Commit Graph
2742 Commits
Author SHA1 Message Date
Jason Schonberg 1e4a1a7cdc php: upgrade 8.5.11 -> 8.5.12
This is a security update.  Fixes unauthenticated remote code execution.

CVE-2026-109618 CVE-2026-109619

Advisory: https://www.php.net/archive/2026.php#2026-10-21-5

Changelog: https://www.php.net/ChangeLog-8.php#8.5.12

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 898ac0ba1c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
2026-10-26 23:15:53 +13:00
Peter Marko 1a0a133351 grpc: update gRPC repo roots
See https://emudhra.we-have-a-problem.com/

Signed-off-by: Peter Marko <peter.marko@siemens.com>
2026-10-26 23:14:40 +13:00
Ankur Tyagi 622cd276dd rapidjson: mark CVE-2024-38517 fixed
Commit mentioned in the NVD is part of the current version:

$ git log HEAD --oneline | grep 8269bc2b
8269bc2b Prevent int underflow when parsing exponents

Details:
https://nvd.nist.gov/vuln/detail/cve-2024-38517

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
2026-10-19 00:13:53 +13:00
Ankur Tyagi 1964bbc475 cjson: patch CVE-2026-87933
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-87933

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 2b3f5cbbd8)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
2026-10-13 21:32:54 +13:00
Ankur Tyagi 1dac3dca9d jq: ignore already fixed CVEs
All these CVEs are already fixed in the recipe version[1].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-33948
https://nvd.nist.gov/vuln/detail/cve-2026-39979
https://nvd.nist.gov/vuln/detail/cve-2026-40164
https://nvd.nist.gov/vuln/detail/cve-2026-44777

[1]https://github.com/jqlang/jq/releases/tag/jq-1.8.2

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
2026-10-13 11:50:55 +13:00
Ankur Tyagi 110844e1f0 capnproto: ignore CVE-2026-59704
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59704

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
2026-10-13 11:50:55 +13:00
Ankur Tyagi 0d1a54af87 pahole: upgrade 1.31 -> 1.32
Changelog:
https://git.kernel.org/pub/scm/devel/pahole/pahole.git/tree/NEWS?h=v1.32

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-01 07:40:51 -07:00
Ankur Tyagi b406396fe2 mpich: upgrade 5.0.1 -> 5.0.2
Changelog:
https://github.com/pmodels/mpich/releases/tag/v5.0.2

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-01 07:40:51 -07:00
Ankur Tyagi 9e88a0d5b3 microsoft-gsl: upgrade 5.0.0 -> 5.0.1
Changelog:
https://github.com/microsoft/GSL/releases/tag/v5.0.1

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-01 07:40:51 -07:00
Deepesh Varatharajan 44bdac6abf librust-cxx: upgrade 1.0.197 -> 1.0.202
Update cxx crate from 1.0.197 to 1.0.202.

Changes in this update:

v1.0.198:
- Update to syn 3

v1.0.199:
- Suppress clone_on_copy clippy lint in generated code

v1.0.200:
- Do not classify references as guaranteed POD

v1.0.201:
- Specialize enable_borrowed_range and enable_view for rust::Slice<T>
- Register bazel toolchains as dev dependencies

v1.0.202:
- Support build environments that limit build-script filesystem writes
  outside of OUT_DIR

Assisted-by: Kiro CLI 2.12.0 (AI assistant)
Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-30 19:09:34 -07:00
Khem Raj 255a09ab7f android-tools: fix musl build (off64_t, LFS64 fns, b64_pton, ANDROID_HOST_MUSL)
Several independent musl gaps surfaced one after another as each was
fixed and the build progressed further:
- android-base/off64_t.h only worked around __APPLE__ lacking off64_t;
  extend the same typedef fallback to musl.
- sysdeps.h's adb_pread/adb_pwrite/adb_lseek only fell back to the
  plain (non-LFS64) functions on __APPLE__; musl needs the same
  fallback for pread64/pwrite64/lseek64.
- daemon/auth.cpp calls b64_pton() from <resolv.h>, which the Linux
  host build gets via -lresolv and bionic provides natively, but musl
  has neither; vendor the standard BSD implementation for it.
- android-base/endian.h and threads.h already gate a musl-aware branch
  behind ANDROID_HOST_MUSL, matching upstream's own expectation, but
  nothing defined that macro for this recipe's build; define it via
  CFLAGS/CXXFLAGS for the musl toolchain.

AI-Generated: Uses Claude Code

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-29 15:35:17 -07:00
Khem Raj a1038beb9e perfetto: avoid getprogname() macro clobbering its own fallback
The bundled liblog/libbase compat shim defines a getprogname()
fallback macro and then immediately redefines program_invocation_name
using it in a way that collides with musl's own declaration. Fix the
ordering/guard so the two definitions don't conflict.

AI-Generated: Uses Claude Code

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-29 15:35:17 -07:00
Khem Raj df137f3ffd canvenient: include <sys/time.h> for struct timeval on musl
canvenient_socketcan.c uses struct timeval without pulling in a header
that declares it; glibc gets it transitively, musl doesn't.

AI-Generated: Uses Claude Code

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-29 09:57:21 -07:00
Ankur Tyagi 6bbc65fd7a pocketpy: upgrade 2.1.8 -> 2.2.0
Changelog:
https://github.com/pocketpy/pocketpy/releases/tag/v2.2.0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-28 06:57:40 -07:00
Ankur Tyagi e064b21966 python3-psycopg: upgrade 3.3.4 -> 3.3.6
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-27 12:54:15 -07:00
Ankur Tyagi b057d96ae9 grpc: upgrade 1.83.1 -> 1.84.0
Changelog:
https://github.com/grpc/grpc/releases/tag/v1.84.0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-27 07:53:49 -07:00
Ankur Tyagi bdfd9c1fb5 flatcc: upgrade 0.6.3 -> 0.6.4
Changelog:
https://github.com/dvidelabs/flatcc/releases/tag/v0.6.4

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-27 07:53:49 -07:00
Khem Raj 201f3c95cc pocketpy: disable CMake Unity build to fix buildpaths QA warnings
pocketpy's upstream CMakeLists.txt defaults PK_BUILD_WITH_UNITY to ON
for CMake >= 3.16, which makes CMake generate a synthetic translation
unit (Unity/unity_pocketpy_c.c) that #includes every source file by
its absolute build-tree path. That generated file gets copied
verbatim into the pocketpy-src package's /usr/src/debug tree, so its
embedded paths trip the buildpaths QA check for both TMPDIR and the
build host's HOME directory.

Setting OEQA_BUILDPATHS_SKIP as suggested in the warning text would
only silence the HOME-directory half of the check; TMPDIR has no skip
mechanism in insane.bbclass and would keep firing. Instead, disable
the Unity build via -DPK_BUILD_WITH_UNITY=OFF so CMake emits normal
per-file translation units with no absolute paths in their contents.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-09-27 07:51:34 -07:00
Jason Schonberg 38accdd031 php: upgrade 8.5.10 -> 8.5.11
This is a security release.

CVE-2025-1218 CVE-2025-14181
CVE-2026-91765 CVE-2026-91766 CVE-2026-91767 CVE-2026-91768 CVE-2026-91769
CVE-2026-6103 CVE-2026-93682 CVE-2026-92842 CVE-2026-17545

Changelog: https://www.php.net/ChangeLog-8.php#8.5.11
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-26 08:52:57 -07:00
Daiane Angolini e37c3ee6fc android-tools: recommend the USB gadget modules adbd needs
Recommend libcomposite and usb_f_fs from the adbd package.

adbd needs both loaded: android-gadget-setup modprobes the first, and
the second comes in via request_module when the ffs function is
created. Nothing in an image pulls them in, so adbd fails to start on
kernels that build them as modules. A kernel with gadget support built
in ships no kernel-module packages, which recommendations tolerate.

Assisted-by: Claude Code:claude-opus-5

Signed-off-by: Daiane Angolini <daiane.angolini@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-14 13:56:22 -07:00
Peter Marko e2d0044b92 msgpack-c: upgrade 6.1.0 -> 7.0.2
Handles CVE-2026-72854 (in 7.0.2).
Add tag to git SRC_URI.

Release notes:
* https://github.com/msgpack/msgpack-c/releases/tag/c-7.0.0
    Refine CI (#1152)
  << breaking changes >>
    Updated cmake minimum required to 3.5-4.0 (#1160)

* https://github.com/msgpack/msgpack-c/releases/tag/c-7.0.1
  Set INSTALL_INTERFACE to CMAKE_INSTALL_INCLUDEDIR (#1177)

* https://github.com/msgpack/msgpack-c/releases/tag/c-7.0.2
  Fix integer overflow on msgpack_unpacker_expand_buffer(). (#1182)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-14 13:56:21 -07:00
Peter Marko 3adf23dff7 msgpack-cpp: upgrade 8.0.0 -> 9.0.0
Release notes:
* https://github.com/msgpack/msgpack-c/releases/tag/cpp-9.0.0

2026-08-25 version 9.0.0

    Add regression tests for the fixes below. (#1183)
    Fix ext_ref comparison operators ignoring the last payload byte. (#1183)
    Fix out-of-bounds write on self-move-assignment of the create object visitor. (#1183)
    Fix broken array_ref<T[N]> comparison operators. (#1183)
    Fix heap buffer overflow in vrefbuffer::migrate() caused by a wrong growth check. (#1183)
    Fix v1 unpacker not applying str/bin/ext size limits on the reference path. (#1183)
    Fix x3 parser treating uint8 values as negative integers. (#1183)
    Fix double free / use-after-free in zone::swap() (C++03 only). (#1183)
    Fix use-after-free from wrong member destruction order in zone move-assignment. (#1183)
    Fix use-after-free after moving an unpacker (dangling referenced buffer hook). (#1183)
    Fix out-of-bounds read converting a short STR into std::array<char, N> / <unsigned char, N>. (#1183)
    Fix out-of-bounds read and null dereference converting an array whose size differs from the tuple arity. (#1183)
    Fix null pointer dereference converting an empty array into a C array T[N]. (#1183)
    Fix integer overflow in the unpacker buffer expansion size arithmetic. (#1183)

<< breaking changes >>

    Fix ext32 max size truncation on 64bit by widening visit_ext size to size_t. (#1183)
    * If you have a custom visitor that implements visit_ext(), widen its size parameter from uint32_t to std::size_t:
        Before: bool visit_ext(const char* v, uint32_t size)
        After : bool visit_ext(const char* v, std::size_t size)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-14 13:54:16 -07:00
Peter Marko 8d2e4609e3 msgpack-cpp: fix upstream check
Without any prefix/suffix, it picks the highest version-like string.
Set REGEX to pick msgpack-cpp version.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-14 13:54:16 -07:00
Peter Marko 127855a249 msgpack-c: fix upstream check
By default it picks the highest version, which for this repository is
for msgpack-cpp. Set GITTAGREGEX to pick msgpack-c tag.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-13 09:13:41 -07:00
Khem Raj fcface3aaa jsoncpp: fix run-ptest with busybox sed
run-ptest piped ctest output through 'sed -u', which busybox sed does
not support, so the pipeline produced no output and the ptest image
reported "ptests which had no test results: ['jsoncpp']".

Drop sed and classify ctest result lines in awk directly. This also
maps Timeout/Exception/Not Run results to FAIL; previously they were
printed as e.g. "Exception:: <name>" and ignored by the ptest parser.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-12 16:52:16 -07:00
Khem Raj 5bdb6cac38 extract-cert: fix build with OpenSSL 4
OpenSSL 4.0 removed the ENGINE API. <openssl/engine.h> still exists as a
source-compatibility stub, so both binaries fail to link:

  ld.lld: error: undefined symbol: ENGINE_load_builtin_engines
  ld.lld: error: undefined symbol: ENGINE_by_id
  ld.lld: error: undefined symbol: ENGINE_init
  ld.lld: error: undefined symbol: ENGINE_ctrl_cmd_string
  ld.lld: error: undefined symbol: ENGINE_load_public_key

The ENGINE use is confined to the "pkcs11:" input branch of each tool, so
compile that branch out on OpenSSL 4 and diagnose the unsupported input
instead. Reading certificates and public keys from PEM files, which is
what the kernel build and most other users do, is unaffected.

Providers supersede engines, but none exposes an equivalent of the pkcs11
engine's LOAD_CERT_CTRL command, so there is nothing to port to yet.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-09-11 22:47:21 -07:00
Jason Schonberg 8dac658feb nodejs: upgrade 24.20.0 -> 24.21.0
Changelog: https://github.com/nodejs/node/releases/tag/v24.21.0

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-11 07:07:58 -07:00
Khem Raj 0c37249cb3 mercurial: Fix build with python3 linked against openssl 4.x
mercurial's setup.py treats ssl.HAS_TLSv1_2 as authoritative and refuses
to build at all:

  The `ssl` module does not advertise support for TLS 1.2.
  Please make sure that your Python installation was compiled against an
  OpenSSL version enabling these features (likely this requires the
  OpenSSL version to be at least 1.0.1).

  ERROR: mercurial-7.2.4-r0 do_compile: Execution of .../run.do_compile
  failed with exit code 1

Add a patch which only trusts the flag with OpenSSL < 4.0, in setup.py
and in sslutil.supportedprotocols (which otherwise loses b'tls1.2' and
makes `hg debuginstall` under-report the available protocols).

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-11 07:07:58 -07:00
Khem Raj 2eaf5f05b5 microsoft-gsl: upgrade 4.2.2 -> 5.0.0
Release notes:
https://github.com/microsoft/GSL/releases/tag/v5.0.0

Switch to the rel/5.0 branch. New in this release is the gsl::dyn_array
container, so the -dev package gains include/gsl/dyn_array.

Fix the build with clang 22. The tests are compiled with -Weverything
-Werror, so every new clang diagnostic becomes a build failure; the newly
added lifetime-safety suggestions produce:

  notnull_tests.cpp:63:19: error: parameter in intra-TU constructor should
    be marked [[clang::lifetimebound]]
    [-Werror,-Wlifetime-safety-intra-tu-constructor-suggestions]

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-09-08 08:23:17 -07:00
Fabian Pflug 1c4c37d21a systemd-systemctl: enable templated services
The wrapper script previously did not allow to instantiate templated
services without DefaultInstance defined. This change allows
foo@.service be installed and therefor be in enabled state.

In real systemd land, templated units without a specified instance are
valid, but we restrict it here a bit in order to not have a foo@.service
with:

  [Install]
  WantedBy=bar.service    # bar.service starts -> start foo@???.service

In this case, system can never resolve the specific instance of
foo@.service when bar.service is started. It is fixed by adding the
template_only variable, which restricts the dependents of generic
template units to template-only ones. This means the following is still
legal for the above foo@.service:

  [Install]
  WantedBy=bar@.service   # bar@1.service starts -> start foo@1.service
                          # bar@2.service starts -> start foo@2.service
                          # etc...

  WantedBy=bas@1.service  # bas@1.service starts -> start foo@1.service
                          # bas@2.service starts -> no dependency here
                          # etc...

Signed-off-by: Fabian Pflug <f.pflug@pengutronix.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-08 08:23:16 -07:00
Chitti Babu Theegala 03f6939945 boot-time-analysis-tools: add boot time profiling tools
Add two new recipes from the CentOS Automotive SIG
boot-time-analysis-tools project to enable boot time profiling
and measurement.

boot-time-analysis-tools:
  Python-based toolset for collecting, analyzing and visualizing system
  boot timing data from the systemd journal. Provides the 'boot_timings'
  CLI utility which queries D-Bus and the systemd journal to produce
  structured boot time reports. Depends on python3-dbus and python3-systemd
  for runtime journal and D-Bus access.

cntvct-log:
  Userspace C utility built with Meson that logs ARM CNTVCT_EL0 virtual
  counter timestamps to correlate hardware-level timing with systemd boot
  events. Installs cntvct@.service as a systemd template unit (disabled
  by default) for on-demand per-instance activation. The service preset
  file (98-cntvct-log.preset) is installed for system-preset-based enablement.

Both recipes fetch from the same upstream git repository:
  https://gitlab.com/CentOS/automotive/src/boot-time-analysis-tools

Signed-off-by: Chitti Babu Theegala <ctheegal@qti.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-07 19:01:28 -07:00
Sunil DoraandDeepesh Varatharajan 138648195f castxml: Fix build with LLVM 23
Clang 23 renamed ASTContext::getRawCommentForDeclNoCache to
getRawCommentNoCache, so castxml no longer builds:

  src/Output.cxx:1976:47: error: 'const class clang::ASTContext' has no
  member named 'getRawCommentForDeclNoCache'; did you mean
  'getRawCommentNoCache'?

Backport the upstream fix. It is guarded on LLVM_VERSION_MAJOR so older
Clang keeps working. There is no release carrying it yet; v0.7.0 is
still the newest tag.

Co-authored-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-04 17:10:39 -07:00
Ross Burton f727a0847a meta-oe: remove redundant PYPI_PACKAGE assignments
Remove assignments to PYPI_PACKAGE where the value is the default value,
that is the recipe name with any python3- prefix removed.

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-04 17:10:37 -07:00
Joel Winarske f403e76619 capnproto: build position independent code
The recipe produces static archives only, and does not compile them PIC, so
linking capnp or kj into a shared library fails:

  libkj.a(exception.c++.o): relocation R_X86_64_TPOFF32 against
  `kj::(anonymous namespace)::threadLocalCallback' can not be used when making
  a shared object; local-exec is incompatible with -shared

kj/exception.c++ has a file-scope thread_local, which non-PIC code compiles to
the local-exec TLS model. A shared object cannot use that model, so the link
fails on any consumer that puts capnp inside a .so. Debian and Fedora do not
hit this because they ship shared libcapnp.

Set CMAKE_POSITION_INDEPENDENT_CODE. Packaging is unchanged: still static,
still no .so, no new packages and no ABI surface, only the code model differs.

Signed-off-by: Joel Winarske <joel.winarske@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-03 13:23:12 -07:00
Wang Mingyu db0dc39b91 uftrace: upgrade 0.19 -> 0.20
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-03 07:30:37 -07:00
Wang Mingyu 364b7782f0 pstack: upgrade 2.17.7 -> 2.18.4
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-03 07:30:33 -07:00
Khem Raj a7a205ed93 ldns: Disable GOST support
ldns implements GOST exclusively through the OpenSSL ENGINE API, which was
removed in OpenSSL 4.0

Causes

  ./keys.c:664:5: error: use of undeclared identifier 'ldns_key_new_frm_fp_gost_l'
    664 |                                 ldns_key_new_frm_fp_gost_l(fp, line_nr));
        |                                 ^~~~~~~~~~~~~~~~~~~~~~~~~~

USE_GOST gets defined because configure probes for a
working GOST engine using AC_RUN_IFELSE, which cannot run when cross
compiling and therefore falls back to "maybe", which is treated as success.

Pass --disable-gost since the feature cannot work at all without ENGINE
support.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-02 11:48:55 -07:00
Claus Stovgaard 0fbb14ef85 android-tools: Install bootimg utilities
mkbootimg.py is used for creating boot.img for devices with abl
(android bootloader) like Qualcomm qcs8550 and similar.

Signed-off-by: Claus Stovgaard <claus@stovgaard.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-02 11:48:54 -07:00
Khem Raj d72d11b798 doxygen: strip build paths from the generated sources
configgen.py writes the absolute path of config.xml into the header of
every file it generates, so generated_src/configvalues.h, which is
shipped in the doxygen-src package, carries the recipe build directory:

  WARNING: doxygen-1.18.0-r0 do_package_qa: QA Issue: File
  /usr/src/debug/doxygen/1.18.0/generated_src/configvalues.h in package
  doxygen-src contains reference to TMPDIR [buildpaths]

On builders whose HOME is a parent of the build tree the same file e.g.
yocto autobuilder, also trips the build-host HOME variant of the check.

flex leaks the path of the lex file the same way: it emits a #line
directive for the %top{} block even when called with --noline, and
post_lex.py rewrites it to the absolute path of the original .l file.
Those .cpp files are not shipped today, but the leak is the same one.

Strip ${B}/ and ${S}/ from everything under generated_src/ during
do_install, before do_package picks the sources up, so the references
become relative.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-08-30 11:19:47 -07:00
Ankur Tyagi 2f7977478e grpc: upgrade 1.83.0 -> 1.83.1
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-08-29 23:00:18 -07:00
Jaipaul Cheernam 7fd7419390 pjproject: fix build with OpenSSL 4.0
OpenSSL 4.0 makes ASN1_TIME opaque. Backport upstream fix using
ASN1_TIME_to_tm() API.

Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/3923fad2e4f6]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-08-27 23:33:16 -07:00
Jaipaul Cheernam 273228675b grpc: fix build with OpenSSL 4.0
OpenSSL 4.0 returns const pointers from X509 accessor functions,
makes ASN1_OCTET_STRING opaque, and deprecates HMAC one-shot API.

Four patches addressing credentials, TSI transport security, and
TSI utils.

Upstream-Status: Submitted [https://github.com/grpc/grpc/pull/41932]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-08-27 23:33:14 -07:00
Jason Schonberg e5f8c8d53a php: upgrade 8.5.9 -> 8.5.10
This is a bug fix release.

Changelog: https://www.php.net/ChangeLog-8.php#8.5.10

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-08-27 23:33:13 -07:00
Jaipaul Cheernam 559c952507 doxygen: upgrade 1.17.0 -> 1.18.0
Release info: https://www.doxygen.nl/manual/changelog.html#log_1_18_0

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-08-27 23:33:13 -07:00
Jason Schonberg 6e9f266f14 nodejs: upgrade 24.19.0 -> 24.20.0
License-Change: move from zlib 1.3.1 to zlib 1.3.2.1

Changelog: https://github.com/nodejs/node/releases/tag/v24.20.0

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-08-27 23:33:12 -07:00
Wang Mingyu a12018a3a5 ctags: upgrade 6.2.20260816.0 -> 6.2.20260823.0
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-08-26 10:26:43 -07:00
Devansh Patel fe530d55ef ldns: correct CVE_PRODUCT mapping
The default product-only mapping generates a vendor-wildcard CPE.
nlnetlabs:ldns is the active NVD dictionary CPE and configuration
identity for the packaged NLnet Labs source.

This changes the generated product identity to an exact CPE, but the
frozen sbom-cve-check database leaves the eight-entry CVE report
unchanged, with no current CVE delta.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-08-26 10:26:42 -07:00
Devansh Patel 5d23770adc jq: correct CVE_PRODUCT mapping
The default product-only mapping generates a vendor-wildcard CPE.
Use jq_project:jq for the historical NVD dictionary CPE and configuration
identity carrying two jq 1.5 CVEs, and jqlang:jq for the active NVD
dictionary CPE and configuration identity plus CNA affected-data identity
used by the current upstream.

This changes the generated identities to two exact CPEs, but the frozen
sbom-cve-check database leaves the 26-entry CVE report unchanged, with no
current CVE delta.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-08-26 10:26:42 -07:00
Devansh Patel 4b8eedb7d2 php: correct CVE_PRODUCT mapping
The default product-only mapping generates a vendor-wildcard CPE. php:php
is the active NVD dictionary CPE and configuration identity. php_group:php
preserves historical NVD configurations and current authoritative PHP
Security CNA affected data for the same php-src source; it is not an NVD
dictionary CPE.

This changes the generated identities to two exact CPEs, but the frozen
sbom-cve-check database leaves the 731-entry CVE report unchanged, with no
current CVE delta.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-08-26 10:26:42 -07:00
Khem Raj f1fc1f3908 libdbi-perl: add missing perl module ptest RDEPENDS
All 6 ptest failures (t/31methcache, t/35thrclone, t/40profile,
t/41prof_dump, t/42prof_data, t/43prof_env) are missing runtime perl
modules, in two groups:

Module::Load, required by DBI/Profile.pm line 682:

  Can't locate Module/Load.pm in @INC ... at
  /usr/lib/perl5/vendor_perl/5.44.0/aarch64-linux/DBI/Profile.pm line 682.

This breaks t/40profile and t/43prof_env directly, and cascades into
t/41prof_dump and t/42prof_data: once DBI/Profile.pm fails to compile,
%INC is poisoned, so those two report "Attempt to reload DBI/Profile.pm
aborted" and a missing DBI::Profile->flush_to_disk method rather than
the underlying cause. Provided by perl-module-load.

Test2::Util::Sig, required by Test2/IPC/Driver/Files.pm line 18, which
Test::Builder pulls in when a test enables Test2 IPC (threads/forking):

  Can't locate Test2/Util/Sig.pm in @INC ... at
  /usr/lib/perl5/5.44.0/Test2/IPC/Driver/Files.pm line 18.

This makes Test::More unusable in t/31methcache and t/35thrclone, which
is why only those two of the many Test::More-based tests fail. Provided
by perl-module-test2-util-sig.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-08-22 18:50:04 -07:00