Ankur Tyagi
bb956bf8ff
redis: upgrade 8.10.2 -> 8.10.3
...
Changelog:
https://github.com/redis/redis/releases/tag/8.10.3
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 53276e6882ankur.tyagi85@gmail.com >
2026-10-28 08:22:29 +13:00
Jason Schonberg
0d9abd6842
c-ares: backport security fixes from 1.34.9
...
Add the eight unique upstream commits that fix the security advisories addressed in c-ares 1.34.9.
Several advisories share commits, so patches are ordered by commit rather than duplicated per advisory; each patch lists the GHSA IDs it resolves.
Assisted-by: opencode (big-pickle)
Signed-off-by: Jason Schonberg <schonm@gmail.com >
2026-10-27 17:43:29 +13:00
Ankur Tyagi
2a8300a0ef
7zip: upgrade 26.04 -> 26.05
...
Changelog:
https://github.com/ip7z/7zip/releases/tag/26.05
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 533d0a63acankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Ankur Tyagi
e5a8e3e298
7zip: upgrade 26.03 -> 26.04
...
Changelog:
https://github.com/ip7z/7zip/releases/tag/26.04
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 1c45c216f6ankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Jason Schonberg
1e4a1a7cdc
php: upgrade 8.5.11 -> 8.5.12
...
This is a security update. Fixes unauthenticated remote code execution.
CVE-2026-109618 CVE-2026-109619
Advisory: https://www.php.net/archive/2026.php#2026-10-21-5
Changelog: https://www.php.net/ChangeLog-8.php#8.5.12
Signed-off-by: Jason Schonberg <schonm@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 898ac0ba1cankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Jason Schonberg
82e99aebb4
brotli: upgrade 1.2.0 -> 1.2.1
...
This is a security release
CVE-2026-111497: out-of-bounds write permits remote code execution
Changelog: https://github.com/google/brotli/releases/tag/v1.2.1
Signed-off-by: Jason Schonberg <schonm@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit b5d66bf60dankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Ankur Tyagi
fa4dfa140d
libmspack: patch CVE-2026-110602
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-110602
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Peter Marko
1a0a133351
grpc: update gRPC repo roots
...
See https://emudhra.we-have-a-problem.com/
Signed-off-by: Peter Marko <peter.marko@siemens.com >
2026-10-26 23:14:40 +13:00
Peter Marko
8a760baf57
nss: remove compromised eMudhra certificates
...
See https://emudhra.we-have-a-problem.com/
Signed-off-by: Peter Marko <peter.marko@siemens.com >
2026-10-26 23:14:32 +13:00
Ankur Tyagi
b625e91dcf
libvncserver: patch CVE-2026-50538
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-50538
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
105c0a7d4b
libvncserver: patch CVE-2026-32853
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32853
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
3f2eb98cd8
libvncserver: patch CVE-2026-32854
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32854
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
4ba15423c7
libvncserver: patch CVE-2026-44988
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-44988
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
406da4cb70
nmap: patch CVE-2026-72712
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-72712
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-21 21:35:11 +13:00
Ankur Tyagi
e3266bede8
nmap: patch CVE-2026-58058
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-58058
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-21 21:35:11 +13:00
Ankur Tyagi
27b41701a0
opensc: patch CVE-2026-103531
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-103531
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
3e78f34c9b
poppler: patch CVE-2026-102620
...
Also backport commit[1] to allow cherry-pick of the commit fixing the CVE.
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-102620
[1]https://gitlab.freedesktop.org/poppler/poppler/-/commit/786b06dac87dbe28e85ec7ea3d340810f151c25b
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
435cd16e9b
poppler: patch CVE-2026-102621
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-102621
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
3e0c7af047
psqlodbc: patch CVE-2026-109448
...
Backport the commit identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-109448
[1]https://security-tracker.debian.org/tracker/CVE-2026-109448
PTEST pass:
root@qemuarm64:~# ptest-runner psqlodbc
START: ptest-runner
2026-10-17T09:22
BEGIN: /usr/lib/psqlodbc/ptest
...
DURATION: 43
END: /usr/lib/psqlodbc/ptest
2026-10-17T09:23
STOP: ptest-runner
TOTAL: 1 FAIL: 0
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:07 +13:00
Ankur Tyagi
622cd276dd
rapidjson: mark CVE-2024-38517 fixed
...
Commit mentioned in the NVD is part of the current version:
$ git log HEAD --oneline | grep 8269bc2b
8269bc2b Prevent int underflow when parsing exponents
Details:
https://nvd.nist.gov/vuln/detail/cve-2024-38517
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:13:53 +13:00
Ankur Tyagi
6894d75451
libxmp: upgrade 4.7.3 -> 4.7.4
...
Changelog:
https://github.com/libxmp/libxmp/releases/tag/libxmp-4.7.4
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 22:35:24 +13:00
Ankur Tyagi
3fb79999f2
libmikmod: upgrade 3.3.14 -> 3.3.15
...
Changelog:
https://sourceforge.net/p/mikmod/mikmod/ci/libmikmod-3.3.15/tree/libmikmod/NEWS
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 22:35:19 +13:00
Ankur Tyagi
6cb8fca0bc
libspdm: upgrade 3.8.2 -> 3.8.3
...
Changelog:
https://github.com/DMTF/libspdm/releases/tag/3.8.3
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 22:35:09 +13:00
Ankur Tyagi
b598e510a5
spitools: upgrade 1.1.0 -> 1.1.1
...
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 22:35:01 +13:00
Ankur Tyagi
63837fd4bd
freerdp3: upgrade 3.32.1 -> 3.32.2
...
Dropped patch that is part of the upstream version.
Changelog:
https://github.com/FreeRDP/FreeRDP/releases/tag/3.32.2
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 22:34:44 +13:00
Ankur Tyagi
991d096781
xdg-dbus-proxy: upgrade 0.1.7 -> 0.1.9
...
Changelog:
https://github.com/flatpak/xdg-dbus-proxy/blob/0.1.9/NEWS
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 17:28:24 +13:00
Ankur Tyagi
79d9892d59
flatpak: upgrade 1.18.0 -> 1.18.4
...
Changelog:
https://github.com/flatpak/flatpak/blob/1.18.4/NEWS
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 17:18:39 +13:00
Ankur Tyagi
a145655a58
tmate: patch CVE-2026-4751
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-4751
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 16:22:21 +13:00
Ankur Tyagi
f3215567dc
udisks2: patch CVE-2026-7867
...
Backport commits from the PR[1].
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-7867
[1]https://github.com/storaged-project/udisks/pull/1530
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 16:16:01 +13:00
Ankur Tyagi
a9d69bc066
lvgl-demo-fb: fix SRCREV
...
Previous SRCREV does not belong to any branch on this repository and build
fails with error:
ERROR: lvgl-demo-fb-9.5.0+git-r0 do_fetch: Fetcher failure: Unable to find revision 045137cf0fa1781483cb796261a11b5eb21e99d9 in branch release/v9.5 even from upstream
ERROR: lvgl-demo-fb-9.5.0+git-r0 do_fetch: Bitbake Fetcher Error: FetchError('Unable to fetch URL from any source.', 'git://github.com/lvgl/lv_port_linux_frame_buffer.git;protocol=https;branch=release/v9.5;name=demo')
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 09:26:03 +13:00
Ankur Tyagi
c7f1f03d1b
gpsd: patch CVE-2026-60122
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-60122
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit da527bb6baankur.tyagi85@gmail.com >
2026-10-13 21:32:54 +13:00
Ankur Tyagi
68a702ac5d
tesseract: patch CVE-2026-88054
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88054
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit 4c00053135ankur.tyagi85@gmail.com >
2026-10-13 21:32:54 +13:00
Ankur Tyagi
9ca7f33f69
tesseract: patch CVE-2026-88051
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88051
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit 727354dae2ankur.tyagi85@gmail.com >
2026-10-13 21:32:54 +13:00
Ankur Tyagi
21dc40e65a
tesseract: patch CVE-2026-88047
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88047
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit b8fa7aac91ankur.tyagi85@gmail.com >
2026-10-13 21:32:54 +13:00
Ankur Tyagi
08a6852a7e
tesseract: patch CVE-2026-88050
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88050
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit 4aab0847c2ankur.tyagi85@gmail.com >
2026-10-13 21:32:54 +13:00
Ankur Tyagi
8f56f67a2f
tesseract: patch CVE-2026-88049
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88049
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit 218b6a19b1ankur.tyagi85@gmail.com >
2026-10-13 21:32:54 +13:00
Ankur Tyagi
221a1e49f4
tesseract: patch CVE-2026-88048
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88048
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit 9e544d6e50ankur.tyagi85@gmail.com >
2026-10-13 21:32:54 +13:00
Ankur Tyagi
3d862201ff
tesseract: patch CVE-2026-88052
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88052
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit 251dd7f80dankur.tyagi85@gmail.com >
2026-10-13 21:32:54 +13:00
Ankur Tyagi
95be90acc0
smarty: mark CVE-2026-82531 patched
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-82531
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-13 21:32:54 +13:00
Ankur Tyagi
1964bbc475
cjson: patch CVE-2026-87933
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-87933
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit 2b3f5cbbd8ankur.tyagi85@gmail.com >
2026-10-13 21:32:54 +13:00
Ankur Tyagi
9c7e3a2ba9
smarty: upgrade 5.8.4 -> 5.8.5
...
Changelog:
https://github.com/smarty-php/smarty/releases/tag/v5.8.5
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 3fe4c22474ankur.tyagi85@gmail.com >
2026-10-13 11:50:55 +13:00
Ankur Tyagi
c829548246
libyang: patch CVE-2026-41401
...
Backport patch identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41401
[1]https://security-tracker.debian.org/tracker/CVE-2026-41401
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit 6b06704ac1ankur.tyagi85@gmail.com >
2026-10-13 11:50:55 +13:00
Ankur Tyagi
dc56cbbc02
libssh: ignore CVE-2026-59851
...
GSSAPI Key Exchange was introduced in v0.12.0[1].
Debian also confirmed the same[2].
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59851
[1]https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.12.0
[2]https://security-tracker.debian.org/tracker/CVE-2026-59851
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-13 11:50:55 +13:00
Ankur Tyagi
26f0474644
libssh: mark CVEs patched
...
Changelog[1] also confirms the fix.
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59843
https://nvd.nist.gov/vuln/detail/cve-2026-59844
https://nvd.nist.gov/vuln/detail/cve-2026-59845
https://nvd.nist.gov/vuln/detail/cve-2026-59846
https://nvd.nist.gov/vuln/detail/cve-2026-59848
https://nvd.nist.gov/vuln/detail/cve-2026-59850
[1]https://gitlab.com/libssh/libssh-mirror/-/blob/libssh-0.11.5/CHANGELOG?ref_type=tags
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-13 11:50:55 +13:00
Ankur Tyagi
d1b13ec2ac
libssh: ignore CVE-2025-14821
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-14821
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit 6541aefe60ankur.tyagi85@gmail.com >
2026-10-13 11:50:55 +13:00
Ankur Tyagi
5a964c11f8
libnfs: patch CVE-2026-57918
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57918
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit bb3f5628f1ankur.tyagi85@gmail.com >
2026-10-13 11:50:55 +13:00
Ankur Tyagi
8abdf08b09
libnfs: patch CVE-2026-53689
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-53689
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit 6ace2f0b5eankur.tyagi85@gmail.com >
2026-10-13 11:50:55 +13:00
Ankur Tyagi
1dac3dca9d
jq: ignore already fixed CVEs
...
All these CVEs are already fixed in the recipe version[1].
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-33948
https://nvd.nist.gov/vuln/detail/cve-2026-39979
https://nvd.nist.gov/vuln/detail/cve-2026-40164
https://nvd.nist.gov/vuln/detail/cve-2026-44777
[1]https://github.com/jqlang/jq/releases/tag/jq-1.8.2
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-13 11:50:55 +13:00
Ankur Tyagi
a7b6f19ac6
iniparser: mark CVE-2025-0633 pached
...
Also mentioned in the release notes[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-0633
[1] https://gitlab.com/iniparser/iniparser/-/releases/v4.2.6
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit 86fba2b580ankur.tyagi85@gmail.com >
2026-10-13 11:50:55 +13:00
Ankur Tyagi
38078503c1
hdf5: patch CVE-2026-19025
...
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
[1] https://github.com/HDFGroup/hdf5/pull/6508
[2] https://github.com/HDFGroup/hdf5/issues/6491
[3] https://nvd.nist.gov/vuln/detail/cve-2026-19025
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit df3f814ab8ankur.tyagi85@gmail.com >
2026-10-13 11:50:55 +13:00
Ankur Tyagi
Jason Schonberg
Peter Marko