2565 Commits

Author SHA1 Message Date
Xiaozhan Li b5a792e209 jemalloc: fix always_inline build failure
Enable debug build flag in jemalloc to avoid error as below:
inlining failed in call to 'always_inline' 'heap_ph_cmp':
function not considered for inlining

Signed-off-by: Xiaozhan Li <Xiaozhan.Li.CN@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-23 07:54:07 -07:00
Gyorgy Sarvari aef8bc3422 protobuf, python3-protobuf: ignore CVE-2026-6409
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-6409

The vulnerability impacts only the PHP library component, not the
cpp/python one. Ignore this CVE due to this.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-20 07:35:37 -07:00
Gyorgy Sarvari 2b1e34f0f5 jq: patch CVE-2026-39979
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-39979

Backport the patch that is referenced by the NVD advisory.y

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-20 07:35:33 -07:00
Gyorgy Sarvari 8d399af333 jq: patch CVE-2026-33948
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-33948

Backport the patch that is referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-20 07:35:33 -07:00
Gyorgy Sarvari 525e18ce21 jq: patch CVE-2026-33947
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-33947

Backport the patch that is referenced by the NVD report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-20 07:35:33 -07:00
Gyorgy Sarvari e94ab85126 jq: patch CVE-2026-32316
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-32316

Backport the patch that is referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-20 07:35:33 -07:00
Khem Raj 574aa17a02 libtoml11: Fix build with C23 and clang
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-17 14:15:58 -07:00
Jörg Sommer d09f50438f lshw: Fix binmerge
In case $sbindir = $bindir we have to pass this setting to make.

Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-15 22:45:59 -07:00
Zeming LIU f23c00b163 jsoncpp: add ptest support
Add ptest support for jsoncpp to enable automated testing of the
JSON C++ library functionality.

Note:
- Tested on: WRLinux master-wr (based on meta-openembedded master)
- jsoncpp version: 1.9.7
- Unable to test on pure upstream due to poky/meta-oe branch mismatch

Test Result:
root@qemux86-64:~# ptest-runner jsoncpp
START: ptest-runner
2026-04-15T14:04
BEGIN: /usr/lib64/jsoncpp/ptest
PASS: jsoncpp_readerwriter
PASS: jsoncpp_readerwriter_json_checker
PASS: jsoncpp_test
DURATION: 122
END: /usr/lib64/jsoncpp/ptest
2026-04-15T14:06
STOP: ptest-runner
TOTAL: 1 FAIL: 0

Signed-off-by: Zeming LIU <zeming.liu@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-15 22:45:58 -07:00
Wang Mingyu 38402132a9 mpich: upgrade 5.0.0 -> 5.0.1
Changelog:
==========
- Fix bad cast in release-gather collectives that caused data loss
  issues on Big-Endian 64b arches (s390x)
- Fix issue with canceling MPI_ANY_SOURCE receive requests
- Fix configuration issue when C++ compiler does not support complex types
- Fix function signature issue in Hydra PBS support
- Fix crash in MPI_Allreduce with MPI_LOGICAL type
- Fix potential crash in multi-nic libfabric initialization
- Fix memory leaks in Level Zero and PMIx support
- Fix bug in CMA code when GPU support is enabled
- Fix potential shared memory collision between multiple singleton
  processes on the same node
- Add large count and other necessary aliases to ROMIO to avoid
  accidental profiling of internal MPI function usage
- Add missing error checks in rndv and colletive composition code
- Improve autogen.sh error message when autotools are too old

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-14 08:59:32 -07:00
Wang Mingyu c3461d98fb b4: upgrade 0.15.1 -> 0.15.2
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-14 08:59:30 -07:00
Ross Burton 8093eeb036 xerces-c: fix escaping in CVE_PRODUCT
The CPE parsing in oe-core's cve_check.py now handles escapes correctly[1]
so we don't need to escape in CVE_PRODUCT.

[1] oe-core 3c73dafd03b ("cve_check: Improve escaping of special characters in CPE 2.3")

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-14 08:59:29 -07:00
Gyorgy Sarvari b483760dba nodejs: mark CVE-2026-21710 patched
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-21710

The CVE is fixed in the current recipe version[1], but NVD tracks it
without verison info.

Mark it as patched in the recipe.

[1]: https://github.com/nodejs/node/blob/v22.x/doc/changelogs/CHANGELOG_V22.md

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-13 15:28:25 -07:00
Khem Raj a2d9a9be5f ltrace: Upgrade to 0.8.1 and clang build errors
Drop the upstream applied patches
Add patches to fix build with clang-22
Bump PE to account for version going from 7.x to 0.8

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-12 16:42:04 -07:00
Jason Schonberg abf8a5cfec php: upgrade 8.5.4 -> 8.5.5
This is a bug fix release.

Changelog: https://www.php.net/ChangeLog-8.php#8.5.5

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 17:25:49 -07:00
Changqing Li 2966646af2 protobuf-c: upgrade 1.5.1 to 1.5.2
Changes[1]:
* Chase compatibility issues with Google protobuf 30.0-rc1 by @edmonds in https://github.com/protobuf-c/protobuf-c/pull/762
* protoc-gen-c: Explicitly construct strings where needed for protobuf 30.x by @edmonds in https://github.com/protobuf-c/protobuf-c/pull/768

Remove protobuf-30.patch, this patch already included in 1.5.2

[1] https://github.com/protobuf-c/protobuf-c/compare/v1.5.1...v1.5.2

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:52 -07:00
Peter Kjellerstedt ed33569f82 jq: Use Git to fetch the code
There is a bug (see https://github.com/jqlang/jq/issues/434), which
results in an empty version being used if autoreconf is run on the jq
sources when using a release tar ball. The incorrect assumption is that
autoreconf is only used when fetching the code using Git.

The empty version results in an incorrect libjq.pc file being created
where the version is not set, which results in, e.g.,
`pkgconf --libs 'libjq > 1.6'` failing even if version 1.8.1 of jq is
actually installed.

Switch to fetching the code using Git to workaround the bug.

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:52 -07:00
Gyorgy Sarvari 22a31ea701 nodejs: ignore fixed CVEs
All these CVEs are fixed in v22.22.2[1], except for CVE-2026-21712,
which does not affect v22 series, because it was introduced in a
later version[2]. All these CVEs are tracked without version info
by NVD at the time of creating this patch.

[1]: https://github.com/nodejs/node/blob/v22.x/doc/changelogs/CHANGELOG_V22.md
[2]: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:31 -07:00
Gyorgy Sarvari a0531bc55a giflib: mark CVE-2026-23868 patched
The fix[1] that is referenced by the NVD advisory is
already included in the current recipe version.

[1]: https://sourceforge.net/p/giflib/code/ci/f5b7267aed3665ef025c13823e454170d031c106/

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:30 -07:00
Wang Mingyu 8db28a60e3 sip: upgrade 6.15.2 -> 6.15.3
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-01 19:29:11 -07:00
Wang Mingyu 8a92f95a89 debootstrap: upgrade 1.0.142 -> 1.0.143
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-01 19:29:03 -07:00
Wang Mingyu 0d360f35db ctags: upgrade 6.2.20260322.0 -> 6.2.20260329.0
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-01 19:29:03 -07:00
Wang Mingyu d8f72725a0 b4: upgrade 0.15.0 -> 0.15.1
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-01 19:29:03 -07:00
Gyorgy Sarvari ddfd1cadb2 giflib: upgrade 5.2.2 -> 6.1.2
Drop patch that was merged upstream.

License update: a copyright line was removed. The license is still MIT.

Changes:
Version 6.1.2
=============

Code Fixes
----------
* Fix for low-severity CVE-2026-23868 affecting gifponge, giftool, and gifbuild,
  but not the core library - library clients need not be alarned.

Version 6.1.1
=============

This release bumps the major version, but only one entry point -
EGifSpew() - has changed signature and behavior (in order to be able
to pass out a detailed error code). The internal error
codes in the E_GIF_ERR series have changed value so none of them
collides with GIF_ERROR.

This code has been systematically audited and hardened wuth
ChatGPT-5.2. The only library fixes reported by users or found by
robot were for some memory leaks that could only triggered by severely
malformed GIFs. Other bugs are edge-case failures in the CLI tools.

The gif2rbg CLI tool has been moved to the "obsolete" bin, because its
only deployment case in 2026 is as a piñata at fuzzer parties.

Warning: the CLI tools in the obsolete category will soon be removed
from the distribution entirely. The maintainer is tired of fielding
junk bugs filed against them by would-be coup-counters who found yet
another edge case, and the rest of the world doesn't need noisy CVEs
that aren't actually DoS or security issues for giflib clients.

Code Fixes
----------

* Fix for CVE-2021-40633.
* Fix SF bug #165 EGifSpew leaks GifFileOut->SColorMap
* Fix SF bug #171 ImageMagick required to build giflib on non-Darwin Platforms
* Fix SF bug #172 Incorrect object files in shared libutil on darwin
* Fix SF bug #173 installation of manual pages and html documentation
* Fix SF bug #175 Memory leaks in gifecho.c's main() and in gifalloc.c's GifMakeMapObject
* Fix SF bug #177 wrong pointer used in giftool getbool
* Fix SF bug #179 Path Traversal vulnerability
* Fix SF bug #180: -Wformat-truncation likely pointing out an actual bug
* Fix SF bug #182 out‐of‐bounds writes in Icon2Gif
* Fix SF bug #184 uninitialized buffer in DumpScreen2RGB
* Fix SF bug #185 integer overflow in gifbg.c
* Fix SF bug #186 integer overflow in Icon2Gif
* Fix SF bug #187: CVE-2025-31344
* Fix SF bug #170 Tests failing on Ubuntu Noble, giftext buffer overflow
* Fix SF bug #165 EGifSpew leaks GifFileOut->SColorMap
* Fix SF bug #162 detected memory leaks in GifMakeSavedImage giflib/gifalloc.c
* Fix SF bug #161 detected memory leaks in EGifOpenFileHandle giflib/egif_lib.c
* Fix SF bug #142 ABI break public symbol GifQuantizeBuffer

Other bugs that duplicate these have breen addressesed by these fixes

* SF bug #156 EGifSpew leaks SavedImages (and more); won't fix, caller
  might want to write a GIF, modify the in-memory data, then write
  again.

Tests
-----

Test suite now emits TAP (Test Anything Protocol).

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-01 14:07:45 -07:00
Michael Fitzmayer 269bae787f canvenient: update to version 1.01
- Add versioning
- New version to be able to use a proper version tag
  in the Yocto recipe

Signed-off-by: Michael Fitzmayer <mail@michael-fitzmayer.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-01 13:18:13 -07:00
Michal Sieron 4f37dfeafe flatbuffers: Convert confusing append to override syntax
While in this case `SYSROOT_PREPROCESS_FUNCS:class-target +=` wouldn't
result in any unwanted override, there is no guarantee there won't be a
change, which would be hidden by this override. To avoid any surprises
in the future let's use `:append:class-target =` syntax here.

Signed-off-by: Michal Sieron <michalwsieron@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-01 13:16:38 -07:00
Michael Fitzmayer 343f5a7a75 Add recipe: isocline 1.0.9
Isocline is a pure C library that can be used as an alternative to the GNU readline library.

Signed-off-by: Michael Fitzmayer <mail@michael-fitzmayer.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-03-30 19:46:41 -07:00
Peter Marko 95446dcf8f grpc: upgrade 1.78.1 -> 1.80.0
License-Update: Re-scope secondary licenses [1]
Release information [2]:

This is release 1.80.0 (glimmering) of gRPC Core.
Core
* [ssl] Implement TLS private key signer in Python. (#41701)
* [TLS Credentials]: Private Key Offload Implementation. (#41606)
* Fix max sockaddr struct size on OpenBSD. (#40454)
* [core] Enable EventEngine for Python by default, and EventEngine fork support in Python and Ruby. (#41432)
* [TLS Credentials]: Create InMemoryCertificateProvider to update certificates independently. (#41484)
* [Ruby] Build/test ruby 4.0 and build native gems with Ruby 4.0 support. (#41324)
* [EventEngine] Remove an incorrect std::move in DNSServiceResolver constructor. (#41502)
* [RR and WRR] enable change to connect from a random index. (#41472)
* [xds] Implement gRFC A101. (#41051)
C++
* [C++] Add SNI override option to C++ channel credentials options API. (#41460)

[1] https://github.com/grpc/grpc/commit/fb53717dfa6b264e7f930bb5e9a7e5c86a31ed9e
[2] https://github.com/grpc/grpc/releases/tag/v1.80.0

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-03-30 19:46:40 -07:00
Khem Raj e79ff35fbe include-what-you-use: Upgrade to 0.26
This works with clang-22

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-03-30 19:46:38 -07:00
Wang Mingyu 9bcba5654d sip: upgrade 6.15.1 -> 6.15.2
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-03-27 09:09:03 -07:00
Wang Mingyu 485d35a7b0 ctags: upgrade 6.2.20260308.0 -> 6.2.20260322.0
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-03-26 07:43:37 -07:00
Wang Mingyu 4060dcda65 b4: upgrade 0.14.3 -> 0.15.0
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-03-26 07:43:36 -07:00
Khem Raj b5bb24b356 spdm-utils: Upgrade to tip of trunk
Needed to fix build with rust 1.94+

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Cc: Alistair Francis <alistair.francis@wdc.com>
2026-03-25 23:29:31 -07:00
Deepesh Varatharajan d0f83b6df2 librust-cxx: Fix update_crates command in crates.inc
Update comment to use correct recipe name
(librust-cxx instead of cxx).

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-03-25 23:29:30 -07:00
Changqing Li 92fa6c0f86 Luajit: Update to latest on v2.1 branch
License-Update: copyright year updated

Apply missing SRCREV update

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-03-25 16:32:44 -07:00
Jason Schonberg d32cd27eaa nodejs: upgrade 22.22.1 -> 22.22.2
This is the March 2026 security release.

  2 high severity issues.
  5 medium severity issues.
  2 low severity issues.

High priority fixes:
  CVE-2026-21637
  CVE-2026-21710

Medium priority fixes:
  CVE-2026-21711 (affects only nodejs v25)
  CVE-2026-21712 (affects only nodejs v24 & v25)
  CVE-2026-21713
  CVE-2026-21714
  CVE-2026-21717

Low priority fixes:
  CVE-2026-21715
  CVE-2026-21716

https://nodejs.org/en/blog/vulnerability/march-2026-security-releases

Changelog: https://github.com/nodejs/node/releases/tag/v22.22.2

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-03-24 23:32:48 -07:00
Ross Burton 77ea4610d8 protobuf: disable ptests for now
oe-core just moved from pkgconfig to pkgconf, which has broken the
ptest buikd due to how fragile the compilation was.

This will be revisited to build the tests properly, but for now simply
disable the ptests.

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-03-24 09:13:49 -07:00
Peter Marko e71ef5a4a1 jsoncpp: upgrade 1.9.6 -> 1.9.7
Added tag to SRC_URI.

Release information [1]:

1.9.7: Bugfixes, build system cleanups
What's Changed
* Fixes PreventInSourceBuilds.cmake to work with add_subdirectory by @morbo84 in #1383
* json_value.cpp bug in the edges of uint/int by @YaalLek in #1519
* Release 1.9.6 and move versions to 1.9.7 by @baylesj in #1566
* Fixed work secure_allocator on old compiers by @TsynkPavel in #1478
* Fix flag -DJSONCPP_USE_SECURE_MEMORY:BOOL=TRUE by @tfc in #1567
* fix(build): remove check_required_components for meson build by @chenrui333 in #1570
* the cgi module was removed from Python3.13 by @a-detiste in #1578
* Fix name of static library when targeting MinGW. by @mmuetzel in #1579
* Fix comparison warnings caused by 54fc4e2 by @JensMertelmeyer in #1575
* Drop pre-C++11 alternatives by @BillyDonahue in #1593
* feat: support std::string_view in Value API by @evalon32 in #1584
* Added Value::findType with String key by @SwintonStreet in #1574
* Set up for Bazel module builds. by @bcsgh in #1597
* Add a BUILD.bazel file for //example. by @bcsgh in #1602
* Fix "include what you use" issue by @victorvianna in #1625
* Make the build configuration under Bazel more correct. by @bcsgh in #1600
* Add Bazel tests by @bcsgh in #1601
* Return false in Reader::readValue when stack limit is exceeded by @xuhdev in #1619
* Remove deprecated/removed clang-tidy key AnalyzeTemporaryDtors (#1614) by @bmagistro in #1615
* [docs] Consuming JSONCpp via Conan package manager by @uilianries in #1622
* Cleanup README.md, fix broken link. by @baylesj in #1633
* Add gcovr.cfg to fix CI coverage merge errors by @baylesj in #1635
* Remove build directory exclusion from gcovr config by @baylesj in #1640
* Add test for allowDroppedNullPlaceholders by @baylesj in #1648
* Prevent test colision when running in parallel via RESOURCE_LOCK by @marty1885 in #1637
* fixup project version updater by @baylesj in #1649
* Update README with project status and focus by @baylesj in #1639
* Adding a cmake option to exclude the jsoncpp files from install. by @nv-jdeligiannis in #1596
* Change stack depth limit to 256 by @baylesj in #1657
* Fix uninitialized CMake variable in version.in by @baylesj in #1658
* Fix CMake deprecation warning for compatibility with CMake < 3.10 by @baylesj in #1659
* Scope JSON_DLL_BUILD to shared lib target only by @baylesj in #1660
* Fix number parsing failing under non-C locales by @baylesj in #1662
* Reject unescaped control characters in JSON strings by @baylesj in #1663
* Fix MSAN issue in #1626 by @baylesj in #1654
* Fix string_view ABI mismatch between library and consumers by @baylesj in #1661
* Revert "Fix number parsing failing under non-C locales" by @baylesj in #1664
* Fix use-after-free in Reader::parse(std::istream&) by @baylesj in #1665
* Update bazel config for 9.x by @keith in #1655

[1] https://github.com/open-source-parsers/jsoncpp/releases/tag/1.9.7

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-03-23 13:34:20 -07:00
Khem Raj aee9d873f7 protobuf: Upgrade to 6.33.6
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-03-20 18:29:28 -07:00
Khem Raj 347474c362 memstat: Pass OE environment CFLAGS to makefile
Helps with reproducible builds

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-03-20 14:13:05 -07:00
Khem Raj 6b55bede28 luaposix: Upgrade to 36.3
Fix build with lua 5.5

License-Update: bump copyright years to 2025 [1]

[1] https://github.com/luaposix/luaposix/commit/07cf96f23c10ad01736205e6ca18375a208d05bf

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-03-18 16:18:32 -07:00
Viswanath Kraleti ad2a5ac0a0 android-tools-conf-configfs: make USB gadget IDs configurable
The android-gadget-setup script currently hardcodes the USB vendor ID,
product ID, and configuration string. This makes it difficult for BSP
layers to customize USB gadget identity with platform specific values.

Introduce variables for the vendor ID, product ID, and configuration
string when populating the configfs attributes. This allows machine
or distro specific overrides via `/etc/android-gadget-setup.machine`,
while preserving the existing default values.

Signed-off-by: Viswanath Kraleti <viswanath.kraleti@oss.qualcomm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-03-18 14:33:33 -07:00
Willi Ye 701a1df07c perfetto: Don't copy gn native binary
With the current recipe I am getting
```
gn: error while loading shared libraries: libc++abi.so.1: cannot open shared object file: No such file or directory
```
on my aarch64 machine
This is due to gn having a relative library runpath causing the interpreter not finding the shared libraries
Instead of copying the binary just directly execute it

Additionally remove the unnecessary download of the prebuilt gn binary

Signed-off-by: Willi Ye <zye2@snap.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-03-18 14:33:29 -07:00
Changqing Li 510ea4db57 luajit: Update to latest on v2.1 branch
License-Update: copyright year updated

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-03-18 14:33:27 -07:00
Gyorgy Sarvari c407d8669c capnproto: upgrade 1.0.2 -> 1.4.0
Contains fix for CVE-2026-32239 and CVE-2026-32240

Also, mark these CVEs explicitly patched, because NVD tracks them
without version info at this time.

Shortlog:
https://github.com/capnproto/capnproto/compare/v1.0.2...v1.4.0

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-03-18 14:33:27 -07:00
Deepesh Varatharajan 2c74fbff25 librust-cxx: Add librust-cxx recipe
Add a recipe for the cxx crate, which provides a safe and efficient
bridge for interoperability between Rust and C++ code. It allows
defining the FFI boundary in a shared Rust module and generates
compatible bindings for both languages during the build process.

The crate is implemented in Rust and supports zero-overhead FFI with
common Rust and C++ standard library types.

More information: https://crates.io/crates/cxx

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-03-18 14:33:26 -07:00
Jason Schonberg 65b7f7330e php: upgrade 8.5.3 -> 8.5.4
This is a bug fix release.

Changelog: https://www.php.net/ChangeLog-8.php#8.5.4

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-03-18 14:33:23 -07:00
Wang Mingyu 361c25fc20 uftrace: upgrade 0.18.1 -> 0.19
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-03-17 13:25:34 -07:00
Wang Mingyu 13dd3dada8 ctags: upgrade 6.2.20260222.0 -> 6.2.20260308.0
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-03-17 13:25:24 -07:00
Wang Mingyu 4af1af7b4f castxml: upgrade 0.6.13 -> 0.7.0
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-03-17 13:25:24 -07:00