summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* python3-marshmallow: upgrade 4.1.1 -> 4.1.2Wang Mingyu2026-02-191-1/+1
| | | | | | | | | | | | | | Changelog: Merge error store messages without rebuilding collections. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 54691ea40a98cc617d374d8368c665d103ceaf07) Contains fix for CVE-2025-68480 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-marshmallow: upgrade 4.1.0 -> 4.1.1Wang Mingyu2026-02-191-1/+1
| | | | | | | | | | | Bug fix: Ensure URL validator is case-insensitive when using custom schemes Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 39335015913a8bcc1b40fb7318334f626a9b8285) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-m2crypto: mark CVE-2020-25657 as patchedGyorgy Sarvari2026-02-191-0/+1
| | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2020-25657 The commit[1] that fixes the vulnerability has been part of the package since version 0.39.0 [1]: https://git.sr.ht/~mcepl/m2crypto/commit/84c53958def0f510e92119fca14d74f94215827a Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit ba6468f7a09bf8e268ea5ac7939925c362ead876) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-m2crypto: ignore CVE-2009-0127Gyorgy Sarvari2026-02-191-0/+2
| | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2009-0127 The vulnerability is disputed[1] by upstream: "There is no vulnerability in M2Crypto. Nowhere in the functions are the return values of OpenSSL functions interpreted incorrectly. The functions provide an interface to their users that may be considered confusing, but is not incorrect, nor it is a vulnerability." [1]: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-0127 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit b46a5452a1c1a417f2971e494e151fa1f4022e36) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-lief: upgrade 0.17.1 -> 0.17.2Gyorgy Sarvari2026-02-191-1/+1
| | | | | | | | | | | | | | | | | | | Contains fix for CVE-2025-15504 Changelog: - Differentiate Mach-O FAT magic bytes and Java class - Fix MinGW compilation for some configuration - Fix alignment issue when rebuilding PE relocations - Fix infinite loop when processing v2 dynamic relocation - Ensure that added DYN ELF sections are properly aligned - Fix GnuHash null dereference - Fix strong performance issue when parsing certain Mach-O Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit cc4aa9b9d0263de0ea172db4d97ea9f98ae022b3) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-ldap: upgrade 3.4.4 -> 3.4.5Gyorgy Sarvari2026-02-191-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Contains fixes for CVE-2025-61911 and CVE-2025-61912 Changelog: Security fixes: - CVE-2025-61911 (GHSA-r7r6-cc7p-4v5m): Enforce str input in ldap.filter.escape_filter_chars with escape_mode=1; ensure proper escaping. - CVE-2025-61912 (GHSA-p34h-wq7j-h5v6): Correct NUL escaping in ldap.dn.escape_dn_chars to \00 per RFC 4514. Fixes: - ReconnectLDAPObject now properly reconnects on UNAVAILABLE, CONNECT_ERROR and TIMEOUT exceptions (previously only SERVER_DOWN), fixing reconnection issues especially during server restarts - Fixed syncrepl.py to use named constants instead of raw decimal values for result types - Fixed error handling in SearchNoOpMixIn to prevent a undefined variable error Tests: - Added comprehensive reconnection test cases including concurrent operation handling and server restart scenarios Doc: - Updated installation docs and fixed various documentation typos - Added ReadTheDocs configuration file Infrastructure: - Add testing and document support for Python 3.13 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9eabbca90565e4ae790bedeef9a91df1878c6f93) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-flask-cors: upgrade 4.0.0 -> 4.0.2Gyorgy Sarvari2026-02-192-116/+2
| | | | | | | | | | | | | | | | | | | | | Contains a fix for CVE-2024-6221 (related patch dropped) and CVE-2024-1681 Changelog: 4.0.1: - Fix Read the Docs builds - Update extension.py to clean request.path before logging it - Update CI to include Python 3.12 and flask 3.0.3 4.0.2: - Bump requests from 2.31.0 to 2.32.0 in /docs - Backwards Compatible Fix for CVE-2024-6221 - Add unit tests for Private-Network Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit fbe5524dc822317c1a4b7aad566a6dae5657cb22) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-cbor2: patch CVE-2025-68131Gyorgy Sarvari2026-02-192-0/+516
| | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-68131 The NVD report mentions a PR as the solution, however in the discussion of that PR it turned out that this is incorrect, and another patch is the solution. That patch was picked. Ptests passed successfully. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* Use https when accessing archive.xfce.orgJason Schonberg2026-02-059-10/+10
| | | | | | | | | | | | | | | | | | | | | | While using devtool to check available versions, I noticed a 301 http error. Specifically : $ devtool latest-version libxfce4ui Resolving archive.xfce.org (archive.xfce.org)... 217.70.191.87 Connecting to archive.xfce.org (archive.xfce.org)|217.70.191.87|:80... connected . HTTP request sent, awaiting response... 301 Moved Permanently Location: https://archive.xfce.org/src/xfce/libxfce4ui/4.20/ [following] With this patch, we change to make the SRC_URI an https request. Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 808916819692d4ee2a592ef25af55081d80a8021) Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-aiohttp: patch CVE-2025-69230Gyorgy Sarvari2026-02-052-0/+86
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69230 Backport the patch referenced by the NVD advisory. The tests were only partially backported, as the original patch touched some tests that don't exist in this version. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-aiohttp: patch CVE-2025-69229Gyorgy Sarvari2026-02-053-0/+368
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69229 Backport the patches referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-aiohttp: patch CVE-2025-69228Gyorgy Sarvari2026-02-052-0/+48
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69228 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-aiohttp: patch CVE-2025-69227Gyorgy Sarvari2026-02-052-0/+149
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69227 Backport the patch that is referenced by teh NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-aiohttp: patch CVE-2025-69226Gyorgy Sarvari2026-02-052-0/+135
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69226 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-aiohttp: patch CVE-2025-69225Gyorgy Sarvari2026-02-052-1/+52
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69225 Backport the patch that is referenced by the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-aiohttp: patch CVE-2025-69224Gyorgy Sarvari2026-02-052-0/+94
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69224 Backport the patch indicated by the NVD advisory. Only a part of the tests were backported, because some of the new tests require a compression method that is not supported yet by this version. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gimp: patch libunwind detectionGyorgy Sarvari2026-02-042-0/+52
| | | | | | | | | | | | | | Gimp 3.0.8's meson file detects the presence of libunwind incorrectly, making it fail on some platforms, even when libunwind is explicitly disabled: | <snip>i686-oe-linux-musl-ld: app/core/libappcore.a.p/gimpbacktrace-linux.c.o: in function `gimp_backtrace_get_address_info': | /usr/src/debug/gimp/3.0.8/../sources/gimp-3.0.8/app/core/gimpbacktrace-linux.c:708:(.text+0xbd7): undefined reference to `_ULx86_init_local' This backported patch fixes this. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Reviewed-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* linux-atm: fix SRC_URIGyorgy Sarvari2026-02-031-1/+1
| | | | | | | | | The original SRC_URI's certificate has expired - change it to a working URL. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit a1baa1c027cba6ba86d92b4ad5c2db0b7bba0d1f) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* ttf-vlgothic: fix SRC_URIGyorgy Sarvari2026-02-031-1/+1
| | | | | | | | | The old URL is inoperable since a while - switch to Ubuntu's mirror. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d99c82c0883b3bda89976af17f4114f292f71221) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* anthy: fix SRC_URIGyorgy Sarvari2026-02-031-1/+1
| | | | | | | | | The old URL is gone - switch to a working mirror. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit fd562c65c60edd774a36860b6daed485247d4bfb) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* sblim-sfcc: fix SRC_URIGyorgy Sarvari2026-02-031-1/+1
| | | | | | | | | The old URL is gone - set a working mirror. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 47efd1f9b8c61d4516cc4f6937431e004c5de856) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* proftpd: ignore CVE-2021-47865Gyorgy Sarvari2026-02-031-0/+1
| | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-47865 This CVE was opened based on a 5 years old Github issue[1], and has been made public recently. The CVE wasn't officially disputed (yet?), but based on the description and the given PoC the application is working as expected. The vulnerability description and the PoC basically configures proftpd to accept maximum x connections, and then when the user tries to open x + 1 concurrent connections, it refuses new connections over the configured limit. See also discussion in the Github issue. It seems that it won't be fixed, because there is nothing to fix. [1]: https://github.com/proftpd/proftpd/issues/1298 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* ez-ipupdate: patch CVE-2003-0887Gyorgy Sarvari2026-02-032-0/+165
| | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2003-0887 The vulnerability is about the default (example) configurations, which place cache files into the /tmp folder, that is world-writeable. The recommendation would be to place them to a more secure folder. The recipe however does not install these example configurations, and as such it is not vulnerable either. Just to make sure, patch these folders to a non-tmp folder (and also install that folder, empty). Some more discussion about the vulnerability: https://bugzilla.suse.com/show_bug.cgi?id=48161 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nodejs: upgrade 22.21.1 -> 22.22.0Jason Schonberg2026-02-033-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the December 2025 security release that the nodejs team released January 13, 2026. 3 high severity issues. 4 medium severity issues. 1 low severity issue. High priority fixes: CVE-2025-55131 CVE-2025-55130 CVE-2025-59465 Medium priority fixes: CVE-2025-59466 CVE-2025-59464 CVE-2026-21636 * CVE-2026-21637 Low priority fixes: CVE-2025-55132 * note that this medium priority CVE only effects Nodejs v25. https://nodejs.org/en/blog/vulnerability/december-2025-security-releases Changelog: https://github.com/nodejs/node/releases/tag/v22.22.0 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0bb156371e433cf3e9fdc4291da2319d63a83575) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* ndpi: ignore CVE-2025-25066Gyorgy Sarvari2026-02-031-1/+2
| | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-25066 The vulnerable code was introduced in version 4.12[1], and the recipe version is not vulnerable yet. Due to this, ignore this CVE. [1]: https://github.com/ntop/nDPI/commit/b9348e9d6e0e754c4b17661c643ca258f1540ca1 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libcupsfilters: patch CVE-2025-64503Gyorgy Sarvari2026-02-032-4/+51
| | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-64503 Pick the patch that explicitly refernces the CVE ID in its message. (The NVD advisory mentions only the cups-filters patch, but the developer indicated the CVE ID in the libcupsfilters patch also) Between this recipe version and the patch the project has decided to eliminate c++ from the project, and use c only. The patch however is straightforward enough that it could be backported with very small modifications. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libcdio: patch CVE-2024-36600Gyorgy Sarvari2026-02-032-1/+35
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-36600 Backport the patch from the PR that is referenced in the NVD advisory. Note that there are two PRs mentioned: one is the fix, and the other is just readme update with the CVE ID. The latter wasn't backported. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* imagemagick: upgrade 7.1.2-12 -> 7.1.2-13Wang Mingyu2026-02-031-3/+3
| | | | | | | | | | | | | | License-Update: change license url to https://imagemagick.org/license/ Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit c2b4809fe8bb2eaa3ce99807dcafae7aaa880f4b) Contains fixes for CVE-2026-22770, CVE-2026-23874, CVE-2026-23876 and CVE-2026-23952. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gpsd: patch CVE-2025-67269Gyorgy Sarvari2026-02-032-0/+159
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-67269 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gpsd: patch CVE-2025-67268Gyorgy Sarvari2026-02-032-0/+98
| | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-67268 Pick the patch that is referenced by the NVD advisory. The original commit also contains a lot of commenting style changes (// vs /* */) and whitespace changes which were removed from the backport. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gimp: mark CVE-2025-15059 patchedGyorgy Sarvari2026-02-031-0/+1
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15059 The patch that is referenced by the NVD report has been backported[1] to the recipe version, and is included already. [1]: https://gitlab.gnome.org/GNOME/gimp/-/commit/c9eb407485f6c085adf70c8a334f75ea31565c60 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* gimp: update 3.0.6 -> 3.0.8Markus Volk2026-02-036-322/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - remove cve fixes which are included in this release - remove the fix for bzip2. meson.build was improved so this is not required anymore - inherit bash-completion This releases contains a lot of bugfixes. The below list is not exhaustive. Core: - Font handling improvements: * Font loading on start massively sped up. * As an exception, Skia font family (apparently quite common on macOS) is special-cased because it behaves weirdly and was not working with current font handling. * Various other fixes related to font handling. * We now wait for fonts to be fully loaded before loading any file. - Command Line Interface: * Option -i / --no-interface is not shown anymore on `gimp-console` binary (it can still be used — it does nothing there anyway —, which allows to use the same sets of option with the GUI binary, and also so that existing shell scripts don't break). * Option --show-debug-menu is not hidden anymore for discoverability. * The `gimp-3.0` executable can now run with --no-interface even when no display is available (ex: virtual terminal with no window manager/compositor, containers, etc.). This used to only work with `gimp-console-3.0` executable. - Windows: * output CLI messages to the parent console like Linux and macOS. * Ctrl+C signals are now correctly handled in the attached console. * The attached console supports color too. * Interpreters are run conditionally if running in console. - macOS: default to "quartz" Input Method for emoji keyboard support. - Wayland: wait before we get our first surface before listing input devices to work around a Wayland limitation and GTK bug. - Default "Search" feature in GTK3 is now disabled in the component editor in the Channels dockable. - Several fixes related to Quick Mask handling. - Fixed some cases where config migration from GIMP 2 to GIMP 3 was problematic. - Several buggy undo cases were fixed. - Several fixes related to pass-through group layers. - Export will now be properly triggered even if no drawables are selected (this is not a requirement anymore with GIMP 3 API). - Path import and export respectively from and to SVG improved. - Serialize colors in legacy GimpRGB format into a XCF when the XCF version is older than GIMP 3 for backward compatibility. Tools: - Symmetry: fix initial stroke symmetry when using pixmap brushes. - Move tool: fixed weird position jumps in some cases. Graphical User Interface: - Center buttons in overlay dialogs. - Headerbar's (when titlebar and menubar are merged) button colors now match our theme. - Dialogs' header icon and view will now scale based on custom icon size. - Resize dialog: Canvas Size fill combo set to insensitive if layers won't be resized. - Navigation and Selection editor will now properly match the theme (in particular, in dark mode, they won't show large bright area). - Do not show outlines when hovering the absent "Fx" icon anymore, which was confusing people into making it look like you could click and interact with this empty area. Plug-ins: - Fixes on: OpenRaster export, TIFF import, Map Object, PDF export, Gradient Flare, ANI export, Script-Fu, DDS export, Fractal Explorer, PSP import, ICO import, XWD import, PSD import, WebP export, ICNS import, Gimpressionist, JPEG 2000 import, Busy Dialog. - Scale entries have been replaced by spin scale widgets in a bunch of plug-ins. - Fixed vulnerabilities: ZDI-CAN-28376, ZDI-CAN-28311, ZDI-CAN-28273, ZDI-CAN-28158, ZDI-CAN-28232, ZDI-CAN-28265, ZDI-CAN-28530, ZDI-CAN-28248, PSP issue 15732. - Script-Fu improved to not initialize UI code unnecessarily (and therefore make it unusable on systems without a display). API: - libgimp: * Fixes where made in libgimp metadata object. * Make GExiv2Metadata as parent of GimpMetadata visible to Gobject-Introspection tools (bindings were missing this information). * Fixes made on: gimp_drawable_get_thumbnail(), gimp_drawable_get_sub_thumbnail(), gimp_drawable_filter_new(), gimp_proc_view_new(), gimp_procedure_set_sensitivity_mask(), gimp_procedure_dialog_get_spin_scale(). * Remove thumbnail metadata before writing it on export, to make sure we don't cary on metadata written by other software in thumbnails. - libgimpconfig: * Improve error messaging on config deserialization. * Fix gimp_config_serialize_value() when serializing file objects. * New functions: gimp_config_get_xcf_version() and gimp_config_set_xcf_version(). - libgimpcolor: * gimp_color_is_perceptually_identical() docs clarified. - libgimpbase: * The host config directory is now shown in MSIX. * The host config directory is now shown in flatpak. - libgimpwidgets: * Fixes made on: GimpLabelEntry, gimp_widget_free_native_handle(). - libgimpcolor: * New function: gimp_cairo_surface_get_buffer() * Deprecated function: gimp_cairo_surface_create_buffer() in favor of gimp_cairo_surface_get_buffer(). The function implementation was also changed so that it does not necessarily return a linear-memory backed buffer anymore (it might, but developers should not have any expectation about this). Build: - Third-party binary plug-in support in the Snap backported from the original third-party snap. - Snap package for release is now created and submitted on a release pipeline. - Release URLs added to AppStream metadata. - We do not build GEGL with Matting Levin for Windows builds anymore because of crashes. - Flatpak nightly builds will now show a pseudo-release visible with `flatpak list`, showing proper version information. - Windows installer now has a dark mode. - Update changelog on MS Store (MSIX) releases. - AppImage now ships with full MIDI support. - Make it clearer that GExiv2 0.15.0 and over are incompatible (because of API breakage). - Improve build to ensure that the language list (shown in Preferences) is localized during compilation. This also means that a build machine should be set up for localization at build time when optional language selection is enabled. - We now require the generic C++14 standard, and not the GNU variant anymore. - MSVC support added. - Various tweaks which used to be required to make packages work as relocatable builds were dropped since babl and GEGL now have a relocatable option working also on Linux. - The `man` page of GIMP binaries was updated. - The `gimp-console` binary is now shipped in the Flatpak. - macOS pipeline added in our Gitlab CI. - Make sure that harfbuzz is built with libgraphite2 shaper on macOS. - Generate file associations for macOS automatically. - A Bash completion file was added for `gimp` and `gimp-console` binaries. Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f8fcc9ccf529455c992e79fc13e77dfc1a8dd9d9) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* fontforge: patch CVE-2025-15270Gyorgy Sarvari2026-02-032-0/+45
| | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15270 Pick the patch that mentions this vulnerbaility explicitly in its description. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* fontforge: patch CVE-2025-15269Gyorgy Sarvari2026-02-032-0/+36
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15269 Pick the patch that refers to this vulnerability ID explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* fontforge: patch CVE-2025-15275Gyorgy Sarvari2026-02-032-0/+34
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15275 Pick the patch that mentions this vulnerability ID explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* fontforge: patch CVE-2025-15279Gyorgy Sarvari2026-02-033-1/+78
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15279 Pick the patch that mentions this vulnerability ID explicitly. Also, this patch has caused some regression - pick the patch also that fixed that regression. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* unicode-ucd: adjust to correct checksum values.Tom Geelen2026-02-031-3/+3
| | | | | | | | | | | | | | The checksums are wrong and thus this fails to build. Signed-off-by: Tom Geelen <t.f.g.geelen@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit dc5132edf7c7464371122ea9af871406fa66635a) Also rename the license file to avoid clashing with the previous version in DL_DIR. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* hdf5: fix shasum, downloadfilenameTrevor Gamblin2026-02-021-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: #1023 Upstream seems to have regenerated the archive, as the checksum no longer matches the one specified in the recipe: |WARNING: hdf5-2.0.0-r0 do_fetch: Checksum failure encountered with download of https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/hdf5-2.0.0.tar.gz - will attempt other sources if available |WARNING: hdf5-2.0.0-r0 do_fetch: Checksum mismatch for local file /buildcache/downloads/hdf5-2.0.0.tar.gz |Cleaning and trying again. |WARNING: hdf5-2.0.0-r0 do_fetch: Renaming /buildcache/downloads/hdf5-2.0.0.tar.gz to /buildcache/downloads/hdf5-2.0.0.tar.gz_bad-checksum_a7a8f43e76e825ea22234bc735d5b184e880d305e33e4c9bb93a3912421c9973 |ERROR: hdf5-2.0.0-r0 do_fetch: Checksum failure fetching https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/hdf5-2.0.0.tar.gz |ERROR: hdf5-2.0.0-r0 do_fetch: Bitbake Fetcher Error: ChecksumError('Checksum mismatch!\nFile: \'/buildcache/downloads/hdf5-2.0.0.tar.gz\' has sha256 checksum \'a7a8f43e76e825ea22234bc735d5b184e880d305e33e4c9bb93a3912421c9973\' when \'6e45a4213cb11bb5860) |ERROR: Logfile of failure stored in: /home/tgamblin/workspace/yocto/openembedded-core/build/tmp/work/x86-64-v3-poky-linux/hdf5/2.0.0/temp/log.do_fetch.2054297 However, the tarballs look identical. Update the hash and be explicit about downloadfilename to avoid any mirroring issues. A note has been left that this measure can be removed with a future upgrade. Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com> Reviewed-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f0f02434c892769a307edc6728dd667f9c31a1d1) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-protobuf: upgrade 6.33.2 -> 6.33.5Peter Marko2026-02-021-1/+1
| | | | | | | Solves CVE-2026-0994. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-protobuf: upgrade 6.33.1 -> 6.33.2Liu Yiding2026-02-021-1/+1
| | | | | | | | | | Change log: https://github.com/protocolbuffers/protobuf/releases/tag/v33.2 Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2023-42822Gyorgy Sarvari2026-02-022-0/+305
| | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-42822 Pick the patch the references the github advisory[1] and the cve ID also from the nvd report. The patch is a backported version of the patch referenced by the nvd report. [1]: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-2hjx-rm4f-r9hw Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit a9fa1c5c2a83d301aa004cd16d18a516ae383042) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2023-40184Gyorgy Sarvari2026-02-022-0/+74
| | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-40184 Pick the patch that is associated with the github advisory[1], which is a backported version of the patch that is referenced by the nvd report. [1]: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-f489-557v-47jq Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 259e4f9266680f4afd2c54a3a4a6358151edf41b) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23493Gyorgy Sarvari2026-02-022-0/+34
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23493 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit f81041bb39d0fb10bbf3c0edcae47a65c573088c) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23484Gyorgy Sarvari2026-02-022-0/+32
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23484 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 2578e5c17d95cdb56e3d85cecaf541d7473122f9) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23483Gyorgy Sarvari2026-02-022-0/+66
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23483 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 8ffd8f29d5f055e390d4475c99f2d2c22f9797d9) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23482Gyorgy Sarvari2026-02-022-0/+70
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23482 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 31694c82e3269855fe6a9cc3614f66c4e1067589) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23481Gyorgy Sarvari2026-02-022-0/+47
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23481 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 64ee8f84c4edfb4d0b9b2e299e1a1afe6a6168e0) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23480Gyorgy Sarvari2026-02-023-0/+412
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23480 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 71e9d02b125578593eebde2422223a9ede7265f6) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23479Gyorgy Sarvari2026-02-022-0/+84
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23479 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 19e076e66b3e3230b1fa05580e64de45a832ab13) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xrdp: patch CVE-2022-23478Gyorgy Sarvari2026-02-022-0/+86
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23478 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 63b5fff9755a5849a0bbfba5447e117130efcf54) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-22 01:40:19 +0000