mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-13 17:39:57 +00:00
Code Issues Projects Releases Wiki Activity
24,192 Commits 64 Branches 0 Tags
3f9744d6b2e17d858f6fc0e272ded4aaa9568c71
Commit Graph

24192 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Gyorgy Sarvari 3f9744d6b2 usb-modeswitch: upgrade 2.6.0 -> 2.6.2 
Changelog:
2.6.2:
- Bug in C code (with gcc 1.5) fixed

2.6.1:
- Wrapper now handles devices with non-continuous interface numbering:
  www.draisberghof.de/usb_modeswitch/bb/viewtopic.php?f=2&t=2915&p=19605
- catch error with retrieving the active configuration, exit gracefully:
  https://bugs.launchpad.net/bugs/1880191

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari ecf59eb1a1 xdg-user-dirs: upgrade 0.17 -> 0.18 
Changelog:
- Fixed minor leak
- Documentation fixes
- Updated translations

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Sanjay Chitroda 672f5f28e8 recipes-core/toybox: Switch SRC_URI to HTTPS for reliable fetch 
The upstream site (landley.net) serves inconsistent content when using HTTP,
causing checksum mismatches during do_fetch. Using HTTPS ensures stable
downloads and resolves checksum failures.

Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari 08c486ce76 netdata: ignore CVE-2024-32019 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32019

The vulnerability affects the ndsudo binary, part of netdata.
This binary was introduced in version 1.45.0[1], and the recipe
contains v1.34.1 - which is not vulnerable yet.

Ignore the CVE due to this.

[1]: https://github.com/netdata/netdata/commit/0c8b46cbfd05109a45ee4de27f034567569fa3fa
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari 3dc63bce4d nodejs: ignore CVE-2024-36137 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-36137

The vulnerability affects the permission model, which was introduced[1]
in v20 - the recipe version isn't vulerable yet.

[1]: https://github.com/nodejs/node/commit/00c222593e49d817281bc88a322f41f8dca95885

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari e88e353f30 nodejs: ignore CVE-2024-3566 and CVE-2024-36138 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-3566
https://nvd.nist.gov/vuln/detail/CVE-2024-36138

This vulnerabilities affect Windows only.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Peter Marko 9e38c37a62 sassc: ignore CVE-2022-43357 
This CVE is fixed in current libsass recipe version.
So wrapper around it will also not show this problem.
It's usual usecase is to be statically linked with libsass which is
probably the reason why this is listed as vulnerable component.

[1] links [2] as issue tracker which points to [3] as fix.
[4] as base repository for the recipe is not involved and files from [3]
    are not present in this repository.

[1] https://nvd.nist.gov/vuln/detail/CVE-2022-43357
[2] https://github.com/sass/libsass/issues/3177
[3] https://github.com/sass/libsass/pull/3184
[4] https://github.com/sass/sassc/

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 576b84263b)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)

Kirkstone has also the fixed libsass version (3.6.6), the CVE can
be considered fixed.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari 4e2c202346 phpmyadmin: ignore CVE-2020-22452 
Details: https://nvd.nist.gov/vuln/detail/CVE-2020-22452

The fix is present in the recipe version (5.1.4)[1]

[1]: https://github.com/phpmyadmin/phpmyadmin/pull/16004/commits/ca42395ee4b2936d3702524f8fb8bec1e9502bc7

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari 8e69851e6d nodejs: patch CVE-2024-27983 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-27983

Pick the patch that mentions this CVE ID explcitly in its commit message.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari ab83c61385 nodejs: ignore CVE-2024-22017 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-22017

The vulnerability is related to the io_uring usage of libuv.

Libuv first introduced io_uring support in v1.45[1].
oe-core ships a non-vulnerable version (1.44.2), and nodejs
vendors also an older version (1.43).

Mark this CVE as ignored for this recipe version.

[1]: https://github.com/libuv/libuv/commit/d2c31f429b87b476a7f1344d145dad4752a406d4

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari f9ed3b8197 nodejs: patch CVE-2023-39333 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-39333

Backport the patch that mentions this CVE ID explicitly in its
commit message.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari 04f577d527 nodejs: ignore CVE-2023-30583, CVE-2023-30584 and CVE-2023-30587 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-30583
https://nvd.nist.gov/vuln/detail/CVE-2023-30584
https://nvd.nist.gov/vuln/detail/CVE-2023-30587

None of these vulnerabilities are present in the recipe version.

CVE-2023-30583: While the main feature (blob) was intruced in v16, the vulnerable
code (load blobs from file) was introduced in v20[1], and as such,
the vulnerability is not present in the recipe version.

CVE-2023-30584, CVE-2023-30587: The whole vulnerable feature (permission model) was
introduced[2] in v20.

Ignore these CVE IDs.

[1]: https://github.com/nodejs/node/commit/950cec4c2642c15e2913f35babadda56c1d8a723
[2]: https://github.com/nodejs/node/commit/00c222593e49d817281bc88a322f41f8dca95885

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari 9608348824 fio: ignore CVE-2025-10824 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-10824

The upstream maintainer wasn't able to reproduce the issue[1],
and the related bug is closed without further action.

[1]: https://github.com/axboe/fio/issues/1981

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a275078cbe)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_STATUS)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari c7127b94f3 python3-django: ignore CVE-2024-22199 
This CVE is not for python-django, but for some go project
which shares the same name.

Ignore this CVE due to this.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Peter Marko 6b7a0197f9 proftpd: set status of CVE-2001-0027 
This ancient CVE [1] is unversioned ("*") in NVD DB.
"mod_sqlpw module in ProFTPD does not reset a cached password..."

Looking at history and changelog, the module was removed [2] around
the time when this CVE was published, likely as reaction to this CVE.
"mod_sqlpw.c, mod_mysql.c and mod_pgsql.c have been REMOVED from the
distribution. They are currently unmaintained and have numerous bugs."

Note: It was later re-introduced as mod_sql when it got fixed under
new maintainer.

[1] https://nvd.nist.gov/vuln/detail/CVE-2001-0027
[2] https://github.com/proftpd/proftpd/blob/v1.3.8b/NEWS#L3362

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 03a1b56bc7)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Ankur Tyagi 71adc2f371 civetweb: patch CVE-2025-9648 
Details https://nvd.nist.gov/vuln/detail/CVE-2025-9648

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit eb338ebb60)

Rebased patch on Kirkstone's civetweb.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari 15750d5584 atop: patch CVE-2025-31160 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-31160

Backport the patch that's subject references the CVE id explicitly.

I was able to verify the patch with a reproducer[1] (which is mentioned
in a reference[2] in the nvd report). Without the patch atop crashed,
with the patch it worked fine (both with and without -k/-K flags).

[1]: https://blog.bismuth.sh/blog/bismuth-found-the-atop-bug
[2]: https://gist.github.com/kallsyms/3acdf857ccc5c9fbaae7ed823be0365e

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari f3df89aedb php: upgrade 8.1.33 -> 8.1.34 
Comes with fixes for CVE-2025-14177, CVE-2025-14178 and CVE-2025-14180

Changelog:
- Curl: Fix curl build and test failures with version 8.16.
- Opcache: Reset global pointers to prevent use-after-free in zend_jit_status().
- PDO: Fixed: PDO quoting result null deref. (CVE-2025-14180)
- Standard:
  *  Fixed: Null byte termination in dns_get_record().
  *  Fixed: Heap buffer overflow in array_merge(). (CVE-2025-14178)
  *  Fixed: Information Leak of Memory in getimagesize. (CVE-2025-14177)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari 6d28476b74 nbdkit: remove unused patch 
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari 2ab2b60609 nbdkit: patch CVE-2025-47712 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-47712

Pick the patch from the project's repository which explicitly
mentions this vulnerability ID.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari 4a97186719 nbdkit: patch CVE-2025-47711 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-47711

Pick the patch from the repository which explicitly mentions
this CVE ID.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari d618b8dc84 xmlsec1: update SRC_URI 
The tarball was moved to a subfolder. Adapt the SRC_URI.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari dcf2b5030d softhsm: correct SRC_URI branch 
The develop branch doesn't exist anymore. The fetched commit is on the main branch.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari 11b7fe9a91 thrift: fix SRC_URI 
The tarball was moved to an archive server, so the link stopped
working. Update it to the new location.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari feb9c53544 srecord: fix SRC_URI 
The tarball was moved to a new folder in the SourceForge project,
and the original convenience link stopped working.
Use the direct link instead.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari 02422765c6 pcp: switch SRC_URI to git 
The original link stopped working.

I have compared the original tarball's content with this revision: the contents
are bit-identical to each other. The only difference is that the original
tarball came with an extra "debian/control" file which is not present in
the git repository, but it not using for compiling.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari 0ac70cf0bb tcsh: update SRC_URI 
The tarball was moved to a new subfolder, making do_fetch fall back to a mirror.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari 75080e6708 hunspell: patch CVE-2019-16707 
Details: https://nvd.nist.gov/vuln/detail/CVE-2019-16707

Pick the patch that resolves the Github issue[1] that tracked
this vulnerability.

[1]: https://github.com/hunspell/hunspell/issues/624

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari 6ba8215d31 smarty: patch CVE-2023-28447 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-28447

Pick the patch that is referenced by the NVD report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Ankur Tyagi 2acc0c3720 smarty: update CVE_PRODUCT 
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit ceadb83fcf)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari a5ac9b82bd smarty: patch CVE-2018-25047 
Details: https://nvd.nist.gov/vuln/detail/CVE-2018-25047

Pick the patch that resolved the issue referenced in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:02:57 +01:00
Emil Kronborg Andersen f642e61588 snappy: add CVE_PRODUCT 
If CVE_PRODUCT is not explicitly set to google:snappy, CVEs are
found for https://github.com/KnpLabs/snappy instead.

Signed-off-by: Emil Kronborg Andersen <emkan@prevas.dk>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b888130e95)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 15:09:15 +01:00
Gyorgy Sarvari 9af2a4a468 dbus-broker: patch CVE-2022-31212 
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-31212

A detailed writeup[1] is referenced by the nvd report, which
describes that the vulnerability itself is not in the application,
rather in a dependency of it, in c-shutil, which is pulled in as
a submodule.

Pick the patch from this submodule that fixes a stack overflow, and
adds a test explictly verifying the described vulnerability.

[1]: https://sec-consult.com/vulnerability-lab/advisory/memory-corruption-vulnerabilities-dbus-broker/

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 13:57:04 +01:00
Gyorgy Sarvari 5b7d15db18 cups-filters: patch CVE-2023-24805 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-24805

Pick the patch referenced by the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 13:57:02 +01:00
Gyorgy Sarvari c590e88d19 cups-filters: patch CVE-2025-64524 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-64524

Pick the patch referenced by the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 13:57:02 +01:00
Gyorgy Sarvari 16f6b4287c cups-filters: patch CVE-2025-57812 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-57812

Backport the patch that is referenced by te nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 13:57:01 +01:00
Gyorgy Sarvari 4da4c6547c redis: ignore CVE-2025-46686 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-46686

Upstream disputes that it is a security violation, and says that
implementing a mitigation for this would negatively affect the rest
of the application, so they elected to ignore it.

See Github advisory about the same vulnerability:
https://github.com/redis/redis/security/advisories/GHSA-2r7g-8hpc-rpq9

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 13:57:00 +01:00
Gyorgy Sarvari ef7ac09d7a nanopb: patch CVE-2024-53984 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-53984

Pick the patch referenced by the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 13:56:59 +01:00
Ninette Adhikari d07ae6a5c8 mpd: Update status for CVE-2020-7465 and CVE-2020-7466 
The recipe used in the `meta-openembedded` is a different mpd package compared to the one which has the CVE issue.
Package used in `meta-embedded`: http://www.musicpd.org
Package with CVE issue: https://sourceforge.net/projects/mpd/
No action required.

Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 3e3c256981)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 13:56:59 +01:00
Gyorgy Sarvari 360720faba mtr: patch CVE-2025-49809 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-49809

Pick the patch mentioned in the NVD report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 13:56:58 +01:00
Gyorgy Sarvari 0cc9b2df36 vlc: upgrade 3.0.17-1 -> 3.0.17.4 
This update contains minor bugfixes.

Changelog:
3.0.17.4:
Service Discovery: Fix UPnP regression on Windows

3.0.17.3:
Demux: Fix a regression causing a lack of audio in adaptive streaming

3.0.17.2:
Interface: Qt: Fix right click support on video
Misc: Update YouTube script

This commit has been detached from all branches. The version format
change does not cause version-going-backwards issues.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 10:17:02 +01:00
Gyorgy Sarvari d8e53c627c vorbis-tools: upgrade 1.4.2 -> 1.4.3 
Refreshed gettext.patch
Dropped 0001-ogginfo-Include-utf8.h-for-missing-utf8_decode.patch & CVE-2023-43361.patch
Dropped patches fixed in newer version
Dropped md5sum

Changelog:
https://gitlab.xiph.org/xiph/vorbis-tools/-/blob/release-1.4.3/CHANGES

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 37a17c25cc)

Adapted to Kirkstone.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 10:17:02 +01:00
Gyorgy Sarvari 593b6d93ca libmediaart-2.0: upgrade 1.9.6 -> 1.9.7 
This is a bugfix release, fixing some memory leaks and compiler warning
(and it also has a couple of commits related to the project's own CI system,
which doesn't affect the application)

Changelog: https://gitlab.gnome.org/GNOME/libmediaart/-/blob/master/NEWS

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 10:17:02 +01:00
Gyorgy Sarvari 12807d9007 zabbix: patch CVE-2025-49643 
The actual patch was identified by checking the file that was modified
in the tag 6.0.42, and also by looking at the Jira item referenced by it:
the patch references DEV-4466, the same ID that is referenced in the
Jira ticket[1] referenced by the NVD report (look in the "All Activity" tab).

[1]: https://support.zabbix.com/browse/ZBX-27284

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 10:17:02 +01:00
Gyorgy Sarvari 68bc6d3bbe imagemagick: patch CVE-2025-62171 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-62171

Pick the patch that's mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 10:17:02 +01:00
Gyorgy Sarvari 339ac6d59c imagemagick: patch CVE-2025-65955 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-65955

Pick the patch referenced by the NVD report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 10:17:02 +01:00
Gyorgy Sarvari 4eae56f5d0 imagemagick: patch CVE-2022-1115 
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-1115

Pick the patch referenced in the NVD report.
Tested successfully against the PoC described in the related Github issue[1].

[1]: https://github.com/ImageMagick/ImageMagick/issues/4974

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 10:17:02 +01:00
Hitendra Prajapati 4ac316bf47 krb5: fix for CVE-2024-3596 
Upstream-Status: Backport from https://github.com/krb5/krb5/commit/871125fea8ce0370a972bf65f7d1de63f619b06c

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 10:17:01 +01:00
Gyorgy Sarvari d2894888c9 nodejs: fix CVE_PRODUCT 
The CVE_PRODUCT is set with a weak default assignment in the cve-check.bbclass,
which means that when the recipe uses +=, it overrides the original weak adefault
value instead of appending to it.

Set all applicable values in CVE_PRODUCT variable explicitly.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-22 20:56:37 +01:00
Gyorgy Sarvari 3b6d6286c7 xdebug: upgrade 3.1.1 -> 3.1.5 
This update contains many bugfixes.

Changelog: https://xdebug.org/updates#x_3_1_5

3.1.5:
- Install documentation gives wrong arch for installation on M1 Macs
- phpize --clean removes required clocks.m4 file
- Constant defined with an enum case produce double "facet" attribute in context_get response
- Crash when used with source guardian encoded files
- Segfault in __callStatic() after FFI initialization

3.1.4:
- Removing second call breakpoint with same function name
- XDebug breaks the Symfony "PhpFilesAdapter" cache adapter
- Possible use after free with GC Stats
- Can't inspect ArrayObject storage elements
- Segmentation fault in symfony cache
- Debug session can be started with "XDEBUG_SESSION_START=anything" when xdebug.trigger_value is set
- Warn when profiler_append is used together with zlib compression
- Code coverage misses static array assignment lines

3.1.3:
- evaling broken code (still) causes unhandled exception in PHP 7.4
- Memory leak when a trace file can't be opened because xdebug.trace_output_name is invalid
- Slowdown when calling a function with long string parameters
- Debugger creates XML with double facet attribute

3.1.2:
- Segfault on fiber switch in finally block in garbage collected fiber
- Crash when profile file can not be created
- __debugInfo is not used for var_dump output
- Segault on xdebug_get_function_stack inside a Fiber

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-22 20:56:36 +01:00