mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-15 18:27:12 +00:00
Code Issues Projects Releases Wiki Activity
40,638 Commits 65 Branches 0 Tags
30acdca70627340dfc9601d1b29eafc8bd6c2ee3
Commit Graph
40638 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ankur Tyagi 30acdca706 sngrep: patch CVE-2026-90558 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-90558

(cherry picked from commit 36ddee53b1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:15 -07:00
Ankur Tyagi ba9537ae1f ntopng: patch CVE-2026-86090 and CVE-2026-86091 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-86090
https://nvd.nist.gov/vuln/detail/cve-2026-86091

(cherry picked from commit ae180302f4)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:14 -07:00
Ankur Tyagi 4e8a7265bd ntopng: patch CVE-2026-84990 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84990

(cherry picked from commit 2d932fa4e3)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:14 -07:00
Ankur Tyagi df5f8478c4 smarty: mark CVE-2026-82531 patched 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-82531

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:14 -07:00
Ankur Tyagi c8dd8428d0 cjson: patch CVE-2026-87933 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-87933

(cherry picked from commit 2b3f5cbbd8)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:13 -07:00
Ankur Tyagi 96cedce046 python3-eventlet: mark CVE-2023-29483 fixed 
Fix[1] for the CVE is part of the upstream version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-29483

[1]https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4

(cherry picked from commit 47b2ce9cc7)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:13 -07:00
Ankur Tyagi 896ea53058 openvpn: upgrade 2.7.7 -> 2.7.8 
Changelog:
https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:12 -07:00
Peter Marko 53ffd4623b thrift: upgrade 0.24.0 -> 0.25.0 
This upgrade includes fix for 61 CVEs.
Refreshed/removed patches via devtool.

Release announcement: [1]
Release notes: [2]

[1] https://lists.apache.org/thread/prryfzdozvt6t02c9k5jf46or3m7ctzy
[2] https://github.com/apache/thrift/blob/v0.25.0/CHANGES.md

License-Update: Added notice for MIT license of a Makefile

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 14:20:30 -07:00
Ricardo Salveti b2486769a3 polkit: keep the agent helper units in the main package 
Commit 3e423e21e5 ("polkit: enable the agent helper socket") enables
polkit-agent-helper.socket from polkit, but since 03420389ca ("polkit:
Add a separate package for polkit systemd service/dbus config")
polkit-service comes first in PACKAGES and takes the whole systemd unit
directory, so the socket is packaged there. Images that install polkit
without polkit-service then fail in do_rootfs:

  Failed to enable unit: Unit polkit-agent-helper.socket does not exist

Installing polkit-service as well does not help with rpm, as it depends
on polkit, whose postinst then runs before the socket unit is installed.

Only package polkit.service in polkit-service, so the agent helper units
stay in polkit with polkit-agent-helper-1, as FILES:${PN} already
intends.

AI-Generated: Uses Claude Code
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 12:00:52 -07:00
Khem Raj 7a14b1e465 Revert "pipewire: add pw-voiceui SVA voice-UI control/listen client" 
This reverts commit a09474fb9a.

Upstream has rejected this patch [1], it was
added here in hope it will be accepted in pipewire.

[1] https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/2969#note_3631852

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Cc: Nicolas Dechesne <nicolas.dechesne@oss.qualcomm.com>
Cc: Kiruthika Vijayasekar <kvijayas@qti.qualcomm.com>
Cc: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
 2026-10-12 11:51:12 -07:00
Igor Opaniuk eb6f714c6b libzip: drop recipe 
The recipe has been moved to oe-core in commit f17e8750c3 ("libzip:
import recipe from meta-oe").

Signed-off-by: Igor Opaniuk <igor.opaniuk@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:57 -07:00
Martin Jansa ced616944a Revert "python3-google-api-core, python3-googleapis-common-protos: set PYPI_PACKAGE_SDIST" 
This reverts commit b9cc78ed6b.

The same issue was resolved in:
https://git.openembedded.org/meta-openembedded/diff/meta-python/recipes-devtools/python/python3-google-api-core_2.19.1.bb?id=0a583b35021692dac485c16d85b3f9a9f5601da0
with the only difference of using PYPI_PACKAGE variable
instead of another hardcoded pypi name.

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:57 -07:00
Ankur Tyagi 1c45c216f6 7zip: upgrade 26.03 -> 26.04 
Changelog:
https://github.com/ip7z/7zip/releases/tag/26.04

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi 95db044886 open62541: upgrade 1.5.8 -> 1.5.9 
Changelog:
https://github.com/open62541/open62541/releases/tag/v1.5.9

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi 8cd6a6b15a libde265: patch CVE-2026-54240 and CVE-2026-54241 
Debian identified same commit as fix for both CVEs[1][2].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54240
https://nvd.nist.gov/vuln/detail/cve-2026-54241

[1]https://security-tracker.debian.org/tracker/CVE-2026-54240
[2]https://security-tracker.debian.org/tracker/CVE-2026-54241

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi a1a902b3b9 libde265: patch CVE-2026-49346 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49346

(cherry picked from commit 4a63a2afa1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi 6f9970147f libde265: patch CVE-2026-49337 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49337

(cherry picked from commit c83399f83f)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi 2bba25a0e6 libde265: patch CVE-2026-49295 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49295

(cherry picked from commit bd09bb41b4)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi 9b938c1616 tinyproxy: patch CVE-2026-55202 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55202

[1]https://security-tracker.debian.org/tracker/CVE-2026-55202

(cherry picked from commit 233e6a56e5)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:15 -07:00
Ankur Tyagi c3796d630f tinyproxy: patch CVE-2026-54387 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54387

[1]https://security-tracker.debian.org/tracker/CVE-2026-54387

(cherry picked from commit 33649b0657)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:15 -07:00
Ankur Tyagi 568c569c2f tinyproxy: patch CVE-2026-31842 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-31842

[1]https://security-tracker.debian.org/tracker/CVE-2026-31842

(cherry picked from commit 985acd9e7c)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:15 -07:00
Ankur Tyagi d015851ed9 libyang: patch CVE-2026-41401 
Backport patch identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41401

[1]https://security-tracker.debian.org/tracker/CVE-2026-41401

(cherry picked from commit 6b06704ac1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 2c888ebe75 miniupnpd: patch CVE-2026-107159 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-107159

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 0f8cf2b6f7 libiec61850: mark CVE-2024-45969 patched 
NVD[1] mentions commit[2] for v1.5 but is also present in v1.6[3]

[1] https://nvd.nist.gov/vuln/detail/cve-2024-45969
[2] https://github.com/mz-automation/libiec61850/commit/7afa40390b26ad1f4cf93deaa0052fe7e357ef33
[3] https://github.com/mz-automation/libiec61850/commit/d1ab50298fcba3f87b1e58dabff92f8615b14ee7

(cherry picked from commit a7088b0fda)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 796a3d4adb hdf5: patch CVE-2026-19025 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].

[1] https://github.com/HDFGroup/hdf5/pull/6508
[2] https://github.com/HDFGroup/hdf5/issues/6491
[3] https://nvd.nist.gov/vuln/detail/cve-2026-19025

(cherry picked from commit df3f814ab8)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 0cdf123177 hdf5: patch CVE-2026-17574 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-17574

(cherry picked from commit 637f437de9)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 5ac7a070e3 hdf5: patch CVE-2026-17573 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.

[1] https://github.com/HDFGroup/hdf5/pull/6160
[2] https://github.com/HDFGroup/hdf5/issues/6124
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17573
[4] https://security-tracker.debian.org/tracker/CVE-2026-17573

(cherry picked from commit f46990293c)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 5468d43cbd hdf5: patch CVE-2026-17572 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.

[1] https://github.com/HDFGroup/hdf5/pull/6499
[2] https://github.com/HDFGroup/hdf5/issues/6501
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17572
[4] https://security-tracker.debian.org/tracker/CVE-2026-17572

(cherry picked from commit c279e9e688)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi ed7807e83b python3-gunicorn: mark CVE-2024-1135 patched 
Debian[1] also identified the commit.

Details:
https://nvd.nist.gov/vuln/detail/cve-2024-1135

[1]https://security-tracker.debian.org/tracker/CVE-2024-1135

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:41 -07:00
Ankur Tyagi 2873762621 wolfssl: mark CVEs patched 
CVE-2023-6937[1] and CVE-2024-5814[2] are patched in current version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-6937
https://nvd.nist.gov/vuln/detail/cve-2024-5814

[1]https://github.com/wolfSSL/wolfssl/blob/v5.6.6-stable/ChangeLog.md#vulnerabilities
[2]https://github.com/wolfSSL/wolfssl/blob/v5.7.2-stable/ChangeLog.md#vulnerabilities

(cherry picked from commit c12fcc9b48)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:41 -07:00
Ankur Tyagi 58ca5eac91 iniparser: mark CVE-2025-0633 pached 
Also mentioned in the release notes[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2025-0633

[1] https://gitlab.com/iniparser/iniparser/-/releases/v4.2.6

(cherry picked from commit 86fba2b580)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:41 -07:00
Ankur Tyagi bef03c1c45 gerbera: ignore CVE-2025-23386 
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-23386

This vulnerability is due to openSUSE specific packaging issue.

(cherry picked from commit 369d962967)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:41 -07:00
Ankur Tyagi 34576300e0 gpm: ignore CVE-2025-4558 
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-4558

(cherry picked from commit e134adc8f3)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:41 -07:00
Ankur Tyagi 997a8ab5af haveged: ignore CVE-2026-41054 
Debian[1] also confirms the fixed version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41054

[1] https://security-tracker.debian.org/tracker/CVE-2026-41054

(cherry picked from commit 086a780db0)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:40 -07:00
Ankur Tyagi 0b890c4745 dool: patch CVE-2026-56652 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-56652

(cherry picked from commit 53bbf2771b)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:40 -07:00
Ankur Tyagi 0a807241ff dool: patch CVE-2026-56651 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-56651

(cherry picked from commit 2e1445decd)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:40 -07:00
Ankur Tyagi 567dad7713 bcc: correct CVE_PRODUCT mapping 
Use "iovisor:bpf_compiler_collection", the exact NVD identity for the
https://github.com/iovisor/bcc source.

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:40 -07:00
Ankur Tyagi 13d46c5cb2 gpsd: patch CVE-2026-58459 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-58459

(cherry picked from commit 57e1f7d3d2)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:40 -07:00
Ankur Tyagi 6ed50c8a2b eject: ignore CVE-2026-28065 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-28065

(cherry picked from commit e6d111c169)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:40 -07:00
Ankur Tyagi ead8f70fa6 dovecot: ignore already fixed CVEs 
Upstream has confirmed that these vulnerabilities are fixed,
and Debian has also identified the relevant commits:

CVE-2025-59028: https://security-tracker.debian.org/tracker/CVE-2025-59028
CVE-2025-59032: https://security-tracker.debian.org/tracker/CVE-2025-59032
CVE-2026-27859: https://security-tracker.debian.org/tracker/CVE-2026-27859
CVE-2026-27851: https://security-tracker.debian.org/tracker/CVE-2026-27851
CVE-2026-33603: https://security-tracker.debian.org/tracker/CVE-2026-33603
CVE-2026-40016: https://security-tracker.debian.org/tracker/CVE-2026-40016
CVE-2026-40020: https://security-tracker.debian.org/tracker/CVE-2026-40020
CVE-2026-42006: https://security-tracker.debian.org/tracker/CVE-2026-42006

(cherry picked from commit 86a9ad852a)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:39 -07:00
Ankur Tyagi 187e2890da civetweb: ignore CVE-2026-5789 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-5789

(cherry picked from commit db080436aa)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:39 -07:00
Ankur Tyagi 52ef4850f4 capnproto: ignore CVE-2026-59704 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59704

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:39 -07:00
Johannes Schneider 3de9f29b7f imx-cst: restore PKCS#11 signing on OpenSSL 4 via the provider 
0015-fix-openssl-4-engine-api-removal made CST build against OpenSSL 4 by
stubbing out the removed ENGINE API, but left PKCS#11-backed signing broken:
ENGINE_by_id("pkcs11") returns NULL, so engine_ctx_init() fails. Add a patch
that reimplements the pkcs11 certificate and key loading on OSSL_STORE and the
pkcs11 provider (pkcs11-provider), restoring HSM/token-backed signing on
OpenSSL 4. OpenSSL 3 builds are unaffected.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 11:03:51 -07:00
Ankur Tyagi cf030e73b8 apache2: upgrade 2.4.68 -> 2.4.69 
Changelog:
https://downloads.apache.org/httpd/CHANGES_2.4.69

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-10 06:12:32 -07:00
Ross Burton 4d617d1b20 python3-pytz: add recipe (from oe-core) 
This recipe is being removed from core as it is now deprecated and no
longer needed with Python 3.9 onwards, which integrated the zoneinfo
module.

All users of pytz in meta-python should be reviewed as the dependencies
may be obsolete.

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-09 10:01:43 -07:00
Markus Volk 9c32badf01 gtkmm4: upgrade 4.22.0 -> 4.24.0 
GdkCursor became a final type in GTK 4.24, so gtkmm 4.22 no longer
compiles against it:

  error: conflicting declaration 'using GdkCursorClass = struct _GdkCursorClass'

Depends on the gtk4 4.24.0 upgrade in oe-core.

AI-Generated: Uses Claude Code (Claude Opus 5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-09 10:01:43 -07:00
Vaibhav Jindal b7c86d875d meta-oe: update benchmark patch metadata 
Add missing Signed-off-by tags to benchmark package patches and
update Upstream-Status annotations where appropriate.

Mark the coremark-pro toolchain override patch as OE-specific
cross-compilation support, update the unixbench patch to reflect
that it is needed for the OpenEmbedded runtime packaging model,
and add the missing Signed-off-by tag to the wrk2 patch.

Signed-off-by: Vaibhav Jindal <vaibjind@qti.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-09 10:01:42 -07:00
Etienne Cordonnier ec5c55a1b9 android-tools: make adbd fs_config opt-in via PACKAGECONFIG 
On non-Android builds should_use_fs_config() in adbd's
file_sync_service.cpp unconditionally returns true, so every
`adb push` destination, including paths under /data, is routed through
Android's fs_config tables. Those tables have a catch-all directory entry
for "data" (mode 0771, AID_SYSTEM) but no equivalent file entry, so a
freshly pushed directory and the file inside it end up with inconsistent
owners, and non-root/system processes can't list the directory.

On non-Android builds should_use_fs_config() now returns false by
default: adbd then honours the mode sent by the host and leaves
ownership untouched.

Add a "fs-config" PACKAGECONFIG (disabled by default) which defines
ADBD_USE_FS_CONFIG and re-enables fs_config, scoped to /system, /vendor
and /oem, for BSPs that rely on it.

Behaviour change: fs_config is no longer applied on non-Android builds
unless PACKAGECONFIG contains "fs-config".

AI-Generated: Uses Claude Code (Claude Sonnet 5.5)

Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-09 10:01:42 -07:00
Bastian Krause 46fad8b381 pcsc-lite: create pcscd user and group also via useradd 
The recipe currently only does this via systemd-sysusers. This does not
work for read-only root filesystems, though. So use useradd to create
the pcscd user and group.

Signed-off-by: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-09 10:01:42 -07:00
Peter Marko 201c25456e libwebsockets: upgrade 4.5.8 -> 5.0.0 
Release notes: [1]

Solves (at least) CVE-2026-19773 and CVE-2026-78161.
[2] claims that there are many security fixes available.

Drop patch included in this release.
Drop LIB_SUFFIX which now only throws deprecation warning.
Disable WERROR to keep build green.

Add new option http3 to packageconfig and disable it as it cannot use
openssl which is now enabled for ssl package option.
It can be used together with openssl for ssl and gnutls for https but
that would be weird.
Added possibility to switch gnutls as SSL backend.

License-Update: Addend additional files [3]

[1] https://github.com/warmcat/libwebsockets/blob/v5.0.0/README.md?plain=1#L29
[2] https://github.com/warmcat/libwebsockets/commit/ed1d8f3bc5b7772f283f05d77dec3b4ced0c95b3
[3] https://github.com/warmcat/libwebsockets/commit/a64f8d72c7442d8a982cce5fc0754d87c8db7ee7

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-09 10:01:42 -07:00