summaryrefslogtreecommitdiffstats
path: root/meta-oe/recipes-devtools
Commit message (Collapse)AuthorAgeFilesLines
* editorconfig-core-c: patch CVE-2024-53849Ankur Tyagi2025-12-173-1/+106
| | | | | | | Details https://nvd.nist.gov/vuln/detail/CVE-2024-53849 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* yasm: patch CVE-2021-33456Gyorgy Sarvari2025-12-032-0/+36
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-33465 The patch was taken from Debian: https://sources.debian.org/patches/yasm/1.3.0-8/1020-hash-null-CVE-2021-33456.patch/ Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 1e2731fce05d15020fddf3dca5d8ee42ec3c04e1) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* yasm: patch CVE-2021-33464Gyorgy Sarvari2025-12-032-0/+35
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-33464 The patch was taken from Debian: https://sources.debian.org/patches/yasm/1.3.0-8/1010-nasm-pp-no-env-CVE-2021-33464.patch/ Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 66a0b01b52e5d1cd2af4c41ae0b67541464874e6) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* yasm: patch CVE-2023-29579Gyorgy Sarvari2025-12-032-1/+41
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-29579 The patch was taken from Debian: https://sources.debian.org/patches/yasm/1.3.0-8/1000-x86-dir-cpu-CVE-2023-29579.patch/ Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit cc30757a7fd0af5f60b9a6408b3eb94c0810acda) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* yasm: add alternative CVE_PRODUCTGyorgy Sarvari2025-12-031-0/+1
| | | | | | | | | | | | | | | There are multiple vendors for yasm: $ sqlite3 ./nvdcve_2-2.db "select distinct vendor, product from products where product = 'yasm';" tortall|yasm yasm_project|yasm Both products refer to the same application Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 93f85e4fd2fb124cb047f6b378cf0052a1f102aa) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* uw-imap: patch CVE-2018-19518Peter Marko2025-11-252-0/+25
| | | | | | | | | | | Take patch from Debian from https://salsa.debian.org/lts-team/packages/uw-imap/-/commit/873b07f46ce40f43bca10ec85fe63a7a0b934294 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9f7c1e6bd101494c6cc5dad16a7fa65a13cbac70) Signed-off-by: Anil Dongare <adongare@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* iptraf-ng: patch CVE-2024-52949Gyorgy Sarvari2025-11-192-0/+219
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-52949 Pick the commit that mentions the CVE in its description. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> (cherry picked from commit 16071ef98f7cfd1501e9c399ac27afe2e061b22a) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* breakpad: correct SRC_URI branchGyorgy Sarvari2025-11-121-1/+1
| | | | | | | Master branch was renamed to main, causing fetching failures. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* mercurial: set CVE_PRODUCT to "mercurial-scm:mercurial"Ankur Tyagi2025-11-121-0/+1
| | | | | | | | | Other product "mercurial" introduce false CVE finding like: https://nvd.nist.gov/vuln/detail/CVE-2022-43410 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* cjson: upgrade 1.7.18 -> 1.7.19Praveen Kumar2025-10-302-35/+1
| | | | | | | | | | | | | | This includes CVE-fix for CVE-2023-26819. Removed CVE-2025-57052, as the issue was already resolved in v1.7.19. Changelog: ========== https://github.com/DaveGamble/cJSON/blob/master/CHANGELOG.md Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
* jq: fix CVE-2025-9403Divya Chellam2025-10-302-0/+50
| | | | | | | | | | | | | | | | | A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-9403 Upstream-patch: https://github.com/jqlang/jq/commit/a4d9d540103ff9a262e304329c277ec89b27e5f9 Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
* yasm: fix CVE-2024-22653Praveen Kumar2025-10-302-0/+33
| | | | | | | | | | | | | | yasm commit 9defefae was discovered to contain a NULL pointer dereference via the yasm_section_bcs_append function at section.c. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-22653 Upstream-patch: https://github.com/yasm/yasm/commit/121ab150b3577b666c79a79f4a511798d7ad2432 Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
* nodejs: ignore CVE-2024-3566Jeroen Hofstee2025-10-061-0/+1
| | | | | | CVE-2024-3566 only effects Microsoft Windows. Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
* php: ignore CVE-2024-3566Jeroen Hofstee2025-10-061-0/+1
| | | | | | | | | | CVE-2024-3566 only effects Microsoft Windows. Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d68c56e1ed2adc8246a18424ed5d9ede5e8254a0) Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
* cjson 1.7.18: Fix CVE-2025-57052Shubham Pushpkar2025-09-232-0/+34
| | | | | | | | | | | | | Upstream Repository: https://github.com/DaveGamble/cJSON.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-57052 Type: Security Fix CVE: CVE-2025-57052 Score: 9.8 Patch: https://github.com/DaveGamble/cJSON/commit/74e1ff4994aa Signed-off-by: Shubham Pushpkar <spushpka@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
* nodejs: fix build with gcc-15 on hostMartin Jansa2025-09-232-0/+34
| | | | | Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
* protobuf 4.25.8: Mark CVE-2024-7254 as patchedDeepak Rathore2025-09-121-0/+2
| | | | | | | | | | | | | | | | | | | | | Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2024-7254 Type: Security Fix CVE: CVE-2024-7254 Score: 8.7 Patch: https://github.com/protocolbuffers/protobuf/commit/850fcce9176e Analysis: The original fix [1] for CVE-2024-7254 is listed in the NVD security tracker (https://nvd.nist.gov/vuln/detail/CVE-2024-7254) and was subsequently backported to the v4.25.8 version via commit [2]. Hence, this CVE is considered patched in the current source. Reference: [1] https://github.com/protocolbuffers/protobuf/commit/cc8b3483a558 [2] https://github.com/protocolbuffers/protobuf/commit/850fcce9176e (v4.25.8) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
* abseil-cpp: fix build with gcc-15 on hostMartin Jansa2025-09-122-0/+35
| | | | | Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
* luajit: fix several CVEsChangqing Li2025-09-124-0/+244
| | | | | | | Fix CVE-2024-25176, CVE-2024-25177, CVE-2024-25178 Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
* jq: add Upstream-Status and CVE tags into .patch filesRoland Kovacs2025-09-123-0/+9
| | | | | | | | | | v1 version was merged instead of v2 from: https://lists.openembedded.org/g/openembedded-devel/message/118302 add missing Upstream-Status and CVE tags from v2. Signed-off-by: Roland Kovacs <roland.kovacs@est.tech> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
* php: upgrade 8.2.28 -> 8.2.29Praveen Kumar2025-09-121-1/+1
| | | | | | | | | | | | This upgrade fixes below CVEs. CVE-2025-1735 CVE-2025-6491 CVE-2025-1220 Changelog: https://www.php.net/ChangeLog-8.php#8.2.29 Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
* jq-1.7.1: Backport multiple CVE fixesRoland Kovacs2025-07-104-0/+360
| | | | | | | | | | | | CVE: CVE-2024-23337 CVE: CVE-2024-53427 CVE: CVE-2025-48060 Patches CVE-2024-23337.patch and CVE-2024-53427.patch are backported from jq-1.8.0, and CVE-2025-48060.patch is backported from jq-1.8.1. Signed-off-by: Roland Kovacs <roland.kovacs@est.tech> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* protobuf: upgrade from 4.25.3 to 4.25.8Chen Qi2025-07-062-796/+1
| | | | | | | | | | | | 0001-Add-recursion-check-when-parsing-unknown-fields-in-J.patch is dropped because it has been in new version. This upgrade also fixes CVE-2025-4565. The fix commit is as below: d31100c91 Manually backport recursion limit enforcement to 25.x Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: backport a patch to prevent brotli crashing nodejsJeroen Hofstee2025-05-172-0/+65
| | | | | | | | | | | Brotli can crash nodejs (on ARM), because the memory allocated for brotli wasn't properly aligned. https://github.com/google/brotli/issues/1159 https://github.com/nodejs/node/commit/dc035bbc9b310ff8067bc0dad22230978489c061 Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* php: Upgrade 8.2.26 -> 8.2.28Soumya Sambu2025-04-161-1/+1
| | | | | | | | | | | Includes fix for - CVE-2025-1219, CVE-2025-1736, CVE-2025-1861, CVE-2025-1734 and CVE-2025-1217 Changelog: https://www.php.net/ChangeLog-8.php#8.2.28 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* perfetto: Fix contains reference to TMPDIR [buildpaths] warningalperak2025-04-161-2/+2
| | | | | | | | WARNING:perfetto-31.0-r0 do_package_qa: QA Issue: File /usr/bin/.debug/tracebox in package perfetto-dbg contains reference to TMPDIR [buildpaths] Signed-off-by: alperak <alperyasinak1@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
* ldns: Fix buildpaths QA issuesKhem Raj2025-04-161-1/+2
| | | | | | | | | | MJ: Backported from 'ldns: Upgrade to 1.8.4' commit without the upgrade. Fix buildpaths QA errors while here Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
* abseil-cpp: upgrade 20240116.2 -> 20240116.3Changqing Li2025-03-031-1/+1
| | | | | | | | | | | | | This upgrade include security fix for CVE-2025-0838, refer: https://github.com/abseil/abseil-cpp/releases?page=1 git log: 54fac219 (tag: 20240116.3) Fix potential integer overflow in hash container create/resize (#1812) d7aaad83 (tag: 20240116.2) Abseil LTS Branch, Jan 2024, Patch 2 (#1650) 2f9e432c (tag: 20240116.1) Prepare 20240116.1 patch for Apple Privacy Manifest (#1623) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sip: Fix homepage and licenseLeon Anavi2025-03-031-2/+2
| | | | | | | | | | | | | After the migration from Mercurial to GitHub the homepage has changed and SIP has been licensed under the BSD-2-Clause license since Feb 9, 2024, including for release 6.8.6. This work was sponsored by GOVCERT.LU. License-Update: SIP is licensed under the BSD-2-Clause license. Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* modejs: upgrade 20.18.0 -> 20.18.2Archana Polampalli2025-02-041-1/+1
| | | | | | | | | | | | | | | Below list of CVEs are addressed in this release CVE-2025-23083 CVE-2025-23084 CVE-2025-23085 CVE-2025-22150 Changelog: https://github.com/nodejs/node/releases/tag/v20.18.2 https://github.com/nodejs/node/releases/tag/v20.18.1 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: upgrade 20.17.0 -> 20.18.0J. S2025-02-044-3/+3
| | | | | | | | | | | | | | | | License checksum change due to whitespace changes. https://github.com/nodejs/node/commit/1dfd238781 libatomic.patch change due to changes in node.gyp https://github.com/nodejs/node/commit/25c788009f1fa7a392af51cb97d0a55f0f4a6983 Changelog : https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.18.0 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: Fix build with libc++ 19Khem Raj2025-02-042-0/+183
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | As noted in the libc++ 19 release notes [1], std::char_traits<> is now only provided for char, char8_t, char16_t, char32_t and wchar_t, and any instantiation for other types will fail. This causes nodejs-20 to fail to compile with clang 19 and libc++ 19, resulting in errors similar to: /usr/include/c++/v1/string:820:42: error: implicit instantiation of undefined template 'std::char_traits<unsigned short>' 820 | static_assert(is_same<_CharT, typename traits_type::char_type>::value, | ^ ../deps/v8/src/inspector/string-16.h:114:28: note: in instantiation of template class 'std::basic_string<unsigned short>' requested here 114 | std::basic_string<UChar> m_impl; | ^ /usr/include/c++/v1/__fwd/string.h:23:29: note: template is declared here 23 | struct _LIBCPP_TEMPLATE_VIS char_traits; | ^ Upstream v8 has fixed this in commit 182d9c05e78 [2], so add it as a backported patch, until the next version of node is released. [1] https://libcxx.llvm.org/ReleaseNotes/19.html#deprecations-and-removals [2] https://chromium.googlesource.com/v8/v8.git/+/182d9c05e78 Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: upgrade 20.16.0 -> 20.17.0J. S2025-02-043-2/+2
| | | | | | | | | | | | | | | | | | commit c1ddc60fd25456da07d8402c89157c4354fde5ac Author: Jason Schonberg <schonm@gmail.com> Date: Wed Aug 21 17:40:03 2024 -0400 License change - remove highlight.js https://github.com/nodejs/node/commit/1c5fe040a0a73b483cc3e3fef76efe2d1712205b Changelog : https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.17.0 nodejs: upgrade 20.16.0 -> 20.17.0 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: support cross compile without qemu user conditionallyHongxu Jia2025-02-042-41/+124
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Due to the scope of supported BSPs by qemu-user is limited, such as a segment fault on armv9 after qemu apply commit [target/arm: Convert LDAPR/STLR (imm) to decodetree][1] ``` |tmp-glibc/work/neoversen2-crypto-wrs-linux/nodejs/20.5.1/node-v20.5.1/out/ Release/v8-qemu-wrapper.sh: line 7: 3179613 Segmentation fault (core dumped) PSEUDO_UNLOAD=1 qemu-aarch64 -r 5.15 -L tmp-glibc/work/neoversen2-crypto-wrs-linux/ nodejs/20.5.1/recipe-sysroot -E LD_LIBRARY_PATH=tmp-glibc/work/neoversen2-crypto-wrs-linux/ nodejs/20.5.1/recipe-sysroot/usr/lib64:tmp-glibc/work/neoversen2-crypto-wrs-linux/ nodejs/20.5.1/recipe-sysroot/usr/lib64 "$@" ``` Upstream nodejs have cross compile support, but it needs host and target have same bit width (e.g. a x86_64 host targeting arrch64 to produce a 64-bit binary). So: 1. If host and target have different bit width, build with QEMU user as usual; 2. If host and target have same bit width, enable notejs cross compile support: - The build tools of nodejs is GYP[2], set CC_host, CFLAGS_host, CXX_host, CXXFLAGS_host, LDFLAGS_host, AR_host for host build which is separated with target build [3] - Satisfy layer compatibility, set GYP variables in prefuncs of do_configure, do_compile and do_install other than in recipe parsing - Add missing native packages to fix library missing on host build - Rework libatomic.patch, explicitly link to libatomic for clang conditionally [1] https://github.com/qemu/qemu/commit/2521b6073b7b4b505533a941d4f9600f7585dc78 [2] https://github.com/nodejs/node-gyp [3] https://github.com/nodejs/node-gyp/blob/main/gyp/docs/UserDocumentation.md#cross-compiling Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: upgrade 20.13.0 -> 20.16.0Jason Schonberg2025-02-043-1/+1
| | | | | | | Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: Upgrade to 20.13.0 releaseKhem Raj2025-02-043-2/+2
| | | | | | | | | | | | | nodejs release notes [1] License-Update: Copyright year changed for Unicode License [2] [1] https://nodejs.org/en/blog/release/v20.13.0 [2] https://github.com/nodejs/node/commit/d5a316f5ea3fade3140c2ae35c144b500fb5d758 Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lapack: fix buildpaths in ptest also when CBLAS is enabledMartin Jansa2025-02-041-6/+17
| | | | | | | | | | | | | | | | | | | ERROR: lapack-3.12.0-r0 do_package_qa: QA Issue: File /usr/lib/lapack/ptest/bin/xccblat3 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xdcblat3 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xdcblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xscblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xccblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xzcblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xzcblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xccblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xdcblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xscblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xscblat3 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xzcblat3 in package lapack-ptest contains reference to TMPDIR [buildpaths] Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lapack: add PACKAGECONFIG for cblasMartin Jansa2025-02-041-0/+1
| | | | | Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lapack: fix TMPDIR reference in do_package_qaZhang Peng2025-02-041-0/+31
| | | | | | | | | | | | | | | | | | | | | | | When building the `lapack` package, the following QA error occurs: "File /usr/lib64/libblas.so.3.12.0 in package lapack contains reference to TMPDIR [buildpaths]" The issue arises because the `xerbla.o` object file embeds the absolute host path of `xerbla.f`. This occurs during compilation, where the build command in `build.make` (generated by CMake) specifies: `gfortran -c <absolute path>/xerbla.f -o`. As a result, the absolute path is included in `xerbla.o`. Unfortunately, `gfortran` does not support flags like `-fdebug-prefix-map` or `-ffile-prefix-map` to remove such paths. To resolve this, the fix involves replacing the absolute path of `xerbla.f` in the generated `build.make` file with a relative path before the compilation step. This ensures that the resulting `xerbla.o` does not contain any references to TMPDIR, passing the `do_package_qa` check. For ptest code, the solution is to replace `${WORKDIR}` with `../../..` in the generated `build.make` files located in the TESTING directory. Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* grpc: patch CVE-2024-11407Peter Marko2025-01-202-0/+33
| | | | | | | | | | Cherry-pick commit [1] mentioned in [2]. [1] https://github.com/grpc/grpc/commit/e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 [2] https://nvd.nist.gov/vuln/detail/CVE-2024-11407 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* glade: fix CVE-2020-36774Zhang Peng2025-01-202-0/+55
| | | | | | | | | | | | | | | | CVE-2020-36774: plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash). Reference: [https://nvd.nist.gov/vuln/detail/CVE-2020-36774] Upstream patches: [https://gitlab.gnome.org/GNOME/glade/-/commit/7acdd3c6f6934f47b8974ebc2190a59ea5d2ed17] Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* php: upgrade 8.2.24 -> 8.2.26Vijay Anusuri2025-01-201-1/+1
| | | | | | | | | | Includes fix for CVE-2024-8929, CVE-2024-11236, CVE-2024-11234 and CVE-2024-11233 Changelog: https://www.php.net/ChangeLog-8.php#8.2.26 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sip: Upgrade 6.8.3 -> 6.8.6Leon Anavi2024-12-271-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | Upgrade to version 6.8.6: - Handle single number macOS deployment targets - Support for architectures where `char` is unsigned - Support for building from git archives - Run the tests using the current Python version The project has a proper pyproject.toml which declares the setuptools.build.meta PEP-517 backend. Fixes: WARNING: sip-6.8.6-r0 do_check_backend: QA Issue: inherits setuptools3 but has pyproject.toml with setuptools.build_meta, use the correct class [pep517-backend] The work was sponsored by GOVCERT.LU. License-Update: Update years Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
* grpc: Fix CVE-2024-7246Libo Chen2024-12-152-0/+421
| | | | | | | | | Backport patches [1] to fix CVE-2024-7246. [1] https://github.com/grpc/grpc/pull/37361/files Signed-off-by: Libo Chen <libo.chen.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* protobuf: fix CVE-2024-7254Chen Qi2024-12-152-0/+795
| | | | | | | | Backport patch with adjustments for the current version to fix CVE-2024-7254. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* php: upgrade 8.2.20 -> 8.2.24Yogita Urade2024-12-152-7/+10
| | | | | | | | | | | | | Includes fix for CVE-2024-8925, CVE-2024-8926, CVE-2024-8927 and CVE-2024-9026 Changelog: https://www.php.net/ChangeLog-8.php#8.2.24 Rebase 0001-ext-opcache-config.m4-enable-opcache.patch to new version Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libdev-checklib-perl: fix do_fetch errorJiaying Song2024-11-241-1/+1
| | | | | | | | Change the SRC_URI to the correct value due to the following error: WARNING: libdev-checklib-perl-native-1.16-r0 do_fetch: Failed to fetch URL https://cpan.metacpan.org/modules/by-module/Devel/Devel-CheckLib-1.16.tar.gz, attempting MIRRORS if available Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: cleanupJ. S.2024-11-092-118/+0
| | | | | | | | | | Drop two patches which haven't been referenced by the nodejs recipe since the 20.11.0 version checkin. 0001-build-fix-build-with-Python-3.12.patch 0001-gyp-resolve-python-3.12-issues.patch Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* debootstrap: fix do_fetch errorJiaying Song2024-10-271-1/+1
| | | | | | | | | Change the SRC_URI to the correct value due to the following error: WARNING: debootstrap-1.0.132-r0.vr2401 do_fetch: Failed to fetch URL http://ftp.debian.org/debian/pool/main/d/debootstrap/debootstrap_1.0.132.tar.gz, attempting MIRRORS if available Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* xmlrpc-c: update SRCREVMartin Jansa2024-10-151-1/+1
| | | | | | | | | | | | | | | | * github repo was force pushed and git history re-written since 2018 commit: 69ee98df Release 1.43.07 * $ git branch -a --contains 352aeaa9ae49e90e55187cbda839f2113df06278 $ * $ git diff 352aeaa9ae49e90e55187cbda839f2113df06278 08b052692b70171a6fcb437d4f52a46977eda62e $ * so at least the 1.59.01 content is the same Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-25 09:46:35 +0000