linux/poky.git/meta/recipes-devtools, branch yocto-5.0.5

e2fsprogs: removed 'sed -u' option

2024-11-09T13:53:57+00:00

In embedded box, sed might be provided another providers like Busybox, hence use generic options whenever possible. /bin/sed -> /etc/alternatives/sed /etc/alternatives/sed -> /bin/busybox.nosuid Here used 'sed -u' option is not necessary, hence removed it. Fixes below error: sed: invalid option -- 'u' Also added 'set -eux' option which halts execution of the script on any failures. (From OE-Core rev: 5b3b290baa0a83f493b7ca25d5ffa5ff279bcc69) Signed-off-by: Aditya Tayade Signed-off-by: Pawan Badganchi Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 07caee1829d2a61bc018fe0e37ecd482922179ee) Signed-off-by: Steve Sakoman

python3-lxml=v5.0.2

2024-11-09T13:53:57+00:00

* minor upgrade to fix building with gcc-14 on host * contains 31 commits: https://github.com/lxml/lxml/compare/lxml-5.0.0...lxml-5.0.2 the important one for gcc-14 is: https://github.com/lxml/lxml/commit/663041a56a075a8fa1e6ca13ba4c6d1de7043ac2 * https://bugs.launchpad.net/lxml/+bug/2045435 * https://bugs.gentoo.org/917562 (From OE-Core rev: baa0ba7084533907c0735dcb58b4432e0b3072df) Signed-off-by: Martin Jansa Signed-off-by: Steve Sakoman

go: upgrade 1.22.7 -> 1.22.8

2024-11-09T13:53:57+00:00

Upgrade to latest 1.22.x release [1]: $ git --no-pager log --oneline go1.22.7..go1.22.8 aeccd613c8 (tag: go1.22.8) [release-branch.go1.22] go1.22.8 b4086b7c16 [release-branch.go1.22] syscall: skip TestAmbientCapsUserns when restricted, document 6fab4b9a9e [release-branch.go1.22] runtime: size maps.Clone destination bucket array safely 71655f14ce [release-branch.go1.22] cmd/cgo: correct padding required by alignment [1] https://github.com/golang/go/compare/go1.22.7...go1.22.8 (From OE-Core rev: 552b9913b25107d7a34611b499b7811896b5f098) (From OE-Core rev: f3bc0483519fcf08f5e3ccbbbb29de0ec4fc927e) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

go: upgrade 1.22.6 -> 1.22.7

2024-11-09T13:53:57+00:00

Upgrade to latest 1.22.x release [1]: $ git --no-pager log --oneline go1.22.6..go1.22.7 7529d09a11 (tag: go1.22.7) [release-branch.go1.22] go1.22.7 d4c53812e6 [release-branch.go1.22] go/build/constraint: add parsing limits 2092294f2b [release-branch.go1.22] encoding/gob: cover missed cases when checking ignore depth b232596139 [release-branch.go1.22] go/parser: track depth in nested element lists e87be9833e [release-branch.go1.22] runtime: on AIX, fix call to _cgo_sys_thread_create in _rt0_ppc64_aix_lib 676d6100d8 [release-branch.go1.22] cmd/fix: support go versions with patch release 0a525a3ed0 [release-branch.go1.22] os: fix Chtimes test flakes Fixes CVE-2024-34155, CVE-2024-34156 and CVE-2024-34158 [1] https://github.com/golang/go/compare/go1.22.6...go1.22.7 (From OE-Core rev: 92d609c49c0870ca10fcc39d52a801109d65a98b) (From OE-Core rev: 4a0ccebab099b3654097ca6ba591eefce58a410e) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

orc: upgrade 0.4.39 -> 0.4.40

2024-11-09T13:53:57+00:00

Changelog: =========== - Security: Minor follow-up fixes for CVE-2024-40897 - powerpc: fix div255w which still used the inexact substitution - x86: work around old GCC versions (pre 9.0) having broken xgetbv implementations - x86: consider MSYS2/Cygwin as Windows for ABI purposes only - x86: handle unnatural and misaligned array pointers - orccodemem: Assorted memory mapping fixes - Fix include header use from C++ - Some compatibility fixes for Musl - ppc: Disable VSX and ISA 2.07 for Apple targets - ppc: Allow detection of ppc64 in Mac OS - x86: Fix non-C11 typedefs - meson: Fix detecting XSAVE on older AppleClang - x86: try fixing AVX detection again by adding check for XSAVE - Check return values of malloc() and realloc() (From OE-Core rev: a11152a65f27521ec9a546b4dd3c16d04bbd9db4) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie (cherry picked from commit ed7e4eb12491968c5f962b7e89d557c2c6d86a33) Signed-off-by: Steve Sakoman

rust-llvm: Fix CVE-2024-0151

2024-11-09T13:53:57+00:00

(From OE-Core rev: 175e22f2df542b0e1eb638c43c11eeefe794b0b7) Signed-off-by: Deepthi Hemraj Signed-off-by: Steve Sakoman

python3-setuptools: Add "python:setuptools" to CVE_PRODUCT

2024-10-30T15:30:00+00:00

Since there are vulnerabilities that cannot be detected by the existing CVE_PRODUCT, add "python:setuptools" to CVE_PRODUCT. https://nvd.nist.gov/vuln/detail/CVE-2013-1633 https://nvd.nist.gov/vuln/detail/CVE-2022-40897 (From OE-Core rev: 85b61bf9cefc024faefa083c37ce88ba9c7355e1) Signed-off-by: Shunsuke Tokumoto Signed-off-by: Richard Purdie (cherry picked from commit aa1c8d97efc6640a1cffa2459d9b20ad1f7309b0) Signed-off-by: Steve Sakoman

makedevs: Fix matching uid/gid

2024-10-18T13:04:41+00:00

Correct the length to compare in convert2guid() to fix an issue where it ends up with returning a wrong id that matches partially. Also fix the length of usr_buf and grp_buf in interpret_table_entry() which are used as arguments of convert2guid(). (From OE-Core rev: 865b7149da5dd6301c1d9805a1e7bac8dcac82a9) Signed-off-by: Jaeyoon Jung Signed-off-by: Richard Purdie (cherry picked from commit ca9d193a21e6b8669c4da1a68cd5e0791bb80a4b) Signed-off-by: Steve Sakoman

ruby: upgrade 3.2.2 -> 3.3.5

2024-10-18T13:04:40+00:00

Includes fix for CVE-2024-41123 & CVE-2024-41946 Release notes: https://github.com/ruby/ruby/releases/tag/v3_3_5 Rebase: 0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch 0006-Make-gemspecs-reproducible.patch Drop: 0001-fiddle-Use-C11-_Alignof-to-define-ALIGN_OF-when-poss.patch 0002-Obey-LDFLAGS-for-the-link-of-libruby.patch CVE-2023-36617_1.patch CVE-2023-36617_2.patch CVE-2024-27281.patch CVE-2024-27282.patch (merged upstream) 0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch 0002-template-Makefile.in-filter-out-f-prefix-map.patch remove_has_include_macros.patch (code rewritten upstream) License-Update: Updated LEGAL section (From OE-Core rev: 69ffe5bc09260918fb32bfcb29586dcaa1958a5c) Signed-off-by: Yogita Urade Signed-off-by: Steve Sakoman

rust: ignore CVE-2024-43402

2024-10-18T13:04:40+00:00

This CVE was created because fix for CVE-2024-24576 was incomplete. Ignore the new CVE in the same way as the old one. See https://nvd.nist.gov/vuln/detail/CVE-2024-43402 (From OE-Core rev: 6ed9968bf3e35aca316227ee23294c683f77055d) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman