summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* minidlna: ignore CVE-2024-51442Gyorgy Sarvari2026-03-061-0/+1
| | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-51442 The description of the vulnerability says "attacker [...] execute arbitrary OS commands via a specially crafted minidlna.conf configuration file". There is no official fix for this CVE, and upstream seems to be inactive for the past 3 years. The reason for ignoring this CVE is that the referenced minidlna.conf file is in the /etc folder, and the file is not world-writable. Which means that this vulnerability can be exploited only when someone is root - but if the attacker is already root, they don't need to resort to minidlna config-file modifications to execute any command they want. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gimp: ignore already fixed CVEsGyorgy Sarvari2026-03-061-1/+4
| | | | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-0797 https://nvd.nist.gov/vuln/detail/CVE-2026-2044 https://nvd.nist.gov/vuln/detail/CVE-2026-2045 https://nvd.nist.gov/vuln/detail/CVE-2026-2047 https://nvd.nist.gov/vuln/detail/CVE-2026-2048 All these CVEs are already fixed in the recipe version, however NVD tracks them currently without CPE info. Ignore them. Relevant upstream commits: CVE-2026-0797: https://gitlab.gnome.org/GNOME/gimp/-/commit/ca449c745d58daa3f4b1ed4c2030d35d401a009d Note that the commit referenced by NVD is incorrect. This commit was identified from the relevant upstream Gitlab issue: https://gitlab.gnome.org/GNOME/gimp/-/issues/15555 CVE-2026-2044: https://gitlab.gnome.org/GNOME/gimp/-/commit/3b5f9ec2b4c03cf4a51a5414f2793844c26747e5 CVE-2026-2045: https://gitlab.gnome.org/GNOME/gimp/-/commit/bb896f67942557658b3fbfc67a1c073775c002c7 CVE-2026-2047: https://gitlab.gnome.org/GNOME/gimp/-/commit/5873e16f80cf4152d25a4c86b08553008a331e90 CVE-2026-2048: https://gitlab.gnome.org/GNOME/gimp/-/commit/fa69ac5ec5692f675de5c50a6df758f7d3e45117 Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gnome-shell: ignore CVE-2021-3982Gyorgy Sarvari2026-03-061-0/+1
| | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-3982 The vulnerability is about a privilege escalation, in case the host distribution sets CAP_SYS_NICE capability on the gnome-shell binary. OE distros don't do that, and due to this this recipe is not affected by this issue. The CVE is ignored. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libjxl: upgrade 0.11.1 -> 0.11.2Ankur Tyagi2026-03-061-2/+2
| | | | | | | | | | | | | - fix tile dimension in low memory rendering pipeline (CVE-2025-12474) - fix number of channels for gray-to-gray color transform (CVE-2026-1837) - djxl: reject decoding JXL files if "packed" representation size overflows size_t https://github.com/libjxl/libjxl/releases/tag/v0.11.2 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* protobuf: ignore CVE-2026-0994Gyorgy Sarvari2026-03-061-0/+2
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-0994 The vulnerability impacts only the python bindings of protobuf, which is in a separate recipe (python3-protobuf, where it is patched). Ignore this CVE in this recipe due to this. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* postgresql: upgrade 17.7 -> 17.8Ankur Tyagi2026-03-067-21/+15
| | | | | | | | | | | | | | | License-Update: Update license year to 2026 Refreshed patches for version 17.8 Includes fix for CVE-2026-2003, CVE-2026-2004, CVE-2026-2005, CVE-2026-2006 Release Notes: https://www.postgresql.org/docs/release/17.8/ Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* openjpeg: patch CVE-2023-39327Gyorgy Sarvari2026-03-062-0/+51
| | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-39327 Take the patch that is used by OpenSUSE to mitigate this vulnerability. Upstream seems to be unresponsive to this issue. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: patch CVE-2026-1642Gyorgy Sarvari2026-03-062-0/+47
| | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-1642 Note: this is only for v1.29.1. v1.28.x recipe contains this fix already. Pick the commit that was identified by the reporter on the oss-sec mailing list[1] [1]: https://www.openwall.com/lists/oss-security/2026/02/05/1 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wolfssl: patch CVE-2025-7394Ankur Tyagi2026-03-067-0/+632
| | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-7394 Backport patches from the PR[1][2][3] mentioned in the changelog[4]. [1] https://github.com/wolfSSL/wolfssl/pull/8849 [2] https://github.com/wolfSSL/wolfssl/pull/8867 [3] https://github.com/wolfSSL/wolfssl/pull/8898 [4] https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#wolfssl-release-582-july-17-2025 Dropped changes to github workflow and tests during backport. Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wolfssl: patch CVE-2025-7395Ankur Tyagi2026-03-065-0/+170
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-7395 Backport patches from the PR[1] mentioned in the changelog[2] [1] github.com/wolfSSL/wolfssl/pull/8833 [2] https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#wolfssl-release-582-july-17-2025 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wolfssl: patch CVE-2025-13912Ankur Tyagi2026-03-062-0/+440
| | | | | | | | | | Backport changes from PR[1] mentioned in nvd[2] [1] https://github.com/wolfSSL/wolfssl/pull/9148 [2] https://nvd.nist.gov/vuln/detail/CVE-2025-13912 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* systemd-netlogd: upgrade 1.4.4 -> 1.4.5Anuj Mittal2026-03-061-2/+2
| | | | | | | | | | | | Fixes build with 32 bit machines. - Fix build on 32-bit with 64-bit time_t by @cgzones in #136 - Misc by @cgzones in #137 - Add terminating newline also for TLS connections by @Googulator in #139 - Add RFC5425 length field by @derobert in #140 - Correct examples for ExcludeSyslogFacility and ExcludeSyslogLevel by @ngraziano in #141 Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-pybind11-json: fix Targets.cmake trying to reference hostTafil Avdyli2026-03-062-1/+36
| | | | | | | | | | | | | | | | | | The resulting pybind11_jsonTargets.cmake in the dev-package adds an absolute path to python include directories in the target properties: set_target_properties(pybind11_json PROPERTIES INTERFACE_INCLUDE_DIRECTORIES "/usr/include/python3.13;${_IMPORT_PREFIX}/include" ) The patch removes ${PYTHON_INCLUDE_DIRS} which is set by pybind11 from set_target_properties to remove the poisonous host path. Signed-off-by: Tafil Avdyli <tafil@tafhub.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0332dae9bb2ff79e4a4faa45c42d96e0dccee4db) Signed-off-by: Tafil Avdyli <tafil@tafhub.de> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* tomoyo-tools: update SRC_URIAnkur Tyagi2026-02-241-1/+2
| | | | | | | The previous one became inaccessible. Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: upgrade 1.28.1 -> 1.28.2Gyorgy Sarvari2026-02-191-1/+1
| | | | | | | | | | | | Changelog: - Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642). - Bugfix: use-after-free might occur after switching to the next gRPC or HTTP/2 backend. - Bugfix: fixed warning when compiling with MSVC 2022 x86. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* php: upgrade 8.4.17 -> 8.4.18Jason Schonberg2026-02-191-1/+1
| | | | | | | | | This is a bug fix release. Changelog: https://www.php.net/ChangeLog-8.php#8.4.18 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libtracefs: upgrade 1.8.2 -> 1.8.3Wang Mingyu2026-02-191-1/+1
| | | | | | | | | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0fbbddd53762d6cb273e898dbea6838a8af468d5) Changes: https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git/tag/?h=libtracefs-1.8.3 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* usbids: upgrade 2025.09.15 -> 2025.12.13Jason Schonberg2026-02-191-2/+2
| | | | | | | | Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5aca0a216d07a1876ed6e9d22f34456f0595ed64) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* minizip-ng: 4.0.8 -> 4.0.10Liu Yiding2026-02-192-37/+1
| | | | | | | | | | | | | 1.Changelog: https://github.com/zlib-ng/minizip-ng/releases/tag/4.0.10 2.Remove 0001-crypt.h-Remove-register-keyword.patch as it was merged upstream. Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5f6dbb284a16d3e0e85bb9ece7566703c213ba63) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* paho-mqtt-c: upgrade 1.3.14 -> 1.3.15Gyorgy Sarvari2026-02-192-40/+2
| | | | | | | | | | | | | | | | Drop patch to fix gcc15 compatibility - the problem has been solved by upstream. Changelog: - Update getaddrinfo options to support IPv6 hostname resolution - Removed unnecessary _WIN64 conditional checks - Fixed condition variable timed wait - Support tls:// prefix Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit cb9d043f4639e88ea0267882f46a41b2c5e49c16) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libx86-1: upgrade 1.1 -> 1.1.1Gyorgy Sarvari2026-02-196-247/+4
| | | | | | | | | | | | | | | Bugfix release, mostly with patches applied from other distros. Also fixes the SRC_URI which became inaccessible over time. Drop patches that are included in this release. Shortlog: https://gitlab.archlinux.org/grawlinson/libx86/-/compare/v1.1...v1.1.1 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 19fdc49db3a41b1380c387bf9b5dbbf631048a64) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libsdl2-compat: update 2.32.58 -> 2.32.62Markus Volk2026-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Changelog: 2.32.62: This is a stable bugfix release, with the following changes: Improved support for GNU/Hurd Fixed crash if hidapi strings are not available 2.32.60: This is a stable bugfix release, with the following changes: Fixed crash at startup in Dwarf Fortress Fixed crash at startup in Stellaris Fixed mouse stuttering in Amiberry Fixed the viewport not being reset when the window is resized Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> Adapted for Whinlatter to keep x11 in REQUIRED_DISTRO_FEATURES Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* cryptsetup: upgrade 2.8.3 -> 2.8.4Wang Mingyu2026-02-191-1/+1
| | | | | | | | | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Stable bug-fix release https://gitlab.com/cryptsetup/cryptsetup/-/blob/v2.8.4/docs/v2.8.4-ReleaseNotes?ref_type=tags (cherry picked from commit 9111684d670f1091fc38778cfb140d39871d9c0b) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-django: upgrade 4.2.27 -> 4.2.28Gyorgy Sarvari2026-02-191-1/+1
| | | | | | | | Contains fixes for CVE-2025-13473, CVE-2025-14550, CVE-2026-1207, CVE-2026-1285, CVE-2026-1287 and CVE-2026-1312 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-django: upgrade 5.2.9 -> 5.2.11Gyorgy Sarvari2026-02-191-1/+1
| | | | | | | | | | | | | | | | | Changelog: 5.2.11: Contains fixes for CVE-2025-13473, CVE-2025-14550, CVE-2026-1207, CVE-2026-1285, CVE-2026-1287 and CVE-2026-1312 5.2.10: * Fixed a bug in Django 5.2 where data exceeding max_length was silently truncated by QuerySet.bulk_create on PostgreSQL. * Fixed a bug where management command colorized help (introduced in Python 3.14) ignored the --no-color option and the DJANGO_COLORS setting. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-watchdog: Remove obsolete dependenciesTero Kinnunen2026-02-191-7/+2
| | | | | | | | | | | | | | | | Python watchdog has removed all dependencies except optional `pyyaml` dependency for `watchmedo` utility, like follows [1]: * pathtools dependency was removed in 1.0.0 * python-argh dependency removed in 2.1.6 * requests was never a dependency * pyyaml only needed for extras (`watchmedo`) and may not be strictly necessary [1] https://github.com/gorakhargosh/watchdog/blob/master/changelog.rst Signed-off-by: Tero Kinnunen <tero.kinnunen@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gnome-desktop: upgrade 44.1 -> 44.4Gyorgy Sarvari2026-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | Changes: Version 44.4 - Support TryExec for thumbnailers - Translation updates Version 44.3 - Fix CI regression for release upload Version 44.2 - Stop using ratio character for time in the wall-clock - Fix variable initialization - General CI cleanups - Only parse XML files as slideshows - Translation updates Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wireshark: patch CVE-2026-0962Gyorgy Sarvari2026-02-192-0/+132
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-0962 Backport the commit that is referenced in the related gitlab issue[1]. [1]: https://gitlab.com/wireshark/wireshark/-/issues/20945 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-python-multipart: patch CVE-2026-24486Gyorgy Sarvari2026-02-192-0/+62
| | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-24486 Pick the patch that is referenced by the NVD advisory. Ptests passed successfully: Testsuite summary TOTAL: 121 PASS: 121 SKIP: 0 XFAIL: 0 FAIL: 0 XPASS: 0 ERROR: 0 DURATION: 2 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* redis: ignore CVE-2025-46686Gyorgy Sarvari2026-02-192-0/+2
| | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-46686 Upstream disputes that it is a security violation, and says that implementing a mitigation for this would negatively affect the rest of the application, so they elected to ignore it. See Github advisory about the same vulnerability: https://github.com/redis/redis/security/advisories/GHSA-2r7g-8hpc-rpq9 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 868b4b2959c1f6be13693e31eae5b27a1fa697e6) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* raptor2: patch CVE-2024-57822 and CVE-2024-57823Gyorgy Sarvari2026-02-193-0/+77
| | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-57822 https://nvd.nist.gov/vuln/detail/CVE-2024-57823 Pick the patches mentioned in the github issue[1] mentioned in the NVD advisories (both of them are covered by the same issue) [1]: https://github.com/dajobe/raptor/issues/70 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit dc2c6a514e7744da4165effefa61ad59c27cf507) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-werkzeug: upgrade 3.1.4 -> 3.1.5Gyorgy Sarvari2026-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Contains fix for CVE-2026-21860 Changelog: - safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. - The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. - Fix AttributeError when initializing DebuggedApplication with pin_security=False. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit ecf359d2562795ca8de18f12f117cd654c30965e) From the release notes: This is the Werkzeug 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-werkzeug: upgrade 3.1.3 -> 3.1.4Wang Mingyu2026-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ============== - safe_join on Windows does not allow special device names. This prevents reading from these when using send_from_directory. secure_filename already prevented writing to these. - The debugger pin fails after 10 attempts instead of 11. - The multipart form parser handles a \r\n sequence at a chunk boundary. - Improve CPU usage during Watchdog reloader. - Request.json annotation is more accurate. - Traceback rendering handles when the line number is beyond the available source lines. - HTTPException.get_response annotation and doc better conveys the distinction between WSGI and sans-IO responses. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 74aa2bdac6d658791af34881f291d91aa4dc57ba) Contains fix for CVE-2025-66221. From the release notes: This is the Werkzeug 3.1.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-virtualenv: patch CVE-2026-22702Gyorgy Sarvari2026-02-192-0/+61
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-22702 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-uvicorn: mark CVE-2020-7694 patchedGyorgy Sarvari2026-02-191-0/+1
| | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2020-7694 The vulnerability was reported to the project[1], and the commit[2] that resolved the issue has been part of the project since version 0.11.7. Mark the CVE as patched due to this. [1]: https://github.com/Kludex/uvicorn/issues/723 [2]: https://github.com/Kludex/uvicorn/commit/895807f94ea9a8e588605c12076b7d7517cda503 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit a5ee234b8cf06b6385a9bf1eb5b60d6171a993c9) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-twitter: mark CVE-2012-5825 patchedGyorgy Sarvari2026-02-191-0/+2
| | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2012-5825 The Debian bugtracker[1] indicated that the issue is tracked by upstream in github[2] (with a difference CVE ID, but same issue), where the vulnerability was confirmed. Later in the same github issue the solution is confirmed: the project switched to use the requests library, which doesn't suffer from this vulnerability. Due to this mark the CVE as patched. [1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692444 [2]: https://github.com/tweepy/tweepy/issues/279 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3ee544e7591b36a49550a263a0ec4d64b5e490e8) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-tornado: upgrade 6.5.3 -> 6.5.4Wang Mingyu2026-02-191-1/+1
| | | | | | | | | | | | | | | Bug fixes ~~~~~~~~~ - The "in" operator for "HTTPHeaders" was incorrectly case-sensitive, causing lookups to fail for headers with different casing than the original header name. This was a regression in version 6.5.3 and has been fixed to restore the intended case-insensitive behavior from version 6.5.2 and earlier. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit ebca0ae79d15c5d5f1489a8b5de18c810891e7e4) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-tornado: upgrade 6.5.2 -> 6.5.3Wang Mingyu2026-02-191-1/+1
| | | | | | | | | | | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 8ba97b66461e6dc9c8b073e43286932394d53ed0) Changelog: https://github.com/tornadoweb/tornado/blob/master/docs/releases/v6.5.3.rst - Fix CVE-2025-67724, CVE-2025-67725 and CVE-2025-67726 - Fix open redirect vulnerabilities in demos - Fix path traversal vulnerabilites in demos Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-pyjwt: ignore CVE-2025-45768Gyorgy Sarvari2026-02-191-0/+2
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-45768 The CVE is disputed: though the vulnerability is there, but it comes from incorrect configuration of the library by the main application. Due to this, ignore this CVE. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-py: ignore CVE-2022-42969Gyorgy Sarvari2026-02-191-0/+2
| | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-42969 Upstream could not reproduce the issue. The vulnerability has currently the "disputed" flag in the NVD database, and Github has revoked their related advisory[1]. Ignore this CVE due to this. [1]: https://github.com/advisories/GHSA-w596-4wvx-j9j6 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 91f6b85b36316d5940ee194b1d195caf3ac040b1) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-orjson: upgrade 3.10.17 -> 3.10.18Gyorgy Sarvari2026-02-191-1/+1
| | | | | | | | | Changelog: Fix incorrect escaping of the vertical tabulation character. This was introduced in 3.10.17. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-marshmallow: upgrade 4.1.1 -> 4.1.2Wang Mingyu2026-02-191-1/+1
| | | | | | | | | | | | | | Changelog: Merge error store messages without rebuilding collections. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 54691ea40a98cc617d374d8368c665d103ceaf07) Contains fix for CVE-2025-68480 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-marshmallow: upgrade 4.1.0 -> 4.1.1Wang Mingyu2026-02-191-1/+1
| | | | | | | | | | | Bug fix: Ensure URL validator is case-insensitive when using custom schemes Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 39335015913a8bcc1b40fb7318334f626a9b8285) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-m2crypto: mark CVE-2020-25657 as patchedGyorgy Sarvari2026-02-191-0/+1
| | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2020-25657 The commit[1] that fixes the vulnerability has been part of the package since version 0.39.0 [1]: https://git.sr.ht/~mcepl/m2crypto/commit/84c53958def0f510e92119fca14d74f94215827a Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit ba6468f7a09bf8e268ea5ac7939925c362ead876) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-m2crypto: ignore CVE-2009-0127Gyorgy Sarvari2026-02-191-0/+2
| | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2009-0127 The vulnerability is disputed[1] by upstream: "There is no vulnerability in M2Crypto. Nowhere in the functions are the return values of OpenSSL functions interpreted incorrectly. The functions provide an interface to their users that may be considered confusing, but is not incorrect, nor it is a vulnerability." [1]: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-0127 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit b46a5452a1c1a417f2971e494e151fa1f4022e36) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-lief: upgrade 0.17.1 -> 0.17.2Gyorgy Sarvari2026-02-191-1/+1
| | | | | | | | | | | | | | | | | | | Contains fix for CVE-2025-15504 Changelog: - Differentiate Mach-O FAT magic bytes and Java class - Fix MinGW compilation for some configuration - Fix alignment issue when rebuilding PE relocations - Fix infinite loop when processing v2 dynamic relocation - Ensure that added DYN ELF sections are properly aligned - Fix GnuHash null dereference - Fix strong performance issue when parsing certain Mach-O Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit cc4aa9b9d0263de0ea172db4d97ea9f98ae022b3) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-ldap: upgrade 3.4.4 -> 3.4.5Gyorgy Sarvari2026-02-191-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Contains fixes for CVE-2025-61911 and CVE-2025-61912 Changelog: Security fixes: - CVE-2025-61911 (GHSA-r7r6-cc7p-4v5m): Enforce str input in ldap.filter.escape_filter_chars with escape_mode=1; ensure proper escaping. - CVE-2025-61912 (GHSA-p34h-wq7j-h5v6): Correct NUL escaping in ldap.dn.escape_dn_chars to \00 per RFC 4514. Fixes: - ReconnectLDAPObject now properly reconnects on UNAVAILABLE, CONNECT_ERROR and TIMEOUT exceptions (previously only SERVER_DOWN), fixing reconnection issues especially during server restarts - Fixed syncrepl.py to use named constants instead of raw decimal values for result types - Fixed error handling in SearchNoOpMixIn to prevent a undefined variable error Tests: - Added comprehensive reconnection test cases including concurrent operation handling and server restart scenarios Doc: - Updated installation docs and fixed various documentation typos - Added ReadTheDocs configuration file Infrastructure: - Add testing and document support for Python 3.13 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9eabbca90565e4ae790bedeef9a91df1878c6f93) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-flask-cors: upgrade 4.0.0 -> 4.0.2Gyorgy Sarvari2026-02-192-116/+2
| | | | | | | | | | | | | | | | | | | | | Contains a fix for CVE-2024-6221 (related patch dropped) and CVE-2024-1681 Changelog: 4.0.1: - Fix Read the Docs builds - Update extension.py to clean request.path before logging it - Update CI to include Python 3.12 and flask 3.0.3 4.0.2: - Bump requests from 2.31.0 to 2.32.0 in /docs - Backwards Compatible Fix for CVE-2024-6221 - Add unit tests for Private-Network Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit fbe5524dc822317c1a4b7aad566a6dae5657cb22) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-cbor2: patch CVE-2025-68131Gyorgy Sarvari2026-02-192-0/+516
| | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-68131 The NVD report mentions a PR as the solution, however in the discussion of that PR it turned out that this is incorrect, and another patch is the solution. That patch was picked. Ptests passed successfully. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* Use https when accessing archive.xfce.orgJason Schonberg2026-02-059-10/+10
| | | | | | | | | | | | | | | | | | | | | | While using devtool to check available versions, I noticed a 301 http error. Specifically : $ devtool latest-version libxfce4ui Resolving archive.xfce.org (archive.xfce.org)... 217.70.191.87 Connecting to archive.xfce.org (archive.xfce.org)|217.70.191.87|:80... connected . HTTP request sent, awaiting response... 301 Moved Permanently Location: https://archive.xfce.org/src/xfce/libxfce4ui/4.20/ [following] With this patch, we change to make the SRC_URI an https request. Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 808916819692d4ee2a592ef25af55081d80a8021) Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-22 11:25:14 +0000