wvstreams relies on C++ that clang rejects, e.g. access to private and
incomplete nested classes, and so do its headers that wvdial includes.
Upstream is no longer maintained, so build both with gcc when clang is
the default toolchain.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The x86 assembly aliases registers with .set, and clang's integrated
assembler can not infer the operand size from such aliases:
x86-sse2.S:124:9: error: ambiguous operand size for instruction 'add'
Define the aliases with the preprocessor instead.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The juju backend uses variable length arrays in structs, a GCC
extension which clang does not support:
error: fields must have a constant size: 'variable length array in structure' extension will never be supported
Allocate the buffers with alloca() and use the flexible array members
of the kernel event structs instead.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The version script lists all APIs, including the asymmetric cipher and
KPP ones that are only built with --enable-lib-asym/--enable-lib-kpp, so
lld fails with:
error: version script assignment of 'LIBKCAPI_0.12.0' to symbol 'kcapi_akcipher_init' failed: symbol not defined
Upstream prefers to keep a single version script for all configurations
[1], so allow undefined versioned symbols with lld.
[1] https://github.com/smuellerDD/libkcapi/issues/191
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The pam module version script lists pam_sm_chauthtok(), which
pam_wtmpdb does not implement, so lld fails with:
error: version script assignment of 'global' to symbol 'pam_sm_chauthtok' failed: symbol not defined
Drop it from the version script.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The version script lists vorbis_comment_add() and
vorbis_comment_add_tag(), which tremor does not implement, so lld fails
with:
error: version script assignment of 'libvorbisidec.so.1' to symbol 'vorbis_comment_add' failed: symbol not defined
Drop them from the version script. It has CRLF line endings, which a
patch does not survive git am with, so use sed.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
getipnodebyname() and freehostent() are only interposed when the
platform has getipnodebyname(), which glibc and musl do not, but they
are always exported, so lld fails with:
error: version script assignment of 'global' to symbol 'freehostent' failed: symbol not defined
Only export them when configure finds getipnodebyname().
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The frame_x11_* functions are only built with the X11 backend, but the
version script always lists them, so lld fails without x11 with:
error: version script assignment of 'FRAME_2.2' to symbol 'frame_x11_new' failed: symbol not defined
Generate a version script without them when the X11 backend is disabled.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The version script lists nfct_timeout_policy_unset(), which has never
been implemented, so lld fails with:
error: version script assignment of 'LIBNETFILTER_CTTIMEOUT_1.0' to symbol 'nfct_timeout_policy_unset' failed: symbol not defined
Drop it from the version script.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
ConsoleKit2 no longer requires X11, so use it for session tracking on
all non-systemd distros. NetworkManager only reads the ConsoleKit
session database, whose format is unchanged by ConsoleKit2 2.0.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
ConsoleKit2 2.0 uses bare session IDs ("Session1") instead of D-Bus
object paths both on D-Bus and in its session database, so polkit no
longer finds sessions when built with session_tracking=ConsoleKit.
Strip the object path returned by GetSessionForUnixProcess to the ID
and rebuild the path when calling into the session object.
The changed code is only exercised when ConsoleKit is running, so
apply the patch unconditionally.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
test_monitor_multiple_lines_by_name has the same race which was fixed
in test_monitor_all_lines_on_request: it toggles line foo twice, with
line xyz in between, before reading any event. gpio-sim delivers both
changes of foo as one interrupt when they happen before it is handled,
so the rising edge is lost:
ASSERT: '45056166795 falling "foo" 45056147828 rising "xyz"' did not
match '[0-9]+ rising\s+"foo"'
Wait for each event before triggering the next one. In a qemux86-64
guest this took the test from 13 of 20 runs failing to none, and
ptest-runner libgpiod passed 12 of 12 runs on the rebuilt image.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
test_monitor_all_lines_on_request toggles line 1 twice, with line 4 in
between, before reading any event. gpio-sim delivers both changes of
line 1 as one interrupt when they happen before it is handled, so the
rising edge is lost:
ASSERT: '41610700648 falling "foo" 41610665414 rising 4' did not
match '[0-9]+ rising\s+"foo"'
Wait for each event before triggering the next one. In a qemux86-64
guest this took the test from 12 of 20 runs failing to none.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
sdbus-c++-integration-tests fails intermittently in the ptest image on
qemuarm64 (qemu TCG, no KVM) when the build host is busy running other
testimage tasks:
- CallsMethodWithLargeArgument sends ~30 MB in one method call with the
default 25 second D-Bus timeout. That takes 13-16 s on an idle qemu
and 40-50 s under load, so it fails with
org.freedesktop.DBus.Error.Timeout. Use a 120 second timeout.
- ThrowsTimeoutErrorWhen{Method,ClientSideAsyncMethod}TimesOut require
the timeout error within 50 ms; under load it took up to 57 ms.
Allow 500 ms, still well below the 1 s operation the tests time out.
With both patches, 10 repeats of the integration tests under heavy
host and guest CPU contention pass; without them 4 of 10 failed.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Many tests, most of them in net, fail rather than skip when the kernel
lacks a feature they need (vxlan, geneve, macvlan, vrf, netdevsim, TLS,
tc actions and qdiscs, audit for the landlock tests, ...). Skip them
based on the running kernel's config, so the results show regressions
instead of the kernel configuration.
Also skip the udpgro tests when iptables can't set up NAT (legacy
iptables on a kernel with only nftables), tc-testing when scapy is not
installed, landlock's fs_bench, which only reports timings and needs
twice the default timeout in qemu, mseal's sysmap_is_sealed when the
kernel doesn't seal the system mappings, and the ptrace vmaccess and
tty_tiocsti tests, which check for kernel changes that are not in
mainline.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add fixes for tests that fail on qemux86-64 because of bugs in the
tests, and make tests that fail when an optional kernel feature or
device is missing skip instead:
- core: unshare_test fails when fs.nr_open is at its maximum
- proc: proc-empty-vm treats pkey_alloc() ENOSPC as a failure, and
read fails when a task exits while it walks /proc
- sched: cs_prctl_test is not installed from the output directory and
fails without core scheduling
- gpio: gpio-mockup expects an empty range to be accepted, and
gpio-cdev-uaf fails without CONFIG_GPIO_CDEV_V1
- splice: short_splice_read fails without test_module
- syscall_user_dispatch: sud_benchmark needs a frame pointer
- lsm: lsm_get_self_attr_test checks the wrong errno and
lsm_list_modules_test fails without securityfs
- cgroup: test_cpu fails without CONFIG_CFS_BANDWIDTH
- binderfs: binderfs_stress fails without binderfs
- kvm: nx_huge_pages_test.sh fails without KVM
- watchdog: watchdog-test fails without a watchdog device
- net: udpgro_fwd.sh hangs the whole run without vxlan, and icmp.sh
fails without tcpdump
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Many selftests modprobe what they need (gpio-mockup, netdevsim, vrf,
the tc qdiscs, classifiers and actions, ...), but the image only had a
couple of kernel modules, so recommend all of them.
The net tests also need real iproute2, iputils ping and ping6, ethtool,
iperf3, socat, jq, bc and taskset; busybox ip and ping lack most of the
options they use, and busybox's ping6 has no -M, which pmtu.sh picks up
over ping when it exists.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The net selftests generate their netlink code with tools/net/ynl, which
needs the netlink specs from Documentation/netlink, python3 with pyyaml
and jsonschema, and the top-level MAINTAINERS file: ynl_gen_c.py finds
the kernel root by walking up until it sees MAINTAINERS and loops
forever when it is not there. libbpf needs elfutils and zlib,
reuseport_bpf_numa numactl and tcp_mmap openssl.
net/lib installs the whole ynl tree, so drop its build artifacts and
bytecode, which trip the staticdev and buildpaths QA checks, and pass
the prefix maps to clang so the BPF objects don't carry build paths
either.
The python tests load the netlink specs at runtime, so add pyyaml there
as well.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
run-ptest printed "PASS: kernel-selftest" or "[FAIL]: kernel-selftest".
The latter does not match the FAIL: pattern of the ptest log parser, so
whenever any selftest failed testimage reported no results at all:
ptests which had no test results:
['kernel-selftest']
Convert the per-test TAP lines from run_kselftest.sh into PASS:, FAIL:
and SKIP: lines, so results are recorded and failing selftests are
listed by name.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
SRCREV was set to the v2.7.2 annotated tag object instead of the commit
it points to, so it did not match what tag=v${PV} resolves to.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
SRCREV was set to the v2.7.0 annotated tag object instead of the commit
it points to, so it did not match what tag=v${PV} resolves to.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Without tracker-testutils the tracker3 tests look for localsearch on
the build host now. Extend 0001-Avoid-running-trackertestutils.patch to
skip these tests too (Upstream-Status: Inappropriate [OE-Specific]).
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
gnome-commander is written in Rust entirely now: the C++ parts,
libgcmd and the exiv2, taglib, libgsf and poppler options are gone, so
drop the CXXFLAGS, the PACKAGECONFIGs, the libgcmd packaging and the
chrpath call. Rework
0001-meson-Support-cross-compilation-via-a-rust_target-cr.patch for
the new gnome-commander/meson.build (Upstream-Status: Pending) and drop
0002-weak_ref-Use-a-Mutex-for-the-object-id-counter.patch, the code it
changed is gone. Regenerate gnome-commander-crates.inc.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
51.2 is on the gnome-51 branch. Regenerate loupe-crates.inc.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
0.45 uses the WnckHandle API, which libwnck for gtk2 lacks, so build
against gtk+3 and libwnck3. COPYING holds the GPLv3 text now and
GPL3.txt is gone; the sources are GPL-3.0-or-later. Pass PREFIX to
make in do_compile too, so LOCALEDIR is not /usr/local/share/locale.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default branch is main now.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
It depends on libgedit-gfls and libgedit-amtk now.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The default branch is main now.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
5.10 and 5.11 are released as git tags only, so fetch from git.
libgedit-gtksourceview 299.8.0 requires amtk >= 5.11.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
testQueryUDPFallbackWithSocket fails intermittently because it connects
its TCP socket with a 2s socket timeout, and the resulting TimeoutError
is not dns.exception.Timeout, so the test's retry_on_timeout decorator
does not retry it. Retry TimeoutError too and give the connect the same
4s budget as the query.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 40.54.0:
- Fix: bn_BD swift_bank_codes and swift11 length.
For previous releases:
- Fix: allow the digit 9 in the first eight positions of an en_CA
SIN
- Fix: generate valid it_IT VAT IDs in vat_id()
- Fix: reject non-positive precision in time_series
- Fix: avoid random offsets for equal parsed date_time_between
bounds
- Docs: add faker-cti to community providers
- Fix: respect zero fractional digits for positive pyfloat fallback
- Fix: generate valid bg_BG VAT check digits
- Fix: pass tzinfo through when resolving relative
date_time_between_dates bounds
- Fix: allow repeated digits in numeric pt_BR CNPJ roots
- Update the base currency list to current ISO 4217
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.4.2 with security fixes:
- Fixed shell command injection through file names in the edit
command and Cmd.run_editor(). A file name containing shell
syntax such as $(...) or backticks was interpreted by the
shell instead of being passed to the editor as-is. On
Windows, run_editor() now raises ValueError for an editor or
file path containing a double quote, which cannot be passed
safely to cmd.exe.
- The persistent history file is now readable and writable only
by its owner (mode 0600 on POSIX), since history can contain
secrets typed as command arguments. The permissions of an
existing history file are tightened the next time history is
saved.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 6.2.1:
- Fixed a segmentation fault on Python 3.12-3.13 when hashing,
comparing or printing a self-referential CBORTag decoded from
untrusted CBOR data, such as when used as a map key or set
element; a catchable RuntimeError (wrapped in a CBORDecodeError
during decoding) is now raised instead (GHSA-6rgc-8hxm-rj7p)
- Corrected the semantic-decoder example for immutable sets
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 0.0.6:
Breaking Changes:
- Drop support for Python 3.9.
Upgrades:
- Add support for Python 3.15 and 3.15t.
Docs:
- Enable Ruff formatting for Python in Markdown.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
ppc-musl.patch no longer applies after the 2.19.3 upgrade, failing
do_patch on musl. Upstream fixed PT_NIP handling for non-glibc in
122d6e7885 and 17ff2e676b, and elf_mem_image.cc no longer uses
__WORDSIZE, so drop it and the elf_mem_image patch.
Replace the Makefile.am patch that stopped building the test programs
with the --disable-tests configure option added upstream.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The per-dictionary licenses were set as LICENSE:dictionaries/<lang>
overrides, which never apply since they are not package names, so the
recipe, which installs every dictionary into a single package, was
reported as MIT only. Several of those values were also deprecated SPDX
ids (GPL-2.0, LGPL-2.1, ...) or license refs without a license text
(LicenseRef-BSD, LicenseRef-Other).
Record each dictionary's license in HUNSPELL_DICT_LICENSE, taken from the
"license" field of its upstream package.json with deprecated ids mapped
to their -only equivalents, and set LICENSE to the conjunction of all of
them. Exceptions:
- en-*: "BSD" is not an SPDX id; these use the SCOWL license text, added
as LicenseRef-SCOWL.
- ru: a BSD-style license with an extra clause, added as
LicenseRef-hunspell-ru.
- vi: package.json says GPL-2.0, but the license file says GPLv3.
- is: the license file also covers the CC-BY-4.0 hyphenation rules.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
LGPLv2.1 is a legacy name that is only accepted through SPDXLICENSEMAP,
which maps it to LGPL-2.1-only. The sources are licensed under "the GNU
Lesser General Public License, version 2.1 or any later version", so use
LGPL-2.1-or-later.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Use the standard WIRELESS_DAEMON variable in the same way as recipes in
oe-core so that networkmanager will automatically use iwd or
wpa-supplicant depending on which is selected globally.
This avoids installing two different wireless daemons as rdepends of
networkmanager and packagegroup-base-wifi.
Signed-off-by: John Keeping <jkeeping@inmusicbrands.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add -M30% -C --find-copies-harder to the git send-email example in
README.md so that git format-patch detects renames and copies more
aggressively.
Patches that move or copy files then show only the changed lines
instead of full file deletions and additions, which makes them
smaller and easier to review.
Suggested-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.12.3:
- Fixed the MQTT keepalive of the Cloud connection. It was only
checked when the connection was idle, so a link with steady
inbound traffic never noticed an unanswered ping and could stay
stalled indefinitely. The ping and acknowledgement deadlines also
followed the wall clock, so a clock step caused a false ping
timeout or delayed detection, and on boards without an RTC
acknowledgements never timed out before the first NTP sync.
Deadlines now use a monotonic clock, and a dead connection is
detected 60 seconds after an unanswered ping.
- The Agent's HTTPS client for Netdata Cloud now checks the chunk
sizes of chunked responses strictly and caps such responses at 1
MiB. A malformed or very large chunk size could make the Agent
exit while allocating memory for it.
- Fixed use-after-free crashes when netdatacli remove-stale-node or
the orphan and ephemeral host cleanup removed a host that was
still in use, either by a child reconnecting to it or by a plugin
that had it selected as a virtual node. A child that reconnects
during a removal is now asked to retry, and a virtual node
selected by a plugin is reported as online and left alone.
- Removed the [stream] parent using h2o option. The h2o web server
was removed in v2.7.0, and since v2.8.0 a child with this option
enabled crashed on every connection attempt to its Parent. A
stream.conf that still sets it is accepted and the option is
ignored.
- Access lists: a client whose IP matches a negated entry, such as
!203.0.113.7 in allow connections from = !203.0.113.7 *, is now
denied without its hostname being checked against the list. This
applies to every access list in netdata.conf when DNS checks are
enabled, including the default heuristic mode for lists with a
wildcard.
- URLs with malformed percent escapes are now rejected with HTTP
400. A % had to be followed by two hex digits but was not
checked, and a URL that failed to decode was served using the
part decoded so far, so /api/v1/info%zz was answered as
/api/v1/info. A request containing a literal % that is not
followed by two hex digits, such as ?x=100%, now gets 400.
- The MCP API key and the management API key are now compared in
constant time, so response timing no longer reveals how close a
guessed key is.
- MCP: JSON-RPC batches are limited to 64 requests and 16 MiB of
responses, and WebSocket messages to 1 MiB, the same as HTTP
requests. Requests whose id is not a string, number or null are
rejected.
- X-Forwarded-For: the Agent now keeps only the first address of
the header, and only when it is a valid IPv4 or IPv6 address.
This is the forwarded client address shown in the access log and
in the audit entries of dynamic configuration changes. Other
values, such as unknown, are dropped.
- Registry: the netdata_registry_id identity is now read only from
the Cookie header, not from anywhere else in the request, such as
the query string. This affects only Agents with the registry
enabled, which is off by default.
- Claiming: a request to /api/v2/claim or /api/v3/claim with a
wrong key no longer regenerates the claim challenge, so it cannot
interrupt a claim an administrator is making. The challenge is
still regenerated at startup and after a claim with a valid key.
- Fixed SQLite stalls across the Agent. A global lock was held
around SQLite calls, so one slow statement blocked every thread
using SQLite, not only those using the same database connection.
- Corruption of the metadata database that appears while the Agent
is running is now marked for recovery on the first failing query,
instead of only at a clean shutdown or never after a crash. The
SQLite query statistics no longer count a busy retry that later
succeeded as a failed query.
- Parents using the ram or alloc storage modes no longer shift
their children's streamed and replicated history after a gap.
Every gap moved all older values one interval earlier and
overstated retention by one interval.
- dbengine now loads only datafiles with the exact name it writes.
A copy such as datafile-1-0000000001.ndf.bak was loaded a second
time alongside the real file, and a stray datafile-2-*.ndf
stopped the Agent at startup. Other names are now reported as
unknown files and skipped.
- Fixed crashes when the cleanup of obsolete charts freed a chart,
or its labels, while health variable lookups, Prometheus export,
alert and context API requests or queries were still reading it.
These include the Agent exiting on an allocation of a huge size.
- dbengine: the Agent no longer hangs at startup when the directory
of a tier cannot be created or its initialization thread cannot
start. A missing tier above tier 0 now leaves the Agent running
with the tiers below it, and a missing tier 0 stops startup with
an error.
- Fixed a crash in metric correlations and other weights queries
over two or more nodes on Agents without a dbengine tier, such as
a Parent using the ram or alloc storage modes. Such Agents now
process the nodes one at a time.
- The summary.nodes[] section of query responses now includes the
query time of the last node, which was missing. With
options=percentage, the anomaly rate of the dimensions view is no
longer inflated. The chart_labels arrays of /api/v1/data now have
one entry per dimension, with null where a chart lacks the label.
- [ml] dimension anomaly score threshold is now limited to 0.01 to
1.00, with a warning in the log when the configured value is
changed. Values up to 5.00 were accepted, but anything above 1.00
silently turned off anomaly detection, because a model's anomaly
score cannot exceed 100. Such values now run at 1.00, the least
sensitive setting.
- ebpf.plugin and ebpf-go.plugin are installed setuid root. When
they run with elevated privileges, they now ignore the
NETDATA_*_DIR environment variables and use the plugin,
configuration and log directories they were built with. Standard
installations are not affected. A [directories] override in
netdata.conf that points these directories elsewhere no longer
reaches the eBPF plugins, which log one line for each ignored
variable.
- Redfish: manager network ports exposed as standard Port resources
are now collected, including their link state and speed. They
were rejected, leaving the collection permanently partial.
- PAN-OS: panos.ipsec.tunnels now counts the established IPsec
tunnels instead of reporting the configured ones, and a tunnel
with overlapping SAs during rekeying counts once. The remaining
SA lifetime now reports the longest valid lifetime of a tunnel
instead of a varying or summed value.
- go.d.plugin: fixed collectors such as Cato Networks failing a
collection cycle with a host scope conflict when a host's
metadata changed while its identity stayed the same.
- Cato Networks: the topology Function now connects each site to
its devices, keeps every observed WAN tunnel instead of merging
parallel ones, and marks tunnels as connected, disconnected or
unknown. Sites, devices and tunnels carry more detail for
troubleshooting, such as HA roles, loss, jitter, last-mile
measurements and BGP sessions, and the graph notes when
inventory, metrics or BGP data are missing. The collector now
uses Cato SDK v1.1.0.
- ebpf.plugin: the number of tracked PIDs in ebpf.monitoring_pid no
longer keeps growing on hosts with short-lived processes. A
process that exited before its /proc entry was read was released
without being subtracted.
- statsd.plugin: with [statsd] set charts as obsolete after enabled
(off by default), the Agent no longer crashes the first time an
idle metric is removed. Removal also no longer leaks the metric's
values, and metrics used by synthetic charts are kept. The
private chart count no longer wraps around and blocks every new
private chart.
- Virtual nodes: the inactivity timeout set by a collector, such as
the one SNMP devices use, works again. It was discarded when the
node was defined, so a virtual node never went offline after its
collector stopped reporting it. A virtual node taken over again
by its local collector after a streamed copy of it stops now has
its health checks and normal operation restored.
- SNMP: a poll in which the device answered no request now fails.
Profile statistics built from cached metadata were still reported
for the device's virtual node, keeping it active after its
measurements had stopped.
- PowerStore: performance, Ethernet and capacity charts now show
the values the array reports. The collector read the field names
of raw samples, while the five-minute and daily rollups it
requests use different names, so these charts showed zeros or
were missing. CPU now shows the peak utilization of the interval
as a percentage, and average login counts keep their fractions.
- log2journal: JSON lines that end inside a backslash escape are
now rejected instead of being parsed with bytes from beyond the
end of the line.
- log2journal: a named group of a PCRE2 pattern or rewrite rule
that does not take part in a match, such as an optional group, no
longer makes the parser read one byte before its buffer. Output
does not change.
- log2journal: fixed several JSON parsing and output issues. Very
long numbers with an exponent could overflow the number buffer or
crash the process, \u000a and \u0009 escapes dropped the rest of
the value, unpaired surrogates produced invalid UTF-8, and a line
that failed to parse left its fields to the next line in both
JSON and logfmt mode. An --inject now replaces a value read from
the log instead of being appended to it, and a rewrite that
refers to its own key reads the original value.
- go.d.plugin: fixed two shutdown races in the job manager. A
shutdown or failed restart could wait until its deadline instead
of finishing, and a Function request that had already been
accepted could be reported as rejected because the plugin was
stopping.
- go.d.plugin service discovery: discovered names and addresses are
now encoded as data in the jobs that discovery rules generate.
They were inserted into the YAML as text, so an IPv6 address
could make a job fail to parse and a name such as on became a
boolean. Stock rules use a new job template helper, for example
{{ job "name" .Name "url" .Address }}, which custom rules can use
too. Existing rules and saved dynamic configurations keep
working.
- go.d.plugin: collector logs and errors, including those returned
by dynamic configuration checks, no longer include raw content
from the files a collector reads, such as log samples,
configuration lines or certificates. They name the file, line,
field and reason instead, so some messages are less detailed.
- go.d.plugin and ibm.d.plugin: HTTP responses read by collectors,
including Prometheus and OpenMetrics endpoints, are now limited
to 64 MiB, measured after gzip decompression. A larger response
fails the collection instead of growing memory without bound.
HTTPCheck reports such a response as bad_content; use a smaller
endpoint for health checks.
- SNMP traps and S3: the state files these collectors keep are now
read and written safely. Symlinks and special files are rejected,
and a temporary file left by a crash no longer blocks later
writes.
- Fixed stock alert and metadata issues: the Portcheck
portcheck_connection_fails alert no longer looks up a dimension
that does not exist, the Elasticsearch, OpenSearch and Unbound
metadata now match the charts they describe, and the Unbound and
ethtool module charts are titled "Module ..." again instead of
"CollectorV1 ...".
- The progress Function now shows API calls that failed with a
server error as errors. They were styled with a severity the
dashboard does not recognize and looked like successful calls.
- Host labels are now read from the configuration file the Agent
loaded, including one given with -c, at startup and on netdatacli
reload-labels. Labels removed from that file are also removed on
reload.
- Crash reports now include a stack trace for SIGABRT raised
outside the Agent's own fatal error handling.
- On macOS and Linux builds without libbacktrace, the Agent again
saves its status file when it crashes, so the next start reports
the exit reason and signal.
- Fixed a use-after-free at shutdown on Parents with archived
children, when loading their contexts outlasted the shutdown
wait.
- Fixed rate-limited log messages being emitted more often than
their limit when several threads logged through the same limiter
at once.
- When [db] update every is above 3600, the warning now reports the
value it was clamped to (3600) instead of 1. The clamp itself was
already correct.
- When a collector tries to add a dimension without an id, the
fatal error now says so, instead of blaming the destruction of
the chart's dimension index.
- The installer and updater now treat curl exit status 56, which
some curl versions return on protocol errors, as a download
failure, like exit statuses 22 and 78.
- Windows packages now include updated MSYS2 packages on top of the
bundled MSYS2 base, including OpenSSL 3.6.5, curl 8.23.0 and
msys2-runtime 3.6.11. Each update is pinned by URL and checksum,
and the bundled package database matches the files that ship.
- When building from source needs a Go toolchain and none is
installed, the installer now downloads Go 1.27.3 instead of
1.27.0. Go 1.27.0 and later remain supported.
Refresh 0002-Do-not-hardcode-systemd-unit-directories.patch for
netdata v2.12.3 because the upstream now routes all systemd unit
installs through NETDATA_SYSTEMD_UNIT_DEST, so override that
variable instead of each DESTINATION.
Add 0005-build-allow-using-a-local-SQLite-source-tree.patch which
is the SQLite part of upstream commit 09e668b build:
restructure the CMake build system. The full commit does not apply
to 2.12.x. It allows SQLite offline builds.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Khem Raj
Markus Volk
Leon Anavi
John Keeping
Ankur Tyagi