ConsoleKit2 no longer requires X11, so use it for session tracking on
all non-systemd distros. NetworkManager only reads the ConsoleKit
session database, whose format is unchanged by ConsoleKit2 2.0.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
ConsoleKit2 2.0 uses bare session IDs ("Session1") instead of D-Bus
object paths both on D-Bus and in its session database, so polkit no
longer finds sessions when built with session_tracking=ConsoleKit.
Strip the object path returned by GetSessionForUnixProcess to the ID
and rebuild the path when calling into the session object.
The changed code is only exercised when ConsoleKit is running, so
apply the patch unconditionally.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
test_monitor_multiple_lines_by_name has the same race which was fixed
in test_monitor_all_lines_on_request: it toggles line foo twice, with
line xyz in between, before reading any event. gpio-sim delivers both
changes of foo as one interrupt when they happen before it is handled,
so the rising edge is lost:
ASSERT: '45056166795 falling "foo" 45056147828 rising "xyz"' did not
match '[0-9]+ rising\s+"foo"'
Wait for each event before triggering the next one. In a qemux86-64
guest this took the test from 13 of 20 runs failing to none, and
ptest-runner libgpiod passed 12 of 12 runs on the rebuilt image.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
test_monitor_all_lines_on_request toggles line 1 twice, with line 4 in
between, before reading any event. gpio-sim delivers both changes of
line 1 as one interrupt when they happen before it is handled, so the
rising edge is lost:
ASSERT: '41610700648 falling "foo" 41610665414 rising 4' did not
match '[0-9]+ rising\s+"foo"'
Wait for each event before triggering the next one. In a qemux86-64
guest this took the test from 12 of 20 runs failing to none.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
sdbus-c++-integration-tests fails intermittently in the ptest image on
qemuarm64 (qemu TCG, no KVM) when the build host is busy running other
testimage tasks:
- CallsMethodWithLargeArgument sends ~30 MB in one method call with the
default 25 second D-Bus timeout. That takes 13-16 s on an idle qemu
and 40-50 s under load, so it fails with
org.freedesktop.DBus.Error.Timeout. Use a 120 second timeout.
- ThrowsTimeoutErrorWhen{Method,ClientSideAsyncMethod}TimesOut require
the timeout error within 50 ms; under load it took up to 57 ms.
Allow 500 ms, still well below the 1 s operation the tests time out.
With both patches, 10 repeats of the integration tests under heavy
host and guest CPU contention pass; without them 4 of 10 failed.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Many tests, most of them in net, fail rather than skip when the kernel
lacks a feature they need (vxlan, geneve, macvlan, vrf, netdevsim, TLS,
tc actions and qdiscs, audit for the landlock tests, ...). Skip them
based on the running kernel's config, so the results show regressions
instead of the kernel configuration.
Also skip the udpgro tests when iptables can't set up NAT (legacy
iptables on a kernel with only nftables), tc-testing when scapy is not
installed, landlock's fs_bench, which only reports timings and needs
twice the default timeout in qemu, mseal's sysmap_is_sealed when the
kernel doesn't seal the system mappings, and the ptrace vmaccess and
tty_tiocsti tests, which check for kernel changes that are not in
mainline.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add fixes for tests that fail on qemux86-64 because of bugs in the
tests, and make tests that fail when an optional kernel feature or
device is missing skip instead:
- core: unshare_test fails when fs.nr_open is at its maximum
- proc: proc-empty-vm treats pkey_alloc() ENOSPC as a failure, and
read fails when a task exits while it walks /proc
- sched: cs_prctl_test is not installed from the output directory and
fails without core scheduling
- gpio: gpio-mockup expects an empty range to be accepted, and
gpio-cdev-uaf fails without CONFIG_GPIO_CDEV_V1
- splice: short_splice_read fails without test_module
- syscall_user_dispatch: sud_benchmark needs a frame pointer
- lsm: lsm_get_self_attr_test checks the wrong errno and
lsm_list_modules_test fails without securityfs
- cgroup: test_cpu fails without CONFIG_CFS_BANDWIDTH
- binderfs: binderfs_stress fails without binderfs
- kvm: nx_huge_pages_test.sh fails without KVM
- watchdog: watchdog-test fails without a watchdog device
- net: udpgro_fwd.sh hangs the whole run without vxlan, and icmp.sh
fails without tcpdump
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Many selftests modprobe what they need (gpio-mockup, netdevsim, vrf,
the tc qdiscs, classifiers and actions, ...), but the image only had a
couple of kernel modules, so recommend all of them.
The net tests also need real iproute2, iputils ping and ping6, ethtool,
iperf3, socat, jq, bc and taskset; busybox ip and ping lack most of the
options they use, and busybox's ping6 has no -M, which pmtu.sh picks up
over ping when it exists.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The net selftests generate their netlink code with tools/net/ynl, which
needs the netlink specs from Documentation/netlink, python3 with pyyaml
and jsonschema, and the top-level MAINTAINERS file: ynl_gen_c.py finds
the kernel root by walking up until it sees MAINTAINERS and loops
forever when it is not there. libbpf needs elfutils and zlib,
reuseport_bpf_numa numactl and tcp_mmap openssl.
net/lib installs the whole ynl tree, so drop its build artifacts and
bytecode, which trip the staticdev and buildpaths QA checks, and pass
the prefix maps to clang so the BPF objects don't carry build paths
either.
The python tests load the netlink specs at runtime, so add pyyaml there
as well.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
run-ptest printed "PASS: kernel-selftest" or "[FAIL]: kernel-selftest".
The latter does not match the FAIL: pattern of the ptest log parser, so
whenever any selftest failed testimage reported no results at all:
ptests which had no test results:
['kernel-selftest']
Convert the per-test TAP lines from run_kselftest.sh into PASS:, FAIL:
and SKIP: lines, so results are recorded and failing selftests are
listed by name.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2.19.1 declares protobuf < 6, while meta-python provides 7.36, and
google-cloud-pubsub 2.39.2, which Home Assistant 2026.11 uses, requires
google-api-core >= 2.25.0.
New runtime dependencies: proto-plus and opentelemetry-api. pytz is no
longer used. The package is built with setuptools.build_meta now. The
sdist on PyPI was renamed from google-api-core-2.19.1.tar.gz to
google_api_core-2.44.0.tar.gz; the underscore form is the pypi.bbclass
default, so PYPI_PACKAGE_SDIST, which pointed at the old name, is
dropped.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
1.63.2 declares protobuf < 6, while meta-python provides 7.36. The new
release accepts protobuf < 8. Needed by the google-api-core upgrade.
The package is built with setuptools.build_meta now. The sdist on PyPI
was renamed from googleapis-common-protos-1.63.2.tar.gz to
googleapis_common_protos-1.76.0.tar.gz; the underscore form is the
pypi.bbclass default, so PYPI_PACKAGE_SDIST, which pointed at the old
name, is dropped.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
python3-google-api-core 2.x requires proto-plus. A recipe for 1.27.1
exists in meta-python-ai, but meta-python cannot depend on that layer.
Only protobuf is a runtime dependency; google-api-core is needed by the
test suite only.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pydantic 2.14.1 in its test requirements and
package constraints. Upgraded together with python3-pydantic-core
2.50.1, which it pins.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
pydantic 2.14.1 pins pydantic-core 2.50.1; with 2.46.5, "import pydantic"
raises SystemError because the versions do not match.
Refresh 0001-cargo.toml-Update-bitvec-to-use-radium-1.x.patch and
regenerate python3-pydantic-core-crates.inc with
bitbake -c update_crates.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins orjson 3.13.0.
Refresh the two x86 guard patches and regenerate
python3-orjson-crates.inc with bitbake -c update_crates.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pylint 4.1.3 in its test requirements.
Drop patches that are no longer needed:
- 0002-pyproject.toml-Keep-tool.setuptools.license-files.patch rewrote
the PEP 639 license and license-files keys into the older
tool.setuptools form. 4.1.3 requires setuptools >= 77, which handles
the PEP 639 keys, and OE-Core provides 84.0.0.
- 0003-astroid-4.1.2-endlineno.patch adjusted functional test
expectations for astroid 4.1.2 (for example MyClass instead of
MyClass.my_method). 4.1.3 ships the same expectations.
- 0004-checkers-variables-do-not-pass-asname-to-Import.infer.patch was
a backport of upstream commit 554b1d192434, which is part of 4.1.3.
Refresh 0001-Adjust-test-expectations-for-ptest.patch. The expected
output was regenerated by running the functional test with pylint 4.1.3
and astroid 4.3.4 installed into a virtualenv and the tests outside the
source tree, which is how the ptest sees pylint.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pytest-socket 0.8.1 in its test
requirements.
0.8.x builds with uv_build instead of poetry-core. Backport the upstream
change that allows uv_build < 0.14, since OE-Core provides 0.13.7.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins lru-dict 1.4.1.
The sdist is now published as lru_dict-*.tar.gz, the default name, so
drop PYPI_PACKAGE_SDIST. 1.4.x pins the build to setuptools==80.9.0 and
no longer needs wheel; relax the setuptools pin with a patch and drop
the python3-wheel-native dependency.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins SQLAlchemy 2.0.54 (core and the recorder
integration).
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pychromecast 14.1.1 for its cast integration.
Drop 0001-pyproject.toml-relax-build-requirements.patch. It removed the
upper bounds setuptools < 83 and wheel < 0.47 from the build
requirements. 14.1.1 allows setuptools < 85 and wheel < 0.49, and
OE-Core provides setuptools 84.0.0 and wheel 0.48.0, which are within
the new bounds.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Needed together with the Cython 3.3.1 upgrade in OE-Core: 0.4.1, with the
backported "Update Cython to version 3.2.3" patch, requires
Cython ~= 3.2.0 and does not build with Cython 3.3. Home Assistant
2026.11 also pins propcache 0.5.4.
Drop both local patches:
- 0001-Update-Cython-to-version-3.2.3-184.patch backported the change
from Cython ~= 3.1.0 to Cython ~= 3.2.0. 0.5.4 requires
Cython >= 3.2.0 (packaging/pep517_backend/_backend.py), so the
backport is not needed; it would even pin the build back to
Cython ~= 3.2.0.
- 0001-build-wheel-in-place.patch hardcoded build_inplace=True in the
in-tree build backend. 0.5.4 adds the build-inplace config setting
for this, so the recipe passes "-C build-inplace=true" in
PEP517_BUILD_OPTS instead.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
httpx2 requires httpcore2, anyio and truststore, so "import httpx2"
fails with "No module named 'httpcore2'". Home Assistant 2026.11 imports
httpx2 at startup and does not start without them.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
httpx2 imports httpcore2, which is released as a separate package from
the same repository and with the same version.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
httpx2 and httpcore2 require truststore. Home Assistant 2026.11 pins
truststore 0.10.4.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
numba is optional for haversine, but haversine only catches
ModuleNotFoundError. With the NumPy 2.5 from OE-Core, numba 0.66 (as in
meta-python-ai) raises
ImportError: Numba needs NumPy 2.4 or less. Got NumPy 2.5.
which makes "import haversine" fail. Catch ImportError instead.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
pint requires flexcache, flexparser and typing-extensions, but only the
ptest package pulled in flexcache and flexparser, so "import pint" fails
with "No module named 'flexcache'" on an image without the ptest.
pint is extended to native and nativesdk, so flexcache and flexparser
are as well.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The upgrade to 1.4.4 only changed SRC_URI[sha256sum], which is unused
since the recipe fetches from git, so SRCREV still pointed at a 1.4.2
era commit and the package installed pika 1.4.2 under version 1.4.4.
Point SRCREV at the 1.4.4 tag commit and drop the unused checksum. Add
tag=${PV} to SRC_URI so that the fetcher checks that SRCREV is the
commit of the release tag.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
- mod_authnz_ldap: Fix crashes in 2.4.69 reported on Windows
- mod_cgid: Increase limits for number and length of environment variables,
URI and arguments
- mod_substitute: Fix an integer overflow that can happen in very special
setups
- mod_cache: Do not store a response whose "Vary: *" was set via
"Header always"
- mod_dav_lock: Fix a heap buffer overflow in dav_size_indirect(), which
under-reserved space for the stored key length field, written as
apr_size_t but sized as int
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2.7 is the new release series; library ABI is unchanged (libldap.so.2,
liblber.so.2). It also builds the symbol version map through the
preprocessor (ITS#9739), which drops most entries for code that is not
configured in.
- back-perl and back-sql were removed upstream, drop their
PACKAGECONFIGs.
- Refresh remove-user-host-pwd-from-version.patch for the
LDAP_GCCATTR((unused)) attribute added in build/mkversion.
- Add a patch to guard the remaining SASL-only symbols in ldap.map.in;
without Cyrus SASL lld fails:
ld.lld: error: version script assignment of 'OPENLDAP_2.200' to
symbol 'ldap_int_sasl_config' failed: symbol not defined
This replaces the -Wl,--undefined-version workaround meta-clang
carried for openldap.
License checksums are unchanged. Tested on qemux86-64 with clang/lld:
openldap and samba (with ldap) build.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
wafsamba generates version scripts that name symbols which may not
exist in the library: _end, __bss_start and _edata are always listed as
local, and the per-version nodes carry symbols from older ABI signature
files that were later removed (e.g. tdb_do_delete). GNU ld ignores
these, but lld rejects them by default:
ld.lld: error: version script assignment of 'local' to symbol '_end'
failed: symbol not defined
meta-clang used to add -Wl,--undefined-version for libtalloc, libtdb,
libtevent, libldb and samba. Since the scripts are generated by design
this way, do it once in the class for all its users; binutils accepts
the option too. FreeBSD ports do the same for talloc and tdb.
Tested: libtalloc, libtdb, libtevent, libldb ptest images pass on
qemux86-64 with clang/lld; samba builds.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog
---------
Changes for version 20261020
Update from Mozilla repository to 2026-10-20
Denylisted certificates:
emSign ECC Root CA - G3
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add -M30% -C --find-copies-harder to the git send-email example in
README.md so that git format-patch detects renames and copies more
aggressively.
Patches that move or copy files then show only the changed lines
instead of full file deletions and additions, which makes them
smaller and easier to review.
Suggested-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.4:
Breaking changes:
- CMake:
- The minimum CMake version is now 3.15, up from 3.12.
- Library file names changed on MSVC: z is now libz, as in
libz.dll, libz.lib, and the static libzs.lib. minizip's
libraries changed the same way.
- On Cygwin, the libraries now use the lib prefix.
- Contrib targets and tests built as part of zlib are now
prefixed with zlib_. Several test targets were renamed to one
scheme, for example zlib_examplestatic and minigzipstatic.
- The zlib1.dll option ENABLE_BZIP2 is now
ZLIB1_DLL_ENABLE_BZIP2.
- When not otherwise determined, z_off_t is again long, as in
1.3.1, instead of 1.3.2's long long. Windows applications built
with 1.3.2 headers should be recompiled; see Enhancements for
64-bit offsets.
- deflateReset() now resets the gzip header set by
deflateSetHeader(), as zlib.h has always said. Code relying on
the header persisting must set it again.
- Raw deflate that completes exactly at the end of the output
buffer now returns Z_STREAM_END instead of Z_OK, as documented.
- gzopen() with "x" now fails where O_EXCL isn't available, instead
of truncating an existing file (Trail of Bits TOB-ZLIB-009).
- gzip reading now delivers the data decompressed before a read
error, and only then reports the error.
Security fixes:
- Non-blocking gzwrite() had a buffer overflow; CVE-2026-85091
(reported by mat-mo; also TOB-ZLIB-003).
- inflateGetDictionary() could write up to 8 MB past the caller's
32K buffer (Theorem THM-ZLIB-001). This took a zlib header with
an invalid window size, then inflateReset() or inflateSync().
Affects 1.3.1 and 1.3.2.
- inflateSync() before the window size was known allocated a
one-byte window that could later be overrun (TOB-ZLIB-004).
- inflatePrime() could lead inflate() to read before the start of
the input (TOB-ZLIB-014).
- Repeated deflatePrime() calls could write past the pending buffer
(TOB-ZLIB-013).
- inflateBack() failed to detect distances too far back, and copied
uninitialized memory to the output (reported by Kornel Lesiński).
- gzseek() forward before any data was written could write
uninitialized memory to the gzip output (found by Claude Opus
5.5).
- deflateResetKeep() used mid-stream could read outside the window
(reported by Jason Gross).
- gzdopen() now sets close-on-exec with the correct flag
(TOB-ZLIB-008).
- minizip:
- A double free in block_central_name() (reported by Oculytic),
and a NULL dereference on repeated zipAlreadyThere() calls
after a bad central directory (reported by Naveed Khan).
- Validation of extra-field sizes, plus portable, alignment-safe
reading, in zipRemoveExtraInfoBlock() (reported by Naveed Khan
and jmestwa-coder).
- unzip no longer reads Zip64 values from outside their
extra-field record (reported by Mohamed Elnady). It also uses
only the Zip64 locator immediately before the end of central
directory record (reported by snajafov). Crafted archives could
make minizip report different entries than other readers.
- miniunz could create directories outside the extraction
directory (reported by Naveed Khan), and on Windows write files
anywhere (reported by Trail of Bits). Fixed by Naveed Khan.
Path names are now processed by component.
- contrib/infback9: removed out-of-bounds pointer arithmetic in
inftree9.c; CVE-2026-4738 (fix by npt-1707, submitted by
CrossVR). The pointers return in bounds before use and no known
compiler mishandles this, so the critical rating overstates it,
though it could trap on capability hardware such as CHERI.
Bug fixes:
- gzip reading:
- Restored the detection of truncated gzip streams, part of which
was lost in 1.3.2. Also fixed a complete stream being reported
as truncated.
- An error in the first member is no longer treated as trailing
garbage.
- Corrected pending-skip handling in gz_skip(), gzdirect() and
forced seeks at EOF.
- gzgets() now returns an empty string when promised.
- gzip writing:
- Successive SEEK_CUR seeks no longer lose zero fill.
- Zero fill is now handled correctly after a write error.
- gzprintf() is now all-or-nothing when blocked, and is no longer
a stub when compiled as C++.
- gzseek() leaves the position unchanged on failure.
- gzopen_w() now works with paths not representable in the
locale.
- inflate:
- total_in was short six bytes on Z_NEED_DICT.
- inflateReset() now restores the requested window size, and the
wrap after inflateSync().
- inflateSetDictionary() rejects a null dictionary.
- With PKZIP_BUG_WORKAROUND, the code tables were slightly too
small.
- deflate:
- A bad deflateSetDictionary() call is now detected as promised.
- A failed deflateCopy() or inflateCopy() leaves the destination
safe to end.
- Removed a possible overflow in deflate_stored() comparisons.
- Undefined behavior removed in gzwrite.c, gzseek, gz_vacate() and
mztools.c.
- minizip:
- zip.c no longer writes corrupt headers when a Zip64 field
overflows an extra field (reported by mzfr and itsgaldoron), or
for Zip64 entries with file comments.
- zipOpen3() no longer leaks memory or returns a freed comment
pointer on failure.
- Added allocation checks.
- Build:
- configure now builds the shared library with linkers such as
lld that reject undefined symbols in zlib.map, including for
--solo.
- zlib.h no longer depends on NULL being defined.
- zip.c builds with NO_ADDFILEINEXISTINGZIP.
- The test programs use the generated zconf.h when building out
of tree.
- Many CMake fixes: pkg-config files, installation of headers and
of minizip's configuration, symbol prefixing, assembler
detection, and parallel testing. It also works with CMake 4.
Enhancements:
- 64-bit offsets on Windows with MSVC or MinGW, by compiling the
application with _FILE_OFFSET_BITS=64 or _LARGEFILE64_SOURCE. The
library itself needs no changes.
- Platforms:
- Android large file support.
- An export list on AIX.
- -Wno-psabi, only where the PowerPC note would appear.
- s390x VGFMAFLAG in configure.
- Win32 Makefile.msc builds for ARM64.
- minigzip's mmap code uses POSIX types.
- CMake:
- Package components, with _FOUND variables.
- Installation and export of zlib1.dll and zlibwapi.dll.
- Contribs build standalone, with zlib's defaults.
- Tests consolidated, and tests on Windows.
- minizip:
- The traditional encryption header uses a PCG generator instead
of rand().
- Fewer compiler warnings.
- Documentation:
- Clarified that undocumented functions are not part of the API.
- inflateGetHeader() header reuse.
- deflateBound() and deflateSetDictionary() ordering.
- The application's responsibilities in unzip.h.
Known issues:
- contrib/iostream2 is unsafe on untrusted input (reported by Trail
of Bits). When reading a string, it uses the length stored in the
compressed data without checking it, so a crafted file can write
past the end of the destination buffer. Use contrib/iostream3
instead.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.1.0:
Changes:
- Add tss_request_add_bora_tags() and tss_request_add_durant_tags()
to the API
- Update auth client version and add Ap,Timestamp to requests
- Restrict Yonkers tag selection to SysTopPatch
Fixes:
- Handle realloc() failure in tss_write_callback()
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 3.4.20:
- Fixed mouse wheel direction in mouse relative mode on Windows
- Improved Wayland clipboard handling
- Fixed color cursor alpha mask on X11
- Fixed a crash when Vulkan texture memory binding fails
- Fixed transparent windows using the Vulkan renderer
- Improved handling of Nintendo Switch controller calibration
- Fixed Nintendo Switch controllers failing because of missing
stick and IMU calibration
- Fixed reports stopping on the Flydigi Vader 5 Pro while the
Flydigi Space Station service is running
- Added support for rumble and trigger rumble on the Flydigi Vader
5 Pro
- Added support for the 8BitDo Ultimate 2C Wireless controller via
HIDAPI
- Fixed a crash recording float audio on Android 10
- Improved relative mouse mode handling on Android
- Fixed window orientation on iOS 27
- Fixed keyboard focus when using the latest Xcode on iOS
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.3.0:
- Remove paperconf(1) and support for
{/etc,$XDG_CONFIG_HOME}/papersize
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 0.1.24:
- API: nice_agent_attach_recv_ex() to retrieve extra message data
in recv callback
- API: nice_message_extra_data_get_tos() to enable access to
IP_TOS/IPV6_TCLASS IP header field of incoming packets; requires
GLib 2.88
- API: stun_usage_bind_run_compat() to allow specifying
compatibility mode when sending a binding request
- Nicesrc: Attach GstNetControlMessageMeta containing the TOS
header field to buffers
- Ensure NICE_CANDIDATE_MAX_TURN_SERVERS is obeyed
- Ensure nice_agent_get_local_credentials() returns FALSE on error
- Fix random crashes
- Fix potential heap buffer overflow in UDP-TURN over TCP
- Fix compilation on FreeBSD
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.656:
- Prevent dbi_profile crash (CVE-2026-108518) (Henrik Teichmann)
- Fix lock file not removed when DBD::DBM check for bad serializer
class fails. (CVE-2026-111879)
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.20:
- Added a plug-in type for profile header parsing.
- Fixed premultiplied alpha on planar 16 bit and optimized
matrix-shaper transforms.
- Fixed planar half float and Lab double formatters, and planar
strides in fast_float.
- Fixed gamut checking with two profiles and a possible crash with
malformed profiles.
- Recovered neutrality correction in black point detection.
- Made cmsCreateLab2Profile white point handling consistent with
cmsCreateLab4Profile.
- Fixed UTF8 buffer size calculation.
- CGATS parser is now more permissive on certain properties.
- Fixed callback type mismatch in resampled CLUT evaluation.
- Fixed a crash in PostScript CSA generation.
- Fixed memory leaks in black preserving intents and .cube loading.
- cmsChangeBuffersFormat now correctly rejects format changes on
floating point transforms.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 3.2.3:
- configure.ac: add 0800-openssl-4.patch from Brent Kirby
- util/ipmiutil.c: set ver 3.23
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.8.146:
- Update compile-time configuration option `WITH_SELF_PIPE` to use
`poll()` when available.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 16.1.0:
Added
- Graph attribute svgid sets the id property of the <svg> of a
graph.
Fixed
- An sfdp crash has been fixed. This was a regression in Graphviz
15.1.1.
- Graphs that induce invalid trapezoids during ortho routing no
longer cause Graphviz crashes on non-Windows platforms. These
scenarios now exit with failure gracefully.
- edgepaint no longer crashes when passed the illegal option -s.
- cluster no longer crashes when passed single character
command-line options without arguments (e.g. cluster -C).
- cluster of trivial graphs with no nodes no longer crashes.
- cluster on large chains of nodes no longer references
out-of-bounds memory. This was a regression in Graphviz 7.1.0.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Khem Raj
Thomas Roos
Ankur Tyagi
Jason Schonberg
Leon Anavi