summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* nodejs: upgrade 20.17.0 -> 20.18.0J. S2025-02-044-3/+3
| | | | | | | | | | | | | | | | License checksum change due to whitespace changes. https://github.com/nodejs/node/commit/1dfd238781 libatomic.patch change due to changes in node.gyp https://github.com/nodejs/node/commit/25c788009f1fa7a392af51cb97d0a55f0f4a6983 Changelog : https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.18.0 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: Fix build with libc++ 19Khem Raj2025-02-042-0/+183
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | As noted in the libc++ 19 release notes [1], std::char_traits<> is now only provided for char, char8_t, char16_t, char32_t and wchar_t, and any instantiation for other types will fail. This causes nodejs-20 to fail to compile with clang 19 and libc++ 19, resulting in errors similar to: /usr/include/c++/v1/string:820:42: error: implicit instantiation of undefined template 'std::char_traits<unsigned short>' 820 | static_assert(is_same<_CharT, typename traits_type::char_type>::value, | ^ ../deps/v8/src/inspector/string-16.h:114:28: note: in instantiation of template class 'std::basic_string<unsigned short>' requested here 114 | std::basic_string<UChar> m_impl; | ^ /usr/include/c++/v1/__fwd/string.h:23:29: note: template is declared here 23 | struct _LIBCPP_TEMPLATE_VIS char_traits; | ^ Upstream v8 has fixed this in commit 182d9c05e78 [2], so add it as a backported patch, until the next version of node is released. [1] https://libcxx.llvm.org/ReleaseNotes/19.html#deprecations-and-removals [2] https://chromium.googlesource.com/v8/v8.git/+/182d9c05e78 Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: upgrade 20.16.0 -> 20.17.0J. S2025-02-043-2/+2
| | | | | | | | | | | | | | | | | | commit c1ddc60fd25456da07d8402c89157c4354fde5ac Author: Jason Schonberg <schonm@gmail.com> Date: Wed Aug 21 17:40:03 2024 -0400 License change - remove highlight.js https://github.com/nodejs/node/commit/1c5fe040a0a73b483cc3e3fef76efe2d1712205b Changelog : https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.17.0 nodejs: upgrade 20.16.0 -> 20.17.0 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: support cross compile without qemu user conditionallyHongxu Jia2025-02-042-41/+124
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Due to the scope of supported BSPs by qemu-user is limited, such as a segment fault on armv9 after qemu apply commit [target/arm: Convert LDAPR/STLR (imm) to decodetree][1] ``` |tmp-glibc/work/neoversen2-crypto-wrs-linux/nodejs/20.5.1/node-v20.5.1/out/ Release/v8-qemu-wrapper.sh: line 7: 3179613 Segmentation fault (core dumped) PSEUDO_UNLOAD=1 qemu-aarch64 -r 5.15 -L tmp-glibc/work/neoversen2-crypto-wrs-linux/ nodejs/20.5.1/recipe-sysroot -E LD_LIBRARY_PATH=tmp-glibc/work/neoversen2-crypto-wrs-linux/ nodejs/20.5.1/recipe-sysroot/usr/lib64:tmp-glibc/work/neoversen2-crypto-wrs-linux/ nodejs/20.5.1/recipe-sysroot/usr/lib64 "$@" ``` Upstream nodejs have cross compile support, but it needs host and target have same bit width (e.g. a x86_64 host targeting arrch64 to produce a 64-bit binary). So: 1. If host and target have different bit width, build with QEMU user as usual; 2. If host and target have same bit width, enable notejs cross compile support: - The build tools of nodejs is GYP[2], set CC_host, CFLAGS_host, CXX_host, CXXFLAGS_host, LDFLAGS_host, AR_host for host build which is separated with target build [3] - Satisfy layer compatibility, set GYP variables in prefuncs of do_configure, do_compile and do_install other than in recipe parsing - Add missing native packages to fix library missing on host build - Rework libatomic.patch, explicitly link to libatomic for clang conditionally [1] https://github.com/qemu/qemu/commit/2521b6073b7b4b505533a941d4f9600f7585dc78 [2] https://github.com/nodejs/node-gyp [3] https://github.com/nodejs/node-gyp/blob/main/gyp/docs/UserDocumentation.md#cross-compiling Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: upgrade 20.13.0 -> 20.16.0Jason Schonberg2025-02-043-1/+1
| | | | | | | Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: Upgrade to 20.13.0 releaseKhem Raj2025-02-043-2/+2
| | | | | | | | | | | | | nodejs release notes [1] License-Update: Copyright year changed for Unicode License [2] [1] https://nodejs.org/en/blog/release/v20.13.0 [2] https://github.com/nodejs/node/commit/d5a316f5ea3fade3140c2ae35c144b500fb5d758 Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: fix the tarball and license checksumsJef Driesen2025-02-041-2/+2
| | | | | | | | | The nginx upgrade in commit 6eef5e3efb0a871622d2ea5eeb016b61d46f722c added an incorrect tarball checksum and didn't update the license checksum, resulting in build failures. Signed-off-by: Jef Driesen <jefdriesen@telenet.be> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* uutils-coreutils: upgrade 0.0.27 -> 0.0.28Wang Mingyu2025-02-042-195/+475
| | | | | | | | | | Changelog: https://github.com/uutils/coreutils/releases/tag/0.0.28 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: upgrade 7.2.6 -> 7.2.7Divya Chellam2025-02-0410-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | ChangeLog: https://github.com/redis/redis/releases/tag/7.2.7 Upgrade urgency SECURITY: See security fixes below. Security fixes ==================== * (CVE-2024-46981) Lua script commands may lead to remote code execution * (CVE-2024-51741) Denial-of-service due to malformed ACL selectors Bug fixes ==================== * #13380 Possible crash due to OOM panic on invalid command * #13338 Streams: XINFO lag field is wrong when tombstone is after the last_id of the consume group * #13473 Streams: XTRIM does not update the maximal tombstone, leading to an incorrect lag * #13311 Cluster: crash due to unblocking client during slot migration * #13443 Cluster: crash when loading cluster config * #13422 Cluster: CLUSTER SHARDS returns empty array * #13465 Cluster: incompatibility with older node versions Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lapack: fix buildpaths in ptest also when CBLAS is enabledMartin Jansa2025-02-041-6/+17
| | | | | | | | | | | | | | | | | | | ERROR: lapack-3.12.0-r0 do_package_qa: QA Issue: File /usr/lib/lapack/ptest/bin/xccblat3 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xdcblat3 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xdcblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xscblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xccblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xzcblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xzcblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xccblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xdcblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xscblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xscblat3 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xzcblat3 in package lapack-ptest contains reference to TMPDIR [buildpaths] Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lapack: add PACKAGECONFIG for cblasMartin Jansa2025-02-041-0/+1
| | | | | Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lapack: fix TMPDIR reference in do_package_qaZhang Peng2025-02-041-0/+31
| | | | | | | | | | | | | | | | | | | | | | | When building the `lapack` package, the following QA error occurs: "File /usr/lib64/libblas.so.3.12.0 in package lapack contains reference to TMPDIR [buildpaths]" The issue arises because the `xerbla.o` object file embeds the absolute host path of `xerbla.f`. This occurs during compilation, where the build command in `build.make` (generated by CMake) specifies: `gfortran -c <absolute path>/xerbla.f -o`. As a result, the absolute path is included in `xerbla.o`. Unfortunately, `gfortran` does not support flags like `-fdebug-prefix-map` or `-ffile-prefix-map` to remove such paths. To resolve this, the fix involves replacing the absolute path of `xerbla.f` in the generated `build.make` file with a relative path before the compilation step. This ensures that the resulting `xerbla.o` does not contain any references to TMPDIR, passing the `do_package_qa` check. For ptest code, the solution is to replace `${WORKDIR}` with `../../..` in the generated `build.make` files located in the TESTING directory. Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-grpcio: patch CVE-2024-11407Peter Marko2025-02-042-0/+33
| | | | | | | | | | Cherry-pick commit [1] mentioned in [2]. [1] https://github.com/grpc/grpc/commit/e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 [2] https://nvd.nist.gov/vuln/detail/CVE-2024-11407 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mdio-tools: fix mdio-netlink kernel module reproducibilityYoann Congal2025-02-042-4/+3
| | | | | | | | | | | | | | | | | | mdio-netlink source make reference to ${S}/.. which breaks -fdebug-prefix-map and results in the full TMPDIR path being present in the -dbg package and, also, change a related CRC in the main package. This changes ${S} to enclose the whole SRC_URI repo and adapt relative paths to build (MODULES_MODULE_SYMVERS_LOCATION) This make mdio-netlink reproducible and fixes this warning: WARNING: mdio-netlink-1.3.1-r0 do_package_qa: QA Issue: File /lib/modules/6.6.29-yocto-standard/updates/.debug/mdio-netlink.ko in package mdio-netlink-dbg contains reference to TMPDIR [buildpaths] Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Reviewed-by: Alexandre Truong <alexandre.truong@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d161de0b00b91cd0c286fbbc1190f87cf20fe088) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* poppler: fix CVE-2024-56378Yogita Urade2025-02-042-0/+78
| | | | | | | | | | | | | | | libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-56378 Upstream patch: https://gitlab.freedesktop.org/poppler/poppler/-/commit/ade9b5ebed44b0c15522c27669ef6cdf93eff84e Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libcamera: backport 0.4.0 from master-nextThomas Roos2025-02-044-248/+5
| | | | | | | | | | | | | | This is done because libcamera 0.2. is broken, probablay because of 0001-rpi-Use-alloca-instead-of-variable-length-arrays.patch Tested good with upstream version. See more details here: https://github.com/openembedded/meta-openembedded/issues/919 and here: https://github.com/raspberrypi/rpicam-apps/issues/654 Signed-off-by: Thomas Roos <throos@amazon.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gphoto2: Fix contains reference to TMPDIR [buildpaths] warningHieu Van Nguyen2025-01-201-0/+3
| | | | | | | | Remove ${RECIPE_SYSROOT} path from ${B}/config.h to fix the QA warning: WARNING: gphoto2-2.5.28-r0 do_package_qa: QA Issue: File /usr/bin/gphoto2 in package gphoto2 contains reference to TMPDIR [buildpaths] Signed-off-by: Hieu Van Nguyen <hieu2.nguyen@lge.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* crash: fix crash cannot work with kaslrXiangyu Chen2025-01-202-0/+90
| | | | | | | | | According to crash help message, crash can decode the random address with "--kaslr=auto". But it has a bug that when with "-S" in parameter, crash will bypass the kaslr option. Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* hostapd: Add CVE id to CVE-2024-3596_00.patchRobert Yang2025-01-201-0/+1
| | | | | Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* grpc: patch CVE-2024-11407Peter Marko2025-01-202-0/+33
| | | | | | | | | | Cherry-pick commit [1] mentioned in [2]. [1] https://github.com/grpc/grpc/commit/e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 [2] https://nvd.nist.gov/vuln/detail/CVE-2024-11407 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* opensc: fix CVE-2024-8443Zhang Peng2025-01-203-0/+117
| | | | | | | | | | | | | | | | | | | | | CVE-2024-8443: The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘themehunk_megamenu_bg_image' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note that this was partially fixed in 1.1.0 due to the missing authorization protection that was added. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-8433] Upstream patches: [https://github.com/OpenSC/OpenSC/commit/02e847458369c08421fd2d5e9a16a5f272c2de9e] [https://github.com/OpenSC/OpenSC/commit/b28a3cef416fcfb92fbb9ea7fd3c71df52c6c9fc] Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* glade: fix CVE-2020-36774Zhang Peng2025-01-202-0/+55
| | | | | | | | | | | | | | | | CVE-2020-36774: plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash). Reference: [https://nvd.nist.gov/vuln/detail/CVE-2020-36774] Upstream patches: [https://gitlab.gnome.org/GNOME/glade/-/commit/7acdd3c6f6934f47b8974ebc2190a59ea5d2ed17] Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ptest-packagelists-meta-oe.inc: Add asioMingli Yu2025-01-201-0/+1
| | | | | | Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* asio: Add ptest supportMingli Yu2025-01-203-2/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | | | # ./run-ptest PASS: address PASS: address_v4 PASS: address_v4_iterator PASS: address_v4_range PASS: address_v6 PASS: address_v6_iterator PASS: address_v6_range PASS: any_completion_executor PASS: any_completion_handler PASS: any_executor PASS: any_io_executor PASS: append PASS: as_tuple PASS: associated_allocator PASS: associated_cancellation_slot PASS: associated_executor PASS: associated_immediate_executor PASS: associator PASS: async_result [snip] Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: upgrade 1.25.3 -> 1.25.4Divya Chellam2025-01-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: =========== https://nginx.org/en/CHANGES *) Security: when using HTTP/3 a segmentation fault might occur in a worker process while processing a specially crafted QUIC session (CVE-2024-24989, CVE-2024-24990). *) Bugfix: connections with pending AIO operations might be closed prematurely during graceful shutdown of old worker processes. *) Bugfix: socket leak alerts no longer logged when fast shutdown was requested after graceful shutdown of old worker processes. *) Bugfix: a socket descriptor error, a socket leak, or a segmentation fault in a worker process (for SSL proxying) might occur if AIO was used in a subrequest. *) Bugfix: a segmentation fault might occur in a worker process if SSL proxying was used along with the "image_filter" directive and errors with code 415 were redirected with the "error_page" directive. *) Bugfixes and improvements in HTTP/3. Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* pipewire: upgrade 1.0.5 -> 1.0.9gudnimar2025-01-201-1/+1
| | | | | | | | | | | Bug fix releases which are API and ABI compatible with previous 1.0.x releases. Changelog can be found here: https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/1.0.9/NEWS?ref_type=tags Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* thrift: fix c++ generated code compilation with clangPeter Marko2025-01-202-1/+602
| | | | | | | | | Backport PR merged to thrift v0.21.0 to be able to compile thrift generated c++ code with C++20 clang 15+. Signed-off-by: Stanislav Angelovic <stanislav.angelovic.ext@siemens.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* bpftool: fix libelf.h not found errorPreeti Sachan2025-01-201-1/+1
| | | | | | | | | | | | | When build host machine is not installed with elfutils-libelf-devel, it throws compile error "libelf.h: No such file or directory". Fix missing headers file by including path ${STAGING_INCDIR_NATIVE} via CFLAGS variable. Use headers file from ${STAGING_INCDIR_NATIVE} instead of host machine. Error: | libbpf_internal.h:19:10: fatal error: libelf.h: No such file or directory Signed-off-by: Preeti Sachan <preeti.sachan@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 5.0.9 -> 5.0.10Soumya Sambu2025-01-201-1/+1
| | | | | | | | | | Fixes CVE-2024-53907 and CVE-2024-53908 Release Notes: https://docs.djangoproject.com/en/dev/releases/5.0.10/ Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 4.2.16 -> 4.2.17Soumya Sambu2025-01-201-2/+2
| | | | | | | | | | Fixes CVE-2024-53907 and CVE-2024-53908 Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.17/ Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireshark 4.2.7: Fix CVE-2024-9781Shubham Pushpkar2025-01-202-0/+134
| | | | | | | | | | | | | Upstream Repository: https://gitlab.com/wireshark/wireshark.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2024-9781 Type: Security Fix CVE: CVE-2024-9781 Score: 7.8 Patch: https://gitlab.com/wireshark/wireshark/-/commit/cad248ce3bf5 Signed-off-by: Shubham Pushpkar <spushpka@cisco.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* php: upgrade 8.2.24 -> 8.2.26Vijay Anusuri2025-01-201-1/+1
| | | | | | | | | | Includes fix for CVE-2024-8929, CVE-2024-11236, CVE-2024-11234 and CVE-2024-11233 Changelog: https://www.php.net/ChangeLog-8.php#8.2.26 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* chrony: fix do_fetch errorJiaying Song2025-01-201-1/+1
| | | | | | | | Change the SRC_URI to the correct value due to the following error: WARNING: chrony-4.5-r0.wr2401 do_fetch: Failed to fetch URL https://download.tuxfamily.org/chrony/chrony-4.5.tar.gz, attempting MIRRORS if available Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ghex,gnome-chess,gnome-photos: Add missing dep on itstool-nativeKhem Raj2025-01-053-1/+3
| | | | | | | | Fixes build issues in these recipe in meta-gnome Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit af6858aa3729a81780f2ec113c095f7f0c87c226) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* eog: add itstool-native dependencyMarkus Volk2025-01-051-0/+1
| | | | | | | | | | | | | fixes: | ../eog-47.0/help/meson.build:45:6: ERROR: Program 'itstool' not found or not executable | | A full log can be found at /home/flk/poky/build/tmp/work/corei7-64-poky-linux/eog/47.0/build/meson-logs/meson-log.txt | ERROR: meson failed Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit b523303f785c459e2f9232af45504863564ad7b9) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* geary: add itstool-native dependencyMarkus Volk2025-01-051-0/+1
| | | | | | | | | | | | | fixes: | Configuring org.gnome.Geary.service using configuration | Program itstool found: NO | | ../git/help/meson.build:21:6: ERROR: Program 'itstool' not found or not executable Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 34962ffbbef0a7b8af82121655ec78a4b7c7e055) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-tornado: Upgrade 6.4 -> 6.4.2Soumya Sambu2024-12-271-2/+2
| | | | | | | | | | | | | Changelog: ========== https://github.com/tornadoweb/tornado/releases/tag/v6.4.2 https://github.com/tornadoweb/tornado/releases/tag/v6.4.1 Switch to python_setuptools_build_meta - https://github.com/tornadoweb/tornado/commit/e71fb6e616e08838df55dddb494c96a80454f812 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
* sip: Upgrade 6.8.3 -> 6.8.6Leon Anavi2024-12-271-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | Upgrade to version 6.8.6: - Handle single number macOS deployment targets - Support for architectures where `char` is unsigned - Support for building from git archives - Run the tests using the current Python version The project has a proper pyproject.toml which declares the setuptools.build.meta PEP-517 backend. Fixes: WARNING: sip-6.8.6-r0 do_check_backend: QA Issue: inherits setuptools3 but has pyproject.toml with setuptools.build_meta, use the correct class [pep517-backend] The work was sponsored by GOVCERT.LU. License-Update: Update years Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
* postgresql: upgrade 16.4 -> 16.5Yogita Urade2024-12-272-4/+4
| | | | | | | | | | | | | | Includes fix for CVE-2024-10976, CVE-2024-10977, CVE-2024-10978 and CVE-2024-10979 Changelog: https://www.postgresql.org/docs/release/16.5/ 0003-configure.ac-bypass-autoconf-2.69-version-check.patch Refreshed for 16.5 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
* ndisc6: Fix reproducible buildKhem Raj2024-12-152-0/+86
| | | | | | | | | | | | includes the CFLAGS used to build the package in the binary via PACKAGE_CONFIGURE_INVOCATION which then includes the absolute build path via (eg.) the -ffile-prefix-map flag. Here we remove using variables like PACKAGE_CONFIGURE_INVOCATION in code Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ndisc: Remove buildpaths from binariesKhem Raj2024-12-151-0/+4
| | | | | | | | | | configure emits its arguments into binaries via PACKAGE_CONFIGURE_INVOCATION therefore edit the paths from this in generated config.h before it gets into binaries. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* xmlsec1: Switch SRC_URI to use github releaseJiaying Song2024-12-151-1/+1
| | | | | | | | This ensures that we do not have to do the toggling from releases to old-release in LTS release branches Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mosquitto: upgrade 2.0.19 -> 2.0.20Wang Mingyu2024-12-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== Broker: - Fix QoS 1 / QoS 2 publish incorrectly returning "no subscribers". Closes #3128. - Open files with appropriate access on Windows. - Don't allow invalid response topic values. - Fix some strict protocol compliance issues. Client library: - Fix cmake build on OS X. Build: - Fix build on NetBSD Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Bruno VERNAY <bruno.vernay@se.com> Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mosquitto: upgrade 2.0.18 -> 2.0.19Fabrice Aeschbacher2024-12-153-50/+1
| | | | | | | | | | | | | | - Solves CVE-2024-8376 - removed 1571.patch and 2894.patch, already applied in v2.0.19 https://github.com/eclipse/mosquitto/blob/v2.0.19/ChangeLog.txt Signed-off-by: Fabrice Aeschbacher <fabrice.aeschbacher@siemens.com> Reviewed-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Bruno VERNAY <bruno.vernay@se.com> Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* grpc: Fix CVE-2024-7246Libo Chen2024-12-152-0/+421
| | | | | | | | | Backport patches [1] to fix CVE-2024-7246. [1] https://github.com/grpc/grpc/pull/37361/files Signed-off-by: Libo Chen <libo.chen.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* pipewire: Add glib-2.0-native dep for bluez5AmateurECE2024-12-151-1/+1
| | | | | | | | | | The SPA plugins for bluez depend on D-Bus bindings generated using gdbus-codegen at build time. Some PACKAGECONFIG combinations appear to pull this in accidentally. Add an explicit dependency to ensure that it's in the sysroot when PACKAGECONFIG contains bluez5. Signed-off-by: Ethan D. Twardy <ethan.twardy@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libgsf: upgrade 1.14.52 -> 1.14.53Zhang Peng2024-12-151-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: * Compilation fixes for libxml 2.13 * Fix ABR in gsf-vba-dump. * Teach gsf (the tool) to handle odf properties. * Fix integer overflows affecting memory allocation. * Add missing "DocumentStatus" ole2 property. * Avoid some undefined C behaviour in overflow checks. Security fixes: CVE-2024-42415 An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. CVE-2024-36474 An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. A specially crafted file can result in an integer overflow when processing the directory from the file that allows for an out-of-bounds index to be used when reading and writing to an array. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Reference: [https://gitlab.gnome.org/GNOME/libgsf/-/issues/34] (master rev: 6ed5891c18fc78a69764af0a29ad9b5feefb1aa8) Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* protobuf: fix CVE-2024-7254Chen Qi2024-12-152-0/+795
| | | | | | | | Backport patch with adjustments for the current version to fix CVE-2024-7254. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: upgrade 7.2.5 -> 7.2.6Yi Zhao2024-12-1510-26/+25
| | | | | | | | | | | | | | | | | | | | | | ChangeLog: Security fixes ============== * (CVE-2024-31449) Lua library commands may lead to stack overflow and potential RCE. * (CVE-2024-31227) Potential Denial-of-service due to malformed ACL selectors. * (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern matching. Bug fixes ========= * Fixed crashes in cluster mode (#13315) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: upgrade 7.2.4 -> 7.2.5Wang Mingyu2024-12-1510-1/+1
| | | | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-05 04:10:18 +0000