Upstream changes (NEWS):
* Require GSSDP >= 1.6.5 and reuse its allocated TCP socket for the web
server.
* Do not leak a GError in the ACL handler.
* Fix IPv6 host-header validation.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 575122a4a0)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upstream changes (git log v1.5.4..v1.5.6):
* Group/bonding fixes: check value length in group config storage, fix
deriving string options by a group, fix getting SRTO_RCVBUF/SRTO_SNDBUF
and rejecting options not allowed on a group, and fix a wrong
'connection lost' error when sending to a connection-pending group.
* Fix a stalled connection that should break after rogue NAK/ACK, and a
misleading listening-socket error message.
* Build: Windows-on-Arm64 support, fix Windows installers, fix use of
the OPENSSL_USE_STATIC_LIBS CMake option, deprecation warning for
Windows+PThreads.
Drop 0002-allow-build-with-cmake-4.patch: it backported the
cmake_minimum_required(VERSION 3.5) bump, which is already present in
1.5.6 upstream.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 70dfb6465f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upstream changes (release notes):
* 1.0.19: security and edge-case correctness fixes - heap-buffer-overflow
read in decode_slice_unit_tiles() from unvalidated PPS tile geometry
(CVE-2026-45382) and heap OOB read in decode_slice_unit_WPP() via an
out-of-bounds CtbAddrRStoTS access (CVE-2026-45383); dec265 SDL fixes
for 4:4:4 streams and mid-stream resolution changes. ABI compatible
with 1.0.18.
Not upgraded to 1.1.x: 1.1.0 reworked the x86 SIMD path to dispatch at
runtime via __builtin_cpu_supports(), which reads the compiler-rt global
__cpu_model. Under this distro's clang/lld toolchain, linking the shared
library then fails with
R_X86_64_PC32 cannot be used against symbol '__cpu_model'; recompile with -fPIC
because clang emits a direct PC-relative access to that exported,
preemptible symbol. Building the objects -fPIC, -Bsymbolic,
--exclude-libs, -fno-direct-access-external-data and a version script
localizing __cpu_model were all tried without success (lld validates the
relocation before applying the localization). 1.0.19 stays on the
compile-time SSE path and builds cleanly, so it is the latest buildable
release here.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 99ca84156d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
python3-mpv RDEPENDS on mpv, which requires ffmpeg (LICENSE_FLAGS =
"commercial"). With "commercial" not in LICENSE_FLAGS_ACCEPTED, parsing
the universe target - which ignores EXCLUDE_FROM_WORLD - reports:
WARNING: Nothing RPROVIDES 'mpv' (but .../python3-mpv_1.0.8.bb
RDEPENDS on or otherwise requires it)
NOTE: Runtime target 'python3-mpv' is unbuildable, removing...
Now that mpv carries LICENSE_FLAGS = "commercial" and is skipped, carry
the same flag here so python3-mpv is likewise skipped cleanly in both
world and universe instead of surfacing as an unbuildable dependency.
The redundant EXCLUDE_FROM_WORLD is dropped.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 2ba9dd8823)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
mpv has an unconditional DEPENDS on ffmpeg, which carries
LICENSE_FLAGS = "commercial". When "commercial" is not in
LICENSE_FLAGS_ACCEPTED (the default), ffmpeg is skipped, and parsing the
universe target - which, unlike world, ignores EXCLUDE_FROM_WORLD -
reports mpv as an unbuildable dependency chain:
WARNING: Nothing PROVIDES 'ffmpeg' (but .../mpv_0.41.0.bb DEPENDS on
or otherwise requires it)
ffmpeg was skipped: Has a restricted license 'commercial' ...
NOTE: Runtime target 'mpv' is unbuildable, removing...
Since mpv cannot be built or shipped without accepting ffmpeg's terms,
propagate the flag onto mpv itself. bitbake then skips mpv cleanly (in
both world and universe) with the same "restricted license" note as
ffmpeg, and no longer emits the confusing unbuildable-dependency
warnings. This mirrors how oe-core's gstreamer1.0-libav (which also
DEPENDS on ffmpeg) carries LICENSE_FLAGS = "commercial".
The explicit EXCLUDE_FROM_WORLD is now redundant - a recipe skipped for
its license flags is already excluded from world - so drop it.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 5f4e021e2d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This fixes:
WARNING: hyprland-image-1.0-r0 do_rootfs: User colord has been defined as (colord, 998, 998, -, /home/colord, /bin/false) but sysusers.d expects it as (colord, -, -, colord colour management daemon, /var/lib/colord, -)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit f4f7c09deb)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
============
- Fixed a 'TypeError' on PHP 8 when 'Security::$static_classes' was set to a
non-array value (e.g. the string ''none'') to disable static class access;
any non-array value now cleanly denies access. Use 'Security::$static_classes =
null' to disable access to all static classes.
- Security: the built-in 'stream:' resource type now validates the nested
stream wrapper against the security policy, so a template such as
'stream:php://filter/...' can no longer bypass 'Security::$streams' (including
'Security::$streams = null') to read local files
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 43fc425c32)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Backport patch to fix CVE-2026-55971.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-55971
Upstream fix:
https://github.com/apache/thrift/commit/db4a473f3a984eee27273256fe737be5dd175595
Testing:
The backported fix ships with a C++ Boost regression test,
test_theadertransport_zlib_roundtrip, in
lib/cpp/test/ThrifttReadCheckTests.cpp. The recipe builds with
-DBUILD_TESTING=OFF, so the C++ test suite is not compiled during a
normal build. To verify the fix, the suite was built with
BUILD_TESTING=ON (using the native thrift compiler for codegen via
THRIFT_COMPILER) and the resulting UnitTests binary was executed
against the target sysroot for MACHINE=qemux86-64.
Result: test_theadertransport_zlib_roundtrip passed. Full C++ UnitTests
suite: 79 of 80 test cases passed, 107659 of 107660 assertions passed.
The single failure (ToStringTest/locale_de_DE_floating_point_to_string)
is unrelated to this fix and is caused by the de_DE locale not being
present in the minimal test sysroot.
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The backport dropped the "j++" body of the delpaths_sorted() grouping
loop while adding the "== 1" guard, turning "while (...) j++;" into an
empty-bodied "while (...);". The index never advances, so any update
that produces "empty" (which reaches _modify() -> delpaths()) hangs,
e.g. "map_values(. // empty)" and ".a |= empty". This also hangs the jq
ptest suite.
Restore the "j++" body while keeping the "== 1" guard.
Assisted-by: kiro:claude-opus-4.8
Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
csysdig fails to link when stock Lua is also present in the sysroot:
ld.lld: error: undefined symbol: luaL_openselectedlibs
>>> referenced by chisel.cpp:1190
ld.lld: error: undefined symbol: lua_pcallk
ld.lld: error: undefined symbol: lua_setglobal
sysdig's chisel code does #include "lua.h" and links against LuaJIT
(lua${JIT}), but the recipe-sysroot also carries stock Lua headers
(openembedded-core lua installs lua.h into ${includedir}). Those headers
win the include search over ${includedir}/luajit-2.1, so the chisel
objects are compiled against stock Lua while the binary links
libluajit-5.1.so. In Lua >= 5.4.4 luaL_openlibs is a macro for
luaL_openselectedlibs and lua_setglobal/lua_pcallk are real symbols,
none of which LuaJIT (a Lua 5.1 ABI) provides, hence the undefined
references. -DLUA_INCLUDE_DIR does not help: sysdig's luajit.cmake only
consults it in its stock-Lua fallback, not when it finds LuaJIT.
Prepend ${STAGING_INCDIR}/luajit-2.1 to CFLAGS/CXXFLAGS. These land in
CMAKE_CXX_FLAGS, which precede CMake's generated -I includes, so LuaJIT's
lua.h is found first and matches the linked library.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 00e7a91180)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The pypi class default python:h11 doesn't match how h11 is tracked
in the CVE databases. NVD has no CPE for it yet; the only existing
record (CVE-2025-43859) carries python-hyper:h11 in its CNA affected
entry [1], so set that pair.
CVE-2025-43859 (request smuggling) is fixed in 0.16.0, the version
we ship, so it resolves as not affected.
[1] https://www.cve.org/CVERecord?id=CVE-2025-43859
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a9bfe001bd)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
lens_default.c defines PRIb64 through a fallback that hardcodes
__PRI64_PREFIX as "ll". That is only correct where uint64_t is unsigned
long long (ILP32). On LP64 musl targets uint64_t is unsigned long, so the
resulting "%llb" conversion does not match the argument and do_compile
aborts under -Werror=format:
lens_default.c:90:48: error: format '%llb' expects argument of type
'long long unsigned int', but argument 3 has type 'uint64_t'
{aka 'long unsigned int'}
glibc never reaches the fallback: it defines __PRI64_PREFIX itself,
wordsize aware, in <inttypes.h>. musl provides the same modifier there
under the name __PRI64 but not __PRI64_PREFIX, so the hardcoded "ll" is
used and is wrong on 64-bit. Reuse musl's __PRI64 when __PRI64_PREFIX is
absent, keeping "ll" as a last resort. glibc builds are unaffected: the
block is skipped entirely.
Signed-off-by: Alejandro Mery <amery@apptly.co>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 09a7b15072)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
===========
* Fix to set VERSION_INFO to create .so.3 instead of .so.11 which will
be reserved for a future 1.10.0 release
* Bugfix: Insufficient verification that responses belong to a
query (CVE-2026-10846). Thanks Pablo Ruiz from 'codecome.ai'
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a5a18fe23f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Ankur Tyagi
Khem Raj
Markus Volk
Jason Schonberg
Wang Mingyu
Adarsh Jagadish Kamini
Hetvi Thakar
Tugrul Kukul
mark.yang
He Zhe
Alejandro Mery