linux/poky.git/meta/recipes-support, branch scarthgap

gnupg: upgrade 2.4.8 -> 2.4.9

2026-06-10T13:35:20+00:00

Drop one patch since change is included in the release. Upgrade was performed using devtool Full changelog: https://github.com/gpg/gnupg/compare/gnupg-2.4.8...gnupg-2.4.9 Noteworthy changes in version 2.4.9 (2025-12-30) ------------------------------------------------ * gpg: Fix possible memory corruption in the armor parser. [T7906] * gpg: Avoid potential downgrade to SHA1 in 3rd party key signatures. [rGddb012be7f] * gpg: Error out on unverified output for non-detached signatures. [rG9d302f978b] * gpg: Do not allow compressed key packets on import. [T7014] * scd: Fix a harmless read buffer over-read in a function used by PKCS#15 cards. [T7662] * dirmngr: Do not require a keyserver for "gpg --fetch-key". [T7693] * agent: Fix ssh-agent's request_identities for skipped Brainpool keys. [rG6bf5696c85] Release-info: https://dev.gnupg.org/T8001 (From OE-Core rev: 5eb2cd21ac86805f5f90ea149da7de6e41342299) Signed-off-by: Guðni Már Gilbert Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

libexif: fix for CVE-2026-40385, CVE-2026-40386

2026-06-10T13:35:20+00:00

Pick patch from [1] & [2] also mentioned at Debian report in [3] & [4] [1] https://github.com/libexif/libexif/commit/93003b93e50b3d259bd2227d8775b73a53c35d58 [2] https://github.com/libexif/libexif/commit/dc6eac6e9655d14d0779d99e82d0f5f442d2f34b [3] https://nvd.nist.gov/vuln/detail/CVE-2026-40385 [4] https://nvd.nist.gov/vuln/detail/CVE-2026-40386 (From OE-Core rev: 9175f776404a1f4536e0320495c446e80a281172) Signed-off-by: Hitendra Prajapati Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

libexif: fix for CVE-2026-32775

2026-06-10T13:35:20+00:00

Pick patch from [1] also mentioned at NVD report in [2] [1] https://github.com/libexif/libexif/commit/7df372e9d31d7c993a22b913c813a5f7ec4f3692 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-32775 [3] https://security-tracker.debian.org/tracker/CVE-2026-32775 (From OE-Core rev: b825582edd8b05be2d3c5ca48d6d7c620628d69b) Signed-off-by: Hitendra Prajapati Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

lz4: Remove a reference to the rejected CVE-2025-62813

2026-06-10T13:35:20+00:00

The CVE-2025-62813 is rejected so do not reference it anymore. So keep the patch but without referencing the CVE identifier. The CVE database indicates the following reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. (From OE-Core rev: 99706716626324605c049a9130f705f2090a9f91) Signed-off-by: Benjamin Robin (Schneider Electric) Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 9c840a69b62a5fdffb3679a44d68dd5630b2916c) Signed-off-by: Deepak Rathore Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

libssh2: fix for CVE-2026-7598

2026-06-10T13:35:20+00:00

Pick patch from [1] also mentioned at NVD report in [2] [1] https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-7598 [3] https://security-tracker.debian.org/tracker/CVE-2026-7598 (From OE-Core rev: 84d6cca01c9d36ec112e5eb4104437f63ad2aee5) Signed-off-by: Hitendra Prajapati Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

vim: fix for CVE-2026-39881

2026-05-12T20:31:34+00:00

Pick patch from [1] also mentioned at Debian report in [2] [1] https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19c6cb52f89a365b4 [2] https://security-tracker.debian.org/tracker/CVE-2026-39881 More details: https://nvd.nist.gov/vuln/detail/CVE-2026-39881 (From OE-Core rev: e92dd3b16cd75d9c765f0ff4bc84fbdda8c3dca6) Signed-off-by: Hitendra Prajapati Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

libsoup: fix CVE-2025-32049

2026-05-12T20:31:34+00:00

Refer: https://gitlab.gnome.org/GNOME/libsoup/-/issues/390 (From OE-Core rev: 3c2f2b6f7af2bb743655859b64faae4786080cb9) Signed-off-by: Changqing Li Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker

libsoup: fix CVE-2025-14523

2026-05-12T20:31:34+00:00

Refer: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/472 (From OE-Core rev: 277297409dbf0bdb17653419e2d5e4a5ee8f33d5) Signed-off-by: Changqing Li Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker

liburcu: upgrade 0.14.0 -> 0.14.2

2026-05-04T12:57:33+00:00

Changelog for liburcu: 0.14.0 -> 0.14.2 ============================================================ 2026-01-26 Userspace RCU 0.14.2 * Fix: Only include linux/time_types.h when __NR_futex_time64 is defined * Use __NR_futex_time64 in futex syscall wrapper * Cleanup: Remove useless declarations from urcu-qsbr * src/urcu-bp.c: assert => urcu_posix_assert 2024-08-28 Userspace RCU 0.14.1 * Fix: missing typename in URCU_FORCE_CAST * Allow building with GCC >= 13.3 on RISC-V * pointer.h: Fix the rcu_cmpxchg_pointer documentation * Adjust shell script to allow Bash in other locations * fix: handle EINTR correctly in get_cpu_mask_from_sysfs * Relicense src/compat-smp.h to MIT * ppc.h: use mftb on ppc * Fix: allow clang to build liburcu on RISC-V * Fix -Walloc-size * urcu/uatomic/riscv: Mark RISC-V as broken * Fix: urcu-bp: misaligned reader accesses * LoongArch: Document that byte and short atomics are implemented with LL/SC * Add LoongArch support * tests/regression/rcutorture: Add wait state * urcu-wait: Initialize node in URCU_WAIT_NODE_INIT * Fix: urcu-wait: add missing futex.h include * Adjust shell scripts to allow Bash in other locations * Add support for OpenBSD * Revert compiler.h: Introduce caa_unqual_scalar_typeof * rculfhash: Use caa_container_of_check_null in cds_lfht_entry * compiler.h: Introduce caa_container_of_check_null * compiler.h: Introduce caa_unqual_scalar_typeof * Avoid calling caa_container_of on NULL pointer in cds_lfht macros * Fix: revise urcu_read_lock_update() comment * Fix: uatomic powerpc comment about lwsync * fix: aarch64: allow RHEL7 gcc 4.8.5-11 * fix: warning 'noreturn' function does return on ppc * Fix: use __noreturn__ for C11-compatibility (From OE-Core rev: dc2df90b1d4f71023169d492f3819326e0e6c055) Signed-off-by: Daniel Turull Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

libatomic-ops: upgrade 7.8.2 -> 7.8.4

2026-05-04T12:57:33+00:00

Changelog for libatomic-ops: 7.8.2 -> 7.8.4 ============================================================ == [7.8.4] 2025-09-05 == * Document Win32-specific AO_NO_ASM_XADD macro in README * Eliminate 'atomic_thread_fence is unsupported with tsan' gcc-11 warning * Eliminate 'munmap argument 1 from incompatible pointer type' gcc warning * Eliminate 'uninitialized memory use' gcc-13 warning in test_atomic * Fix all broken URLs in comments * Fix atomic_ops_sysdeps.S compilation for SunPro compiler in CMake script * Update URLs after repository transfer to bdwgc organization * Update CMake minimum required version to 3.10 (From OE-Core rev: 189ecdff01a9c2c47b809d153b04ea6080f74e4f) Signed-off-by: Daniel Turull (cherry picked from commit 02d66279071cbd043474dc44f44d348ec3228583) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker