summaryrefslogtreecommitdiffstats
path: root/meta-webserver
Commit message (Collapse)AuthorAgeFilesLines
* sthttpd: remove obsolete CVE_STATUSGyorgy Sarvari21 hours1-2/+0
| | | | | | | The CVE is now tracked with the correct version info by NVD. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* layers: update for wrynose release seriesKhem Raj3 days1-1/+1
| | | | | | Drop walnascar from supported release series Signed-off-by: Khem Raj <raj.khem@gmail.com>
* spawn-fcgi: upgrade 1.6.5 -> 1.6.6Ankur Tyagi3 days1-3/+3
| | | | | | | | | Changelog: * Use meson instead of autotools and cmake * Simplify/reduce configure checks and #ifdefs Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade 1.29.5 -> 1.29.6Ankur Tyagi3 days1-1/+1
| | | | | | | | | | | | | | | | | | | | | | Changelog: * Feature: session affinity support; the "sticky" directive in the "upstream" block of the "http" module; the "server" directive supports the "route" and "drain" parameters. * Change: now nginx limits the size and rate of QUIC stateless reset packets. * Bugfix: receiving a QUIC packet by a wrong worker process could cause the connection to terminate. * Bugfix: "[crit] cache file ... contains invalid header" messages might appear in logs when sending a cached HTTP/2 response. * Bugfix: proxying to scgi backends might not work when using chunked transfer encoding and the "scgi_request_buffering" directive. * Bugfix: in the ngx_http_mp4_module. * Bugfix: nginx treated a comma as separator in the "Cookie" request header line when evaluating "$cookie_..." variables. * Bugfix: in IMAP command literal argument parsing. Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* webmin: upgrade 2.520 -> 2.621Ankur Tyagi3 days1-1/+1
| | | | | | | | | | https://github.com/webmin/webmin/releases/tag/2.600 https://github.com/webmin/webmin/releases/tag/2.610 https://github.com/webmin/webmin/releases/tag/2.620 https://github.com/webmin/webmin/releases/tag/2.621 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: upgrade 11.8 -> 12.0Gyorgy Sarvari4 days1-2/+2
| | | | | | | | | | | | | Changelog: * mbed TLS updated to 4.0.0. * Replaced strcpy() with strlcpy() and sprintf() with snprintf(). * Added OS sandbox. * Removed DHsize option. * Known bug: mbed TLS v4.0.0 doesn't compile in Cygwin, so building a Windows package is not possible. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.31.2 -> 5.32.0Wang Mingyu4 days1-1/+1
| | | | | | | | Changelog: oas32: add basic OpenAPI 3.2.0 support Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* xdebug: upgrade 3.5.0 -> 3.5.1Liu Yiding2026-03-021-1/+2
| | | | | | | | Changelog: https://github.com/xdebug/xdebug/releases/tag/3.5.1 Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.30.3 -> 5.31.2Wang Mingyu2026-03-021-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* webmin: upgrade 2.501 -> 2.520Jason Schonberg2026-02-241-1/+1
| | | | | | | | Changelog: https://github.com/webmin/webmin/releases/tag/2.520 Changelog: https://github.com/webmin/webmin/releases/tag/2.510 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade 1.29.1 -> 1.29.5Gyorgy Sarvari2026-02-161-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | License-Update: copyright year bump. Changelog: 1.29.5: - Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642). - Bugfix: use-after-free might occur after switching to the next gRPC or HTTP/2 backend. - Bugfix: an invalid HTTP/2 request might be sent after switching to the next upstream. - Bugfix: a response with multiple ranges might be larger than the source response. - Bugfix: fixed setting HTTP_HOST when proxying to FastCGI, SCGI, and uwsgi backends. - Bugfix: fixed warning when compiling with MSVC 2022 x86. - Change: the logging level of the "ech_required" SSL error has been lowered from "crit" to "info". 1.29.4: - Feature: the ngx_http_proxy_module supports HTTP/2. - Feature: Encrypted ClientHello TLS extension support when using OpenSSL ECH feature branch; the "ssl_ech_file" directive. Thanks to Stephen Farrell. - Change: validation of host and port in the request line, "Host" header field, and ":authority" pseudo-header field has been changed to follow RFC 3986. - Change: now a single LF used as a line terminator in a chunked request or response body is considered an error. - Bugfix: when using HTTP/3 with OpenSSL 3.5.1 or newer a segmentation fault might occur in a worker process; the bug had appeared in 1.29.1. Thanks to Jan Svojanovsky. - Bugfix: a segmentation fault might occur in a worker process if the "try_files" directive and "proxy_pass" with a URI were used. 1.29.3: - Feature: the "add_header_inherit" and "add_trailer_inherit" directives. - Feature: the $request_port and $is_request_port variables. - Feature: the $ssl_sigalg and $ssl_client_sigalg variables. - Feature: the "volatile" parameter of the "geo" directive. - Feature: now certificate compression is available with BoringSSL. - Bugfix: now certificate compression is disabled with OCSP stapling. 1.29.2 - Feature: now nginx can be built with AWS-LC. Thanks Samuel Chiang. - Bugfix: now the "ssl_protocols" directive works in a virtual server different from the default server when using OpenSSL 1.1.1 or newer. - Bugfix: SSL handshake always failed when using TLSv1.3 with OpenSSL and client certificates and resuming a session with a different SNI value; the bug had appeared in 1.27.4. - Bugfix: the "ignoring stale global SSL error" alerts might appear in logs when using QUIC and the "ssl_reject_handshake" directive; the bug had appeared in 1.29.0. Thanks to Vladimir Homutov. - Bugfix: in delta-seconds processing in the "Cache-Control" backend response header line. - Bugfix: an XCLIENT command didn't use the xtext encoding. Thanks to Igor Morgenstern of Aisle Research. - Bugfix: in SSL certificate caching during reconfiguration. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade 1.28.1 -> 1.28.2Gyorgy Sarvari2026-02-161-1/+1
| | | | | | | | | | | | Changelog: - Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642). - Bugfix: use-after-free might occur after switching to the next gRPC or HTTP/2 backend. - Bugfix: fixed warning when compiling with MSVC 2022 x86. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: upgrade 11.7 -> 11.8Gyorgy Sarvari2026-02-044-122/+1
| | | | | | | | | | | Drop patches that are included in this release. Changes: * mbed TLS updated to 3.6.4. * Small bugfixes. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: ignore CVE-2025-53859 for 1.28.1Peter Marko2026-01-121-0/+2
| | | | | | | | | Fix is included via commit [1]. [1] https://github.com/nginx/nginx/commit/fbbbf189dadf3bd59c2462af68c16f2c2874d4ee Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: set CVE_PRODUCTGyorgy Sarvari2026-01-041-0/+2
| | | | | | | | | nginx has a long history, and has used multiple CPEs over time. Set CVE_PRODUCT to reflect current and historic vendor:product pairs. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade 1.28.0 -> 1.28.1Jason Schonberg2026-01-043-138/+5
| | | | | | | | | | | | | Drop CVE patch which has been integrated into this new version. Solves: * CVE-2025-53859 CHANGES: https://nginx.org/en/CHANGES-1.28 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cockpit: upgrade 349 -> 352Jason Schonberg2025-12-111-1/+1
| | | | | | | | | | | | | | | | 352 Shown a warning if the last shutdown/reboot was unclean Bug fixes and translation updates 351 Firewall ports can be deleted individually 350 networking: fix renaming of bridges and other groups (RHEL-117883) bridge: fix OpenSSH_10.2p1 host key detection Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: upgrade 2.4.65 -> 2.4.66Valeria Petrov2025-12-051-1/+1
| | | | | | | | | | | | | | Security fixes: - CVE-2025-66200 - CVE-2025-65082 - CVE-2025-59775 - CVE-2025-58098 - CVE-2025-55753 See: http://www.apache.org/dist/httpd/CHANGES_2.4.66 Signed-off-by: Valeria Petrov <valeria.petrov@spinetix.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* xdebug: upgrade 3.4.7 -> 3.5.0Liu Yiding2025-12-051-1/+1
| | | | | | | | Change log: https://xdebug.org/updates#x_3_5_0 Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* webmin: upgrade 2.402 -> 2.501Jason Schonberg2025-12-021-1/+1
| | | | | | | | Changelog: https://github.com/webmin/webmin/releases/tag/2.501 Changelog: https://github.com/webmin/webmin/releases/tag/2.500 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.30.2 -> 5.30.3Wang Mingyu2025-12-021-1/+1
| | | | | | | | | | | Changelog: ========== - deps: update vulnerable @release-it/conventional-changelog to 10.0.2 - deps: update vulnerable dependencies (js-yaml & glob) - utils: handle sanitizing multi-level relative paths Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* fcgi: upgrade 2.4.6 -> 2.4.7Wang Mingyu2025-12-021-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: switch to libpcre2Hongxu Jia2025-12-011-1/+1
| | | | | | | | | NGINX 1.22 and later supports PCRE2 [1] [1] https://github.com/nginx/nginx/commit/c6fec0b027569a4e0b1d8aaee7dea0f2e4d6052b Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cockpit: set correct CVE_PRODUCTGyorgy Sarvari2025-11-241-0/+2
| | | | | Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* xdebug: upgrade 3.4.6 -> 3.4.7Jason Schonberg2025-11-231-1/+1
| | | | | | | | | | [2025-10-26] — Xdebug 3.4.7 Fixed bug #2359: PHP 8.4 Lazy Ghost Object inoperable/defunct when Xdebug is enabled Fixed bug #2371: Step debugging initialize lazy objects Fixed bug #2375: Xdebug's exception trace conversion initialises lazy objects Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.30.0 -> 5.30.2Wang Mingyu2025-11-111-1/+1
| | | | | | | | | | Changelog: ============ - prevent webook from crashing in case of openapi 3.0 - deps: bump react-syntax-highlighter to 16.0.0 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* xdebug: update UPSTREAM_CHECK_URIYi Zhao2025-11-071-1/+2
| | | | | | | | | | | | | | | | | | Update UPSTREAM_CHECK_URI and UPSTREAM_CHECK_REGEX to check the correct latest stable verison. Before the patch: $ devtool latest-version xdebug INFO: Current version: 3.4.6 INFO: Latest version: After the patch: $ devtool latest-version xdebug INFO: Current version: 3.4.6 INFO: Latest version: 3.4.7 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.29.5 -> 5.30.0Wang Mingyu2025-11-061-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* webmin: upgrade 2.303 -> 2.402Jason Schonberg2025-10-301-1/+1
| | | | | | | | | Changelog: https://github.com/webmin/webmin/releases/tag/2.402 Changelog: https://github.com/webmin/webmin/releases/tag/2.401 Changelog: https://github.com/webmin/webmin/releases/tag/2.400 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* phpmyadmin: upgrade 5.2.2 -> 5.2.3Jason Schonberg2025-10-251-2/+2
| | | | | | | | | | License-Update: Copyright year updated to 2025 Release note: https://www.phpmyadmin.net/news/2025/10/8/phpmyadmin-523-is-released/ Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* xdebug: upgrade 3.4.5 -> 3.4.6Jason Schonberg2025-10-251-1/+1
| | | | | | | | | | [2025-10-06] — Xdebug 3.4.6 Fixed bugs Fixed bug #2328: Stream resource references in stored stack traces don't hold, and can cause crashes Fixed bug #2360: Debugging DateInterval (and other internal objects) causes a crash Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* webmin: upgrade 2.300 -> 2.303Jason Schonberg2025-10-243-7/+20
| | | | | | | | | | | | | | net-generic.patch : lines changed order in the new version disable-version-check.patch : additional code to be removed from the function which is being deleted. Changelog: https://github.com/webmin/webmin/releases/tag/2.303 Changelog: https://github.com/webmin/webmin/releases/tag/2.302 Changelog: https://github.com/webmin/webmin/releases/tag/2.301 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.29.4 -> 5.29.5Wang Mingyu2025-10-211-1/+1
| | | | | | | | | | Changelog: ============ - core: handle complex value stringification in Property component - correct spec paths for parameters, responses and request bodies Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cockpit: Upgrade to 349Daniel Semkowicz2025-10-162-36/+1
| | | | | | | | Remove the patch with the fix that is already present in the new version. Signed-off-by: Daniel Semkowicz <dse@thaumatec.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cockpit: Add runtime dependency on GNU CoreutilsDaniel Semkowicz2025-10-161-2/+2
| | | | | | | | | | | | The BusyBox version of mv does not have the -Z flag for setting SELinux security context. This results in failure when the cockpit-certificate-helper script is executed. Depend the package on GNU Coreutils to make sure that the proper version of mv is installed. Signed-off-by: Daniel Semkowicz <dse@thaumatec.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cockpit: Remove old-bridge leftoversDaniel Semkowicz2025-10-161-5/+3
| | | | | | | | | | | The old-bridge package config option was removed from the recipe, but the usage of this option was left in some places. Remove any reference to old-bridge. Only the Python bridge is currently supported by Cockpit. Signed-off-by: Daniel Semkowicz <dse@thaumatec.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.29.0 -> 5.29.4Wang Mingyu2025-10-141-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: ignore CVE-2025-3891Gyorgy Sarvari2025-10-051-0/+1
| | | | | | | | | | | The vulnerability was reported against mod_auth_openidc, which module is a 3rd party one, and not part of the apache2 source distribution. The affected module is not part of the meta-oe universe currently, so ignore the CVE. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* webmin: upgrade 2.202 -> 2.300Jason Schonberg2025-09-192-3/+3
| | | | | | | | | | Modified net-generic.patch to update a hardcoded version number to avoid patch fuzz. Changelog: https://github.com/webmin/webmin/releases/tag/2.300 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.28.0 -> 5.29.0Wang Mingyu2025-09-161-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.27.1 -> 5.28.0Wang Mingyu2025-09-041-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* xdebug: upgrade 3.4.2 -> 3.4.5Jason Schonberg2025-09-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | [2025-07-14] — Xdebug 3.4.5 Fixed bug #2332: Segmentation fault for code coverage with nested fibers Fixed bug #2356: Reading properties with get hooks may modify property value [2025-06-12] — Xdebug 3.4.4 Fixed bug #2349: Regression in Xdebug 3.4.3 breaks throwing exceptions in nested generators Fixed bug #2350: Crash when a certain page generates an exception since Xdebug 3.4.3 Fixed bug #2352: Crash when using latest Xdebug version when throwing exceptions Fixed bug #2354: The __invoke frame in call stacks don't have the argument name in the trace [2025-05-14] — Xdebug 3.4.3 Fixed bug #2322: Xdebug tries to open debugging connection in destructors during shutdown Fixed bug #2325: Referred chrome browser extension is no longer working Fixed bug #2326: Step debugger finishes if property debugging handler in PHP throws an exception Fixed bug #2331: Segmentation fault with 'invalid' variable names Fixed bug #2339: Trying to throw an exception can cause a zend_mm_heap corrupted error under specific circumstances Fixed bug #2340: Xdebug case sensitivity issues on some files introduced since 3.3.0 Fixed bug #2343: Fatal error on virtual property hook step debugging Fixed bug #2348: Xdebug does not resolve breakpoints in property hooks Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* hiawatha: Fix bundled mbedtls with clang-21Khem Raj2025-08-294-1/+123
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: patch CVE-2025-53859 in stablePeter Marko2025-08-252-0/+132
| | | | | | | | | Pick patch from nginx site which is also mentioned in [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-53859 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade mainline 1.27.4 -> 1.29.1Peter Marko2025-08-252-10/+10
| | | | | | | Solves CVE-2025-53859 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: upgrade stable 1.26.3 -> 1.28.0Peter Marko2025-08-252-6/+6
| | | | | | | | | | | | | | | | | | 2025-04-23 nginx-1.28.0 stable version has been released, incorporating new features and bug fixes from the 1.27.x mainline branch - including memory usage and CPU usage optimizations in complex SSL configurations, automatic re‑resolution of hostnames in upstream groups, performance enhancements in QUIC, OCSP validation of client SSL certificates and OCSP stapling support in the stream module, variables support in the proxy_limit_rate, fastcgi_limit_rate, scgi_limit_rate, and uwsgi_limit_rate directives, the proxy_pass_trailers directive, and more. License-Update: copyright years refreshed and removed C-style comments Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* fcgi: upgrade 2.4.2 -> 2.4.6Peter Marko2025-08-141-4/+3
| | | | | | | | | | | | | Handles CVE-2025-23016 (in 2.4.5) Add tag to SRC_URI. Move version to recipe filename. License-Update: file was renamed without any text change Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.27.0 -> 5.27.1Wang Mingyu2025-08-041-2/+2
| | | | | | | | bugfix: use open-cli instead of require('open') for Node 20+ compatibility Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: upgrade 2.4.64 -> 2.4.65Wang Mingyu2025-07-301-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.18.2 -> 5.27.0Liu Yiding2025-07-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ============= - feat: add support for OpenAPI 3.0.4 (#10247) - feat: apply cumulative update to address various issues (#10324) - fix(docker): fix security issues CVE-2024-56171, CVE-2025-24928 (#10351) - fix: fix definition resolving being affected by the order of schemas (#10386) - fix(json-schema-2020-12): avoid accessing properties of null schemas (#10397) - fix(json-schema-2020-12-samples): fix examples for nullable primitive types defined as list of types (#10390) - fix(utils): fix error messages for range validation of number parameters (#10344) - fix(json-schema-2020-12): use consistent comparison operators for displaying min/max constraints (#10159) - fix(json-schema-2020-12-samples): use zero as default example value for int32 and int64 (#10230) - fix(style): prevent operationId from wrapping when space is available (#10259) - fix(docker): address multiple HIGH security vulnerabilities (#10410) - fix(json-schema-2020-12): infer type string when contentEncoding or contentMediaType is present (#10411) - fix: align OpenAPI 3.x.y file uploads with specification (#10409) - feat(oas31): display file upload input when contentMediaType or contentEncoding is present (#10412) - fix: avoid accessing properties of empty Example Objects (#10453) - fix(oauth2): avoid processing authorizationUrl when it is not a string (#10452) - fix: use spec compliant JSON Pointer implementation (#10455) - fix(spec): assure operation is an immutable map in operations selectors (#10454) - fix: assure parameter is an immutable map when grouping parameters (#10457) - fix(spec): avoid accessing $ref when path item is not an object (#10456) - fix(json-schema-2020-12-samples): generate proper samples for XML atttributes (#10459) - fix(security): update Axios to non-vulnerable 1.9.0 version (#10460) - fix(docker): address CVE-2025-32414/CVE-2025-32415 (#10461) - feat(observability): allow defining custom uncaught exception handler (#10462) - feat(json-schema-5-samples): add support for time format example generation (#10420) (#10421) - refactor: introduce function for getting Schema Object type (#10330) - fix: mitigate ReDoS when generating examples from pattern (#10477) - fix(release): fix failed v5.23.0 release - fix(packagist): exclude large obsolete directories from publishing to Packagist (#10329) - ft(oas3): show the schema tab in the Try it Out mode (#10488) - fix: align expanded content inside expand collapse button (#10497) - feat: release SwaggerUI via GitHub Actions - fix(CD): provide correct npm token - fix(dist): provide correct npm token for swagger-ui-dist release - fix: fix opened model schema resolving issue on spec change (#10509) - fix(docker): bump nginx image to version 1.29.0-alpine to fix CVE-2025-48174 (#10508) - feat: release Swagger UI to Packagist (#10513) - fix(oas3): reset request body values in try it out (#9717) - fix(style): restore paragraph spacing in parameter and response descriptions (#10514) - feat(json-schema): support x-additionalPropertiesName (#10006) - fix: permissions of files to allow running as non-root (#10515) - fix: sanitization of relative OpenAPI JSON paths (#10528) Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-03-21 18:25:05 +0000