Changelog:
===========
- a11y: add aria-labels to copy-to-clipboard buttons
- a11y: add skip-to-operations link, banner and main landmarks
- a11y: close Authorization popup with Escape key and backdrop click
- a11y: name and state for dark-mode toggle button
- a11y: restore icon visibility in Windows High Contrast Mode
- a11y: topbar logo and dark-mode toggle visible in HCM
- a11y: use for model titles to convey emphasis semantically
- ci: bump cycjimmy/semantic-release-action to v6.0.0
- ci: fix Trivy security scan and add dependency vulnerability scan
- style: reduce padding on inline code blocks in markdown
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Advance the pinned SRCREV to the current tip of jchampio's master. The
latest tagged release is still 0.1.2 (already reflected in PV), and the
23 new commits are entirely test-infrastructure work: porting the test
suite from Python 2 to Python 3/asyncio/websockets and adding coverage
for the module APIs. None of them touch the module sources that get
built and installed, so the shipped mod_websocket.so is functionally
unchanged; this simply keeps the git-tracking recipe on the current tip.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upstream changes:
* 2.650: new Systemd Services, GRUB 2, and Kea DHCP modules; WebSocket
proxy support in Servers Index; Alpine Linux support; Let's Encrypt
IP-based certificate support; editable SSH public keys in Users and
Groups.
* 2.651: Certbot certificate request/renewal fixes; fix live activation
of Linux bond interfaces.
* 2.652: global per-user ACL to block URL downloads from non-public IPs;
fix hex HTML entity recognition; fix session checks with HMAC session
keys; fix Usermin switching to use one-time login URLs.
* 2.653: fix missing xmlrpc-lib.pl; fix partially installed Debian
package listing; Authentic theme improvements.
Recipe changes:
* Drop init-exclude.patch: both hunks (init/index.cgi commented-out
runlevel loop and init/init-lib.pl exclude= support) are now
incorporated in upstream webmin 2.653.
* Refresh net-generic.patch: upstream added alpine-linux to the
os_support line in net/module.info; refresh the patch context.
* Refresh net-lib.pl.patch: context shifted by 4 lines with fuzz 1;
refreshed against 2.653 (same fallback to debian-linux-lib.pl).
* Remove webmin-openrc-init from do_install: webmin 2.653 ships a new
webmin-openrc-init script that references /sbin/openrc-run, which is
not available on systemd-based distros; remove the file to avoid an
unresolvable RDEPENDS QA failure.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Major version jump (1.x → 2.x series). Key upstream changes:
* 2.x dropped the legacy Netdata Cloud Agent-Cloud-Link (ACLK) and
merged cloud-connectivity into the main binary; ENABLE_ACLK and
ENABLE_CLOUD cmake options removed. OpenSSL and libcurl are now
mandatory build dependencies (no longer optional via PACKAGECONFIG).
* Improved database engine, new collectors (systemd-units, OTel,
scripts plugin), and expanded Go plugin with SNMP overhaul.
* 2.10.x stabilization: fix ZFS-related crashes, eBPF shared-memory
pool leak, SNMP counter wrapping, database engine memory safety.
* 2.10.4: larger patch for stability, memory safety, and crash
resilience across database engine, streaming, and collectors;
backports new macOS hardware sensor collectors.
Recipe changes:
* Add curl and openssl to mandatory DEPENDS (both now REQUIRED by
cmake); remove PACKAGECONFIG[openssl] and PACKAGECONFIG[cloud].
* Remove webui_v0/v1/v2 PACKAGECONFIG entries and associated
do_install block (the webui architecture changed in 2.x).
* Remove -DENABLE_ACLK=OFF from EXTRA_OECMAKE (option no longer
exists); keep -DENABLE_EXPORTER_PROMETHEUS_REMOTE_WRITE=OFF.
* Refresh 0002-Do-not-hardcode-systemd-unit-directories.patch for
2.10.4 (the BUILD_FOR_PACKAGING/systemd service install blocks
shifted ~1119 lines; same substitution preserved).
* 2.x vendors its own libsensors copy which needs flex/bison to
generate its config lexer/parser at build time; add flex-native
and bison-native to DEPENDS.
* Protobuf detection now runs unconditionally (used by several 2.x
exporters/collectors even with the remote-write exporter disabled);
add protobuf and protobuf-native to DEPENDS and point cmake at the
native protoc via Protobuf_PROTOC_EXECUTABLE.
* Disable several 2.x features that reach out to the network at
configure time and cannot work in an offline build:
- ENABLE_PLUGIN_OTEL / ENABLE_PLUGIN_OTEL_SIGNAL_VIEWER (pull in
Rust/Corrosion via CMake FetchContent)
- ENABLE_PLUGIN_SCRIPTS (requires Go, same as ENABLE_PLUGIN_GO)
- ENABLE_ML (FetchContent-downloads dlib)
- ENABLE_LIBBACKTRACE (ExternalProject-downloads libbacktrace)
- ENABLE_DASHBOARD, now exposed as PACKAGECONFIG[dashboard] and
off by default (the local agent dashboard isn't shipped in the
release tarball; enabling it makes cmake fetch it from
app.netdata.cloud at configure time)
* BUILD_FOR_PACKAGING=ON now also installs sysusers.d/tmpfiles.d
snippets under ${nonarch_libdir}; remove them in do_install since
user creation is handled by useradd.bbclass and tmpfiles by our own
netdata-volatiles.conf, avoiding an "installed but not shipped" QA
failure from duplicate/unmanaged files.
* Fix three new-in-2.x reproducibility leaks that embed host build
paths into the packages (buildpaths QA, an error in oe-core's default
ERROR_QA):
- Add 0003-Do-not-record-the-configure-command-line-in-the-binar.patch:
2.x bakes the full cmake invocation into config.h for
"netdata -W buildinfo"; the collected flags include --sysroot= and
-ffile-prefix-map= and so leak ${WORKDIR} into the binary.
- Add 0004-libsensors-do-not-emit-line-directives-in-generated-s.patch:
pass bison -l / flex -L so the generated conf-parse.[ch] and
conf-lex.c do not carry absolute #line paths (these live in file
contents, so -ffile-prefix-map cannot rewrite them).
- Remove the shipped build-info-cmake-cache.gz in do_install: it is a
gzipped CMakeCache.txt kept only for buildinfo reporting and is full
of host paths.
Verified with buildpaths promoted back to ERROR_QA: netdata builds and
packages with no buildpaths diagnostics and no /home path remains
anywhere under the package tree.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Since mainline version has been deleted, devtool tries to upgrade stable
recipe to mainline version.
Prevent it by telling it that even version needs to be used.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changes with nginx 1.30.3
*) Security: a heap memory buffer overflow might occur in a worker
process when using a configuration with "ignore_invalid_headers off;"
and "large_client_header_buffers" with large configured values when
proxying a specially crafted request to HTTP/2 or gRPC backend,
allowing an attacker to cause worker process memory corruption or
segmentation fault in a worker process (CVE-2026-42055).
*) Security: a heap memory buffer overread might occur in a worker
process while handling a specially sent response with decoding from
UTF-8 via the "charset_map" directive, allowing an attacker to cause
a limited disclosure of worker proccess memory or segmentation fault
in a worker process (CVE-2026-48142).
Signed-off-by: Andrej Kozemcak <andrej.kozemcak@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changes with nginx 1.30.2
*) Security: a heap memory buffer overflow might occur in a worker
process when using a configuration with overlapping captures in
ngx_http_rewrite_module, potentially resulting in arbitrary code
execution (CVE-2026-9256).
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changes with nginx 1.30.1
*) Security: when using the "proxy_set_body" directive, an attacker
might inject data in the proxied request to an HTTP/2 backend
(CVE-2026-42926).
*) Security: a heap memory buffer overflow might occur in a worker
process while handling a specially crafted request by
ngx_http_rewrite_module, potentially resulting in arbitrary code
execution (CVE-2026-42945).
*) Security: a heap memory buffer overread might occur in a worker
process while handling a specially crafted response by
ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an attacker
to cause a disclosure of worker process memory or segmentation fault
in a worker process (CVE-2026-42946).
*) Security: a heap memory buffer overread might occur in a worker
process while handling a specially sent response with decoding from
UTF-8 via the "charset_map" directive, allowing an attacker to cause
a limited disclosure of worker proccess memory or segmentation fault
in a worker process (CVE-2026-42934).
*) Security: when using HTTP/3, processing of connection migration might
cause new QUIC streams to receive a new client address before
validation, allowing an attacker to cause address spoofing
(CVE-2026-40460).
*) Security: use-after-free might occur during DNS server response
processing if the "ssl_ocsp" directive was used, allowing an attacker
to cause worker process memory corruption or segmentation fault in a
worker process (CVE-2026-40701).
*) Bugfix: connections with HTTP/2 backends might not be cached when
using the "proxy_set_body" or "proxy_pass_request_body" directives.
*) Bugfix: proxied HTTP/0.9, SCGI, or uWSGI responses might be
transferred incorrectly if the first line was not fully read.
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
These patches are about a number of CVEs files against the application:
CVE-2025-63649, CVE-2025-63650, CVE-2025-63651, CVE-2025-63652, CVE-2025-63653, CVE-2025-63655,
CVE-2025-63656, CVE-2025-63657 and CVE-2025-63658.
These patches are taken from a pull request[1] that is referenced in the relevant bug report[2].
The patches don't target specific CVEs on separately, but they fix a number of CVEs altogether.
Based on upstream analysis (in the linked issue) a number of these CVEs are duplicates of each
other and/or not exploitable. The valid CVEs are fixed by these patches.
I haven't added specific CVE info to the patches, one hand because of the above, it is hard to
separate the patches by CVE, and secondarily because NVD tracks these CVEs with incorrect version
info: NVD considers 1.8.6 fully fixed, even though the patches are only in the master branch,
untagged at this time. After updating the recipe to 1.8.6+, the vulnerabilites will disappear
from the CVE report due to this.
[1]: https://github.com/monkey/monkey/pull/434
[2]: https://github.com/monkey/monkey/issues/426
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
- HTTP/2 support added via the nghttp2 library
(credits to Heiko Zimmermann) — noted as experimental, so
testing carefully before enabling on production servers is
recommended.
- mbed TLS updated from 4.0.0 to 4.1.0.
- ssi-cgi removed — the release notes suggest using
Hiawatha's XSLT support as a more advanced alternative.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Set ac_cv_prog_cc_c23=no to prevent autoconf from detecting C23
compiler support, avoiding potential build failures as the package
is not yet fully ported to support C23 standard.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changes:
*) Security: a buffer overflow might occur while handling a COPY or MOVE
request in a location with "alias", allowing an attacker to modify
the source or destination path outside of the document root
(CVE-2026-27654).
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module on 32-bit platforms might cause a worker process
crash, or might have potential other impact (CVE-2026-27784).
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module might cause a worker process crash, or might have
potential other impact (CVE-2026-32647).
*) Security: a segmentation fault might occur in a worker process if the
CRAM-MD5 or APOP authentication methods were used and authentication
retry was enabled (CVE-2026-27651).
*) Security: an attacker might use PTR DNS records to inject data in
auth_http requests, as well as in the XCLIENT command in the backend
SMTP connection (CVE-2026-28753).
*) Security: SSL handshake might succeed despite OCSP rejecting a client
certificate in the stream module (CVE-2026-28755).
*) Feature: the "multipath" parameter of the "listen" directive.
*) Feature: the "local" parameter of the "keepalive" directive in the
"upstream" block.
*) Change: now the "keepalive" directive in the "upstream" block is
enabled by default.
*) Change: now ngx_http_proxy_module supports keepalive by default; the
default value for "proxy_http_version" is "1.1"; the "Connection"
proxy header is not sent by default anymore.
*) Bugfix: an invalid HTTP/2 request might be sent after switching to
the next upstream if buffered body was used in the
ngx_http_grpc_module.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changes:
*) Security: a buffer overflow might occur while handling a COPY or MOVE
request in a location with "alias", allowing an attacker to modify
the source or destination path outside of the document root
(CVE-2026-27654).
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module on 32-bit platforms might cause a worker process
crash, or might have potential other impact (CVE-2026-27784).
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module might cause a worker process crash, or might have
potential other impact (CVE-2026-32647).
*) Security: a segmentation fault might occur in a worker process if the
CRAM-MD5 or APOP authentication methods were used and authentication
retry was enabled (CVE-2026-27651).
*) Security: an attacker might use PTR DNS records to inject data in
auth_http requests, as well as in the XCLIENT command in the backend
SMTP connection (CVE-2026-28753).
*) Security: SSL handshake might succeed despite OCSP rejecting a client
certificate in the stream module (CVE-2026-28755).
*) Change: now nginx limits the size and rate of QUIC stateless reset
packets.
*) Bugfix: receiving a QUIC packet by a wrong worker process could cause
the connection to terminate.
*) Bugfix: in the ngx_http_mp4_module.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The CVE is now tracked with the correct version info by NVD.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
* Feature: session affinity support; the "sticky" directive in the
"upstream" block of the "http" module; the "server" directive supports
the "route" and "drain" parameters.
* Change: now nginx limits the size and rate of QUIC stateless reset
packets.
* Bugfix: receiving a QUIC packet by a wrong worker process could cause the
connection to terminate.
* Bugfix: "[crit] cache file ... contains invalid header" messages might
appear in logs when sending a cached HTTP/2 response.
* Bugfix: proxying to scgi backends might not work when using chunked
transfer encoding and the "scgi_request_buffering" directive.
* Bugfix: in the ngx_http_mp4_module.
* Bugfix: nginx treated a comma as separator in the "Cookie" request header
line when evaluating "$cookie_..." variables.
* Bugfix: in IMAP command literal argument parsing.
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
* mbed TLS updated to 4.0.0.
* Replaced strcpy() with strlcpy() and sprintf() with snprintf().
* Added OS sandbox.
* Removed DHsize option.
* Known bug: mbed TLS v4.0.0 doesn't compile in Cygwin, so building
a Windows package is not possible.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Wang Mingyu
Ankur Tyagi
Trevor Gamblin
Khem Raj
Peter Marko
Sandeep J
Andrej Kozemcak
Jason Schonberg
Liyin Zhang
Gyorgy Sarvari
Alper Ak
Khem Raj