-Add-a-variable-to-control-macro-__PAS_ALWAYS_I.patch \
            file://0001-Fix-32bit-arm.patch \
            "
-SRC_URI[sha256sum] = "2c62aebb608e09f930a539f3623a5cc8023b5068029f42a208f45f9124da6e30"
+SRC_URI[sha256sum] = "8737631bac3e9c7ad3e5208f9370e076c09d9c45b39980021ce54edadcc6f94f"
 
 inherit cmake pkgconfig gobject-introspection perlnative features_check upstream-version-is-even gi-docgen
 
 S = "${UNPACKDIR}/webkitgtk-${PV}"
 
 ANY_OF_DISTRO_FEATURES = "${GTK3DISTROFEATURES}"
-REQUIRED_DISTRO_FEATURES = "${@bb.utils.contains('DISTRO_FEATURES', 'wayland', 'opengl', '', d)}"
+REQUIRED_DISTRO_FEATURES = "opengl"
 
 CVE_PRODUCT = "webkitgtk webkitgtk\+"
 
@@ -51,11 +51,10 @@ DEPENDS += " \
           gstreamer1.0-plugins-base \
           glib-2.0-native \
           gettext-native \
+          libsoup \
+          libepoxy \
           "
 
-# using soup2 builds (JavaScript) API version 4.0
-# using soup3 builds (JavaScript) API version 4.1
-PACKAGECONFIG_SOUP ?= "soup3"
 PACKAGECONFIG ??= " \
            ${@bb.utils.filter('DISTRO_FEATURES', 'systemd wayland x11', d)} \
            ${@bb.utils.contains('DISTRO_FEATURES', 'x11 opengl', 'webgl opengl', '', d)} \
@@ -63,7 +62,6 @@ PACKAGECONFIG ??= " \
            ${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'opengl-or-es', '', d)} \
            enchant \
            libsecret \
-           ${PACKAGECONFIG_SOUP} \
            "
 
 PACKAGECONFIG[wayland] = "-DENABLE_WAYLAND_TARGET=ON,-DENABLE_WAYLAND_TARGET=OFF,wayland libwpe wpebackend-fdo wayland-native"
@@ -83,8 +81,6 @@ PACKAGECONFIG[openjpeg] = "-DUSE_OPENJPEG=ON,-DUSE_OPENJPEG=OFF,openjpeg"
 PACKAGECONFIG[systemd] = "-DUSE_SYSTEMD=ON,-DUSE_SYSTEMD=off,systemd"
 PACKAGECONFIG[reduce-size] = "-DCMAKE_BUILD_TYPE=MinSizeRel,-DCMAKE_BUILD_TYPE=Release,,"
 PACKAGECONFIG[lcms] = "-DUSE_LCMS=ON,-DUSE_LCMS=OFF,lcms"
-PACKAGECONFIG[soup2] = "-DUSE_SOUP2=ON,-DUSE_SOUP2=OFF,libsoup-2.4,,,soup3"
-PACKAGECONFIG[soup3] = ",,libsoup,,,soup2"
 PACKAGECONFIG[journald] = "-DENABLE_JOURNALD_LOG=ON,-DENABLE_JOURNALD_LOG=OFF,systemd"
 PACKAGECONFIG[avif] = "-DUSE_AVIF_LOG=ON,-DUSE_AVIF=OFF,libavif"
 PACKAGECONFIG[media-recorder] = "-DENABLE_MEDIA_RECORDER=ON,-DENABLE_MEDIA_RECORDER=OFF,gstreamer1.0-plugins-bad"
@@ -103,6 +99,7 @@ EXTRA_OECMAKE = " \
         ${@oe.utils.vartrue('DEBUG_BUILD', '-DWEBKIT_NO_INLINE_HINTS=ON', '-DWEBKIT_NO_INLINE_HINTS=OFF', d)} \
         -DENABLE_MINIBROWSER=ON \
         -DCMAKE_EXPORT_COMPILE_COMMANDS=OFF \
+        -DUSE_SOUP2=OFF \
                 "
 # pass -g1 to massively reduce the size of the debug symbols (4.3GB to 700M at time of writing)
 DEBUG_LEVELFLAG = "-g1"
@@ -181,3 +178,7 @@ src_package_preprocess () {
             ${B}/WebKitGTK/DerivedSources/webkit/*.cpp
 }
 
+
+# complation fails with Clang-21 issue - https://github.com/llvm/llvm-project/issues/132322
+# Can be removed when clang is updated to v22
+TOOLCHAIN:arm = "gcc"