linux/poky.git/meta/recipes-support/nghttp2, branch scarthgap

nghttp2: Fix CVE-2026-27135

2026-05-04T12:57:31+00:00

Pick patch from [1] also mentioned in [2] [1] https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-27135 (From OE-Core rev: 892fdc819660ab67d9930e0ccb71e4138fcf1750) Signed-off-by: Anil Dongare Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

nghttp2: Upgrade 1.60.1 -> 1.61.0

2024-04-08T22:33:32+00:00

Includes a fix for CVE-2024-28182. (From OE-Core rev: 37d4b0c6c5b836f9f2bc52a142b093ef61ca48b2) Signed-off-by: Richard Purdie

nghttp2: upgrade 1.59.0 -> 1.60.0

2024-03-07T17:25:02+00:00

Drop patch as issue addressed upstream. (From OE-Core rev: b6b337c68fa27a359db6efbedf492ca0cb9d9234) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

nghttp2: upgrade 1.58.0 -> 1.59.0

2024-02-03T22:08:26+00:00

(From OE-Core rev: 4414f0297c7d1b84ec4c1363fe8a91b6e5bd9695) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

nghttp2: upgrade 1.57.0 -> 1.58.0

2024-01-19T12:21:23+00:00

Changelog: ============ -Fix build error when both clock_gettime and GetTickCount64 are available -nghttpx: Shutdown h3 stream write if reset by a remote endpoint -Bump golang.org/x/net from 0.15.0 to 0.17.0 -cmake: speed up warning option detection -Update doc -ngtcp2 has merged BBR and BBRv2 under BBR (fixes issue #1955) -Bump ngtcp2 -Integration servertester h3 -Refactor character comparison -nghttpx: Stricter transfer-encoding checks -Configure cygwin -windows: Fix warnings -Prefer clock_gettime if CYGWIN defined -Bump neverbleed -Bump ngtcp2 -Bump neverbleed (From OE-Core rev: 9b40ffc9766673111214c6a0551c3291032cfd8e) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

nghttp2: update 1.56.0 -> 1.57.0

2023-10-12T06:53:40+00:00

This release has a fix to mitigate CVE-2023-44487: HTTP/2 Rapid Reset: https://nghttp2.org/blog/2023/10/10/nghttp2-v1-57-0/ (From OE-Core rev: c24b75f027f2609dac935e8981f2eb58394b1cc6) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

nghttp2: upgrade 1.55.1 -> 1.56.0

2023-09-14T08:19:37+00:00

(From OE-Core rev: a044b921c7a1f576e0ac787ab9945e153a196c44) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie

nghttp2: upgrade 1.54.0 -> 1.55.1

2023-07-21T10:52:25+00:00

Changelog: ============ doc: Bump boringssl Fix memory leak Fix build error without libev Bump go to 1.20 Bump go package dependencies mruby: Support cross build for autotools h2load, nghttpx: Add UDP_GRO support Bump ngtcp2 nghttpx: Randomize initial QUIC packet number Bump llhttp to a0e744f850d8101a51284868ffdf745bcfe4fbcc Bump macos to 12 (From OE-Core rev: 5049566d6edaa1c3df8db5a0df1ea8d015e64d17) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

nghttp2: upgrade 1.53.0 -> 1.54.0

2023-06-28T06:56:33+00:00

Changelog: ========== nghttpx: Consistent error handling and use of high-level API h2load: Fix http3 upload stall h2load: Use std::chrono::steady_clock for quic timestamp Avoid ev_now by @tatsuhiro-t in #1907 Remove unused macro bswap64 Bump ngtcp2 and nghttp3 Bump libbpf to v1.2.0 Avoid copies (From OE-Core rev: f3b440805cafa525bed0e8512f5fcaa9e1359bfb) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie

nghttp2: upgrade 1.52.0 -> 1.53.0

2023-06-16T14:40:11+00:00

(From OE-Core rev: cc7fb8330059fb632bf55a28875e38c3190470c9) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie