14 files changed, 265 insertions, 18 deletions

diff --git a/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.8.1.bb b/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.8.1.bb
index b5be30cbb2..c297de053d 100644
--- a/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.8.1.bb
+++ b/meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.8.1.bb
@@ -6,7 +6,7 @@ and can hence offer more features than plain dm-crypt. On the other \
 hand, the header is visible and vulnerable to damage."
 HOMEPAGE = "https://gitlab.com/cryptsetup/cryptsetup"
 SECTION = "console"
-LICENSE = "GPL-2.0-with-OpenSSL-exception"
+LICENSE = "LGPL-2.1-or-later & GPL-2.0-or-later & GPL-2.0-with-OpenSSL-exception"
 LIC_FILES_CHKSUM = "file://COPYING;md5=32107dd283b1dfeb66c9b3e6be312326"
 
 DEPENDS = " \
diff --git a/meta-oe/recipes-devtools/luajit/luajit_git.bb b/meta-oe/recipes-devtools/luajit/luajit_git.bb
index f4a1345ab2..9df5fca0e6 100644
--- a/meta-oe/recipes-devtools/luajit/luajit_git.bb
+++ b/meta-oe/recipes-devtools/luajit/luajit_git.bb
@@ -95,3 +95,7 @@ COMPATIBLE_HOST:powerpc64 = "null"
 COMPATIBLE_HOST:powerpc64le = "null"
 COMPATIBLE_HOST:riscv64 = "null"
 COMPATIBLE_HOST:riscv32 = "null"
+
+CVE_STATUS[CVE-2024-25176] = "fixed-version: The used revision contains the fix already."
+CVE_STATUS[CVE-2024-25177] = "fixed-version: The used revision contains the fix already."
+CVE_STATUS[CVE-2024-25178] = "fixed-version: The used revision contains the fix already."
diff --git a/meta-oe/recipes-devtools/openocd/openocd/0001-tcl-board-ti_-_swd_native.cfg-Add-support-for-direct.patch b/meta-oe/recipes-devtools/openocd/openocd/0001-tcl-board-ti_-_swd_native.cfg-Add-support-for-direct.patch
new file mode 100644
index 0000000000..8a3b72321f
--- /dev/null
+++ b/meta-oe/recipes-devtools/openocd/openocd/0001-tcl-board-ti_-_swd_native.cfg-Add-support-for-direct.patch
@@ -0,0 +1,77 @@
+From 5c55d79ecfecc4a1b5a5ebcf649227ca1e1bf38e Mon Sep 17 00:00:00 2001
+From: Joao Lima <joao.lima@hbkworld.com>
+Date: Tue, 30 Sep 2025 12:13:04 +0000
+Subject: [PATCH 1/2] tcl/board/ti_*_swd_native.cfg: Add support for direct
+ memory access via SW
+
+Add support for SWD emulation as a transport method for
+direct memory operations of boards TI AM64x and TI J784s4
+
+Upstream-Status: Submitted [http://openocd.zylin.com/#/c/9020/]
+
+Change-Id: I17fe9b2bef5c58886625bfdb88d92645ba4d7da7
+Signed-off-by: Joao Lima <joao.lima@hbkworld.com>
+---
+ tcl/board/ti_am64xx_swd_native.cfg | 23 +++++++++++++++++++++++
+ tcl/board/ti_j784s4_swd_native.cfg | 22 ++++++++++++++++++++++
+ 2 files changed, 45 insertions(+)
+ create mode 100644 tcl/board/ti_am64xx_swd_native.cfg
+ create mode 100644 tcl/board/ti_j784s4_swd_native.cfg
+
+diff --git a/tcl/board/ti_am64xx_swd_native.cfg b/tcl/board/ti_am64xx_swd_native.cfg
+new file mode 100644
+index 000000000..d3727149e
+--- /dev/null
++++ b/tcl/board/ti_am64xx_swd_native.cfg
+@@ -0,0 +1,23 @@
++# SPDX-License-Identifier: GPL-2.0-or-later
++# Copyright (C) 2022-2023 Texas Instruments Incorporated - http://www.ti.com/
++#
++# Texas Instruments am642
++# Link: https://www.ti.com/product/AM642
++#
++# This configuration file is used as a self hosted debug configuration that
++# works on every AM642 platform based on firewall configuration permitted
++# in the system.
++#
++# In this system openOCD runs on one of the CPUs inside AM625 and provides
++# network ports that can then be used to debug the microcontrollers on the
++# SoC - either self hosted IDE OR remotely.
++
++# We are using dmem, which uses dapdirect_swd transport
++adapter driver dmem
++transport select swd
++
++if { ![info exists SOC] } {
++       set SOC am642
++}
++
++source [find target/ti_k3.cfg]
+diff --git a/tcl/board/ti_j784s4_swd_native.cfg b/tcl/board/ti_j784s4_swd_native.cfg
+new file mode 100644
+index 000000000..13b2ac3b8
+--- /dev/null
++++ b/tcl/board/ti_j784s4_swd_native.cfg
+@@ -0,0 +1,22 @@
++# SPDX-License-Identifier: GPL-2.0-or-later
++# Copyright (C) 2022-2023 Texas Instruments Incorporated - http://www.ti.com/
++#
++# Texas Instruments TDA4VM/J721E
++# Link: https://www.ti.com/product/TDA4VM
++#
++# This configuration file is used as a self hosted debug configuration that
++# works on every TDA4VM platform based on firewall configuration permitted
++# in the system.
++#
++# In this system openOCD runs on one of the CPUs inside TDA4VM and provides
++# network ports that can then be used to debug the microcontrollers on the
++# SoC - either self hosted IDE OR remotely.
++
++# We are using dmem, which uses dapdirect_swd transport
++adapter driver dmem
++transport select swd
++
++if { ![info exists SOC] } {
++        set SOC j784s4
++}
++source [find target/ti_k3.cfg]
diff --git a/meta-oe/recipes-devtools/openocd/openocd/0002-tcl-target-ti_k3.cfg-Add-support-for-direct-memory-a.patch b/meta-oe/recipes-devtools/openocd/openocd/0002-tcl-target-ti_k3.cfg-Add-support-for-direct-memory-a.patch
new file mode 100644
index 0000000000..c879696ef5
--- /dev/null
+++ b/meta-oe/recipes-devtools/openocd/openocd/0002-tcl-target-ti_k3.cfg-Add-support-for-direct-memory-a.patch
@@ -0,0 +1,65 @@
+From 39bc4461642eaaf993d0a6cf772d51cdde8c0ae8 Mon Sep 17 00:00:00 2001
+From: Joao Lima <joao.lima@hbkworld.com>
+Date: Tue, 30 Sep 2025 12:13:30 +0000
+Subject: [PATCH 2/2] tcl/target/ti_k3.cfg: Add support for direct memory
+ access via SWD
+
+Adds support for direct memory access via SWD emulation for AM64x and
+J784s4 boards, configuring addresses and parameters required for
+direct memory operations.
+
+Upstream-Status: Submitted [http://openocd.zylin.com/#/c/9021/]
+
+Change-Id: Iebc16612b3990b2ef19ddc4143b66ab1bcbfe0f3
+Signed-off-by: Joao Lima <joao.lima@hbkworld.com>
+---
+ tcl/target/ti_k3.cfg | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/tcl/target/ti_k3.cfg b/tcl/target/ti_k3.cfg
+index 0dee74e5e..6b0ac2e52 100644
+--- a/tcl/target/ti_k3.cfg
++++ b/tcl/target/ti_k3.cfg
+@@ -176,6 +176,16 @@ switch $_soc {
+                        # Uses the same JTAG ID
+                        set _armv8_cores 0
+                }
++
++               # Setup DMEM access descriptions
++               # DAPBUS (Debugger) description
++               set _dmem_base_address 0x740002000
++               set _dmem_ap_address_offset 0x100
++               set _dmem_max_aps 10
++               # Emulated AP description
++               set _dmem_emu_base_address 0x760000000
++               set _dmem_emu_base_address_map_to 0x1d500000
++               set _dmem_emu_ap_list 1
+        }
+        am625 {
+                set _K3_DAP_TAPID 0x0bb7e02f
+@@ -333,7 +343,7 @@ switch $_soc {
+                set ARMV8_CTIBASE {0x90420000 0x90520000 0x90620000 0x90720000
+                            0x90820000 0x90920000 0x90a20000 0x90b20000}
+ 
+-               # J721s2 has 4 clusters of 2 R5 cores each.
++               # J784s4 has 4 clusters of 2 R5 cores each.
+                set _r5_cores 8
+                set R5_DBGBASE {0x9d010000 0x9d012000
+                         0x9d410000 0x9d412000
+@@ -348,6 +358,16 @@ switch $_soc {
+                       main1_r5.0 main1_r5.1
+                       main2_r5.0 main2_r5.1}
+ 
++               # Setup DMEM access descriptions
++               # DAPBUS (Debugger) description
++               set _dmem_base_address 0x4c40002000
++               set _dmem_ap_address_offset 0x100
++               set _dmem_max_aps 8
++               # Emulated AP description
++               set _dmem_emu_base_address 0x4c60000000
++               set _dmem_emu_base_address_map_to 0x1d600000
++               set _dmem_emu_ap_list 1
++
+                # sysctrl CTI base
+                set CM3_CTIBASE {0x20001000}
+                # Sysctrl power-ap unlock offsets
diff --git a/meta-oe/recipes-devtools/openocd/openocd_git.bb b/meta-oe/recipes-devtools/openocd/openocd_git.bb
index 3bbe33ca1d..30629583cc 100644
--- a/meta-oe/recipes-devtools/openocd/openocd_git.bb
+++ b/meta-oe/recipes-devtools/openocd/openocd_git.bb
@@ -4,19 +4,25 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=599d2d1ee7fc84c0467b3d19801db870"
 DEPENDS = "libusb-compat libftdi"
 RDEPENDS:${PN} = "libusb1"
 
+MIRRORS += " \
+    git://repo.or.cz/openocd.git git://github.com/openocd-org/openocd.git \
+"
+
 SRC_URI = " \
     git://repo.or.cz/openocd.git;protocol=http;name=openocd;branch=master \
     git://repo.or.cz/r/git2cl.git;protocol=http;destsuffix=tools/git2cl;name=git2cl;branch=master \
     git://github.com/msteveb/jimtcl.git;protocol=https;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/jimtcl;name=jimtcl;branch=master \
     git://repo.or.cz/r/libjaylink.git;protocol=http;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/src/jtag/drivers/libjaylink;name=libjaylink;branch=master \
     file://0001-Makefile.am-Use-SOURCE_DATE_EPOCH-environment-variab.patch \
+    file://0001-tcl-board-ti_-_swd_native.cfg-Add-support-for-direct.patch \
+    file://0002-tcl-target-ti_k3.cfg-Add-support-for-direct-memory-a.patch \
 "
 
 SRCREV_FORMAT = "openocd"
-SRCREV_openocd = "91bd4313444c5a949ce49d88ab487608df7d6c37"
+SRCREV_openocd = "66ea461846a3a4a96687c9287c3f61ae8ce0b775"
 SRCREV_git2cl = "8373c9f74993e218a08819cbcdbab3f3564bbeba"
-SRCREV_jimtcl = "fcbb4499a6b46ef69e7a95da53e30796e20817f0"
-SRCREV_libjaylink = "9aa7a5957c07bb6e862fc1a6d3153d109c7407e4"
+SRCREV_jimtcl = "f160866171457474f7c4d6ccda70f9b77524407e"
+SRCREV_libjaylink = "0d23921a05d5d427332a142d154c213d0c306eb1"
 
 PV = "0.12+git"
 
diff --git a/meta-oe/recipes-extended/redis/redis_6.2.20.bb b/meta-oe/recipes-extended/redis/redis_6.2.20.bb
index f2e6175462..cc98781fed 100644
--- a/meta-oe/recipes-extended/redis/redis_6.2.20.bb
+++ b/meta-oe/recipes-extended/redis/redis_6.2.20.bb
@@ -20,6 +20,10 @@ SRC_URI = "http://download.redis.io/releases/${BP}.tar.gz \
 
 SRC_URI[sha256sum] = "7f8b8a7aed53c445a877adf9e3743cdd323518524170135a58c0702f2dba6ef4"
 
+CVE_STATUS[CVE-2025-21605] = "cpe-incorrect: the used version already contains the fix"
+CVE_STATUS[CVE-2022-0543] = "not-applicable-config: the vulnerability is not present in upstream, only in Debian-packaged version"
+CVE_STATUS[CVE-2022-3734] = "not-applicable-config: only affects Windows"
+
 inherit update-rc.d systemd useradd
 
 FINAL_LIBS:x86:toolchain-clang = "-latomic"
diff --git a/meta-oe/recipes-extended/redis/redis_7.2.11.bb b/meta-oe/recipes-extended/redis/redis_7.2.11.bb
index 5aea249133..83cb4531d2 100644
--- a/meta-oe/recipes-extended/redis/redis_7.2.11.bb
+++ b/meta-oe/recipes-extended/redis/redis_7.2.11.bb
@@ -21,6 +21,9 @@ SRC_URI[sha256sum] = "2f9886eca68d30114ad6a01da65631f8007d802fd3e6c9fac711251e63
 
 RPROVIDES:${PN} = "virtual-redis"
 
+CVE_STATUS[CVE-2025-21605] = "cpe-incorrect: the used version already contains the fix"
+CVE_STATUS[CVE-2025-27151] = "cpe-incorrect: the used version already contains the fix"
+
 inherit pkgconfig update-rc.d systemd useradd
 
 FINAL_LIBS:x86:toolchain-clang = "-latomic"
diff --git a/meta-oe/recipes-printing/cups/libppd_2.0.0.bb b/meta-oe/recipes-printing/cups/libppd_2.1.1.bb
index 99b1f6e730..1b7d2be844 100644
--- a/meta-oe/recipes-printing/cups/libppd_2.0.0.bb
+++ b/meta-oe/recipes-printing/cups/libppd_2.1.1.bb
@@ -6,7 +6,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=c1fca671047153ce6825c4ab06f2ab49"
 DEPENDS = "libcupsfilters"
 
 SRC_URI = "https://github.com/OpenPrinting/${BPN}/releases/download/${PV}/${BP}.tar.xz"
-SRC_URI[sha256sum] = "882d3c659a336e91559de8f3c76fc26197fe6e5539d9b484a596e29a5a4e0bc8"
+SRC_URI[sha256sum] = "3fa341cc03964046d2bf6b161d80c1b4b2e20609f38d860bcaa11cb70c1285e4"
 
 inherit autotools gettext pkgconfig github-releases
 
diff --git a/meta-oe/recipes-support/libraw/libraw_0.21.2.bb b/meta-oe/recipes-support/libraw/libraw_0.21.2.bb
deleted file mode 100644
index 01425c6db0..0000000000
--- a/meta-oe/recipes-support/libraw/libraw_0.21.2.bb
+++ /dev/null
@@ -1,13 +0,0 @@
-SUMMARY = "raw image decoder"
-LICENSE = "LGPL-2.1-only | CDDL-1.0"
-LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=1501ae0aa3c8544e63f08d6f7bf88a6f"
-
-SRC_URI = "git://github.com/LibRaw/LibRaw.git;branch=0.21-stable;protocol=https"
-SRCREV = "1ef70158d7fde1ced6aaddb0b9443c32a7121d3d"
-
-inherit autotools pkgconfig
-
-DEPENDS = "jpeg jasper lcms"
-
-CVE_STATUS[CVE-2020-22628] = "cpe-incorrect: The current version (0.21.2) is not affected by the CVE which affects versions earlier than 0.21.2"
-CVE_STATUS[CVE-2023-1729] = "cpe-incorrect: The current version (0.21.2) is not affected by the CVE which affects versions earlier than 0.21.2"
diff --git a/meta-oe/recipes-support/libraw/libraw_0.21.4.bb b/meta-oe/recipes-support/libraw/libraw_0.21.4.bb
new file mode 100644
index 0000000000..ef0a0255d9
--- /dev/null
+++ b/meta-oe/recipes-support/libraw/libraw_0.21.4.bb
@@ -0,0 +1,10 @@
+SUMMARY = "raw image decoder"
+LICENSE = "LGPL-2.1-only | CDDL-1.0"
+LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=1501ae0aa3c8544e63f08d6f7bf88a6f"
+
+SRC_URI = "git://github.com/LibRaw/LibRaw.git;branch=0.21-stable;protocol=https;tag=${PV}"
+SRCREV = "9646d776c7c61976080a8f2be67928df0750493e"
+
+inherit autotools pkgconfig
+
+DEPENDS = "jpeg jasper lcms"
diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.3.bb b/meta-oe/recipes-support/libssh/libssh_0.11.3.bb
index bfeeccdad4..5928581312 100644
--- a/meta-oe/recipes-support/libssh/libssh_0.11.3.bb
+++ b/meta-oe/recipes-support/libssh/libssh_0.11.3.bb
@@ -47,3 +47,6 @@ do_install_ptest () {
 }
 
 BBCLASSEXTEND = "native nativesdk"
+
+CVE_STATUS[CVE-2025-5987] = "fixed-version: The vulnerability was fixed in 0.11.2"
+CVE_STATUS[CVE-2025-5318] = "fixed-version: The vulnerability was fixed in 0.11.2"
diff --git a/meta-oe/recipes-support/touchpademulator/touchpademulator/0001-makefile-Use-CC-instead-of-hardcoding-gcc-calls.patch b/meta-oe/recipes-support/touchpademulator/touchpademulator/0001-makefile-Use-CC-instead-of-hardcoding-gcc-calls.patch
new file mode 100644
index 0000000000..062adc9665
--- /dev/null
+++ b/meta-oe/recipes-support/touchpademulator/touchpademulator/0001-makefile-Use-CC-instead-of-hardcoding-gcc-calls.patch
@@ -0,0 +1,29 @@
+From 37284f7208e43da34cac64b419219c5d4e20b36e Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Thu, 2 Oct 2025 15:25:50 -0700
+Subject: [PATCH] makefile: Use CC instead of hardcoding gcc calls
+
+This helps to cross-compile it using infrastructure like yocto
+
+Upstream-Status: Submitted [https://gitlab.com/CalcProgrammer1/TouchpadEmulator/-/merge_requests/4]
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ Makefile | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index adf39a6..4cebaa6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,9 @@
++CC ?= gcc
++
+ default:                       TouchpadEmulator
+ 
+ TouchpadEmulator:      TouchpadEmulator.c
+-                                       gcc -Wall $(shell pkg-config --cflags dbus-1 dbus-glib-1) TouchpadEmulator.c -ldbus-1 -ldbus-glib-1 -lpthread -o TouchpadEmulator
++                                       $(CC) -Wall $(shell pkg-config --cflags dbus-1 dbus-glib-1) TouchpadEmulator.c -ldbus-1 -ldbus-glib-1 -lpthread -o TouchpadEmulator
+ 
+ clean:
+                                        git clean -dfx
diff --git a/meta-oe/recipes-support/touchpademulator/touchpademulator/0002-LaunchTouchpadEmulator.sh-Demand-sh-instead-of-bash.patch b/meta-oe/recipes-support/touchpademulator/touchpademulator/0002-LaunchTouchpadEmulator.sh-Demand-sh-instead-of-bash.patch
new file mode 100644
index 0000000000..999c557d54
--- /dev/null
+++ b/meta-oe/recipes-support/touchpademulator/touchpademulator/0002-LaunchTouchpadEmulator.sh-Demand-sh-instead-of-bash.patch
@@ -0,0 +1,25 @@
+From 5b715a6741a7a2fcd0dc04e31c682a0183a49fa6 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Thu, 2 Oct 2025 15:27:09 -0700
+Subject: [PATCH] LaunchTouchpadEmulator.sh: Demand sh instead of bash
+
+This script does not really use any bash specific extentions
+so asking for simple /bin/sh should be good and makes it more
+portable
+
+Upstream-Status: Submitted [https://gitlab.com/CalcProgrammer1/TouchpadEmulator/-/merge_requests/4]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ LaunchTouchpadEmulator.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/LaunchTouchpadEmulator.sh b/LaunchTouchpadEmulator.sh
+index d12fc27..63134cd 100755
+--- a/LaunchTouchpadEmulator.sh
++++ b/LaunchTouchpadEmulator.sh
+@@ -1,4 +1,4 @@
+-#! /bin/bash
++#! /bin/sh
+ 
+ if [ "$1" = "--autostart" ] ; then
+     mkdir -p ~/.config/autostart
diff --git a/meta-oe/recipes-support/touchpademulator/touchpademulator_git.bb b/meta-oe/recipes-support/touchpademulator/touchpademulator_git.bb
new file mode 100644
index 0000000000..e7b0387f7e
--- /dev/null
+++ b/meta-oe/recipes-support/touchpademulator/touchpademulator_git.bb
@@ -0,0 +1,34 @@
+SUMMARY = "Emulate a touchpad mouse device using a touchscreen on Linux"
+LICENSE = "GPL-2.0-or-later"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=f744a106227710d355bcc787e464ba2d \
+                    file://debian/copyright;md5=7bed05b78c0e4abec501cf82c4b85d9c"
+
+SRC_URI = "git://gitlab.com/CalcProgrammer1/TouchpadEmulator;protocol=https;branch=master \
+           file://0001-makefile-Use-CC-instead-of-hardcoding-gcc-calls.patch \
+           file://0002-LaunchTouchpadEmulator.sh-Demand-sh-instead-of-bash.patch \
+           "
+
+PV = "0.3+git"
+SRCREV = "7800f4c3af4defaf1be1083c93983ed4ff0e3b32"
+
+inherit pkgconfig
+
+DEPENDS += "dbus dbus-glib"
+
+# Fixes:
+# File /usr/bin/TouchpadEmulator in package touchpademulator doesn't have GNU_HASH (didn't pass LDFLAGS?) [ldflags]
+TARGET_CC_ARCH += "${LDFLAGS}"
+
+do_configure () {
+        :
+}
+
+do_compile () {
+        oe_runmake
+}
+
+do_install () {
+        oe_runmake install 'DESTDIR=${D}'
+}
+
+FILES:${PN} += "${datadir}/icons"