linux/poky.git/meta/recipes-devtools/ruby, branch yocto-3.1.15

ruby: 2.7.4 -> 2.7.5

2022-03-02T00:21:36+00:00

This release includes security fixes. CVE-2021-41817: Regular Expression Denial of Service Vulnerability of Date Parsing Methods CVE-2021-41816: Buffer Overrun in CGI.escape_html CVE-2021-41819: Cookie Prefix Spoofing in CGI::Cookie.parse (From OE-Core rev: a7935c9c4a47098f0c1b2eefdf7773bd85891945) Signed-off-by: Chee Yang Lee Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

ruby: fix DEPENDS append

2022-02-23T23:43:43+00:00

recent change create a blank scope of DEPENDS for class-target, basically leaving out all general dependencies, leading to the effect that ruby will be shipped without the runtime dependencies of zlib, openssl and libffi, making the corresponding gems unusable at runtime. As the class-target scope should be appended only the correct override is append:class-target (From OE-Core rev: 81fab225daf798792c139f669f5bfd96d9fd25a8) Signed-off-by: Konrad Weihmann Signed-off-by: Richard Purdie (cherry picked from commit 8f92444d388d2406be7d317578908975784d3f22) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

ruby: correctly set native/target dependencies

2022-02-23T23:43:42+00:00

In particular libffi was missing from native, which led to linking with host libffi instead. (From OE-Core rev: 61e38b71566183e329d980e26fe8ffe8d331c3a1) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie (cherry picked from commit 293c9f879252a814107579542e8fca9af9dde599) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

ruby: 2.7.3 -> 2.7.4

2021-08-18T17:00:19+00:00

This release includes security fixes. CVE-2021-31810: Trusting FTP PASV responses vulnerability in Net::FTP CVE-2021-32066: A StartTLS stripping vulnerability in Net::IMAP CVE-2021-31799: A command injection vulnerability in RDoc https://www.ruby-lang.org/en/news/2021/07/07/ruby-2-7-4-released/ (From OE-Core rev: 9b1a0d63186a64d78de379494fe256087f62770a) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

ruby: 2.7.1 -> 2.7.3

2021-06-19T15:59:29+00:00

This release includes security fixes. CVE-2021-28965: XML round-trip vulnerability in REXML CVE-2021-28966: Path traversal in Tempfile on Windows CVE-2020-25613 fixed in 2.7.2, do drop the patch release notes for 2.7.2 and 2.7.3 https://www.ruby-lang.org/en/news/2020/10/02/ruby-2-7-2-released/ https://www.ruby-lang.org/en/news/2021/04/05/ruby-2-7-3-released/ (From OE-Core rev: 4de0d54827bc4645b69e5a0043b6f285b0193402) Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

ruby: remove tcl DEPENDS

2021-01-13T08:57:57+00:00

The integrated Tcl/Tk module was removed in Ruby 2.4[1] back in 2016, so this build dependency can be removed. [1] https://github.com/ruby/ruby/commit/303dc3c591e324b6bbc691326d8bea76fe3b8fda (From OE-Core rev: 832e9e6bac91755f6a6a8ab9af0e48c189d3e493) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 9f4e181924a83d7b26b11de765c202a9bd036f64) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

ruby: fix reproducibility

2020-12-18T14:20:19+00:00

(From OE-Core rev: d2619ca71a777ae4fd0ecb4340848ef98282a9ad) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie (cherry picked from commit 07c26e3292dbaf71873f71bec2a631f880b2e76d) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

ruby: fix CVE-2020-25613

2020-11-12T13:07:52+00:00

(From OE-Core rev: 80077479fd687a887cd321fe2e65dfd58edb5832) Signed-off-by: Chee Yang Lee Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

ruby: upgrade 2.7.0 -> 2.7.1

2020-08-12T09:53:46+00:00

This release includes security fixes: CVE-2020-10663: Unsafe Object Creation Vulnerability in JSON (Additional fix) CVE-2020-10933: Heap exposure vulnerability in the socket library (From OE-Core rev: 51b45ec3fcdc3c338f8a141110abf8aa5d374e5e) Signed-off-by: Zheng Ruoqin Signed-off-by: Richard Purdie (cherry picked from commit 8d9b48bdf25363fb115a6311b031a7e5da8e0d4d) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

ruby: Link with libucontext on musl

2020-05-05T07:45:30+00:00

coroutines in ruby 2.7+ needs ucontext APIs which are not available in musl but an external library is available to provide them so use it Use cached values for ac_cv_func_isnan and ac_cv_func_isinf this is not detected correctly by configure on musl on ARM drop using old arm32 implementation of coroutine which is slow and inefficient (From OE-Core rev: a2b1af47316a9f5c522db0c9feff1fbe0d39e022) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie