summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* wolfssl: patch CVE-2026-5778whinlatterAnkur Tyagi2026-05-082-0/+39
| | | | | | | | | | Backport commit from the PR[1] mentioned in the nvd[2] [1]https://github.com/wolfSSL/wolfssl/pull/10125 [2]https://nvd.nist.gov/vuln/detail/CVE-2026-5778 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wolfssl: patch CVE-2026-5772Ankur Tyagi2026-05-083-0/+62
| | | | | | | | | | Backport commits from the PR[1] mentioned in the nvd[2] [1]https://github.com/wolfSSL/wolfssl/pull/10119 [2]https://nvd.nist.gov/vuln/detail/CVE-2026-5772 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wolfssl: patch CVE-2026-5447Ankur Tyagi2026-05-082-0/+66
| | | | | | | | | | | | Backport commit from the PR[1] mentioned in the nvd[2] [1]https://github.com/wolfSSL/wolfssl/pull/10112 [2]https://nvd.nist.gov/vuln/detail/CVE-2026-5447 Dropped unit test changes during the backport. Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wolfssl: patch CVE-2026-5446Ankur Tyagi2026-05-083-0/+91
| | | | | | | | | | Backport commits from the PR[1] mentioned in the nvd[2] [1]https://github.com/wolfSSL/wolfssl/pull/10111 [2]https://nvd.nist.gov/vuln/detail/CVE-2026-5446 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wolfssl: patch CVE-2026-5392Ankur Tyagi2026-05-082-0/+34
| | | | | | | | | | | | Backport commit from the PR[1] mentioned in the nvd[2] [1]https://github.com/wolfSSL/wolfssl/pull/10039 [2]https://nvd.nist.gov/vuln/detail/CVE-2026-5392 Dropped unit test changes during the backport. Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wolfssl: patch CVE-2026-5188Ankur Tyagi2026-05-082-0/+102
| | | | | | | | | | | Backport commit from the PR[1] mentioned in the nvd[2] [1]https://github.com/wolfSSL/wolfssl/pull/10024 [2]https://nvd.nist.gov/vuln/detail/CVE-2026-5188 Dropped unit test changes during the backport. Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wolfssl: patch CVE-2026-3580Ankur Tyagi2026-05-082-0/+426
| | | | | | | | | | Backport commit from the PR[1] mentioned in the nvd[2] [1]https://github.com/wolfSSL/wolfssl/pull/9855 [2]https://nvd.nist.gov/vuln/detail/CVE-2026-3580 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wolfssl: patch CVE-2026-1005Ankur Tyagi2026-05-082-0/+84
| | | | | | | | | | Backport commit from the PR[1] mentioned in the nvd[2] [1]https://github.com/wolfSSL/wolfssl/pull/9571 [2]https://nvd.nist.gov/vuln/detail/CVE-2026-1005 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-django: upgrade 4.2.29 -> 4.2.30Ankur Tyagi2026-05-081-1/+1
| | | | | | | | Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.30/ Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-django: upgrade 5.2.12 -> 5.2.13Gyorgy Sarvari2026-05-081-1/+1
| | | | | | | | | | | | Contains fixes for CVE-2026-3902, CVE-2026-4277, CVE-2026-4292, CVE-2026-33033 and CVE-2026-33034. Changelog: https://docs.djangoproject.com/en/6.0/releases/5.2.13/ Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-gpiod: update to v2.4.2Bartosz Golaszewski2026-05-081-1/+1
| | | | | | | | | | | | Bug-fix release addressing a buffer overflow bug discovered during an AI-augmented security audit as well as another minor issue with unnecessarily duplicated code. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 7e24f2b5a868989719a1afde14258b323c7a3a56) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-bitarray: upgrade 3.8.0 -> 3.8.1Wang Mingyu2026-05-081-1/+1
| | | | | | | | | | | | | Changelog: ========== * fixed critial findings in C Extension Analysis Report * add tests, in particular 'devel/test_capi.py' Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 041704b01cc0c039390b42ee72a28bdc13a630b2) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-tzdata: upgrade 2025.3 -> 2026.1Wang Mingyu2026-05-081-1/+1
| | | | | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 36111dde1a7cd9f9df139d8dded91ea771336a69) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-tzdata: upgrade 2025.2 -> 2025.3Wang Mingyu2026-05-081-1/+1
| | | | | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 2c0a4edb58da813ca3d9709baed7b5c67ae85e2e) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-werkzeug: upgrade 3.1.7 -> 3.1.8Wang Mingyu2026-05-081-1/+1
| | | | | | | | | | Request.host and get_host return the empty string if the header is missing or has invalid characters. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit d8c310aa52e669ca894d4b343bd83a97cb6eb8d4) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-werkzeug: upgrade 3.1.6 -> 3.1.7Wang Mingyu2026-05-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== - parse_list_header preserves partially quoted items, discards empty items, and returns empty for unclosed quoted values. - WWWAuthenticate.to_header does not produce a trailing space when there are no parameters. - Transfer-Encoding is parsed as a set. - Request.host, get_host, and host_is_trusted validate the characters of the value. An empty value is no longer allowed. A Unix socket server address is ignored. The trusted_list argument to host_is_trusted is optional. - Fix multipart form parser handling of newline at boundary. - Response.make_conditional sets the Accept-Ranges header even if it is not a satisfiable range request. - merge_slashes merges any number of consecutive slashes. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit db8bd24b0db925cdbd4b9d444981846871c354f2) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-ecdsa: Upgrade 0.19.1 -> 0.19.2Mingli Yu2026-05-081-1/+1
| | | | | | | | | | | Changlog: https://github.com/tlsfuzzer/python-ecdsa/releases/tag/python-ecdsa-0.19.2 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 27d096d984b1a5b567ba1b217c3fee8581284575) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xdg-dbus-proxy: upgrade 0.1.6 -> 0.1.7Gyorgy Sarvari2026-05-081-2/+4
| | | | | | | | | | | | | | | | | | | | | | Contains fix for CVE-2026-34080. Since it is tracked without version info by NVD, mark it explicitily as patched. Drop the patch that is included in this release. While here, also add the recipe to the ptest list - it's a fast one, runs under a second. Changelog: - Drop the autotools build system - Unbreak the CI - Prevent a crash on disconnect - Fix building with glibc >= 2.43 - Fix the eavesdrop filtering to prevent message interception Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libgpiod: update to v2.2.4Bartosz Golaszewski2026-05-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug-fix release addressing several issues discovered during an AI-augmented security audit. The most severe bug was found in the C extension code of the python bindings - which also get an update - but there were some memory leaks and integer overflow bugs in the core C library as well as in tools and DBus daemon. Full changelog: Bug fixes: - fix buffer over-read bugs when translating uAPI structs to library types - fix variable and argument types where necessary - sanitize values returned by the kernel to avoid potential buffer overflows - fix memory leaks in gpio-tools - add missing return value checks in gpio-tools - fix period parsing in gpio-tools - use correct loop counter in error path in gpio-manager Improvements: - make tests work with newer coreutils by removing cases checking tools' behavior on SIGINT which stopped working due to changes in behavior of the timeout tool Also: drop the patch that's now upstream from the recipe. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libgpiod: update to v2.2.3Bartosz Golaszewski2026-05-081-1/+1
| | | | | | | | | | Bug-fix release addressing a couple problems in gpio-manager and tests. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 172c473caf11c00ce4221f786050f0b9805d868c) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nodejs: mark CVE-2026-21710 patchedGyorgy Sarvari2026-05-081-0/+1
| | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-21710 The CVE is fixed in the current recipe version[1], but NVD tracks it without verison info. Mark it as patched in the recipe. [1]: https://github.com/nodejs/node/blob/v22.x/doc/changelogs/CHANGELOG_V22.md Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit b483760dba76bb66bad820ea0246a38692c28c45) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* freeipmi: mark CVE-2026-33554 patchedGyorgy Sarvari2026-05-081-0/+1
| | | | | | | | | | | The CVE is tracked by NVD without version info. It's description confirms that it is fixed in version 1.6.17. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 21f792ff6321b4631e36c29bfdef080af4fc7da0) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libsoup-2.4: fix several CVEsChangqing Li2026-05-0811-0/+1087
| | | | | | | | | | | | | | | | | | | | | | Fix CVE-2026-1539,CVE-2026-1761,CVE-2026-1801,CVE-2026-2443, CVE-2026-2369,CVE-2026-1760,CVE-2025-14523,CVE-2025-32049,CVE-2026-1467 Refer: CVE-2026-1801 https://gitlab.gnome.org/GNOME/libsoup/-/issues/481 CVE-2026-1761 https://gitlab.gnome.org/GNOME/libsoup/-/issues/493 CVE-2026-2443 https://gitlab.gnome.org/GNOME/libsoup/-/issues/487 CVE-2026-1539 https://gitlab.gnome.org/GNOME/libsoup/-/issues/489 CVE-2026-2369 https://gitlab.gnome.org/GNOME/libsoup/-/issues/498 CVE-2026-1760 https://gitlab.gnome.org/GNOME/libsoup/-/issues/475 CVE-2025-14523 https://gitlab.gnome.org/GNOME/libsoup/-/issues/472 CVE-2025-32049 https://gitlab.gnome.org/GNOME/libsoup/-/issues/390 CVE-2026-1467 https://gitlab.gnome.org/GNOME/libsoup/-/issues/488 Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 07d67228162018f5f619dce7183f85e79293378d) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-grpcio: ignore CVE-2026-33186Gyorgy Sarvari2026-05-081-0/+1
| | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-33186 The vulnerability only affects the Go implememtation of the library, not the Python one. Ignore this CVE due to this. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 468ee626f88272eedf275efe6f68640ee643c3f4) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* protobuf, python3-protobuf: ignore CVE-2026-6409Gyorgy Sarvari2026-05-082-0/+2
| | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-6409 The vulnerability impacts only the PHP library component, not the cpp/python one. Ignore this CVE due to this. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit aef8bc34225cd0a56057749d0db1dfac773b17cb) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libcoap: patch CVE-2026-29013Ankur Tyagi2026-05-082-0/+87
| | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-29013 Debian[1] also identified this as a fix. [1] https://security-tracker.debian.org/tracker/CVE-2026-29013 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* lcms: patch CVE-2026-41254Ankur Tyagi2026-05-083-1/+70
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-41254 Backport the patches referenced by the NVD advisory. Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* lshw: Fix binmergeJörg Sommer2026-04-241-2/+2
| | | | | | | | | In case $sbindir = $bindir we have to pass this setting to make. Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit d09f50438f5d6bda37413e583776f177c3ccd343) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libdvdnav: use https for fetching codeMarkus Volk2026-04-241-1/+1
| | | | | | | Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit b50fbdd66b5d93fed47e62271048372bd97b18f3) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libdvdcss: use https for fetching codeMarkus Volk2026-04-241-1/+1
| | | | | | | Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit ae92a2993cb1d9289ed45859c9891b810c62c1dc) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libdvdread: use https for fetching codeMarkus Volk2026-04-241-1/+1
| | | | | | | Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 7bf89d06a41405b48fa3af260da36bc686973afc) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* jq: patch CVE-2026-39979Gyorgy Sarvari2026-04-242-0/+32
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-39979 Backport the patch that is referenced by the NVD advisory.y Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 2b1e34f0f51b103fa37f163cdccdeebf821ac7c1) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* jq: patch CVE-2026-33948Gyorgy Sarvari2026-04-242-0/+50
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-33948 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 8d399af3337b25d71f8cd4308b9788ac4e88b730) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* jq: patch CVE-2026-33947Gyorgy Sarvari2026-04-242-0/+105
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-33947 Backport the patch that is referenced by the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 525e18ce214213193d9a280de3bfd2deb847110e) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* jq: patch CVE-2026-32316Gyorgy Sarvari2026-04-242-5/+58
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-32316 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit e94ab85126f12d77253107084dc8463c79b3e776) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* jq: Use Git to fetch the codePeter Kjellerstedt2026-04-242-6/+52
| | | | | | | | | | | | | | | | | | | There is a bug (see https://github.com/jqlang/jq/issues/434), which results in an empty version being used if autoreconf is run on the jq sources when using a release tar ball. The incorrect assumption is that autoreconf is only used when fetching the code using Git. The empty version results in an incorrect libjq.pc file being created where the version is not set, which results in, e.g., `pkgconf --libs 'libjq > 1.6'` failing even if version 1.8.1 of jq is actually installed. Switch to fetching the code using Git to workaround the bug. Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit ed33569f822a3a8d41f82f6980a046d17aca37d5) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libgphoto2: patch CVE-2026-40341Gyorgy Sarvari2026-04-242-0/+70
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-40341 Backport the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit de5f93f95d420447043cedbedf798560925c44e1) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libgphoto2: patch CVE-2026-40340Gyorgy Sarvari2026-04-242-0/+41
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-40340 Backport the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 420e5aec46b8e9344c4d9e692f2e05236b9c89e5) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libgphoto2: patch CVE-2026-40339Gyorgy Sarvari2026-04-242-0/+42
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-40339 Backport the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 2e3be1dddc215192ff277740271d65cdceaa0b18) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libgphoto2: patch CVE-2026-40338Gyorgy Sarvari2026-04-242-0/+35
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-40338 Backport the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit f22e17508e89cf8bbb98e3cbe186bb99e379c456) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libgphoto2: patch CVE-2026-40336Gyorgy Sarvari2026-04-242-0/+45
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-40336 Backport the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 078f26b084d7a7e4ac61521f73188249b9bdd39a) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libgphoto2: patch CVE-2026-40335Gyorgy Sarvari2026-04-242-0/+44
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-40335 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit f735ea20b176591b65deaa456e93ebf7ecbead3f) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libgphoto2: patch CVE-2026-40334Gyorgy Sarvari2026-04-242-0/+38
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-40334 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit ce3fa8ad2a403c0c9bfcbcc9f4fc877c6ffb9fab) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libgphoto2: patch CVE-2026-40333Gyorgy Sarvari2026-04-242-1/+152
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-40333 Backport the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 754e02c668a1130e3808cdaa4dbd5c7954e99890) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* openjpeg: patch CVE-2026-6192Gyorgy Sarvari2026-04-242-0/+36
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-6192 Backport the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 09050325e6e0736beccc40d125e56430054b7cb8) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* monkey: patch CVEsGyorgy Sarvari2026-04-244-1/+324
| | | | | | | | | | | | | | | | | | | | | | | | | | These patches are about a number of CVEs files against the application: CVE-2025-63649, CVE-2025-63650, CVE-2025-63651, CVE-2025-63652, CVE-2025-63653, CVE-2025-63655, CVE-2025-63656, CVE-2025-63657 and CVE-2025-63658. These patches are taken from a pull request[1] that is referenced in the relevant bug report[2]. The patches don't target specific CVEs on separately, but they fix a number of CVEs altogether. Based on upstream analysis (in the linked issue) a number of these CVEs are duplicates of each other and/or not exploitable. The valid CVEs are fixed by these patches. I haven't added specific CVE info to the patches, one hand because of the above, it is hard to separate the patches by CVE, and secondarily because NVD tracks these CVEs with incorrect version info: NVD considers 1.8.6 fully fixed, even though the patches are only in the master branch, untagged at this time. After updating the recipe to 1.8.6+, the vulnerabilites will disappear from the CVE report due to this. [1]: https://github.com/monkey/monkey/pull/434 [2]: https://github.com/monkey/monkey/issues/426 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit d31f07340fad43120f5e2ee4aee98cdec6f2717d) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* monkey: upgrade 1.8.4 -> 1.8.7Gyorgy Sarvari2026-04-241-2/+6
| | | | | | | | | | Shortlog: https://github.com/monkey/monkey/compare/v1.8.4...v1.8.7 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 22277ca3a34083c27b5053bde58237e48b0e8799) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* hiawatha: upgrade 11.7 -> 11.8Gyorgy Sarvari2026-04-244-122/+1
| | | | | | | | | | | | | | Drop patches that are included in this release. Changes: * mbed TLS updated to 3.6.4. * Small bugfixes. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d92fa873e5616ee7a7b25683ddfdb6849ef72d29) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* imagemagick: upgrade 7.1.2-18 -> 7.1.2-19Wang Mingyu2026-04-241-1/+1
| | | | | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 946243ec055e9bb810b833a79512341b54039901) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* corosync: patch CVE-2026-35092Gyorgy Sarvari2026-04-242-0/+58
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-35092 Pick the patch that mentions the CVE ID explicitly (the same commit was identified by Debian also[1]) [1]: https://security-tracker.debian.org/tracker/CVE-2026-35092 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-08-21 03:27:17 +0000