summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* gpsd: patch CVE-2025-67268Gyorgy Sarvari2026-02-032-0/+98
| | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-67268 Pick the patch that is referenced by the NVD advisory. The original commit also contains a lot of commenting style changes (// vs /* */) and whitespace changes which were removed from the backport. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gimp: mark CVE-2025-15059 patchedGyorgy Sarvari2026-02-031-0/+1
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15059 The patch that is referenced by the NVD report has been backported[1] to the recipe version, and is included already. [1]: https://gitlab.gnome.org/GNOME/gimp/-/commit/c9eb407485f6c085adf70c8a334f75ea31565c60 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gimp: update 3.0.6 -> 3.0.8Markus Volk2026-02-036-322/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - remove cve fixes which are included in this release - remove the fix for bzip2. meson.build was improved so this is not required anymore - inherit bash-completion This releases contains a lot of bugfixes. The below list is not exhaustive. Core: - Font handling improvements: * Font loading on start massively sped up. * As an exception, Skia font family (apparently quite common on macOS) is special-cased because it behaves weirdly and was not working with current font handling. * Various other fixes related to font handling. * We now wait for fonts to be fully loaded before loading any file. - Command Line Interface: * Option -i / --no-interface is not shown anymore on `gimp-console` binary (it can still be used — it does nothing there anyway —, which allows to use the same sets of option with the GUI binary, and also so that existing shell scripts don't break). * Option --show-debug-menu is not hidden anymore for discoverability. * The `gimp-3.0` executable can now run with --no-interface even when no display is available (ex: virtual terminal with no window manager/compositor, containers, etc.). This used to only work with `gimp-console-3.0` executable. - Windows: * output CLI messages to the parent console like Linux and macOS. * Ctrl+C signals are now correctly handled in the attached console. * The attached console supports color too. * Interpreters are run conditionally if running in console. - macOS: default to "quartz" Input Method for emoji keyboard support. - Wayland: wait before we get our first surface before listing input devices to work around a Wayland limitation and GTK bug. - Default "Search" feature in GTK3 is now disabled in the component editor in the Channels dockable. - Several fixes related to Quick Mask handling. - Fixed some cases where config migration from GIMP 2 to GIMP 3 was problematic. - Several buggy undo cases were fixed. - Several fixes related to pass-through group layers. - Export will now be properly triggered even if no drawables are selected (this is not a requirement anymore with GIMP 3 API). - Path import and export respectively from and to SVG improved. - Serialize colors in legacy GimpRGB format into a XCF when the XCF version is older than GIMP 3 for backward compatibility. Tools: - Symmetry: fix initial stroke symmetry when using pixmap brushes. - Move tool: fixed weird position jumps in some cases. Graphical User Interface: - Center buttons in overlay dialogs. - Headerbar's (when titlebar and menubar are merged) button colors now match our theme. - Dialogs' header icon and view will now scale based on custom icon size. - Resize dialog: Canvas Size fill combo set to insensitive if layers won't be resized. - Navigation and Selection editor will now properly match the theme (in particular, in dark mode, they won't show large bright area). - Do not show outlines when hovering the absent "Fx" icon anymore, which was confusing people into making it look like you could click and interact with this empty area. Plug-ins: - Fixes on: OpenRaster export, TIFF import, Map Object, PDF export, Gradient Flare, ANI export, Script-Fu, DDS export, Fractal Explorer, PSP import, ICO import, XWD import, PSD import, WebP export, ICNS import, Gimpressionist, JPEG 2000 import, Busy Dialog. - Scale entries have been replaced by spin scale widgets in a bunch of plug-ins. - Fixed vulnerabilities: ZDI-CAN-28376, ZDI-CAN-28311, ZDI-CAN-28273, ZDI-CAN-28158, ZDI-CAN-28232, ZDI-CAN-28265, ZDI-CAN-28530, ZDI-CAN-28248, PSP issue 15732. - Script-Fu improved to not initialize UI code unnecessarily (and therefore make it unusable on systems without a display). API: - libgimp: * Fixes where made in libgimp metadata object. * Make GExiv2Metadata as parent of GimpMetadata visible to Gobject-Introspection tools (bindings were missing this information). * Fixes made on: gimp_drawable_get_thumbnail(), gimp_drawable_get_sub_thumbnail(), gimp_drawable_filter_new(), gimp_proc_view_new(), gimp_procedure_set_sensitivity_mask(), gimp_procedure_dialog_get_spin_scale(). * Remove thumbnail metadata before writing it on export, to make sure we don't cary on metadata written by other software in thumbnails. - libgimpconfig: * Improve error messaging on config deserialization. * Fix gimp_config_serialize_value() when serializing file objects. * New functions: gimp_config_get_xcf_version() and gimp_config_set_xcf_version(). - libgimpcolor: * gimp_color_is_perceptually_identical() docs clarified. - libgimpbase: * The host config directory is now shown in MSIX. * The host config directory is now shown in flatpak. - libgimpwidgets: * Fixes made on: GimpLabelEntry, gimp_widget_free_native_handle(). - libgimpcolor: * New function: gimp_cairo_surface_get_buffer() * Deprecated function: gimp_cairo_surface_create_buffer() in favor of gimp_cairo_surface_get_buffer(). The function implementation was also changed so that it does not necessarily return a linear-memory backed buffer anymore (it might, but developers should not have any expectation about this). Build: - Third-party binary plug-in support in the Snap backported from the original third-party snap. - Snap package for release is now created and submitted on a release pipeline. - Release URLs added to AppStream metadata. - We do not build GEGL with Matting Levin for Windows builds anymore because of crashes. - Flatpak nightly builds will now show a pseudo-release visible with `flatpak list`, showing proper version information. - Windows installer now has a dark mode. - Update changelog on MS Store (MSIX) releases. - AppImage now ships with full MIDI support. - Make it clearer that GExiv2 0.15.0 and over are incompatible (because of API breakage). - Improve build to ensure that the language list (shown in Preferences) is localized during compilation. This also means that a build machine should be set up for localization at build time when optional language selection is enabled. - We now require the generic C++14 standard, and not the GNU variant anymore. - MSVC support added. - Various tweaks which used to be required to make packages work as relocatable builds were dropped since babl and GEGL now have a relocatable option working also on Linux. - The `man` page of GIMP binaries was updated. - The `gimp-console` binary is now shipped in the Flatpak. - macOS pipeline added in our Gitlab CI. - Make sure that harfbuzz is built with libgraphite2 shaper on macOS. - Generate file associations for macOS automatically. - A Bash completion file was added for `gimp` and `gimp-console` binaries. Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f8fcc9ccf529455c992e79fc13e77dfc1a8dd9d9) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* fontforge: patch CVE-2025-15270Gyorgy Sarvari2026-02-032-0/+45
| | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15270 Pick the patch that mentions this vulnerbaility explicitly in its description. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* fontforge: patch CVE-2025-15269Gyorgy Sarvari2026-02-032-0/+36
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15269 Pick the patch that refers to this vulnerability ID explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* fontforge: patch CVE-2025-15275Gyorgy Sarvari2026-02-032-0/+34
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15275 Pick the patch that mentions this vulnerability ID explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* fontforge: patch CVE-2025-15279Gyorgy Sarvari2026-02-033-1/+78
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15279 Pick the patch that mentions this vulnerability ID explicitly. Also, this patch has caused some regression - pick the patch also that fixed that regression. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* unicode-ucd: adjust to correct checksum values.Tom Geelen2026-02-031-3/+3
| | | | | | | | | | | | | | The checksums are wrong and thus this fails to build. Signed-off-by: Tom Geelen <t.f.g.geelen@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit dc5132edf7c7464371122ea9af871406fa66635a) Also rename the license file to avoid clashing with the previous version in DL_DIR. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* hdf5: fix shasum, downloadfilenameTrevor Gamblin2026-02-021-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: #1023 Upstream seems to have regenerated the archive, as the checksum no longer matches the one specified in the recipe: |WARNING: hdf5-2.0.0-r0 do_fetch: Checksum failure encountered with download of https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/hdf5-2.0.0.tar.gz - will attempt other sources if available |WARNING: hdf5-2.0.0-r0 do_fetch: Checksum mismatch for local file /buildcache/downloads/hdf5-2.0.0.tar.gz |Cleaning and trying again. |WARNING: hdf5-2.0.0-r0 do_fetch: Renaming /buildcache/downloads/hdf5-2.0.0.tar.gz to /buildcache/downloads/hdf5-2.0.0.tar.gz_bad-checksum_a7a8f43e76e825ea22234bc735d5b184e880d305e33e4c9bb93a3912421c9973 |ERROR: hdf5-2.0.0-r0 do_fetch: Checksum failure fetching https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/hdf5-2.0.0.tar.gz |ERROR: hdf5-2.0.0-r0 do_fetch: Bitbake Fetcher Error: ChecksumError('Checksum mismatch!\nFile: \'/buildcache/downloads/hdf5-2.0.0.tar.gz\' has sha256 checksum \'a7a8f43e76e825ea22234bc735d5b184e880d305e33e4c9bb93a3912421c9973\' when \'6e45a4213cb11bb5860) |ERROR: Logfile of failure stored in: /home/tgamblin/workspace/yocto/openembedded-core/build/tmp/work/x86-64-v3-poky-linux/hdf5/2.0.0/temp/log.do_fetch.2054297 However, the tarballs look identical. Update the hash and be explicit about downloadfilename to avoid any mirroring issues. A note has been left that this measure can be removed with a future upgrade. Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com> Reviewed-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f0f02434c892769a307edc6728dd667f9c31a1d1) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-protobuf: upgrade 6.33.2 -> 6.33.5Peter Marko2026-02-021-1/+1
| | | | | | | Solves CVE-2026-0994. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-protobuf: upgrade 6.33.1 -> 6.33.2Liu Yiding2026-02-021-1/+1
| | | | | | | | | | Change log: https://github.com/protocolbuffers/protobuf/releases/tag/v33.2 Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2023-42822Gyorgy Sarvari2026-02-022-0/+305
| | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-42822 Pick the patch the references the github advisory[1] and the cve ID also from the nvd report. The patch is a backported version of the patch referenced by the nvd report. [1]: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-2hjx-rm4f-r9hw Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit a9fa1c5c2a83d301aa004cd16d18a516ae383042) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2023-40184Gyorgy Sarvari2026-02-022-0/+74
| | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-40184 Pick the patch that is associated with the github advisory[1], which is a backported version of the patch that is referenced by the nvd report. [1]: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-f489-557v-47jq Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 259e4f9266680f4afd2c54a3a4a6358151edf41b) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23493Gyorgy Sarvari2026-02-022-0/+34
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23493 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit f81041bb39d0fb10bbf3c0edcae47a65c573088c) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23484Gyorgy Sarvari2026-02-022-0/+32
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23484 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 2578e5c17d95cdb56e3d85cecaf541d7473122f9) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23483Gyorgy Sarvari2026-02-022-0/+66
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23483 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 8ffd8f29d5f055e390d4475c99f2d2c22f9797d9) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23482Gyorgy Sarvari2026-02-022-0/+70
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23482 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 31694c82e3269855fe6a9cc3614f66c4e1067589) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23481Gyorgy Sarvari2026-02-022-0/+47
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23481 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 64ee8f84c4edfb4d0b9b2e299e1a1afe6a6168e0) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23480Gyorgy Sarvari2026-02-023-0/+412
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23480 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 71e9d02b125578593eebde2422223a9ede7265f6) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23479Gyorgy Sarvari2026-02-022-0/+84
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23479 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 19e076e66b3e3230b1fa05580e64de45a832ab13) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23478Gyorgy Sarvari2026-02-022-0/+86
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23478 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 63b5fff9755a5849a0bbfba5447e117130efcf54) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23477Gyorgy Sarvari2026-02-022-0/+39
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23477 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit a6efc5b2850036cadb044eb8de8bde2e54c97c28) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23468Gyorgy Sarvari2026-02-022-0/+35
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23468 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 1cb08277fe367850eb130c0995d85dca8e609787) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* frr: patch CVE-2025-61099..61107Gyorgy Sarvari2026-02-024-0/+416
| | | | | | | | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-61099 https://nvd.nist.gov/vuln/detail/CVE-2025-61100 https://nvd.nist.gov/vuln/detail/CVE-2025-61101 https://nvd.nist.gov/vuln/detail/CVE-2025-61102 https://nvd.nist.gov/vuln/detail/CVE-2025-61103 https://nvd.nist.gov/vuln/detail/CVE-2025-61104 https://nvd.nist.gov/vuln/detail/CVE-2025-61105 https://nvd.nist.gov/vuln/detail/CVE-2025-61106 https://nvd.nist.gov/vuln/detail/CVE-2025-61107 The NVD advisory refernces a PR[1] that contains only an unfinished, and ultimately unmerged attempt at the fixes. The actual solution comes from a different PR[2]. These patches are 3 commits from that PR. The last commit wasn't backported, because it is just code formatting. [1]: https://github.com/FRRouting/frr/pull/19480 [2]: https://github.com/FRRouting/frr/pull/19983 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3cd47f72ad8d3889e2ef44c63ce6414cb1a9964d) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libowfat: update SRC_URIGyorgy Sarvari2026-01-211-1/+1
| | | | | | | | | | The https link does not work anymore, it just refuses the connection. http still works though. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 8cab2b2977f7cfbbf7bf1aa617070163e2eaf002) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* ncp: update SRC_URIGyorgy Sarvari2026-01-211-1/+1
| | | | | | | | | | The https link does not work anymore, it just refuses the connection. http still works though. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 8da9f2fea2e4c2f525e9357814f21b70669b8d8b) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* softhsm: fix SRC_URI branchGyorgy Sarvari2026-01-211-1/+1
| | | | | | | | | | The "develop" branch doesn't exist anymore, the used revision can be found on the "main" branch. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 21df5861c7e03af154b18573939649ae65dcaa92) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* recipes-core/toybox: Switch SRC_URI to HTTPS for reliable fetchSanjay Chitroda2026-01-211-1/+1
| | | | | | | | | | | The upstream site (landley.net) serves inconsistent content when using HTTP, causing checksum mismatches during do_fetch. Using HTTPS ensures stable downloads and resolves checksum failures. Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 050ffcdea2b2ac3fcfb5bc5f39d64b60b2dd1dca) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: ignore CVE-2025-53859 for 1.28.1Peter Marko2026-01-201-0/+2
| | | | | | | | | | | | Fix is included via commit [1]. [1] https://github.com/nginx/nginx/commit/fbbbf189dadf3bd59c2462af68c16f2c2874d4ee Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5d3936d5dd0489a984e37cc00b59e6a05d9541ac) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: set CVE_PRODUCTGyorgy Sarvari2026-01-201-0/+2
| | | | | | | | | | | | nginx has a long history, and has used multiple CPEs over time. Set CVE_PRODUCT to reflect current and historic vendor:product pairs. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d25aadbbb53d54382b4b82b1f78a69d4d117fd28) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: upgrade 1.28.0 -> 1.28.1Jason Schonberg2026-01-203-138/+5
| | | | | | | | | | | | | | | | Drop CVE patch which has been integrated into this new version. Solves: * CVE-2025-53859 CHANGES: https://nginx.org/en/CHANGES-1.28 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 222c6425644a39c9b7757792b47e500ca55f85b0) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-scapy: set CVE_PRODUCTGyorgy Sarvari2026-01-201-0/+2
| | | | | | | | | | | | | | | | | The default ${PN} (python3-scapy) CVE fails to match relevant CVEs, because they are tracked under the scapy:scapy CPE. Set CVE_PRODUCT to the correct value. See CVE db query: sqlite> select * from products where product like '%scapy%'; CVE-2019-1010142|scapy|scapy|2.4.0|=|| Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 6f68f5fce766096b9d086093ca0435bc5904b8e7) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* tinyproxy: patch CVE-2025-63938Gyorgy Sarvari2026-01-202-0/+44
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-63938 Pick the patch referenced by the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 7981f52062d444aed1759c674bd3ec024a4f232c) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* dante: Add _GNU_SOURCE for musl buildsKhem Raj2026-01-201-0/+2
| | | | | | | | | | This helps build fixes e.g. cpuset_t definitions etc. glibc builds have _GNU_SOURCE defined inherently. Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 848bac20ea27afddc3843c41ad105843ad167177) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* dante: upgrade 1.4.3 -> 1.4.4Gyorgy Sarvari2026-01-201-2/+2
| | | | | | | | | | | | | | | | | | | | License-Update: copyright year bump Changelog: - Fix potential security issue CVE-2024-54662, related to "socksmethod" use in client/hostid-rules. - Add a missing call to setgroups(2). - Patch to fix compilation with libminiupnp 2.2.8. - Client connectchild optimizations. - Client SIGIO handling improvements. - Various configure/build fixes. - Updated to support TCP_EXP1 version of TCP hostid format. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9f12c5fbc63143c33d6c68139cccac770817b4eb) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* frr: upgrade 10.4.1 -> 10.4.2Ankur Tyagi2026-01-201-1/+1
| | | | | | | | Release Notes: https://github.com/FRRouting/frr/releases/tag/frr-10.4.2 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xerces-c: set CVE_PRODUCTGyorgy Sarvari2026-01-201-0/+2
| | | | | | | | | | | | | | | | | | | The related CVEs are tracked with "xerces-c\+\+" (sic). See CVE db query: sqlite> select vendor, product, count(*) from PRODUCTs where product like '%xerces%' group by 1, 2; apache|xerces-c\+\+|29 apache|xerces-j|2 apache|xerces2_java|3 redhat|xerces|3 Set CVE_PRODUCT accordingly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 29a272744a314564035ec4a337704eb6d31e879e) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* lmdb: patch CVE-2026-22185Gyorgy Sarvari2026-01-202-0/+32
| | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-22185 Pick the patch that is mentioned as a solution in the related upstream bug[1]. [1]: https://bugs.openldap.org/show_bug.cgi?id=10421 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e0f86a4a7f8e413c682fbd4a9c01b12b0234cd71) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* boinc-client: mark CVE-2013-2018 patchedGyorgy Sarvari2026-01-201-0/+1
| | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2013-2018 According to oss-security email[1], version 7.0.45 included the fixes[2][3][4] [1]: https://www.openwall.com/lists/oss-security/2013/04/29/11 [2]: https://github.com/BOINC/boinc/commit/6e205de096da83b12ffb2f0183b43e51261eb0c4 [3]: https://github.com/BOINC/boinc/commit/e8d6c33fe158129a5616e18eb84a7a9d44aca15f [4]: https://github.com/BOINC/boinc/commit/ce3110489bc139b8218252ba1cb0862d69f72ae3 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 2a78ad8813845677132ad0f1552fcaa4961c3e15) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* influxdb: ignore CVE-2024-30896Ankur Tyagi2026-01-201-0/+1
| | | | | | | | | | | | | | | | As mentioned in the comment[1], vulnerability is in /api/v2/authorizations API which only exists in 2.x, 1.x is not affected. Details: https://nvd.nist.gov/vuln/detail/CVE-2024-30896 [1] https://github.com/influxdata/influxdb/issues/24797#issuecomment-2514690740 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 2f1d7a8597596d8e51a6f6f3b62e7e5f153f6e73) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* boinc-client: set CVE_PRODUCTGyorgy Sarvari2026-01-201-0/+3
| | | | | | | | | | | | | | | | | | | The relevant CVEs are tracked with underscore in their name. See CVE db query: sqlite> select vendor, product, count(*) from PRODUCTs where product like '%boinc%' group by 1, 2; berkeley|boinc_client|2 berkeley|boinc_forum|1 universityofcalifornia|boinc_client|165 universityofcalifornia|boinc_server|5 Set the CVE_PRODUCT accordingly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 31de060b48c57194ea2e6c6844d746eb59a0d056) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* asyncmqtt: set CVE_PRODUCTGyorgy Sarvari2026-01-201-0/+2
| | | | | | | | | | | | | | | The CVEs are tracked with an underscore in the product name: sqlite> select * from PRODUCTs where product like '%async%mq%'; CVE-2025-65503|redboltz|async_mqtt|10.2.5|=|| This patch sets the correct CVE_PRODUCT. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 4da079d7f572efed610bdf1291e838d0a5fc45cc) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libcereal: set CVE_PRODUCTGyorgy Sarvari2026-01-201-0/+2
| | | | | | | | | | | | | | | | The relevant CVEs are associated with usc:cereal CPE. See CVE db query: sqlite> select * from PRODUCTS where PRODUCT like '%cereal%'; CVE-2020-11104|usc|cereal|||1.3.0|<= CVE-2020-11105|usc|cereal|||1.3.0|<= Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 6e936626cbccf6c17fc8b2d61fd2c7d4bcb022b5) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* raptor2: set CVE_PRODUCTGyorgy Sarvari2026-01-201-0/+2
| | | | | | | | | | | | | | | | | | | | All relevant CVEs are files against these CPEs. See CVE db query (zediious vendor is not relevant): sqlite> select * from PRODUCTs where PRODUCT like '%raptor%' and vendor <> 'symantec' and product <> 'velociraptor'; CVE-2012-0037|librdf|raptor|||2.0.7|< CVE-2017-18926|librdf|raptor_rdf_syntax_library|2.0.15|=|| CVE-2020-25713|librdf|raptor_rdf_syntax_library|2.0.15|=|| CVE-2023-49078|zediious|raptor-web|0.4.4|=|| CVE-2024-57822|librdf|raptor_rdf_syntax_library|||2.0.16|<= CVE-2024-57823|librdf|raptor_rdf_syntax_library|||2.0.16|<= Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 15aca0b2fa03dc25f551e84d381295c89dae8253) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libsdl3: upgrade 3.2.28 -> 3.2.30Liu Yiding2026-01-201-1/+1
| | | | | | | | | | | Changelog: https://github.com/libsdl-org/SDL/releases/tag/release-3.2.30 Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit a524aaddaceabedcfba002550eaef0b5aa10e0eb) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libjxl: Fix build error with arm and muslAnkur Tyagi2026-01-201-0/+3
| | | | | | | | | | | | Build fails for qemuarm with musl with following error: /build/tmp/work/cortexa15t2hf-neon-poky-linux-musleabi/libjxl/0.11.1/sources/libjxl-0.11.1/lib/jxl/convolve_separable5.cc | error: out of range pc-relative fixup value Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 63ae47a70d6d81937f5122c535d890678ed3c13e) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* mozjs-128: Fix build error with arm and muslAnkur Tyagi2026-01-2014-32/+75
| | | | | | | | | | | | | | | | Build fails for qemuarm with musl with following error: mozglue/misc/StackWalk.o: in function `unwind_callback(_Unwind_Context*, void*)': | /usr/src/debug/mozjs-128/128.5.2/mozglue/misc/StackWalk.cpp:810:(.text._ZL15unwind_callbackP15_Unwind_ContextPv+0x4): undefined reference to `_Unwind_GetIP' Referenced commit[1] for the fix, also refreshed patches. [1] https://github.com/OSSystems/meta-browser/commit/bb8662912354dae13634c0ec35c3803c344b1e72 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 30942cebe8997dbadcd8bcd81ed0e55d42b48677) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libsdl3-image: upgrade 3.2.4 -> 3.2.6Wang Mingyu2026-01-201-1/+1
| | | | | | | | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Release Notes: https://github.com/libsdl-org/SDL_image/releases/tag/release-3.2.6 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* smarty: extend CVE_PRODUCTGyorgy Sarvari2026-01-201-1/+1
| | | | | | | | | | | | | | Some CVEs assign smarty-php as the vendor to the corresponding CPE. E.g CVE-2024-35226[1] is tracked with smarty-php:smarty by mitre (NVD tracks it without CPE). [1]: https://cveawg.mitre.org/api/cve/CVE-2024-35226 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 1aee6a403c1901bc7ae793a2f4581b3cdbd95c1d) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* vboxguestdrivers: Upgrade to 7.2.4Khem Raj2026-01-201-1/+1
| | | | | | | | | | | | | | | | | This is a maintenance release. The following items were fixed or added: GUI: Fixed VirtualBox VM Manager crash when host was resuming from sleep (​github:gh-121, ​github:gh-170) GUI: Updated native language support for Traditional Chinese, Greek, Swedish, Hungarian and Indonesian translations NAT: Fixed issue when multiple port forwarding rules affected NAT functionality (​github:gh-232) Linux host and guest: Introduced initial support for kernel 6.18 Linux Guest Additions: Introduced additional fixes for RHEL 9.6 and 9.7 kernels (​github:GH-12) Windows Guest Additions: Introduced additional fixes for issue when installation was failing in Windows XP SP2 guest (​github:GH-142) Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Bruce Ashfield <bruce.ashfield@gmail.com> (cherry picked from commit 0ecf2814b207cc25962a3949c8265d856a355ea0) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-21 22:33:10 +0000