linux/poky.git, branch yocto-4.0.28

build-appliance-image: Update to kirkstone head revision

2025-06-27T15:12:06+00:00

(From OE-Core rev: 75e54301c5076eb0454aee33c870adf078f563fd) Signed-off-by: Steve Sakoman

poky.conf: bump version for 4.0.28

2025-06-27T15:09:27+00:00

(From meta-yocto rev: 0bf3dcef1caa80fb047bf9c3514314ab658e30ea) Signed-off-by: Steve Sakoman

ffmpeg: fix CVE-2022-48434

2025-06-27T15:09:27+00:00

The patch for CVE-2022-48434 was removed when ffmpeg was updated to 5.0.3. The CVE was fixed in 5.0.2, but NVD has not updated the affected versions yet. Added an ignore for this CVE to mark as fixed. (From OE-Core rev: a8c6e2da68c9fc6c692b41c7370ec937680f788c) Signed-off-by: Colin Pinnell McAllister Signed-off-by: Steve Sakoman

go: fix CVE-2025-4673

2025-06-27T15:09:27+00:00

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-4673 Upstream-patch: https://github.com/golang/go/commit/b897e97c36cb62629a458bc681723ca733404e32 (From OE-Core rev: c07547c19e5372ed5eaac8530b2dd651302542a8) Signed-off-by: Praveen Kumar Signed-off-by: Steve Sakoman

cmake: Correctly handle cost data of tests with arbitrary chars in name

2025-06-25T15:11:58+00:00

ctest automatically optimizes the order of (parallel) test execution based on historic test case runtime via the COST property (see [0]), which can have a significant impact on overall test run times. Sadly this feature is broken in CMake < 4.0.0 for test cases that have spaces in their name (see [1]). This commit is a backport of f24178f3 (which itself backports the upstream fix). the patch was adapted slightly to apply cleanly to the older CMake version in kirkstone. As repeated test runs are expected to mainly take place inside the SDK, the patch is only applied to 'nativesdk' builds. [0]: https://cmake.org/cmake/help/latest/prop_test/COST.html [1]: https://gitlab.kitware.com/cmake/cmake/-/issues/26594 Reported-By: John Drouhard (From OE-Core rev: f6a160f7ea57af6dfeca003e6c05aa42419fb755) Signed-off-by: Moritz Haase Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

systemtap: add sysroot Python paths to configure flags

2025-06-25T15:11:58+00:00

Explicitly set Python-related flags to use sysroot-staged headers and tools. (From OE-Core rev: 85a5d7b1d2c8600f30e38e034f828e5897d9a093) Signed-off-by: Soumya Sambu Signed-off-by: Steve Sakoman

go: ignore CVE-2024-3566

2025-06-25T15:11:58+00:00

NVD ([1]) tracks this as: cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Running on/with cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Yocto cve-check ignores the "Running on/with", so it needs to be ignored explicitly. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-3566 (From OE-Core rev: 571fd82e29fe809c63a5743e534ed7816d787963) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libsoup-2.4: fix CVE-2025-4476

2025-06-25T15:11:58+00:00

Refer: https://gitlab.gnome.org/GNOME/libsoup/-/issues/440 (From OE-Core rev: 2be01469687f30f33b768164f66916b081cc8c62) Signed-off-by: Changqing Li Signed-off-by: Steve Sakoman

libsoup-2.4: fix CVE-2025-4948

2025-06-25T15:11:58+00:00

Refer: http://gitlab.gnome.org/GNOME/libsoup/-/issues/449 (From OE-Core rev: d5af0295d26f8967dfe49a53ffa6f275e249d087) Signed-off-by: Changqing Li Signed-off-by: Steve Sakoman

libsoup-2.4: fix CVE-2025-46421

2025-06-25T15:11:58+00:00

Refer: https://gitlab.gnome.org/GNOME/libsoup/-/issues/439 (From OE-Core rev: 33bf900bcb563c5769b75e69059751f969a8771f) Signed-off-by: Changqing Li Signed-off-by: Steve Sakoman