Commit Graph

38194 Commits

Author SHA1 Message Date
Peter Kjellerstedt 143ee5e2a0 php: Correct the license to PHP-3.01
The license used by PHP is actually PHP-3.01, not PHP-3.0.

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 8aade001c1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:38 +05:30
Jason Schonberg df07d57939 php: upgrade 8.5.5 -> 8.5.6
This is a security release.

Changelog: https://www.php.net/ChangeLog-8.php#8.5.6

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 4310ecc78f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:38 +05:30
Anton Skorup 50400e9b41 jq: patch CVE-2026-47770
This patch adds the upstream fix for CVE-2026-47770.

CVE details: https://ubuntu.com/security/CVE-2026-47770

Signed-off-by: Anton Skorup <antonsk@axis.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit e4aae1b880)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:37 +05:30
Max Krummenacher 5376a773c6 fio: fix build with musl
Backport the upstream fix.

Signed-off-by: Max Krummenacher <max.oss.09@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 1f265bd73d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:37 +05:30
Wang Mingyu 8bd9783601 haveged: upgrade 1.9.20 -> 1.9.22
Changelog:
===========
* Add ReadWritePaths=/dev/shm to systemd service for semaphore creation
  under ProtectSystem=full sandboxing
* Fix privilege escalation via command socket (CVE-2026-41054)
* Check peer credentials before reading command (CVE-2026-41054)
* Handle failing opening of semaphore
* Fix /dev/shm permissions to use sticky bit
* Use chmod after mkdir to ensure correct /dev/shm permissions
* Update libtool: add lib64 search paths, remove dead code

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Venkatasainath Ravikanti <venkatasainath.ravikanti@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:36 +05:30
Li Zhou bcc1c15a3f haveged: upgrade 1.9.19 -> 1.9.20
ChangeLog:
https://github.com/jirka-h/haveged/releases/tag/v1.9.20

Signed-off-by: Li Zhou <li.zhou@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Venkatasainath Ravikanti <venkatasainath.ravikanti@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:36 +05:30
Abhishek Bachiphale 2a9765bf8f dnsmasq: upgrade 2.92 -> 2.93
- Update package checksum
- Remove obsolete upstreamed patches
- Verify successful build and runtime functionality

Include upstream security fixes:
- CVE-2026-2291
- CVE-2026-4890

Remove following patches as fixes are now included upstream:
- CVE-2026-4891
- CVE-2026-4892
- CVE-2026-4893
- CVE-2026-5172

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:35 +05:30
Andrej Kozemcak 3521444a71 poco: fix timezone and data time parser issue
Patch contains tree patches which was merge to poco at once
and fix "time" issues

1 - fix(Foundation): Timezone: invalidate utcOffset cache when /etc/localtime changes

Poco commit 1850dc16aabf5980a490bb1b66086d6695abb823 introduced a
TZInfo cache for the UTC offset to avoid repeated tzset() syscalls.
The cache is invalidated only when the TZ environment variable changes.
However, the TZ variable is process-local: if a different process (e.g.
a timezone configuration daemon or an init script) changes the system
timezone by updating /etc/localtime, the running process is not notified
and its TZ environment variable remains unchanged.

On systems that switch timezone by updating /etc/localtime (a symlink)
without touching the TZ env var, the cache is therefore never invalidated
and Timezone::utcOffset() returns the stale value computed at startup.

Fix by extending cacheTZ()/tzChanged() to also track the inode and
mtime of /etc/localtime via stat(2).  When either changes the cache is
considered stale and reloaded, preserving the performance benefit for
the common case where neither TZ nor /etc/localtime changes between
calls.

2 - fix(Foundation): DateTimeParser: %S consume optional fractional seconds

Parsing ISO 8601 date strings that contain both fractional seconds and a
timezone offset (e.g. "2013-10-07T08:23:19.120-04:00") with the format
"%Y-%m-%dT%H:%M:%S%z" raises a SyntaxException:

  - %S consumes the integer seconds but stops at '.', leaving
    ".120-04:00" unconsumed.
  - %z (parseTZD) is called next but sees '.' and returns without
    consuming anything.
  - The trailing-garbage check then raises SyntaxException.

Extend the %S case to consume and discard an optional fractional-second
suffix ('.' or ',' followed by one or more digits) immediately after
parsing the integer seconds.  This mirrors the existing %s behaviour and
allows %z to see the timezone designator directly, keeping the
trailing-garbage check fully effective for truly invalid input.

3 - test(DateTimeParserTest): add ISO8601 fractional seconds parser test

Add testISO8601FracSeconds to verify that DateTimeParser correctly
handles fractional-second suffixes (dot and comma separated) in
ISO8601_FORMAT strings, and rejects malformed input such as a
bare decimal point with no digits.

Signed-off-by: Andrej Kozemcak <andrej.kozemcak@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:04:41 +05:30
Anuj Mittal a43f0d532c README: update listed maintainer
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Jiaying Song 34debec4d8 layer.conf: remove dead BBFILES_DYNAMIC entry for clang-layer
The dynamic-layers/clang-layer/ directory does not exist under meta-oe.
Remove the stale BBFILES_DYNAMIC references as they match nothing.

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a07b2ddc51)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Adam Duskett 7d1f4b0940 kmscon: fix zlib cross-compiling errors
zlib compression was introduced in version 9.3.3. However, when
cross-compiling kmscon for an architecture other than x86_64, the
genunifont executable tries to use the build-systems zlib instead
of the hosts zlib.

This leads to the following error during compiling:
libz.so: error adding symbols: file in wrong format

Fix this by adding a new native zlib dependency specifically for the
genunifont executable.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 72154f38fc)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Jason Schonberg 74c663dd4e nodejs: upgrade 22.22.2 -> 22.22.3
With this upgrade, nodejs updated the llhttp dependency to version 9.3.1
So some of the patches are nolonger necessary.

Changelog: https://github.com/nodejs/node/releases/tag/v22.22.3

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit ea56a5e3ae)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Ankur Tyagi a1ffc4960b imagemagick: upgrade 7.1.2-22 -> 7.1.2-23
Bug and security fixes
https://github.com/ImageMagick/ImageMagick/compare/7.1.2-22...7.1.2-23

PTEST passed:

root@qemuarm64:~# ptest-runner imagemagick
START: ptest-runner
2026-05-23T03:43
BEGIN: /usr/lib/imagemagick/ptest
...
...
DURATION: 1
END: /usr/lib/imagemagick/ptest
2026-05-23T03:43
STOP: ptest-runner
TOTAL: 1 FAIL: 0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Markus Volk 0537a67fc8 pipewire: update 1.6.3 -> 1.6.5
PipeWire 1.6.5 (2026-05-13)

This is a bugfix release that is API and ABI compatible with the previous
1.6.x releases.

Highlights
  - Fix muted output in some cases.
  - Removed the pipe filter in filter-graph.
  - More fixes and improvements.

PipeWire
  - Fix an issue in pw-filter where it could end up in a loop where buffers
    are stuck on a port and the port becomes silent. (#5249)

Modules
  - Improve ROC receiver start/stop, fixes memory leaks. (#5250)
  - Remove the pipe filter from filter-graph, it's broken by design and a
    security nightmare.
  - Fix the midi buffer size in jack-tunnel.

SPA
  - Rate limit out-of-buffers errors. (#5249)
  - Partially revert the line-out mute patch, it seems to break things and leave
    audio muted when plugging-unplugging jacks.  (#5246)
  - Improve renegotiation in audioconvert when the graph rate changes and the
    resampler was disabled. (#4933).
  - Fix potential crash in alsa when logging.

Pulse-server
  - A whole bunch of extra security checks and hardening fixes.

Older versions:

PipeWire 1.6.4 (2026-04-22)

This is a bugfix release that is API and ABI compatible with the previous
1.6.x releases.

Highlights
  - Small improvements and seqfault fixes.
  - Try to not emit ports that JACK doesn't understand. Fixes glitches in
    ardour and other JACK apps.

PipeWire
  - Refuse to load plugins and crash when pw_init() was not called. (!2784)

SPA
  - Fix LADSPA plugin loading, support LADSPA_PATH ending with /
  - Fix segfault in alsa-seq when removing devices in some cases. (#5221)
  - Allow negative gain in mixer. (#5228)
  - Improve alsa-seq port names, add : between client and port. (#5229)
  - ACP: don’t override user-selected port on availability changes.

Bluetooth
  - Backport some important fixes and minor improvements.

JACK
  - Ignore non DSP ports to avoid emitting extra callbacks.

GStreamer
  - Fix crop metadata.

Tools
  - Fix WAVEX saving in pw-cat. (#5233)

Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit babcd87414)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Abhishek Bachiphale ed946592da dnsmasq: fix CVE-2026-5172
A buffer overflow in dnsmasq’s extract_addresses() function allows
an attacker to trigger a heap out-of-bounds read and crash by
exploiting a malformed DNS response, enabling extract_name()
to advance the pointer past the record’s end.

Reference:
[ https://nvd.nist.gov/vuln/detail/CVE-2026-5172 ]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 44c8962f48)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Abhishek Bachiphale b81fd0e23e dnsmasq: fix CVE-2026-4893
An information disclosure vulnerability in dnsmasq allows remote
attackers to bypass source checks via a crafted DNS packet with
RFC 7871 client subnet information.

Reference:
[ https://nvd.nist.gov/vuln/detail/CVE-2026-4893 ]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit b4c4853624)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Abhishek Bachiphale be8d0f006a dnsmasq: fix CVE-2026-4892
A heap-based out-of-bounds write vulnerability in the DHCPv6
implementation of dnsmasq allows local attackers to execute
arbitrary code with root privileges via a crafted DHCPv6 packet.

Reference:
[ https://nvd.nist.gov/vuln/detail/CVE-2026-4892 ]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 21c3d7eb6f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Abhishek Bachiphale 81572e132c dnsmasq: fix CVE-2026-4891
A heap-based out-of-bounds read vulnerability in the
DNSSEC validation of dnsmasq allows remote attackers
to cause a denial of service via a crafted DNS packet.

Reference:
[ https://nvd.nist.gov/vuln/detail/CVE-2026-4891 ]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a9de48a9fa)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:30 +05:30
Wang Mingyu 82dc5548d5 lldpd: upgrade 1.0.21 -> 1.0.22
* Fix:
   + Fix out-of-bound read access when removing VLAN tag (CVE-2026-46433, #787)
   + Reject 0-length management address in LLDP
   + Fix race condition when creating the control socket
   + Fix FDP MAC address
   + Fix memory leak in the BSD bridge query path
   + Fix duplicate management addresses when merging EDP VLAN frames

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 74cd808dbd)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Guocai He c51bb39ebf postgresql: upgrade 17.8 -> 17.10
Refreshed 0003-configure.ac-bypass-autoconf-2.69-version-check.patch
for 17.10

Includes fix for CVE-2026-6472, CVE-2026-6473, CVE-2026-6474, CVE-2026-6475,
CVE-2026-6476, CVE-2026-6477, CVE-2026-6478, CVE-2026-6479, CVE-2026-6637,
CVE-2026-6638 CVE-2026-6575

Release Notes:
https://www.postgresql.org/docs/release/17.10/

Signed-off-by: Guocai He <guocai.he.cn@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 83cad3966c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 61931269ec uriparser: upgrade 1.0.1 -> 1.0.2
Changelog:
==============
* Fixed: [CVE-2026-44927]
    Stop truncating 'ptrdiff_t' to 'int'
* Fixed: [CVE-2026-44928]
    Fix 'EqualsUri' with regard to '.absolutePath'
* Fixed: Fix OOM related memory leak in 'CopyUriMm'
* Improved: Simplify internal function 'CompareRange' into 'RangeEquals'
* Improved: Make function 'RangeEquals' use size_t' internally
* Soname: 3:2:2 - see https://verbump.de/ for what these numbers do

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a0589ae5a4)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 343e59e762 uriparser: upgrade 1.0.0 -> 1.0.1
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 03255a83e3)

https://github.com/uriparser/uriparser/blob/uriparser-1.0.1/ChangeLog

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 915cca7078 bit7z: upgrade 4.0.11 -> 4.0.12
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 84d4d96d9f)

https://github.com/rikyoz/bit7z/releases/tag/v4.0.12

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu f9eea94890 imagemagick: upgrade 7.1.2-21 -> 7.1.2-22
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 5063ac8e48)

Bug and security fixes
https://github.com/ImageMagick/ImageMagick/compare/7.1.2-21...7.1.2-22

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 38c0ee7d23 swagger-ui: upgrade 5.32.5 -> 5.32.6
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a86ee0d4f6)

Bugfix release
https://github.com/swagger-api/swagger-ui/releases/tag/v5.32.6

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu d8cfc583c3 swagger-ui: upgrade 5.32.2 -> 5.32.5
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 137e8d240e)

Bugfixes and performance improvements:
https://github.com/swagger-api/swagger-ui/releases/tag/v5.32.3
https://github.com/swagger-api/swagger-ui/releases/tag/v5.32.4
https://github.com/swagger-api/swagger-ui/releases/tag/v5.32.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Ankur Tyagi 815a038905 python3-django: upgrade 6.0.4 -> 6.0.5
https://docs.djangoproject.com/en/dev/releases/6.0.5/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 2f64c27b18)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Ankur Tyagi 9148bf8e3d python3-django: upgrade 5.2.13 -> 5.2.14
https://docs.djangoproject.com/en/dev/releases/5.2.14/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit ef903fca83)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu be10315436 python3-huey: upgrade 3.0.0 -> 3.0.1
Changelog:
==========
- Fix bug in redis version parsing when using Elasticache or any other that
  sends major/minor. redis-py incorrectly parses these as floats because
  there's only a single decimal, so the version check was breaking.
- Rename max task option --max-tasks (previously was --max_tasks).

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c14a56b358)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 4dc835862b python3-typeguard: upgrade 4.5.1 -> 4.5.2
Changelog:
 Fixed IndexError raised from check_signature_compatible when the subject method has no positional parameters

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 537a4c4484)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu eff6fc8cd9 python3-tzdata: upgrade 2026.1 -> 2026.2
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6321202865)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 0f94b8aa14 python3-inline-snapshot: upgrade 0.32.6 -> 0.32.7
Changelog:
============
- Fixed snapshot comparison for dicts where keys are dataclass instances (or
  other custom objects used as dict keys), which previously caused corrupted
  snapshots - either collapsing multiple entries into one or appending duplicate
  keys on subsequent runs
- Fixed tuple snapshot updates to compare elements positionally rather than
  using sequence alignment, so existing expressions (e.g. 3 + 3) are preserved
  when elements are removed from or added to a tuple.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit fe086de31a)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 009207f76f neatvnc: upgrade 0.9.5 -> 0.9.6
0001-Use-aml-v1.patch
refreshed for 0.9.6

Changelog:
===========
- auth: rsa-aes: Fix potential buffer overflow
- auth: vencrypt: Reject excessively long usernames and passwords

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 9222ec03c3)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu ca24d4cbb3 localsearch: upgrade 3.11.0 -> 3.11.1
Changelog:
  Fix possible failures when extracting metadata from EPUB, ODF and OOXML documents

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 5a08d78f85)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Jason Schonberg 563d2c514f Update README.md example with new branch name.
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 9af4488d46 libtsm: upgrade 4.4.3 -> 4.5.0
Changelog:
=============
- Support for terminal bell and keyboard LEDs
- Fix build musl
- test/vte: fix memory leak in vte tests
- Refactor scrollback and selection
- screen: Fix wrong attribute for new cells when resizing
- Fix remove from sb
- Fix get next line
- Fix scrollback position
- test: robustness, make the test faster.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6d7794e799)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 11:52:30 +05:30
Yi Zhao ce551e0201 nftables: improve reproducibility
Use SOURCE_DATE_EPOCH to set MAKE_STAMP instead of using the current
time, thereby improving reproducibility.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a3b407c982)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 11:44:07 +05:30
Wang Mingyu f543c09d25 python3-ujson: upgrade 5.12.0 -> 5.12.1
Changelog:
==========
- Fix encoding ref leak with non-English character
- Fix memory leak when ujson.dump() is unable to write to its file

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6887661fec)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 10:20:58 +05:30
Wang Mingyu e7a2390854 znc: upgrade 1.10.1 -> 1.10.2
Changelog:
=============
- Fix build with SWIG 4.4.
- Fix build in the event some parts of Boost are installed but Boost.Locale is not.
- Make GetClient() work in the OnClientGetSASLMechanisms module callback.
- Stop accidentally requiring new perl 5.35.1, regression from 1.10.0.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 8b4ce3276c)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 10:20:44 +05:30
Jason Schonberg f32370958c orage: upgrade 4.20.2 -> 4.20.3
- Fixed use-after-free in sound command execution (Issues #47 and #48).

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 3bdbc82938)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 10:19:51 +05:30
Wang Mingyu 8eacf145c8 hunspell: upgrade 1.7.2 -> 1.7.3
Changelog:
===========
- Fix stack-buffer-overflow in Hunzip::getline
- Fix stack overflow in compound_check on Hungarian dictionaries
  under certain conditions
- Fix UB when SFX condition starts with '^' (#1095)
- Bounds-check continuation bytes in u8_u16 (#1110)
- oss-fuzz timeout/OOM hardenings
- Fix #715 CHECKCOMPOUNDCASE considers digits uppercase
- Fix #748 hzip: cannot write file
- Fix #1024 std::string bounds check
- Fix #1044 tools/analyze crash
- Fix #1076 flags 65520/65521 wrongly rejected
- Fix #1058 don't suggest the input word as its own correction
- Fix #1002 exact word marked as a near miss
- Fix tdf#125600 dotted-I regression
- Partial Unicode table refresh for Mc combining marks (#1057)
- Add Hunspell_add_with_flags / Hunspell::add_with_flags
- New SPELL_BEST_SUG flag, MAXBREAKDEPTH limit
- Replace clock() with std::chrono for suggestion time limits (#716)
- Improve exception safety (#587)
- Document analyze/stem/generate requirements (#554)
- Report iconv direction on private dic load failures (#619)
- Show dic load errors unconditionally (#1012)
- Rename es_EU to eu (#1113)
- Build fixes: out-of-tree, Windows ARM64, MSVC hzip tmpfile (#919),
  --disable-shared with mingw32 (#698), iconv on msys2 (#723),
  ncurses with separate tinfo
- New fuzzers: hzfuzzer, persdicfuzzer, parserfuzzer, affdicfuzzer
- Coverity-flagged fixes
- Merge in weblate translations

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit dad06c74bb)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 10:17:23 +05:30
Wang Mingyu f5e824aa82 libauthen-sasl-perl: upgrade 2.1800 -> 2.2000
[Added]
   - Documentation for the security layer
[Fixed]
  - CVE-2025-40918 (Insecure source of randomness),
    required addition of dependency on Crypt::URandom
  - Several public functions missing from the API documentation
[Changed]
  - Modules Authen::SASL::Perl::CRAM_MD5, Authen::SASL::Perl::DIGEST_MD5
    and Authen::SASL::CRAM_MD5 marked as deprecated based on the respective
    RFC documents; thanks to @robrwo for the suggestion and @neustradamus
    for the pointers to the documentation
  - Update module metadata to point to the new 'perl-authen-sasl' org
    on GitHub to which the modules moved
  - Use VERSION declarations in 'package' statements, since our minimum
    Perl version is 5.14 anyway

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit bfd93bafbb)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 10:17:10 +05:30
Wang Mingyu bb9e2765f7 valkey: upgrade 9.0.3 -> 9.0.4
Changelog:
============
(CVE-2026-23479) Use-After-Free in unblock client flow
(CVE-2026-25243) Invalid Memory Access in RESTORE command
(CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit d47ea6487b)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 10:17:05 +05:30
Ross Burton b2657486b3 iwd: depend on the regulatory database
Doing wifi without the regulatory database is not good, so add a runtime
dependency to iwd to ensure that it gets pulled into the image for the
kernel drivers to use.

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 51ed0fcecd)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 10:16:13 +05:30
Hongxu Jia 3abfbefd4f thin-provisioning-tools: fix compile failure on 32bit BSPs
$ echo 'MACHINE = "qemux86"' >> conf/local.conf
$ bitbake thin-provisioning-tools
```
error[E0080]: index out of bounds: the length is 1 but the index is 4
--> tmp/work/core2-32-wrs-linux/thin-provisioning-tools/1.3.1/build/target/release/build/devicemapper-sys-f88f57f28cd965d2/out/dm-bindings.rs:3:8718
|
3 | ...usize] ; ["Alignment of dm_ioctl"] [:: std :: mem :: align_of :: < dm_ioctl > () - 4usize] ; ["Offset of field: dm_ioctl::version"...
|             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ evaluation of `_` failed here
```

Inherit siteinfo to use SITEINFO_BITS replace TUNE_FEATURES
to test 32bit BSPs

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 4fe6bf337a)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 10:13:58 +05:30
Adam Duskett eeb6d01481 kmscon: upgrade 9.3.3 -> 9.3.5
Changelog:
https://github.com/kmscon/kmscon/releases/tag/v9.3.5

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit f36312669c)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 10:09:39 +05:30
Fabian Pflug 2eb4b46762 pkcs11-provider: fix build error on 32 bit systems
PKCS11 Provider did not build on 32 bit systems. Fixed Upstream with
https://github.com/openssl-projects/pkcs11-provider/pull/689

Signed-off-by: Fabian Pflug <f.pflug@pengutronix.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 3608cfdc5b)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 09:05:04 +05:30
Ernest Van Hoecke 30b410cba2 jsoncpp: Fix C++11 ABI breakage when compiled with C++17
When jsoncpp is built with C++17, 1.9.7 drops several legacy overloads
that C++11 consumers can still link against.

Backport the upstream fix to restore compatibility.

Fixes errors such as:
|  undefined reference to `Json::Value::operator[](char const*)'

Patch can be dropped when we move to 1.9.8.

Signed-off-by: Ernest Van Hoecke <ernest.vanhoecke@toradex.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 9be9388574)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 09:04:50 +05:30
Yi Zhao c8e1b7771d postfix: upgrade 3.10.8 -> 3.10.9
Security fix: CVE-2026-43964

Add a patch to fix build with musl.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 7c6ce9d100)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-15 09:33:07 +05:30
Peter Marko ec3fad00a2 cryptsetup: update udev package config
Commit 1ca8df16af fixed a build problem in
wrong way. Relevant rules from lvm2-udevrules were merged into
libdevmapper (which was previously pulled by the rules package), however
instead of that, the whole lvm2 package was added as dependency (which
then pulls the needed libdevmapper).
That is a huge package completely unneeded and due to that, this new
dependency was later changed to recommendation.

Switch to libdevmapper instead of whole lvm2.
Keep recommendation for now as it gives more flexibility.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a5e9c8141a)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-15 09:31:18 +05:30