summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* gnome-tweaks: upgrade 40.0 -> 40.10Gyorgy Sarvari2026-02-122-35/+1
| | | | | | | | | | | Changes (note that there were no intermediate releases): 40.10: This release includes a fix for the broken GNOME Extensions link and several translation updates. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nautilus: upgrade 45.1 -> 45.2.1Gyorgy Sarvari2026-02-121-1/+6
| | | | | | | | | | | | | | | | | | | Changes: 45.2.1: * Fix a crash in sidebar code * Fix build without optional cloudproviders dependency 45.2: * Bugfixes: - Don't crash when reconnecting to remove server - Actually detect unmount on some non-native mounts - Don't crash on image properties - Allow types and sizes in Properties to expand - Don't corrupt toast messages * Translation updates Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gnome-shell-extensions: upgrade 46.1 -> 46.4Gyorgy Sarvari2026-02-121-1/+1
| | | | | | | | | | | | | | | | | | | | | Changes: 46.4: * Update template CI images to fix release pipeline 46.3: * places-menu: Fix a11y labelling * places-menu: Fix opening drives with mount operations * window-list: Fix hiding when entering overview with gestures * workspace-indicator: Only show previews of regular windows * Misc. bug fixes and cleanups 46.2: * apps-menu: Fix a11y of category labels * window-list: Fix long-press support * Misc. bug fixes and cleanups Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gnome-bluetooth: upgrade 46.0 -> 46.2Gyorgy Sarvari2026-02-121-1/+1
| | | | | | | | | | | | | | Changes: ver 46.2: This version contains a fix for the devices page staying empty on load in some circumstances, as well as translation updates. ver 46.1: This version contains translation updates and a bug fix for some device icons not appearing correctly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* mutter: fix profiler PACKAGECONFIGGyorgy Sarvari2026-02-122-0/+37
| | | | | | | | | | | | | | | | | In case "profiler" PACKAGECONFIG is enabled, the build fails with the following error: | ninja: error: '/usr/share/dbus-1/interfaces/org.gnome.Sysprof3.Profiler.xml', needed by 'src/meta-dbus-sysprof3-profiler.c', missing and no known rule to make it meson.build script is looking explicitly for a required file using the sysroot of the build system instead of ${RECIPE_SYSROOT}. To avoid this, patch meson.build to prefix this path with ${RECIPE_SYSROOT}. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit ead8f7b3273965f383ec4999bb38e87ba37daf61) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* mutter: upgrade 46.1 -> 46.9Gyorgy Sarvari2026-02-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Contains many bugfixes: https://gitlab.gnome.org/GNOME/mutter/-/blob/46.9/NEWS 46.9 ==== * Support presentation-time version 2 * Honor wl_surface.offset on cursor surfaces * Fix crash 46.8 ==== * Use BT709 coefficients and limited range for YUV conversion by defaults * Also request high priority secondary EGL context * Fix applying initial _NET_WM_WINDOW_OPACITY on Xwayland * Misc. bug fixes and cleanups 46.7 ==== * Default to high thread instead of realtime priority for KMS thread * Fix updating cursor immediately when starting window drag * Prefer GPUs with built-in panels connected as primary GPU * Fix cursor glitches when using virtual monitors * Ensure frame events are sent for cursor surfaces * Allow BGRX8888 format on big endian * Fix touchscreen drag-and-drop on wayland * Fixed crashes * Misc. bug fixes and cleanups 46.6 ==== * Fix grabbing tablet devices * Fix explicit sync with virtual monitors w/o pipewire streams * Improve detecting preferred primary devices * Fixed crashes * Misc. bug fixes and cleanups 46.5: * Fix drag and drop between X11 and wayland clients * Fix drag and drop from grabbing popups * Fix EGLDevice support * Fix frozen cursor on some hybrid machines * Fix touch window dragging with pointer lock enabled * Fix propagating tablet device removals to clients * Fix tablet input in maximized windows * Reduce damage on window movement * Fix frozen cursor after suspend * Fix using modifiers on multi-GPU setups * Fixed crashes * Misc. bug fixes and cleanups 46.4: * Fix nested popovers on wayland * Misc. bug fixes and cleanups 46.3.1: * Fix visibility of Xwayland windows * Misc. bug fixes 46.3: * Fix performance issues with second virtual monitor * Fix missing unmap animation of some windows * Fix placement/resizing regression * Fix possible out of sync primary selections and clipboard * Fix ibus support in popups * Fix hardware accelerated rendering when headless * Add back support for legacy X11 cursor themes * Fix preedit offsets * Use character offsets to specify surrounding text * Don't force titlebar on screen on all interactive resizes * Fixed crashes * Misc. bug fixes and cleanups 46.2: * Fix hardware cursor with non-atomic KMS drivers * Fix night light state getting stuck on monitor changes * Fix sending preferred buffer transform * Fix key press events with immediate release being ignored * Fix unsetting clipboard on screen lock * Fix wrong input region of undecorated X11 windows * Fix windows potentially shrinking unexpectedly on configure * Fix popup menus sometimes closing immediately * Fixed crashes * Misc. bug fixes and cleanups Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gnome-keyring: upgrade 46.1 -> 46.2Wang Mingyu2026-02-121-1/+1
| | | | | | | | | | | | | | | | | Changelog: ========= * Don't use 'bool' as variable name * autogoo: replace AC_HELP_STRING with AS_HELP_STRING * Default "automatically unlock" checkbox to false * build: Fix distcheck with systemd unit * rpc-layer: Fix undefined reference to g_strlcpy * Updated translations Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0e55ce901a9697f273b1b04dc6daa15b81d4173f) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libgweather4: Upgrade to 4.4.4Khem Raj2026-02-121-5/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | - Fix deprecation warnings [!300] - Fix introspection annotation for async functions [!318] - Plug some memory leaks [!321] - Translation updates Use GI_TYPELIB_PATH to point to typlib paths in target sysroot Fixes | FAILED: data/Locations.bin | /mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux-musl/libgweather4/4.4.4/libgweather-4.4.4/build-aux/meson/gen_locations_variant.py ../libgweather-4.4.4/data/Locations.xml data/Locations.bin | Traceback (most recent call last): | File "/mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux-musl/libgweather4/4.4.4/libgweather-4.4.4/build-aux/meson/gen_locations_variant.py", line 7, in <module> | from gi.repository import GLib | File "/mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux-musl/libgweather4/4.4.4/recipe-sysroot-native/usr/lib/python3.13/site-packages/gi/importer.py", line 133, in create_module | raise ImportError('cannot import name %s, ' | 'introspection typelib not found' % namespace) | ImportError: cannot import name GLib, introspection typelib not found Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Andreas Müller <schnitzeltony@gmail.com> (cherry picked from commit 054716edca0ed56c171b5cb8d375c6bdf53eaa4b) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* tracker-miners: upgrade 3.7.2 -> 3.7.3Wang Mingyu2026-02-122-10/+7
| | | | | | | | | | | | | | | | | | | 0001-fix-reproducibility.patch refreshed for 3.7.3 Changelog: ============ * Fix possible crashes handling live changes to extractor configuration * Make it easier to run tracker-extract-3 under Valgrind * Plug a leak on misdetected JPEG files * Many further metadata extraction tests Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9cc20a0203ebbf052aa70856436a6b265cd3fbeb) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* tracker-miners: upgrade 3.7.1 -> 3.7.2Wang Mingyu2026-02-123-59/+62
| | | | | | | | | | | | 0001-Set-header-file-to-a-fixed-path-instead-of-a-host-pa.patch 0001-fix-reproducibility.patch refreshed for 3.7.2 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 59c62576b40da737703a0b7a42c63c927d95a7c5) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* tracker: upgrade 3.7.2 -> 3.7.3Wang Mingyu2026-02-121-1/+1
| | | | | | | | | | | | | | | Changelog: ========= * Bump database version to fix SQLite 3.45.3 issues in existing installs * Fixed possible infinite loop on incomplete/unterminated Turtle/Trig data. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit c6a9b1559cc5b10d61b552d947da83ac81396654) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* tracker: upgrade 3.7.1 -> 3.7.2Wang Mingyu2026-02-121-1/+1
| | | | | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3142a9ca94fca2ab8c36ac5f6b7fe435cfb9a5ef) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gdm: add missing json-glib dependencyPeter Marko2026-02-121-0/+1
| | | | | | | | | | | | | Fixes do_configure error: | Run-time dependency json-glib-1.0 found: NO (tried pkgconfig) | | ../gdm-46.0/meson.build:64:12: ERROR: Dependency "json-glib-1.0" not found, tried pkgconfig Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 97eaa95cf36ab224047650e5fea58cbbf5bac30d) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gdm: upgrade 46.0 -> 46.2Gyorgy Sarvari2026-02-121-1/+1
| | | | | | | | | | | | Changes (note that there was no 46.1 release): 46.2: - Block suspend when remote displays are active - Support S0ix suspend when deciding if nvidia should use wayland - Misc fixes - Translation updates Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gnome-calculator: upgrade 46.0 -> 46.2Gyorgy Sarvari2026-02-121-1/+1
| | | | | | | | | | | | | | | | Changes: 46.2: * Updated translations * Fixed currency conversions not working 46.1: * Updated translations * Disable undo action if nothing to undo * Keep last conversion options at launch * Fixed event controller propagation phase Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gnuchess: upgrade 6.2.9 -> 6.2.11Gyorgy Sarvari2026-02-122-154/+2
| | | | | | | | | | | | | Drop patch that was incorporated in this release. Also, switch to GNU ftp servers to fetch the source from. Changes: 6.2.11: No changes. 6.2.10: - Tempo bonus added in the evaluation function. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gtksourceview5: upgrade 5.12.0 -> 5.12.1Gyorgy Sarvari2026-02-121-1/+1
| | | | | | | | | | | | | | Changes: * Update documentation links * Specify recoloring hex colors for Adwaita-dark * Improve grid drawing positions slightly * Use a weak ref for GtkSourceView backpointer in GtkSourceGutterRenderers which fixes a potential leak of GtkSourceView * Fix a fontconfig check for Windows * Fix section name for elixir Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gnome-desktop: upgrade 44.0 -> 44.4Gyorgy Sarvari2026-02-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: Version 44.4 - Support TryExec for thumbnailers - Translation updates Version 44.3 - Fix CI regression for release upload Version 44.2 - Stop using ratio character for time in the wall-clock - Fix variable initialization - General CI cleanups - Only parse XML files as slideshows - Translation updates Version 44.1 - Fix compatibility with muslc - Fix GNOME_DESKTOP_IS_THUMBNAIL_FACTORY - Update default Indic input methods - Use ibus-chewing as the default input source for zh_TW - Translation updates Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-virtualenv: patch CVE-2026-22702Gyorgy Sarvari2026-02-122-0/+61
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-22702 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-tornado: mark CVE-2025-67725 patchedGyorgy Sarvari2026-02-121-1/+1
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-67725 According to the NVD advisory references the same commit fixes it as CVE-2025-67726. Just extend the CVE tag to make the cve-checker also see this. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-eventlet: switch to PEP-517 build backendalperak2026-02-121-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The project has a proper pyproject.toml which declares the hatchling.build PEP-517 backend. Fix: WARNING: python3-eventlet-0.36.1-r0 do_check_backend: QA Issue: inherits setuptools3 but has pyproject.toml with hatchling.build, use the correct class [pep517-backend] Signed-off-by: alperak <alperyasinak1@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 19affc7a212d4edca4faa4119fa8e5f9e0b7daf4) This is cherry-picked into Scarthgap, because the Setuptools backend seems to be broken - it doesn't install the submodules, making import fail: root@qemux86-64:~# python3 Python 3.12.12 (main, Oct 9 2025, 11:07:00) [GCC 13.4.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>> import eventlet Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python3.12/site-packages/eventlet/__init__.py", line 6, in <module> from eventlet import convenience File "/usr/lib/python3.12/site-packages/eventlet/convenience.py", line 4, in <module> from eventlet import greenpool File "/usr/lib/python3.12/site-packages/eventlet/greenpool.py", line 4, in <module> from eventlet import queue File "/usr/lib/python3.12/site-packages/eventlet/queue.py", line 48, in <module> from eventlet.event import Event File "/usr/lib/python3.12/site-packages/eventlet/event.py", line 1, in <module> from eventlet import hubs See also https://github.com/eventlet/eventlet/issues/1071 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* raptor2: patch CVE-2024-57822 and CVE-2024-57823Gyorgy Sarvari2026-02-123-0/+77
| | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-57822 https://nvd.nist.gov/vuln/detail/CVE-2024-57823 Pick the patches mentioned in the github issue[1] mentioned in the NVD advisories (both of them are covered by the same issue) [1]: https://github.com/dajobe/raptor/issues/70 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit dc2c6a514e7744da4165effefa61ad59c27cf507) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-django: patch CVE-2025-64460Gyorgy Sarvari2026-02-122-0/+200
| | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-64460 Backport the patch that explicitly references this CVE in its commit message. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-aiohttp: patch CVE-2025-69228Gyorgy Sarvari2026-02-122-0/+49
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69228 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-aiohttp: patch CVE-2025-69226Gyorgy Sarvari2026-02-122-0/+135
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69226 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-aiohttp: patch CVE-2025-69225Gyorgy Sarvari2026-02-122-2/+52
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69225 Backport the patch that is referenced by the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* proftpd: ignore CVE-2021-47865Gyorgy Sarvari2026-02-121-0/+1
| | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-47865 This CVE was opened based on a 5 years old Github issue[1], and has been made public recently. The CVE wasn't officially disputed (yet?), but based on the description and the given PoC the application is working as expected. The vulnerability description and the PoC basically configures proftpd to accept maximum x connections, and then when the user tries to open x + 1 concurrent connections, it refuses new connections over the configured limit. See also discussion in the Github issue. It seems that it won't be fixed, because there is nothing to fix. [1]: https://github.com/proftpd/proftpd/issues/1298 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* netdata: ignore CVE-2024-32019Gyorgy Sarvari2026-02-091-0/+2
| | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32019 The vulnerability affects the ndsudo binary, part of netdata. This binary was introduced in version 1.45.0[1], and the recipe contains v1.34.1 - which is not vulnerable yet. Ignore the CVE due to this. [1]: https://github.com/netdata/netdata/commit/0c8b46cbfd05109a45ee4de27f034567569fa3fa Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* mongodb: ignore CVE-2025-14911Gyorgy Sarvari2026-02-091-0/+1
| | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-14911 The CVE is currently tracked without valid CPE. The vulnerability affects mongo-c-driver component, not mongodb. They are also stored in different repositories. Due to this, ignore this CVE. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* mongodb: upgrade 4.4.29 -> 4.4.30Gyorgy Sarvari2026-02-091-3/+3
| | | | | | | | This is a security release to fix CVE-2025-14847: https://nvd.nist.gov/vuln/detail/CVE-2025-14847 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libcupsfilters: patch CVE-2025-64503Gyorgy Sarvari2026-02-092-6/+51
| | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-64503 Pick the patch that explicitly refernces the CVE ID in its message. (The NVD advisory mentions only the cups-filters patch, but the developer indicated the CVE ID in the libcupsfilters patch also) Between this recipe version and the patch the project has decided to eliminate c++ from the project, and use c only. The patch however is straightforward enough that it could be backported with very small modifications. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* imagemagick: patch CVE-2025-66628Gyorgy Sarvari2026-02-092-0/+28
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-66628 Pick the patch that refers to the relevant github advisory[1] explicitly in its commit message. [1]: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gnome-settings-daemon: ignore CVE-2024-38394Gyorgy Sarvari2026-02-091-0/+2
| | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-38394 The CVE has the disputed flag. The project maintainers claim that the issue is not in gnome-setttings-daemon. If the vulnerability needs to be handled in gnome-settings-daemon, than it is a new feature rather than a vulnerability fix. Due to this, ignore this CVE. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gimp: ignore CVE-2025-14423Gyorgy Sarvari2026-02-091-1/+2
| | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-14423 The vulnerability is about parsing LBM files, however this feature was introduced in verison 3.0[1], and the current recipe version is not vulnerable. [1]: https://gitlab.gnome.org/GNOME/gimp/-/commit/222bef78c71ed8562a610f6863d56c0b3e2bef68 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* freerdp: ignore CVE-2025-68118Gyorgy Sarvari2026-02-091-0/+1
| | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-68118 The vulnerability is specific to the usage of Microsoft specific sprintf implementation. Because of this, ignore this vulnerability. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 1b4b952b5127ed9c35cae0c6cfd6e1133c79a946) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* ez-ipupdate: patch CVE-2003-0887Gyorgy Sarvari2026-02-092-0/+165
| | | | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2003-0887 The vulnerability is about the default (example) configurations, which place cache files into the /tmp folder, that is world-writeable. The recommendation would be to place them to a more secure folder. The recipe however does not install these example configurations, and as such it is not vulnerable either. Just to make sure, patch these folders to a non-tmp folder (and also install that folder, empty). Some more discussion about the vulnerability: https://bugzilla.suse.com/show_bug.cgi?id=48161 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 0080dd79731efa1cca150730c5ac39bad82f7095) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* fontforge: patch CVE-2025-15270Gyorgy Sarvari2026-02-092-0/+45
| | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15270 Pick the patch that mentions this vulnerbaility explicitly in its description. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 15f2f350cc3c170cb016f824fbccfe2426307abc) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* fontforge: patch CVE-2025-15269Gyorgy Sarvari2026-02-092-0/+36
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15269 Pick the patch that refers to this vulnerability ID explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 449999f6767668df4378105b4c79c4a5db5125c3) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* fontforge: patch CVE-2025-15275Gyorgy Sarvari2026-02-092-0/+34
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15275 Pick the patch that mentions this vulnerability ID explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit edc3b69cefe42c80e0cf8c5b64acc03a15da5ef7) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* fontforge: patch CVE-2025-15279Gyorgy Sarvari2026-02-093-1/+79
| | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15279 Pick the patch that mentions this vulnerability ID explicitly. Also, this patch has caused some regression - pick the patch also that fixed that regression. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 21418bce907ee06695d29f8ad759f2d9dfeed5b9) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* php 8.2.29: Fix CVE-2025-14180Anil Dongare2026-02-092-0/+70
| | | | | | | | | | | | | Upstream Repository: https://github.com/php/php-src.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-14180 Type: Security Fix CVE: CVE-2025-14180 Score: 7.5 Patch: https://github.com/php/php-src/commit/5797b94652c3 Signed-off-by: Anil Dongare <adongare@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* php 8.2.29: Fix CVE-2025-14178Anil Dongare2026-02-092-0/+66
| | | | | | | | | | | | | Upstream Repository: https://github.com/php/php-src.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-14178 Type: Security Fix CVE: CVE-2025-14178 Score: 8.2 Patch: https://github.com/php/php-src/commit/c4268c15e361 Signed-off-by: Anil Dongare <adongare@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* Use https when accessing archive.xfce.orgJason Schonberg2026-02-0910-10/+10
| | | | | | | | | | | | | | | | | | | | | While using devtool to check available versions, I noticed a 301 http error. Specifically : $ devtool latest-version libxfce4ui Resolving archive.xfce.org (archive.xfce.org)... 217.70.191.87 Connecting to archive.xfce.org (archive.xfce.org)|217.70.191.87|:80... connected . HTTP request sent, awaiting response... 301 Moved Permanently Location: https://archive.xfce.org/src/xfce/libxfce4ui/4.20/ [following] With this patch, we change to make the SRC_URI an https request. A similar patch is already in master - commit 808916819692d4ee2a592ef25af55081d80a8021 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-protobuf: added python3-ctypes as RDEPENDSJan Vermaete2026-02-091-0/+1
| | | | | | | | | | | | | | | | File "/usr/lib/python3.12/site-packages/google/protobuf/internal/type_checkers.py", line 25, in <module> import ctypes ModuleNotFoundError: No module named 'ctypes' tested on qemu86-64 Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (From meta-openembedded rev: d1b8ebc2a5ff5993e118048f2ca31a893f13cd38) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-protobuf: patch CVE-2026-0994Peter Marko2026-02-092-0/+49
| | | | | | | | | | Pick patch from PR in NVD report. It is the only code change in 33.5 release. Skip the test file change as it's not shipped in python module sources. Resolve formatting-only conflict. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* tigervnc: ignore CVE-2025-26594...26601Gyorgy Sarvari2026-02-091-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ignore the following CVEs: CVE-2025-26594, CVE-2025-26595, CVE-2025-26596, CVE-2025-26597, CVE-2025-26598, CVE-2025-26599, CVE-2025-26600, CVE-2025-26601 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-26594 https://nvd.nist.gov/vuln/detail/CVE-2025-26595 https://nvd.nist.gov/vuln/detail/CVE-2025-26596 https://nvd.nist.gov/vuln/detail/CVE-2025-26597 https://nvd.nist.gov/vuln/detail/CVE-2025-26598 https://nvd.nist.gov/vuln/detail/CVE-2025-26599 https://nvd.nist.gov/vuln/detail/CVE-2025-26600 https://nvd.nist.gov/vuln/detail/CVE-2025-26601 TigerVNC compiles its own xserver, this is why these CVEs are associated with it - despite the vulnerabilities being in xserver. All of these vulnerabilities were fixed by the same PR[1], which has been part of xserver since version 21.1.16 (the currently used xserver version in TigerVNC is 21.1.18). Due to this, ignore these vulnerabilities, and just mark them as patched. [1]: https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 4924e89bb77fe5486063229c50039a458d60f8ea) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* tigervnc: ignore CVE-2023-6478Gyorgy Sarvari2026-02-091-0/+1
| | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-6478 TigerVNC compiles its own xserver, this is why this CVE is associated with it - despite the vulnerability being in xserver. The vulnerability was fixed by [1] (from the nvd report), which has been backported[2] to the xserver version used by the recipe - so ignore the CVE, since it's patched already. [1]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632 [2]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/58e83c683950ac9e253ab05dd7a13a8368b70a3c Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 62a78f8ba7c8bd229cc82cf81bcc6a6d8116ebca) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* tigervnc: ignore CVE-2023-6377Gyorgy Sarvari2026-02-091-0/+1
| | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-6377 TigerVNC compiles its own xserver, this is why this CVE is associated with it - despite the vulnerability being in xserver. The vulnerability was fixed by [1] (from the nvd report), which has been backported[2] to the xserver version used by the recipe - so ignore the CVE, since it's patched already. [1]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd [2]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/a7bda3080d2b44eae668cdcec7a93095385b9652 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f691f2178b15eec22f09a1c17b9945fad4e330e6) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* tigervnc: ignore CVE-2014-8241Gyorgy Sarvari2026-02-091-0/+2
| | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2014-8241 The vulnerability is about a potential null-pointer dereference, because of a malloc result is not verified[1]. The vulnerable code has been refactored since completely[2], and the code isn't present anymore in the codebase. [1]: https://github.com/TigerVNC/tigervnc/issues/993#issuecomment-612874972 - attachment [2]: https://github.com/TigerVNC/tigervnc/commit/b8a24f055f1a29886d8b18bb3f0902144dc5bd14 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit ed8a1038d227ee521cf2349d9f7f8e37eec6a64a) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* tigervnc: sync xserver component with oe-coreGyorgy Sarvari2026-02-094-23/+180
| | | | | | | | | | | | oe-core has a newer version of xserver than this recipe used to compile TigerVNC with. This recipe updates xserver to the same version, 21.1.18. TigerVNC only started to support this xserver version 2 versions later, with 1.13. Due to this 3 commits were backported that add the missing changes. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-05-16 19:05:10 +0000