summaryrefslogtreecommitdiffstats
path: root/meta-webserver
Commit message (Collapse)AuthorAgeFilesLines
* monkey: patch CVEsGyorgy Sarvari2026-04-244-1/+324
| | | | | | | | | | | | | | | | | | | | | | | | | | These patches are about a number of CVEs files against the application: CVE-2025-63649, CVE-2025-63650, CVE-2025-63651, CVE-2025-63652, CVE-2025-63653, CVE-2025-63655, CVE-2025-63656, CVE-2025-63657 and CVE-2025-63658. These patches are taken from a pull request[1] that is referenced in the relevant bug report[2]. The patches don't target specific CVEs on separately, but they fix a number of CVEs altogether. Based on upstream analysis (in the linked issue) a number of these CVEs are duplicates of each other and/or not exploitable. The valid CVEs are fixed by these patches. I haven't added specific CVE info to the patches, one hand because of the above, it is hard to separate the patches by CVE, and secondarily because NVD tracks these CVEs with incorrect version info: NVD considers 1.8.6 fully fixed, even though the patches are only in the master branch, untagged at this time. After updating the recipe to 1.8.6+, the vulnerabilites will disappear from the CVE report due to this. [1]: https://github.com/monkey/monkey/pull/434 [2]: https://github.com/monkey/monkey/issues/426 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit d31f07340fad43120f5e2ee4aee98cdec6f2717d) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* monkey: upgrade 1.8.4 -> 1.8.7Gyorgy Sarvari2026-04-241-2/+6
| | | | | | | | | | Shortlog: https://github.com/monkey/monkey/compare/v1.8.4...v1.8.7 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 22277ca3a34083c27b5053bde58237e48b0e8799) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* hiawatha: upgrade 11.7 -> 11.8Gyorgy Sarvari2026-04-244-122/+1
| | | | | | | | | | | | | | Drop patches that are included in this release. Changes: * mbed TLS updated to 3.6.4. * Small bugfixes. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d92fa873e5616ee7a7b25683ddfdb6849ef72d29) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: upgrade 1.28.2 -> 1.28.3Gyorgy Sarvari2026-04-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: *) Security: a buffer overflow might occur while handling a COPY or MOVE request in a location with "alias", allowing an attacker to modify the source or destination path outside of the document root (CVE-2026-27654). *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module on 32-bit platforms might cause a worker process crash, or might have potential other impact (CVE-2026-27784). *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash, or might have potential other impact (CVE-2026-32647). *) Security: a segmentation fault might occur in a worker process if the CRAM-MD5 or APOP authentication methods were used and authentication retry was enabled (CVE-2026-27651). *) Security: an attacker might use PTR DNS records to inject data in auth_http requests, as well as in the XCLIENT command in the backend SMTP connection (CVE-2026-28753). *) Security: SSL handshake might succeed despite OCSP rejecting a client certificate in the stream module (CVE-2026-28755). *) Change: now nginx limits the size and rate of QUIC stateless reset packets. *) Bugfix: receiving a QUIC packet by a wrong worker process could cause the connection to terminate. *) Bugfix: in the ngx_http_mp4_module. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 34b3d0f4917169c5cd568cdb13796a2d75f1fbf1) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: upgrade 1.29.1 -> 1.29.2Ankur Tyagi2026-04-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Changes with nginx 1.29.2 *) Feature: now nginx can be built with AWS-LC. *) Bugfix: now the "ssl_protocols" directive works in a virtual server different from the default server when using OpenSSL 1.1.1 or newer. *) Bugfix: SSL handshake always failed when using TLSv1.3 with OpenSSL and client certificates and resuming a session with a different SNI value; the bug had appeared in 1.27.4. *) Bugfix: the "ignoring stale global SSL error" alerts might appear in logs when using QUIC and the "ssl_reject_handshake" directive; the bug had appeared in 1.29.0. *) Bugfix: in delta-seconds processing in the "Cache-Control" backend response header line. *) Bugfix: an XCLIENT command didn't use the xtext encoding. *) Bugfix: in SSL certificate caching during reconfiguration. https://nginx.org/en/CHANGES Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* hiawatha: fix SRC_URIGyorgy Sarvari2026-03-261-1/+1
| | | | | | | The tarball was moved to a new folder on the source server. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: patch CVE-2026-1642Gyorgy Sarvari2026-03-062-0/+47
| | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-1642 Note: this is only for v1.29.1. v1.28.x recipe contains this fix already. Pick the commit that was identified by the reporter on the oss-sec mailing list[1] [1]: https://www.openwall.com/lists/oss-security/2026/02/05/1 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: upgrade 1.28.1 -> 1.28.2Gyorgy Sarvari2026-02-191-1/+1
| | | | | | | | | | | | Changelog: - Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642). - Bugfix: use-after-free might occur after switching to the next gRPC or HTTP/2 backend. - Bugfix: fixed warning when compiling with MSVC 2022 x86. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: ignore CVE-2025-53859 for 1.28.1Peter Marko2026-01-201-0/+2
| | | | | | | | | | | | Fix is included via commit [1]. [1] https://github.com/nginx/nginx/commit/fbbbf189dadf3bd59c2462af68c16f2c2874d4ee Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5d3936d5dd0489a984e37cc00b59e6a05d9541ac) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: set CVE_PRODUCTGyorgy Sarvari2026-01-201-0/+2
| | | | | | | | | | | | nginx has a long history, and has used multiple CPEs over time. Set CVE_PRODUCT to reflect current and historic vendor:product pairs. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d25aadbbb53d54382b4b82b1f78a69d4d117fd28) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: upgrade 1.28.0 -> 1.28.1Jason Schonberg2026-01-203-138/+5
| | | | | | | | | | | | | | | | Drop CVE patch which has been integrated into this new version. Solves: * CVE-2025-53859 CHANGES: https://nginx.org/en/CHANGES-1.28 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 222c6425644a39c9b7757792b47e500ca55f85b0) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* apache2: upgrade 2.4.65 -> 2.4.66Valeria Petrov2025-12-171-1/+1
| | | | | | | | | | | | | | | | | Security fixes: - CVE-2025-66200 - CVE-2025-65082 - CVE-2025-59775 - CVE-2025-58098 - CVE-2025-55753 See: http://www.apache.org/dist/httpd/CHANGES_2.4.66 Signed-off-by: Valeria Petrov <valeria.petrov@spinetix.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 220835dac9a39dda9112dcd5383aafc9ad552590) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* swagger-ui: upgrade 5.30.2 -> 5.30.3Wang Mingyu2025-12-171-1/+1
| | | | | | | | | | | | | | Changelog: ========== - deps: update vulnerable @release-it/conventional-changelog to 10.0.2 - deps: update vulnerable dependencies (js-yaml & glob) - utils: handle sanitizing multi-level relative paths Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit fad70abdb36e42eda376fd5ed0275c1dfbdea403) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* fcgi: upgrade 2.4.6 -> 2.4.7Wang Mingyu2025-12-171-1/+1
| | | | | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 39f1d58d2bdc189b65f7752122490c37898a52d8) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* cockpit: set correct CVE_PRODUCTGyorgy Sarvari2025-12-171-0/+2
| | | | | | | | Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit af4df551eec582844a8b56154117915ace1596cd) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* xdebug: upgrade 3.4.6 -> 3.4.7Jason Schonberg2025-12-171-1/+1
| | | | | | | | | | | | | [2025-10-26] — Xdebug 3.4.7 Fixed bug #2359: PHP 8.4 Lazy Ghost Object inoperable/defunct when Xdebug is enabled Fixed bug #2371: Step debugging initialize lazy objects Fixed bug #2375: Xdebug's exception trace conversion initialises lazy objects Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 8a04d45a4e32ee29a12db23e1359729d16549b12) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* swagger-ui: upgrade 5.30.0 -> 5.30.2Wang Mingyu2025-11-111-1/+1
| | | | | | | | | | Changelog: ============ - prevent webook from crashing in case of openapi 3.0 - deps: bump react-syntax-highlighter to 16.0.0 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* xdebug: update UPSTREAM_CHECK_URIYi Zhao2025-11-071-1/+2
| | | | | | | | | | | | | | | | | | Update UPSTREAM_CHECK_URI and UPSTREAM_CHECK_REGEX to check the correct latest stable verison. Before the patch: $ devtool latest-version xdebug INFO: Current version: 3.4.6 INFO: Latest version: After the patch: $ devtool latest-version xdebug INFO: Current version: 3.4.6 INFO: Latest version: 3.4.7 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.29.5 -> 5.30.0Wang Mingyu2025-11-061-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* webmin: upgrade 2.303 -> 2.402Jason Schonberg2025-10-301-1/+1
| | | | | | | | | Changelog: https://github.com/webmin/webmin/releases/tag/2.402 Changelog: https://github.com/webmin/webmin/releases/tag/2.401 Changelog: https://github.com/webmin/webmin/releases/tag/2.400 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* phpmyadmin: upgrade 5.2.2 -> 5.2.3Jason Schonberg2025-10-251-2/+2
| | | | | | | | | | License-Update: Copyright year updated to 2025 Release note: https://www.phpmyadmin.net/news/2025/10/8/phpmyadmin-523-is-released/ Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* xdebug: upgrade 3.4.5 -> 3.4.6Jason Schonberg2025-10-251-1/+1
| | | | | | | | | | [2025-10-06] — Xdebug 3.4.6 Fixed bugs Fixed bug #2328: Stream resource references in stored stack traces don't hold, and can cause crashes Fixed bug #2360: Debugging DateInterval (and other internal objects) causes a crash Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* webmin: upgrade 2.300 -> 2.303Jason Schonberg2025-10-243-7/+20
| | | | | | | | | | | | | | net-generic.patch : lines changed order in the new version disable-version-check.patch : additional code to be removed from the function which is being deleted. Changelog: https://github.com/webmin/webmin/releases/tag/2.303 Changelog: https://github.com/webmin/webmin/releases/tag/2.302 Changelog: https://github.com/webmin/webmin/releases/tag/2.301 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.29.4 -> 5.29.5Wang Mingyu2025-10-211-1/+1
| | | | | | | | | | Changelog: ============ - core: handle complex value stringification in Property component - correct spec paths for parameters, responses and request bodies Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cockpit: Upgrade to 349Daniel Semkowicz2025-10-162-36/+1
| | | | | | | | Remove the patch with the fix that is already present in the new version. Signed-off-by: Daniel Semkowicz <dse@thaumatec.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cockpit: Add runtime dependency on GNU CoreutilsDaniel Semkowicz2025-10-161-2/+2
| | | | | | | | | | | | The BusyBox version of mv does not have the -Z flag for setting SELinux security context. This results in failure when the cockpit-certificate-helper script is executed. Depend the package on GNU Coreutils to make sure that the proper version of mv is installed. Signed-off-by: Daniel Semkowicz <dse@thaumatec.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cockpit: Remove old-bridge leftoversDaniel Semkowicz2025-10-161-5/+3
| | | | | | | | | | | The old-bridge package config option was removed from the recipe, but the usage of this option was left in some places. Remove any reference to old-bridge. Only the Python bridge is currently supported by Cockpit. Signed-off-by: Daniel Semkowicz <dse@thaumatec.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.29.0 -> 5.29.4Wang Mingyu2025-10-141-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: ignore CVE-2025-3891Gyorgy Sarvari2025-10-051-0/+1
| | | | | | | | | | | The vulnerability was reported against mod_auth_openidc, which module is a 3rd party one, and not part of the apache2 source distribution. The affected module is not part of the meta-oe universe currently, so ignore the CVE. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* webmin: upgrade 2.202 -> 2.300Jason Schonberg2025-09-192-3/+3
| | | | | | | | | | Modified net-generic.patch to update a hardcoded version number to avoid patch fuzz. Changelog: https://github.com/webmin/webmin/releases/tag/2.300 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.28.0 -> 5.29.0Wang Mingyu2025-09-161-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.27.1 -> 5.28.0Wang Mingyu2025-09-041-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* xdebug: upgrade 3.4.2 -> 3.4.5Jason Schonberg2025-09-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | [2025-07-14] — Xdebug 3.4.5 Fixed bug #2332: Segmentation fault for code coverage with nested fibers Fixed bug #2356: Reading properties with get hooks may modify property value [2025-06-12] — Xdebug 3.4.4 Fixed bug #2349: Regression in Xdebug 3.4.3 breaks throwing exceptions in nested generators Fixed bug #2350: Crash when a certain page generates an exception since Xdebug 3.4.3 Fixed bug #2352: Crash when using latest Xdebug version when throwing exceptions Fixed bug #2354: The __invoke frame in call stacks don't have the argument name in the trace [2025-05-14] — Xdebug 3.4.3 Fixed bug #2322: Xdebug tries to open debugging connection in destructors during shutdown Fixed bug #2325: Referred chrome browser extension is no longer working Fixed bug #2326: Step debugger finishes if property debugging handler in PHP throws an exception Fixed bug #2331: Segmentation fault with 'invalid' variable names Fixed bug #2339: Trying to throw an exception can cause a zend_mm_heap corrupted error under specific circumstances Fixed bug #2340: Xdebug case sensitivity issues on some files introduced since 3.3.0 Fixed bug #2343: Fatal error on virtual property hook step debugging Fixed bug #2348: Xdebug does not resolve breakpoints in property hooks Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: Fix bundled mbedtls with clang-21Khem Raj2025-08-294-1/+123
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: patch CVE-2025-53859 in stablePeter Marko2025-08-252-0/+132
| | | | | | | | | Pick patch from nginx site which is also mentioned in [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-53859 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade mainline 1.27.4 -> 1.29.1Peter Marko2025-08-252-10/+10
| | | | | | | Solves CVE-2025-53859 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade stable 1.26.3 -> 1.28.0Peter Marko2025-08-252-6/+6
| | | | | | | | | | | | | | | | | | 2025-04-23 nginx-1.28.0 stable version has been released, incorporating new features and bug fixes from the 1.27.x mainline branch - including memory usage and CPU usage optimizations in complex SSL configurations, automatic re‑resolution of hostnames in upstream groups, performance enhancements in QUIC, OCSP validation of client SSL certificates and OCSP stapling support in the stream module, variables support in the proxy_limit_rate, fastcgi_limit_rate, scgi_limit_rate, and uwsgi_limit_rate directives, the proxy_pass_trailers directive, and more. License-Update: copyright years refreshed and removed C-style comments Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* fcgi: upgrade 2.4.2 -> 2.4.6Peter Marko2025-08-141-4/+3
| | | | | | | | | | | | | Handles CVE-2025-23016 (in 2.4.5) Add tag to SRC_URI. Move version to recipe filename. License-Update: file was renamed without any text change Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.27.0 -> 5.27.1Wang Mingyu2025-08-041-2/+2
| | | | | | | | bugfix: use open-cli instead of require('open') for Node 20+ compatibility Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: upgrade 2.4.64 -> 2.4.65Wang Mingyu2025-07-301-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.18.2 -> 5.27.0Liu Yiding2025-07-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ============= - feat: add support for OpenAPI 3.0.4 (#10247) - feat: apply cumulative update to address various issues (#10324) - fix(docker): fix security issues CVE-2024-56171, CVE-2025-24928 (#10351) - fix: fix definition resolving being affected by the order of schemas (#10386) - fix(json-schema-2020-12): avoid accessing properties of null schemas (#10397) - fix(json-schema-2020-12-samples): fix examples for nullable primitive types defined as list of types (#10390) - fix(utils): fix error messages for range validation of number parameters (#10344) - fix(json-schema-2020-12): use consistent comparison operators for displaying min/max constraints (#10159) - fix(json-schema-2020-12-samples): use zero as default example value for int32 and int64 (#10230) - fix(style): prevent operationId from wrapping when space is available (#10259) - fix(docker): address multiple HIGH security vulnerabilities (#10410) - fix(json-schema-2020-12): infer type string when contentEncoding or contentMediaType is present (#10411) - fix: align OpenAPI 3.x.y file uploads with specification (#10409) - feat(oas31): display file upload input when contentMediaType or contentEncoding is present (#10412) - fix: avoid accessing properties of empty Example Objects (#10453) - fix(oauth2): avoid processing authorizationUrl when it is not a string (#10452) - fix: use spec compliant JSON Pointer implementation (#10455) - fix(spec): assure operation is an immutable map in operations selectors (#10454) - fix: assure parameter is an immutable map when grouping parameters (#10457) - fix(spec): avoid accessing $ref when path item is not an object (#10456) - fix(json-schema-2020-12-samples): generate proper samples for XML atttributes (#10459) - fix(security): update Axios to non-vulnerable 1.9.0 version (#10460) - fix(docker): address CVE-2025-32414/CVE-2025-32415 (#10461) - feat(observability): allow defining custom uncaught exception handler (#10462) - feat(json-schema-5-samples): add support for time format example generation (#10420) (#10421) - refactor: introduce function for getting Schema Object type (#10330) - fix: mitigate ReDoS when generating examples from pattern (#10477) - fix(release): fix failed v5.23.0 release - fix(packagist): exclude large obsolete directories from publishing to Packagist (#10329) - ft(oas3): show the schema tab in the Try it Out mode (#10488) - fix: align expanded content inside expand collapse button (#10497) - feat: release SwaggerUI via GitHub Actions - fix(CD): provide correct npm token - fix(dist): provide correct npm token for swagger-ui-dist release - fix: fix opened model schema resolving issue on spec change (#10509) - fix(docker): bump nginx image to version 1.29.0-alpine to fix CVE-2025-48174 (#10508) - feat: release Swagger UI to Packagist (#10513) - fix(oas3): reset request body values in try it out (#9717) - fix(style): restore paragraph spacing in parameter and response descriptions (#10514) - feat(json-schema): support x-additionalPropertiesName (#10006) - fix: permissions of files to allow running as non-root (#10515) - fix: sanitization of relative OpenAPI JSON paths (#10528) Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: upgrade 2.4.63 -> 2.4.64Wang Mingyu2025-07-151-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: Upgrade to 11.7Khem Raj2025-07-121-4/+12
| | | | | | | Enable TLS support Fix build with cmake4+ Signed-off-by: Khem Raj <raj.khem@gmail.com>
* monkey: Upgrade to 1.8.4Khem Raj2025-07-123-23/+47
| | | | | | Use default cmake backend ( ninja ) Signed-off-by: Khem Raj <raj.khem@gmail.com>
* meta-openembedded/all: adapt to UNPACKDIR changesAlexander Kanavin2025-06-259-9/+2
| | | | | | | | | | | | | Please see https://git.yoctoproject.org/poky/commit/?id=4dd321f8b83afecd962393101b2a6861275b5265 for what changes are needed, and sed commands that can be used to make them en masse. I've verified that bitbake -c patch world works with these, but did not run a world build; the majority of recipes shouldn't need further fixups, but if there are some that still fall out, they can be fixed in followups. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* reproducibility: move known non-repro list to layer.confYoann Congal2025-06-202-7/+8
| | | | | | | | | | | | | | | | | | | | | | The current include file that stores the known non-reproducible packages is layer dependent and that forces the user of the layers to maintain the list of the files (for example, see AB config[0]). By moving the exclude list to each layer.conf and extending the common OEQA_REPRODUCIBLE_EXCLUDED_PACKAGES variable, the known non-reproducible packages will be automatically excluded for each layer used in the reproducibility test without any special knowledge in the test environment. NB: the empty list for meta-initramfs was just removed not moved. [0]: https://git.yoctoproject.org/yocto-autobuilder-helper/tree/config.json?id=7d8933e75bdf7fb821a25617cb2dcabf1f3f8700#n322 Suggested-by: Quentin Schulz <quentin.schulz@cherry.de> Co-Developed-by: Guillaume Swaenepoel <guillaume.swaenepoel@smile.fr> Signed-off-by: Guillaume Swaenepoel <guillaume.swaenepoel@smile.fr> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: Enable network during do_compile only when go support is enabledKhem Raj2025-05-141-1/+1
| | | | | | | Makes the hammer a bit smaller, since we do not enable go by default in packageconfig's it helps with yocto check layer with default config. Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cockpit: Fix a build race generating fail-html.cKhem Raj2025-05-092-0/+35
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cockpit: Upgrade to 337Khem Raj2025-05-091-19/+22
| | | | | | | | Get rid of remoeved configure options ERROR: QA Issue: cockpit: configure was passed unrecognised options: --disable-pcp --enable-old-bridge --with-cockpit-ws-instance-user --disable-ssh --disable-polkit --with-cockpit-ws-instance-group --with-cockpit-group --with-cockpit-user [unknown-configure-option] Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: use -std=gnu17 for compilationYoann Congal2025-05-081-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | hiawatha does not build under -std=gnu23 which is the default of gcc15. Forcing -std=gnu17 fixes these build errors: | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/hiawatha-11.2/src/hiawatha.c:814:25: error: passing argument 2 of 'signal' from incompatible pointer type [-Wincompatible-pointer-types] | 814 | signal(SIGHUP, HUP_handler); | | ^~~~~~~~~~~ | | | | | void (*)(void) | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/recipe-sysroot/usr/include/signal.h:88:57: note: expected '__sighandler_t' {aka 'void (*)(int)'} but argument is of type 'void (*)(void)' | 88 | extern __sighandler_t signal (int __sig, __sighandler_t __handler) | | ~~~~~~~~~~~~~~~^~~~~~~~~ | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/hiawatha-11.2/src/hiawatha.c:294:6: note: 'HUP_handler' declared here | 294 | void HUP_handler() { | | ^~~~~~~~~~~ | .../tmp/work/core2-64-poky-linux/hiawatha/11.2/recipe-sysroot/usr/include/signal.h:72:16: note: '__sighandler_t' declared here | 72 | typedef void (*__sighandler_t) (int); | | ^~~~~~~~~~~~~~ Note: Upstream project has no published way to upstream patches. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-29 20:18:19 +0000