mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-14 18:07:06 +00:00
Code Issues Projects Releases Wiki Activity
40,654 Commits 65 Branches 0 Tags
master
Commit Graph
40654 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Alex Kiernan 57918219f8 python3-asyncvarlink: upgrade 0.3.2 -> 0.3.3 
Alex Kiernan (2):
      VarlinkTransport: stop reading after a failed peek
      VarlinkTransport: treat a failed read as a lost connection

Colin Watson (1):
      types: return NotImplemented from __eq__ for type errors

Helmut Grohne (37):
      varlinkmethod: allow overriding the return type
      reduce contents of the main import and avoid star imports
      CI: tune certification socket timeout
      CI: fixup certification timeout change
      document that it is uploaded to PyPI
      docs/structure.rst: finish truncated paragraph on file descriptors
      pyproject.toml: document development packages
      VarlinkTransport: send correct data on partial send
      validate_interface: fix acceptance of garbage at end
      create_unix_server: actually make the socket non-inheritable
      docs: adapt documentation to pause_reading/resume_reading rename
      __init__.py: improve language of initial __doc__ string
      GenericVarlinkErrorReply: provide a __str__ method
      connect_unix_varlink: fix resource leak in error path
      VarlinkTransport: delay eof_received call
      VarlinkTransport: remember the readable handler function
      VarlinkTransport: turn a magic number into a class attribute
      expand ci coverage to Python 3.15
      VarlinkTransport: fix association of messages and file descriptors
      correctly determine whether typing.override exists
      fix result type of wrapped varlinkmethod
      github: allow manually scheduling workflows
      test_protocol.py: fix missing import
      VarlinkTransport: tighten assertion
      test_protocol.py: close the transport, not the connections
      VarlinkTransport: harden resume_reading against concurrent closing
      TransportTests.test_send_socket: avoid exceptions in callbacks
      VarlinkClientProtocol.call: avoid failing future with no consumers
      test_certification.py: delete unused import
      test_protocol.py: delete unused import again
      tests: add StrictAsyncioTestCase helper class and use it
      tests: another type hint improvement
      test_conversion.py: increase precsion of two type annotations
      varlinkmethod: clarify that the type annotation must signal generators
      add a HACKING.md file clarifying development processes
      add the justfile promised in HACKING.md
      upload to pypi as version 0.3.3

Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-13 18:57:12 -07:00
Peter Marko c387452547 python3-thrift: upgrade 0.22.0 -> 0.25.0 
This upgrade includes fix for 61 CVEs, many of them are for python.
Add a dependency missing at least since 0.20.0 for code:

lib/py/src/server/TProcessPoolServer.py:from multiprocessing import Process, Value, Condition

Release announcement: [1]
Release notes: [2]

[1] https://lists.apache.org/thread/prryfzdozvt6t02c9k5jf46or3m7ctzy
[2] https://github.com/apache/thrift/blob/v0.25.0/CHANGES.md

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-13 12:30:07 -07:00
Poornima Lokesh d2aa0f282c mariadb: upgrade 11.4.12 -> 11.4.13 
Fixes CVE-2026-107816: an out-of-bounds heap read in the qc_info plugin
when reading information_schema.query_cache_info after caching a query
that contains embedded null bytes, which could disclose adjacent heap
memory or crash the server.

Drop c21bb11be28ae9b2432b2a661bf38a197cf9514d.patch, which is already
included upstream in 11.4.13.

Disable the DuckDB storage engine (new in 11.4.13) via -DPLUGIN_DUCKDB=NO:
it bundles its own CMake subproject that is not cross-compile aware and
fails do_compile in a cross environment.

CVE: CVE-2026-107816
Signed-off-by: Poornima Lokesh <Poornima.Lokesh@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-13 12:30:07 -07:00
Alex Kiernan cbf3962ed4 python3-yarl: upgrade 1.24.5 -> 1.25.1 
aiohttp 3.14.4 requires yarl >= 1.25.1 and imports query_to_pairs,
which 1.24.5 does not have, so importing aiohttp.web fails with:

  ImportError: cannot import name 'query_to_pairs' from 'yarl'

AI-Generated: Claude Opus 5.5 (Claude Code)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-13 12:30:07 -07:00
Etienne Cordonnier bce850cb0a uutils-coreutils: improve SUMMARY 
The previous SUMMARY could be read as suggesting that this recipe is the
official GNU coreutils project. Reword it to state that uutils is a
separate, Rust reimplementation.

Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-13 12:30:07 -07:00
Leon Anavi cae9015e84 python3-wrapt: Upgrade 2.4.0 -> 2.5.0 
Upgrade to release 2.5.0:

- Added with_doc, a decorator for overriding the docstring that
  help(), pydoc and other introspection tools see for a wrapped
  callable without mutating the wrapped function itself. It is the
  companion of with_signature. The docstring can be supplied
  directly, or as a factory callable that derives it from the
  wrapped function at decoration time. When stacked above
  with_signature the factory sees the overridden signature and can
  embed it in the docstring. Assigning to __doc__ on the resulting
  wrapper replaces the override, and deleting it restores
  delegation to the wrapped function. Previously the only option
  was to assign to __doc__ on a wrapper, which writes through to
  the wrapped function since __doc__ on every proxy delegates to
  the wrapped object, and so changed what was reported for the
  wrapped function everywhere. The override is handled for instance
  methods, class methods and static methods, and propagates through
  outer wrapt decorators stacked on top. See the "Docstring
  Override" section of Bundled Decorators for details.
- with_signature now accepts a doc argument for overriding the
  docstring at the same time as the signature, and the factory
  callable may return a tuple of (signature_or_prototype,
  docstring) so that a single factory can derive both from the
  wrapped function in one pass. When doc is supplied, the docstring
  from the tuple is ignored. When neither is given, __doc__
  continues to delegate to the wrapped function as before,
  including for assignment and deletion.
- A class derived from wrapt.BaseObjectProxy may now define __doc__
  as a property, or other descriptor, in its class body, and that
  is used for instances of the class in place of the default
  delegation of __doc__ to the wrapped object. This works with both
  the pure Python implementation and the C extension, and the
  descriptor is inherited by further derived classes. Previously
  the pure Python metaclass overwrote such a descriptor with the
  default delegating property, and the C extension forwarded
  __doc__ to the wrapped object before consulting the type, so it
  was never used. Only __doc__ is affected, with __module__ always
  delegating to the wrapped object. This is the mechanism with_doc
  relies on.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-13 12:30:06 -07:00
Leon Anavi a593dc46ec python3-texttable: Upgrade 1.7.0 -> 1.7.1 
Upgrade to release 1.7.1:

- Consume Python 3 row iterators when reading table headers
- Invalidate horizontal lines when characters or widths change

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-13 12:30:06 -07:00
Ankur Tyagi 031bdc4ab3 gpsd: patch CVE-2026-60122 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-60122

(cherry picked from commit da527bb6ba)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:17 -07:00
Ankur Tyagi b9c3d34642 tesseract: patch CVE-2026-88054 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88054

(cherry picked from commit 4c00053135)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:17 -07:00
Ankur Tyagi 4c928862f5 tesseract: patch CVE-2026-88051 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88051

(cherry picked from commit 727354dae2)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:17 -07:00
Ankur Tyagi 2ba3ed5dc8 tesseract: patch CVE-2026-88047 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88047

(cherry picked from commit b8fa7aac91)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:16 -07:00
Ankur Tyagi cc2b58f135 tesseract: patch CVE-2026-88050 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88050

(cherry picked from commit 4aab0847c2)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:16 -07:00
Ankur Tyagi 909d433ca0 tesseract: patch CVE-2026-88049 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88049

(cherry picked from commit 218b6a19b1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:16 -07:00
Ankur Tyagi 0aa1782e95 tesseract: patch CVE-2026-88048 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88048

(cherry picked from commit 9e544d6e50)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:15 -07:00
Ankur Tyagi 8ee82e432c tesseract: patch CVE-2026-88052 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88052

(cherry picked from commit 251dd7f80d)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:15 -07:00
Ankur Tyagi bf39596278 strongwan: upgrade 6.0.7 -> 6.1.0 
- Remove PACKAGECONFIG entries for soup, tnc-ifmap, tnccs-11, tnccs-dynamic
- Include xauth-generic in default PACKAGECONFIG. This preserves default
  plugin as upstream disabled IKEv1 by default.

root@qemux86-64:~# swanctl --stats
uptime: 38 seconds, since Oct 13 03:27:29 2026
worker threads: 16 total, 11 idle, working: 4/0/1/0
job queues: 0/0/0/0
jobs scheduled: 0
IKE_SAs: 0 total, 0 half-open
mallinfo: sbrk 1503232, mmap 0, used 552176, free 951056
loaded plugins: charon-systemd random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pgp dnskey sshkey pem openssl pkcs8 xcbc cmac kdf drbg curl sqlite attr kernel-netlink resolve socket-default vici updown xauth-generic

Changelog:
https://github.com/strongswan/strongswan/releases/tag/6.1.0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:15 -07:00
Ankur Tyagi 30acdca706 sngrep: patch CVE-2026-90558 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-90558

(cherry picked from commit 36ddee53b1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:15 -07:00
Ankur Tyagi ba9537ae1f ntopng: patch CVE-2026-86090 and CVE-2026-86091 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-86090
https://nvd.nist.gov/vuln/detail/cve-2026-86091

(cherry picked from commit ae180302f4)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:14 -07:00
Ankur Tyagi 4e8a7265bd ntopng: patch CVE-2026-84990 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84990

(cherry picked from commit 2d932fa4e3)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:14 -07:00
Ankur Tyagi df5f8478c4 smarty: mark CVE-2026-82531 patched 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-82531

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:14 -07:00
Ankur Tyagi c8dd8428d0 cjson: patch CVE-2026-87933 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-87933

(cherry picked from commit 2b3f5cbbd8)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:13 -07:00
Ankur Tyagi 96cedce046 python3-eventlet: mark CVE-2023-29483 fixed 
Fix[1] for the CVE is part of the upstream version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-29483

[1]https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4

(cherry picked from commit 47b2ce9cc7)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:13 -07:00
Ankur Tyagi 896ea53058 openvpn: upgrade 2.7.7 -> 2.7.8 
Changelog:
https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:12 -07:00
Peter Marko 53ffd4623b thrift: upgrade 0.24.0 -> 0.25.0 
This upgrade includes fix for 61 CVEs.
Refreshed/removed patches via devtool.

Release announcement: [1]
Release notes: [2]

[1] https://lists.apache.org/thread/prryfzdozvt6t02c9k5jf46or3m7ctzy
[2] https://github.com/apache/thrift/blob/v0.25.0/CHANGES.md

License-Update: Added notice for MIT license of a Makefile

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 14:20:30 -07:00
Ricardo Salveti b2486769a3 polkit: keep the agent helper units in the main package 
Commit 3e423e21e5 ("polkit: enable the agent helper socket") enables
polkit-agent-helper.socket from polkit, but since 03420389ca ("polkit:
Add a separate package for polkit systemd service/dbus config")
polkit-service comes first in PACKAGES and takes the whole systemd unit
directory, so the socket is packaged there. Images that install polkit
without polkit-service then fail in do_rootfs:

  Failed to enable unit: Unit polkit-agent-helper.socket does not exist

Installing polkit-service as well does not help with rpm, as it depends
on polkit, whose postinst then runs before the socket unit is installed.

Only package polkit.service in polkit-service, so the agent helper units
stay in polkit with polkit-agent-helper-1, as FILES:${PN} already
intends.

AI-Generated: Uses Claude Code
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 12:00:52 -07:00
Khem Raj 7a14b1e465 Revert "pipewire: add pw-voiceui SVA voice-UI control/listen client" 
This reverts commit a09474fb9a.

Upstream has rejected this patch [1], it was
added here in hope it will be accepted in pipewire.

[1] https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/2969#note_3631852

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Cc: Nicolas Dechesne <nicolas.dechesne@oss.qualcomm.com>
Cc: Kiruthika Vijayasekar <kvijayas@qti.qualcomm.com>
Cc: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
 2026-10-12 11:51:12 -07:00
Igor Opaniuk eb6f714c6b libzip: drop recipe 
The recipe has been moved to oe-core in commit f17e8750c3 ("libzip:
import recipe from meta-oe").

Signed-off-by: Igor Opaniuk <igor.opaniuk@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:57 -07:00
Martin Jansa ced616944a Revert "python3-google-api-core, python3-googleapis-common-protos: set PYPI_PACKAGE_SDIST" 
This reverts commit b9cc78ed6b.

The same issue was resolved in:
https://git.openembedded.org/meta-openembedded/diff/meta-python/recipes-devtools/python/python3-google-api-core_2.19.1.bb?id=0a583b35021692dac485c16d85b3f9a9f5601da0
with the only difference of using PYPI_PACKAGE variable
instead of another hardcoded pypi name.

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:57 -07:00
Ankur Tyagi 1c45c216f6 7zip: upgrade 26.03 -> 26.04 
Changelog:
https://github.com/ip7z/7zip/releases/tag/26.04

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi 95db044886 open62541: upgrade 1.5.8 -> 1.5.9 
Changelog:
https://github.com/open62541/open62541/releases/tag/v1.5.9

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi 8cd6a6b15a libde265: patch CVE-2026-54240 and CVE-2026-54241 
Debian identified same commit as fix for both CVEs[1][2].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54240
https://nvd.nist.gov/vuln/detail/cve-2026-54241

[1]https://security-tracker.debian.org/tracker/CVE-2026-54240
[2]https://security-tracker.debian.org/tracker/CVE-2026-54241

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi a1a902b3b9 libde265: patch CVE-2026-49346 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49346

(cherry picked from commit 4a63a2afa1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi 6f9970147f libde265: patch CVE-2026-49337 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49337

(cherry picked from commit c83399f83f)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi 2bba25a0e6 libde265: patch CVE-2026-49295 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49295

(cherry picked from commit bd09bb41b4)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi 9b938c1616 tinyproxy: patch CVE-2026-55202 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55202

[1]https://security-tracker.debian.org/tracker/CVE-2026-55202

(cherry picked from commit 233e6a56e5)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:15 -07:00
Ankur Tyagi c3796d630f tinyproxy: patch CVE-2026-54387 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54387

[1]https://security-tracker.debian.org/tracker/CVE-2026-54387

(cherry picked from commit 33649b0657)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:15 -07:00
Ankur Tyagi 568c569c2f tinyproxy: patch CVE-2026-31842 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-31842

[1]https://security-tracker.debian.org/tracker/CVE-2026-31842

(cherry picked from commit 985acd9e7c)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:15 -07:00
Ankur Tyagi d015851ed9 libyang: patch CVE-2026-41401 
Backport patch identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41401

[1]https://security-tracker.debian.org/tracker/CVE-2026-41401

(cherry picked from commit 6b06704ac1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 2c888ebe75 miniupnpd: patch CVE-2026-107159 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-107159

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 0f8cf2b6f7 libiec61850: mark CVE-2024-45969 patched 
NVD[1] mentions commit[2] for v1.5 but is also present in v1.6[3]

[1] https://nvd.nist.gov/vuln/detail/cve-2024-45969
[2] https://github.com/mz-automation/libiec61850/commit/7afa40390b26ad1f4cf93deaa0052fe7e357ef33
[3] https://github.com/mz-automation/libiec61850/commit/d1ab50298fcba3f87b1e58dabff92f8615b14ee7

(cherry picked from commit a7088b0fda)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 796a3d4adb hdf5: patch CVE-2026-19025 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].

[1] https://github.com/HDFGroup/hdf5/pull/6508
[2] https://github.com/HDFGroup/hdf5/issues/6491
[3] https://nvd.nist.gov/vuln/detail/cve-2026-19025

(cherry picked from commit df3f814ab8)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 0cdf123177 hdf5: patch CVE-2026-17574 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-17574

(cherry picked from commit 637f437de9)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 5ac7a070e3 hdf5: patch CVE-2026-17573 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.

[1] https://github.com/HDFGroup/hdf5/pull/6160
[2] https://github.com/HDFGroup/hdf5/issues/6124
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17573
[4] https://security-tracker.debian.org/tracker/CVE-2026-17573

(cherry picked from commit f46990293c)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 5468d43cbd hdf5: patch CVE-2026-17572 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.

[1] https://github.com/HDFGroup/hdf5/pull/6499
[2] https://github.com/HDFGroup/hdf5/issues/6501
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17572
[4] https://security-tracker.debian.org/tracker/CVE-2026-17572

(cherry picked from commit c279e9e688)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi ed7807e83b python3-gunicorn: mark CVE-2024-1135 patched 
Debian[1] also identified the commit.

Details:
https://nvd.nist.gov/vuln/detail/cve-2024-1135

[1]https://security-tracker.debian.org/tracker/CVE-2024-1135

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:41 -07:00
Ankur Tyagi 2873762621 wolfssl: mark CVEs patched 
CVE-2023-6937[1] and CVE-2024-5814[2] are patched in current version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-6937
https://nvd.nist.gov/vuln/detail/cve-2024-5814

[1]https://github.com/wolfSSL/wolfssl/blob/v5.6.6-stable/ChangeLog.md#vulnerabilities
[2]https://github.com/wolfSSL/wolfssl/blob/v5.7.2-stable/ChangeLog.md#vulnerabilities

(cherry picked from commit c12fcc9b48)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:41 -07:00
Ankur Tyagi 58ca5eac91 iniparser: mark CVE-2025-0633 pached 
Also mentioned in the release notes[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2025-0633

[1] https://gitlab.com/iniparser/iniparser/-/releases/v4.2.6

(cherry picked from commit 86fba2b580)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:41 -07:00
Ankur Tyagi bef03c1c45 gerbera: ignore CVE-2025-23386 
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-23386

This vulnerability is due to openSUSE specific packaging issue.

(cherry picked from commit 369d962967)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:41 -07:00
Ankur Tyagi 34576300e0 gpm: ignore CVE-2025-4558 
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-4558

(cherry picked from commit e134adc8f3)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:41 -07:00
Ankur Tyagi 997a8ab5af haveged: ignore CVE-2026-41054 
Debian[1] also confirms the fixed version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41054

[1] https://security-tracker.debian.org/tracker/CVE-2026-41054

(cherry picked from commit 086a780db0)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:40 -07:00