Commit Graph

1636 Commits

Author SHA1 Message Date
Gyorgy Sarvari d19e7ca876 gimp: patch CVE-2025-14422
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-14422

Backport the patch referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-03-10 10:45:11 +01:00
Gyorgy Sarvari 68a9fca0d8 gimp: patch CVE-2023-44443 and CVE-2023-44444
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-44443
https://nvd.nist.gov/vuln/detail/CVE-2023-44444

The relevant upstream issues:
https://gitlab.gnome.org/GNOME/gimp/-/issues/10072
https://gitlab.gnome.org/GNOME/gimp/-/issues/10071

For the backport, upstream has merged the two patches
into one, solving both CVEs. That patch is in this change.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-03-09 19:22:41 +01:00
Gyorgy Sarvari 9cc3662bef gimp: patch CVE-2023-44442
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-44442

Backport the patch that resolved the related upstream issue[1].

[1]: https://gitlab.gnome.org/GNOME/gimp/-/issues/10101

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-03-09 19:22:32 +01:00
Gyorgy Sarvari 81eac15444 gimp: patch CVE-2023-44441
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-44441

Backport the commit that resolved the related upstream issue[1].

[1]: https://gitlab.gnome.org/GNOME/gimp/-/issues/10069

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-03-09 19:22:24 +01:00
Gyorgy Sarvari 6d6d36409c gimp: ignore irrelevant CVEs
These CVEs are not affecting the recipe, because they were introduced
later, in v3.0.

The commits the introduced the vulnerabilities:
CVE-2025-14423: https://gitlab.gnome.org/GNOME/gimp/-/commit/222bef78c71ed8562a610f6863d56c0b3e2bef68
CVE-2025-14424: https://gitlab.gnome.org/GNOME/gimp/-/commit/a0fc5a025ae3579609730ebabc3c84146385da76
CVE-2026-2047: https://gitlab.gnome.org/GNOME/gimp/-/commit/00232e17875d4676a2c797a429db23b1a9815db8

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-03-08 15:07:09 +01:00
Gyorgy Sarvari 7fd8cd657f gnome-shell: ignore CVE-2021-3982
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-3982

The vulnerability is about a privilege escalation, in case
the host distribution sets CAP_SYS_NICE capability on the
gnome-shell binary.

OE distros don't do that, and due to this this recipe is not
affected by this issue. The CVE is ignored.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-02-27 17:00:26 +01:00
Gyorgy Sarvari 702efc091e gnome-settings-daemon: ignore CVE-2024-38394
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-38394

The CVE has the disputed flag. The project maintainers claim that the issue
is not in gnome-setttings-daemon. If the vulnerability needs to be handled
in gnome-settings-daemon, than it is a new feature rather than a vulnerability fix.

Due to this, ignore this CVE.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 4416006616 nautilus: upgrade 42.1.1 -> 42.6
Bugfix releases. Note that there were no 42.3 and 42.4 releases.

42.6:
* Fix crash when pasting invalid clipboard data. CVE-2022-37290

42.5:
* Really fix the cropped compress format popover on X11
* Fix behavior inconsistencies with new tabs
* Fix memory leaks and missing signal disconnections
* Translation updates

42.2:
* Close broken link message dialog on response
* Fix crash when opening new window from pathbar
* Fix remote filesystem check
* Translation updates

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 8cf36e2d06 libadwaita: upgrade 1.1.1 -> 1.1.7
Bugfix releases.

Changelog:

Version 1.1.7:
- AdwCarousel
  - Fix allocation
- AdwFlap
  - Add a missing setter annotation for :fold-policy
  - Correctly measure separator
  - Avoid notify emissions in dispose()
- AdwLeaflet
  - Fix can-unfold=false
- AdwSpringAnimation
  - Fix critical damping velocity
- AdwSwipeable
  - Fix get_swipe_area() fallback
- AdwTabBar
  - Fix clipped labels
- AdwToastOverlay
  - Don't focus buttons on click
- Demo
  - Open primary menu with F10
  - Fix the switch on the avatar page
- Stylesheet
  - Fix GtkLevelBar fill colors
- Fix dependency names in docs
- Memory leak fixes

Version 1.1.6:
- AdwAvatar
  - Correctly redraw on custom image changes
- AdwFlap
  - Fix natural width with fold-policy=never
- AdwSplitButton
  - Don't make dropdown insensitive when the button is
- AdwTabBar
  - Fix focus handling
  - Fix autoscroll for non-local drags
- AdwToastOverlay
  - Clarify documentation
- Stylesheet
  - Fix GtkSpinButton inside toolbars

Version 1.1.5:
- AdwCarousel
  - Fix a crash when removing a child while it's animating
- AdwSqueezer
  - Sizing fixes
- AdwTabBar
  - Fix long press handling
  - Fix a crash when clicking empty space while a tab is animating
- AdwTabView
  - Fix set_menu_model() input check

Version 1.1.4:
- AdwAvatar
  - Fix draw_to_texture() with rectangular avatars
- AdwTabBar
  - Fix squished or clipped text with gtk-hint-font-metrics=0
- AdwShadowHelper
  - Fix warnings when drawing vertical shadow
- AdwSwipeTracker
  - Fix swipe speed on GTK 4.7.x
  - Fix criticals with GTK 4.7.x

Version 1.1.3:
- AdwLeaflet
  - Fix a broken link in docs
- AdwPreferencesGroup
  - Fix accessibility labels
- AdwToast
  - Fix the example in docs
- Stylesheet
  - Add missing borders in high contrast version

Version 1.1.2:
- AdwLeaflet
  - Fix child sizing with fold-threshold-policy=natural
- AdwStyleManager
  - Correctly handle removing a GdkDisplay
- AdwSwipeTracker
  - Fix a memory leak
  - Fix high contrast setting name when using a portal
- AdwTabBar
  - Fix middle click when inside GtkWindowHandle
- Stylesheet
  - Fix action row title and subtitle inside GtkHeaderBar
  - Fix progressbar.osd overriding text color
  - Ensure active states consistently work with touchscreens
  - Fix GtkDropDown visual glitch when pressed on touchscreen
- Translation updates:

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari cbe365e262 gvfs: upgrade 1.50.4 -> 1.50.7
Changelog:

1.50.7:
* client: Prevent returning invalid mount cache entries
* dav: Fix authentication issues when DNS-SD URIs are used
* nfs: Fix IPv6 URI handling
* sftp/ftp: Ensure that is-symlink is always set to avoid warnings
* Translation updates

1.50.6:
* udisks2: Disconnect signal handlers to fix crashes when unmounting
* fuse: Include missing locale.h header
* Translation updates

1.50.5:
* smbbrowse: Fix empty device listing after unrelated mount failure
* udisks: Fix missing unmount notifications
* trash: Fix nfs4 and cifs monitoring
* smb: Allow renaming a file to the same name with a different case
* mtp: Emit delete event on device disconnection
* trash: Fix wrongly reported item-count
* Some other fixes and improvements
* Translation updates

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 293f6f9384 gtk4: fix qa error with gstreamer PACKAGECONFIG
When gstreamer PACKAGECONFIG is enabled, packaging fails with the following error:

ERROR: gtk4-4.6.9-r0 do_package: QA Issue: gtk4: Files/directories were installed but not shipped in any package:
  /usr/lib/gtk-4.0/4.0.0/media/libmedia-gstreamer.so

Fix it by packaging this file also.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari a12e4bd30e gtksourceview5: upgrade 5.4.1 -> 5.4.2
Changelog:
 * Updated languages: c.lang, perl.lang
 * Updated style-schemes: Adwaita-dark, solarized-light, solarized-dark
 * Updated translations: Friulian
 * Gutter renderers are now provided a prelight quark for lines when the
   pointer is over the gutter.
 * Hover assistants now avoid synthesized motion which is used much more
   often in GTK 4 when dealing with crossing-events.
 * Hover assistants will now dismiss themselves when the cursor moves.
 * GtkSourceMap has reduced how often it needs to do allocation by ignoring
   spurious notify::upper and value-changed signals from GtkTextView's
   vertical GtkAdjustment.
 * The testsuite has gained some correctness improvements thanks to
   issues pointed out by Sébastien Wilmet.
 * The Vim emulation's register implementation is now shared between buffers
   as it would be expected in Vim.
 * Snippets have gained some robustness improvements including the ability
   to simplify results from the snippet parser, more defensive behavior,
   and being lazier when possible.
 * Tabbing through focus-positions in snippets will now immediately jump
   to the new position if scrolling is required instead of animating as
   it results in better placement of tooltip assistants.
 * Assistants including completion, hover, and interactive tooltips now
   reduce how often they request presentation and position calculation from
   GDK and ultimately display servers such as Wayland.
 * Completion windows now take the size of the gutter into account when
   calculating their position relative to the parent GtkWindow so that the
   typed-text column remains aligned with typed text in the source view.
 * Completion has gained robustness improvements to do less work when
   possible and avoid spinning the frame-clock which could happen in
   certain scenarios.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari c7c94b5421 gtksourceview4: upgrade 4.8.2 -> 4.8.4
Changelog:
4.8.3:
* Adds support for more Pango font-variants
* Style updates to solarized-dark, solarized-light
* Language updates to lean, rst, c, gtk-doc, javascript, and json
* Translation updates

4.8.4:
* Style updates to kate, classic, tango
* Language updates to vala, python3, c, cuda, latex
* Add unit tests for language specs
* Translation updates

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 883dbb895d gtk4: upgrade 4.6.2 -> 4.6.9
Changelog:

4.6.9:
* GtkText:
 - Prevent unexpected notify::direction emissions
* Wayland:
 - Fix button masks
* X11:
 - Fix some ordering problems with surface destruction
* Translation updates

4.6.8:
* Input:
 - Fix problems with input method interactions that caused
   dead keys not to work
* GtkText:
 - Respect the no-emoji input hint fully
* GtkNotebook:
 - Fix an infinite loop in accessibility code
 - Event handling fixes
* GtkFileChooser:
 - Restore ~ and .functionality
* GtkTreeView:
 - Event handling fixes
* GtkTreeListModel:
 - Prevent possible crashes with collapsed nodes
* GtkGridView:
 - Fix issues with rubberband selection
* GtkEmojiChooser:
 - Fix navigation with arrow keys when filtered
* GtkPopover:
 - Fix problems with focus when dismissing popovers
 - Fix problems with focusing editable labels in popovers
* GtkStackSidebar:
 - Improve accessible presentation
* Wayland:
 - Make gtk_launch_uri more robust
 - Make monitor bounds handling more robust
 - Prevent shrinking clients due to wrong toplevel bounds
* Flatpak:
 - Fix file DND with the FileTransfer portal
* Translation updates

4.6.7:
* Miscellaneous memory leak fixes
* GtkTreeView:
 - Fix a problem with DND
 - Fix a problem with row selection
* GtkTreePopover:
 - Support scrolling
* GtkGridView:
 - Fix issues with rubberband selection
* GtkSnapshot:
 - Make GtkSnapshot work from bindings
* X11:
 - Fix preferred action for DND
* Windows:
 - Fix DND
* Translation updates

4.6.6:
* Fix translations in GTKs own ui files
* Wayland:
 - Fix a problem with the activation protocol
 - Don't force the HighContrast icontheme
* Windows:
 - Fix a problem with builtin icons if the
   hicolor icontheme is not installed
* Translation updates

4.6.5:
* GtkFileChooser:
 - Fix pasting text into the name field
* GtkText:
 - Remove an assertion that is sometimes hit
* Wayland:
 - Ensure that our cursor surfaces don't violate
   protocol constraints
* Accessibility:
 - Fix a problem in the accessibility tree
* Translation updates

4.6.4:
* GtkFileChooser:
 - Fix select button sensitivity in select_folder mode
 - Fix some fallout from list model porting
* GtkListView, GtkColumnView:
 - Optimize scrolling
* print-to-file:
 - Handle nonexisting files better in the dialog
* Avoid infinite loops in size allocation
* CSS:
 - Optimize a case of reparenting that is important in GtkListView
* GSK:
 - Check for half-float support before using it
* Wayland:
 - Ignore empty preedit updates This fixes a problem with
   textview scrolling
 - Freeze popups when hidden. This addresses a frame rate drop
* Translation updates

4.6.3:
* GtkOverlay:
 - Bring back positional style classes
* GtkFileChooser:
 - Prevent unwanted completion popups
 - Fix small problems in save mode
 - Fix buildable suport of GtkFileFilter
* GtkPopover:
 - Fix button positions in right-to-left locales
* GtkLabel:
 - Fix small issues with link handling
* Tooltips:
 - Don't restrict the minimum tooltip length
* Theme:
 - Don't use opacity for overlay scrollbars
 - Fix selection text color in  vertical spin buttons
* GSK:
 - Accept textures that are generated by webkit
 - Align offscreen rendering to the pixel grid
* Accessibility
 - Fix a crash in startup when orca is running
* Input:
 - Fix display changes in GtkIMMultiContext
 - Fix activating on-screen keyboards
 - Always propagate hold events in GtkEventControllerScroll
* Windows:
 - Fix a critical warning in clipboard handling
 - Report serial numbers for events
* MacOS:
 - Prevent fullscreen transition reentrancy
* Translation updates

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari c019cb9095 gnome-tweaks: upgrade 40.0 -> 40.10
Bugfix release. Note that there were no other intermediate point releases
between these two versions.

Drop patch that is included in this release.

Release notes:
This release includes a fix for the broken GNOME Extensions link and
several translation updates.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 04c8caaf4d gnome-terminal: upgrade 3.42.2 -> 3.42.3
Changelog:
- Translation updates
- window: Use a normal menu for the popup menu
- regex: Fix path-less URL recognition
- Revert "regex: Workaround a PCRE bug resulting in not recognizing schemeless URLs"

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari ee85a03512 gnome-shell: upgrade 42.0 -> 42.9
Bugfix releases.

Changelog:

42.9
====
* Misc. bug fixes and cleanups

42.8
====
* Lower OOM score of gnome-shell process
* Fixed crash
* Plugged leak
* Misc. bug fixes and cleanups

42.7
====
* Properly apply saved shortcuts inhibition permissions
* Don't let wayland popovers block overview
* Misc. bug fixes and cleanups

42.6
====
* Fix remembering inhibit-shortcut permission for multiple apps
* Forward TERMINAL input purpose to ibus
* Fix default keyboard layout during initial setup
* Fix tracking of newly installed apps
* Misc. bug fixes and cleanups

42.5
====
* Fix initial selection in switch-monitor popup on desktop
* Improve handling of recurring events
* Prevent SignalTracker from leaking objects
* Work around pipewire regression for screencasts
* Fix initial input source order
* Fixed crash
* Plugged leak
* Misc. bug fixes

42.4
====
* Fix adding suggestions from on-screen keyboard
* Allow extension updates with only Extension Manager installed
* Only load extensions that support the current session mode
* Fix logging in with realmd
* Tweak access portal dialog
* Improve overview animation performance
* Fix remembering set up bluetooth devices
* Plugged leak
* Misc. bug fixes and cleanups

42.3.1
======
* Fix regression in ibus support
* Make sure screenshot UI opens above dialogs
* Misc. bug fixes and cleanups

42.3
====
* Fix feedback when turning on a11y features by keyboard
* Fix OSD colors with light stylesheet
* Only close messages via delete key if they can be closed
* Fix screenshots when XDG directories are disabled
* Do not create systemd scope for D-Bus activated apps
* Improve high-contrast stylesheet
* Hide overview after 'Show Details' from app context menu
* Fix stylesheet papercuts
* Respect IM hint for candidates list in on-screen keyboard
* Fix edge case where windows stay dimmed after a modal is closed
* Improve Belgian on-screen keyboard layout
* Fix fallback ibus-daemon launching
* Misc. bug fixes

42.2
====
* Align space-padded times in world clocks
* Fix top bar menus on lock screen
* Fix on-screen keyboard gestures
* Fix focus tracking in magnifier on wayland
* Misc. bug fixes

42.1
====
* Limit unfullscreen gesture to not interfere with overview
* Properly hide the second (real) cursor when magnified
* Fix various style glitches
* Fix creating default application folders
* Fix switching monitor configuration
* Add Home/End keynav in app grid
* Handle monitor changes during startup animation
* Fix fractional timezone offsets in world clock
* Default to right text-align in RTL locales
* calendar: Fix alignment of world clocks header in RTL
* Rely on symbolic icons instead of 'HighContrast' icon theme
* Fix moving windows from secondary monitor to non-active workspace
* Make sure startup animation completes
* Fix Swiss on-screen keyboard layouts
* Add Austrian-German on-screen keyboard layout
* Fix on-screen keyboard in modal dialogs and lock screen
* Fix menus in pad OSD
* Sync default colors with libadwaita
* Fix grab regressions when entering overview
* Scale calendar with text size
* Allow more intermediate icon sizes in app grid
* Fixed crash
* Plugged memory leak
* Misc. bug fixes and cleanups

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari aca74c3075 gnome-shell-extensions: upgrade 42.0 -> 42.3
Changelog:
42.3
====
* screenshot-window-sizer: Fix reported sizes on wayland
* window-list: Improve touch support

42.2
====
* native-window-placement: Adjust to gnome-shell 42 changes
* window-list: Fix visibility on non-primary monitors
42.1
====
* Misc. bug fixes and cleanups

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 57e41a048e gnome-settings-daemon: upgrade 42.1 -> 42.2
Changelog:
- Translation updates
- Drop direct uses of GSlice

A11y-settings:
- Enable toolkit-accessibility when using the magnifier

Xsettings:
- Simplify fetching string for an enum value
- Remove direct mapping from gtk-im-module to Gtk/IMModule

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 417d021654 gnome-desktop: upgrade 42.0 -> 42.10
Bug fix release.

https://gitlab.gnome.org/GNOME/gnome-desktop/-/blob/42.10/NEWS

Changelog:
Version 42.10
- Updated translations

Version 42.9
- No changes

Version 42.8
- No changes

Version 42.7
- No changes

Version 42.6
- No changes

Version 42.5
- Translation updates

Version 42.4
- No changes

Version 42.3
- No changes

Version 42.2
- Don't try to use bubblewrap inside snaps

Version 42.1
- Fix build_gtk4 option
- Translation updates

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 3c0ab96b27 gnome-control-center: upgrade 42.0 -> 42.10
These are bugfix releases.

(Note that there were no 42.6, 42.7 and 42.8 tags)

================
Version 42.10
================

- Fix monitor order in display settings
- Add 32:9 aspect ration in display settings
- Fix warning in user  panel in initialization of avatar widget
- Updated translations

================
Version 42.9
================

- Updated translations

Network:
- Fix possible race in tests

================
Version 42.5
================

- Updated translations
- Added various accessibility labels
- Initialize locale early

About
- Don't load version.xml info we don't use

Applications
- Don't recurse into symlinks when clearing app cache

Color
- Fix crash when there's no device rows to show

Cellular
- Improve dbus error messaging
- Handle cases when SIM ID is not present
- Prevent duplicate entries in the SIM providers list

Keyboard
- Fix activation of input source toggle button
- Fix permission_acquired always returning FALSE

Mouse
- Set rows as actiavatable widgets

Network
- Fix crashes when EAP password is missing
- Fix wrong signal of SEA password visibility toggle
- Prevent crash when disconnecting wifi device
- Use mime-types for file chooser filtering TLS files

Online Accounts
- Fix crash when failing to find GOA helper executable

Power
- Prevent terminal from getting spammed with ALS logs

Printers
- Fix loading of UI resources
- Show empty-state when removing the last printer

Region
- Fix creating rows for locales without a country
- Fix critical when changing language
- Fix permission_acquired always returning FALSE

Search
- Fix reordering of list rows

Users
- Show a fallback avatar when failing to load one

Wifi
- Allow accessing settings of known wifi networks

================
Version 42.4
================

- Updated translations

Background
- Restore support for multiple file selection
- Allow more image formats

Display
- Fix primary monitor selection

Network
- Fix network profiles shown on wrong device
- Various crash fixes

Power
- Fix blank-screen settings not applying
- Fix "Power Button Behavior" setting not applying

User Accounts
- Disconnect fingerprint reading devices when closing dialog

Sharing
- Don't set remote-desktop password entry if pw_generate fails
- Don't assert if we can't find the widget for a profile

================
Version 42.3
================

- Updated translations

Display
- Use virtual clone modes when mirroring

Network
- Prevent crash by disconnecting device.
- Fix Wi-Fi network with "&" in name not appearing.
- Fix warning when panel closed.

================
Version 42.2
================

- Updated translations

Applications
- Fix Snap permissions support failing to compile
- Fix CcInfoRow having the wrong parent
- Fix crash crash when switching between two apps

Background
- Make sure the size of the light/dark previews are the same

Keyboard
- Fix crash resetting all keyboard shortcuts

Network:
- Stop freeze when closing wired connection properties with Escape

Sharing
- Fix close button on Verify Encryption dialog
- Turn off RDP gsettings key when turning off RDP

Shell
- Initialise locale early

Sound
- Update theme correctly so other apps respond to change

================
Version 42.1
================

- Updated translations

Display
- Various small behavior improvements
- Fix monitor labels

Network
- Improve handling of VPN connections

Online Accounts
- Fix behavior of helper application on X11
- Fix changes to online accounts services not applying correctly

User Accounts
- Various small polishments

Wacom
- Properly translate various strings

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 264e4d8266 gnome-bluetooth: upgrade 42.3 -> 42.8
Changelog:
ver 42.8:
This update fixes problems with some devices not disappearing from the list
of quick settings in GNOME Shell.

ver 42.7:
This version fixes bugs that stopped the Obex Push server from automatically
accepting files from paired devices and caused the device's Connection switch to
appear out of sync with the connection state. This version also contains build
fixes and updated translations.

ver 42.6:
This version fixes problems with icons for mice and tablets, updates status labels
to be dimmed by default, and contains updated translations.

ver 42.5:
This version fixes the pairing dialogue misbehaving for some Bluetooth Classic
keyboards, with the passkey disappearing after the first digit is typed.

ver 42.4:
This version switches the power state API added in version 42.3 to be backed
by the experimental PowerState property in bluetoothd. The API will not show
transitional states if the version of bluetoothd is too old.

The battery API now exports the battery information for all Bluetooth devices
listed in UPower, not just the ones re-exported from bluetoothd.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 2d4f0e11a8 gjs: upgrade 1.72.2 -> 1.72.4
Changelog:
1.72.3:
- Fix for crash after build against libffi 3.4.2 ported from the development
  branch.

1.72.4:
- Various fixes ported from the development branch.

- Closed bugs and merge requests:
  * log_set_writer_func is not safe to use
  * Gnome-Shell 42 - crash after login (general protection fault)
  * Static methods on classes from GObject introspection are now present on JS
    classes that inherit from those classes.
  * Enabling window-list extension causes gnome-shell to crash when running
    "dconf update" as root
  * Possible errors in cairo enums
  * cairo.SVGSurface need finish() and flush() to finalize painting
  * Handle transfer-none string return value from vfunc implemented in JS
  * GJS freezes, program stops responding, error states Gtk4 EventController
    GestureClick returns incorrect state- Gdk.ModifierType on mouse button press
    in X11
  * gnome-shell crashes on exit in js::gc::Cell::storeBuffer
  * Memory leak with GError
  * GVariant return values leaked
  * GBytes's are leaked when passed as-is to a function
  * Transformed GValues are leaking temporary instances
  * GHash value infos are leaked
  * "flat" arrays of GObject's are leaked
  * Gjs console leaks invalid option errors

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari ccb734ae47 evince: upgrade 42.3 -> 42.4
Changelog:

build:
  * Narrow the version to enable nautilus plugin
  * Disable nautilus extension by default [NB: it is controlled by PACKAGECONFIG in meta-oe]]

comics:
  * Avoid critical when pixbuf can't be rendered
  * Better debug on archive error
  * Fix crash that can happen if archive is damaged
  * Still try to open broken comics

shell:
  * Fix use-after-free on a modified document
  * Use default color when annotation has no color
  * recent-view: Update for new gnome-desktop API

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari bd76c44c9e mutter: upgrade 42.0 -> 42.9
These releases contain many bugfixes.

Changelog:

42.9
====
* Do not overwrite previously set offsets on attach
* Don't disable KMS modifiers on newer i915 systems
* Reduce memory bandwidth usage in some GPUs
* Fix pointer constrains with subsurfaces
* Fix partial updates on offscreen rotated screens
* Do not require a physical device to update pointer visibility
* Fix Xwayland focus regressions

42.8
====
* Skip resize effects for tiled windows during user grabs
* Disable direct scanout during drag-n-drop operations
* Ignore unmapped subsurfaces in direct scanout check
* Fix cursor disappearing over windows during grabs
* Fix cursor position in window screencasts
* Fix initialization of keyboard accessibility
* Don't allow window activation to break global grabs
* Fixed crashes
* Plugged leak
* Misc. bug fixes and cleanups

42.7
====
* Always send modifiers to clients if supported
* Make NVIDIA + gbm use atomic mode setting
* Disable client modifiers with amdgpu driver
* Handle stage view updates without allocation more gracefully
* Fix window screenshots being cut off at the bottom right
* Implement wl_output v3 and v4
* Fix recalculating viewport after window resize
* Fixed crashes
* Misc. bug fixes and cleanups

42.6
====
* Add quirk to work around issue with Mali GPUs
* Stop sending frame callbacks to minimized clients
* Fixed crashes
* Misc. bug fixes and cleanups

42.5
====
* Improve heuristics for adding fallback monitor modes
* Fixed crash
* Misc. bug fixes and cleanups

42.4
====
* screencast: Set correct stride when using dmabufs
* Fix glitches in apps using subsurfaces
* Reduce client work when entering overview
* Highlight actors becoming reactive under the pointer
* Fall back to ARGB if XRGB is not supported
* Support direct scanout on GPUs without modifiers support
* Fix registering as X11 window manager if GDK_BACKEND is set
* Fixed crash
* Plugged leak
* Misc. bug fixes and cleanups

42.3
====
* wayland: Fix rotation transform
* Fix dma-buf screencast regression
* Fix monitor mirroring in some cases
* Fixed crash
* Plugged leak

42.2
====
* Don't use direct scanout for transparent windows
* Fix initialization of privacy mode in displays that support it
* Fix --replace again
* Improve picking a window for direct scanout
* Do not allow windows to steal focus when the shell has a grab
* Fix night light without GAMMA_LUT property
* Fixed crash
* Misc. bug fixes

42.1
====
* Send correct LEAVE events when entering windows
* Be more forgiving with wrongly sized clients
* Add ClutterInputCapabilities enum and device property
* Fall back if COPY_MODE_SECONDARY_GPU fails to init
* Fix missing root window properties after XWayland start
* wayland/shm: Add support for ABGR8888 and XBGR8888 formats
* Keep actors dirty if a redraw was queued up during paint()
* Fix overview painting of shaped texture with layer snippets
* Survive missing GAMMA_LUT KMS property
* Record current event when going through event filters
* Pass events to pointer a11y before going through filters
* Update cursor when scaled or transformed
* Fix screen cast when DMA buffer fails or can't be used
* Repick when pointer actor goes unmapped
* Improve IM support
* Allow using dumb buffers for cursor sprites
* wayland/dma-buf: Only advertise supported formats
* Fix screen cast cursor metadata with unthrottled input
* Fixed crashes
* Plugged memory leak
* Misc. bug fixes and cleanups

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 8697354f8f tracker-miners: update 3.2.1 -> 3.2.2
Changelog:
- Backport seccomp rules for rseq and mbind syscalls
- Translation updates

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari f53ab67e47 yelp: patch CVE-2025-3155
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-3155

Pick the patch that refers to this CVE explicitly in its description.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 4b1149b945 accountservice: ignore CVE-2023-3297
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-3297

The vulnerability is triggered by a patch added by Ubuntu, and the vulnerable patch is
not present in the recipe.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 071a45c9d7)

Adapted to Kirkstone
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-17 15:37:55 +01:00
Gyorgy Sarvari 3422f5d809 evince: fix typo in CVE_CHECK_IGNORE
The CVE to be ignored is from 2011, not from 2021.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:57 +01:00
Gyorgy Sarvari b0d98aae8c gimp: patch CVE-2022-32990
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-32990

Pick the patches that resolved the issue mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-07 11:37:29 +01:00
Gyorgy Sarvari 62db80942f gimp: patch CVE-2022-30067
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-30067

Pick patch that resolved the issue mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-07 11:37:08 +01:00
Gyorgy Sarvari 2c5e52a9d6 gimp: ignore CVE-2007-3741
It has been fixed in version 2.2.16: [1] references [2].

[1]: https://bugzilla.redhat.com/show_bug.cgi?id=248053
[2]: https://bugzilla.gnome.org/show_bug.cgi?id=453973

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 16:52:19 +01:00
Alexandre Truong d1b12c6bd1 evince: Update status for CVE-2011-0433 and CVE-2011-5244
The current version 46.0 is not affected by the issues.
Both issues have been fixed in commit [0].
The fix is in effect since early versions of evince (3.1.2).
Thus, both can be safely ignored.

[0]: https://gitlab.gnome.org/GNOME/evince/-/commit/efadec4ffcdde3373f6f4ca0eaac98dc963c4fd5

Signed-off-by: Alexandre Truong <alexandre.truong@smile.fr>
Reviewed-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 492b1b1adc)

Reworked for Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:06:55 +01:00
Wang Mingyu aa55dc7328 colord-gtk: upgrade 0.3.0 -> 0.3.1
Bugfixes:
 - Fix the callback signature to fix a crash

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 4ccf3d41ce)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Gyorgy Sarvari 63e35ca6a1 keybinder: set correct license
This package uses MIT license, which is very similar to X11, except that
X11 license has an advertisement clause, which is missing from the MIT.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d2b5523333)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Gyorgy Sarvari 6aab558e22 ibus: missing installed file w/ gtk2 PACKAGECONFIG
In case gtk2 PACKAGECONFIG is enabled, do_package task fails
with the following error:

ERROR: ibus-1.5.26-r0 do_package: QA Issue: ibus: Files/directories were installed but not shipped in any package:
  /usr/lib/gtk-2.0/2.10.0/immodules/im-ibus.so

This patch adds the missing folder to the FILES variable.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c87c5d5614)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Khem Raj e8ffe10f05 ibus: Point python interpreter to target location
it encoded PYTHON variable during build which otherwise points to python
on build host which is not correct for cross compiled packages.

Add missing dependency on python3-core which is needed for ibus-setup
script to run

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit fe0e3d77eb)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Mingli Yu 6b253999f7 ibus: add opengl related check
Add opengl to REQUIRED_DISTRO_FEATURES when gtk4 is configured in
PACKAGECONFIG.

Fixes:
  ERROR: Nothing PROVIDES 'gtk4' (but /build/layers/meta-openembedded/meta-gnome/recipes-support/ibus/ibus.bb DEPENDS on or otherwise requires it)
  gtk4 was skipped: missing required distro feature 'opengl' (not in DISTRO_FEATURES)
  ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
  Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'ibus', 'gtk4']

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 35dd6f4833)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
wangmy e49af85d19 zenity: upgrade 3.42.0 -> 3.42.1
Changelog:
==========
    - scale: Make OK button default (allows pressing Enter to accept selected
      value)
    - Fix maximum width of message dialogs to 60 characters, and make message
      dialogs non-resizable (fixes regression from 3b64d05e)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit abe91b6f51)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
zhengrq.fnst@fujitsu.com 8fe9b7cff1 yelp-tools: upgrade 42.0 -> 42.1
Signed-off-by: Zheng Ruoqin <zhengrq.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b0eeb48a28)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
zhengrq.fnst fa77351ea1 yelp: upgrade 42.1 -> 42.2
Signed-off-by: Zheng Ruoqin <zhengrq.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit bfa8892763)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Wang Mingyu b253d70f6d tracker: upgrade 3.3.2 -> 3.3.3
Changelog:
 Prepare D-Bus endpoint for cursor streams

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b4a28c8c84)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Mingli Yu 2ec4027053 nautilus: add opengl to REQUIRED_DISTRO_FEATURES
Fixes:
  ERROR: Nothing PROVIDES 'gnome-desktop' (but /build/layers/meta-openembedded/meta-gnome/recipes-gnome/nautilus/nautilus_42.2.bb DEPENDS on or otherwise requires it)
  gnome-desktop was skipped: missing required distro feature 'opengl' (not in DISTRO_FEATURES)
  ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
  Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'nautilus', 'gnome-desktop']

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit dd10f8edaa)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Wang Mingyu a5daf7fd41 gvfs: upgrade 1.50.3 -> 1.50.4
Changelog:
===========
* dav: Prevent usage of NULL for nonexistent source file
* client: Fix copy/move operation from/to Flatpak sandbox
* http: Report original sizes regardless of compression usage
* Fix string comparison on various places
* Translation updates

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 80534e1f99)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Wang Mingyu 0c21dc9948 gvfs: upgrade 1.50.2 -> 1.50.3
0001-daemon-PATH-expand-the-sftp-backend-ssh-client.patch
included in 1.50.3

Changelog:
===========
* dav: Prevent usage of NULL when user is not specified
* ftp: Fix hangs when the connection is released
* fuse: Decrease file handle reference when open file fail
* sftp: PATH-expand the ssh client
* test: Several smaller enhancements
* backend: Add support for xx-large and x-large thumbnails
* goa: Prevent automounts when resuming from suspension
* Translation updates (GNOME Translation Project contributors)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d11db37985)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Alex Stewart 32265834a5 gvfs: obviate the ssh-client requirement for gvfs
The gvfs project meson configuration attempts to locate and resolve the
path to an ssh-client on the build host, then pass that full-path to the
gvfs sftp-backend as a constant string, to be used at runtime to fork
ssh subprocesses.

As a consequence, if the build machine's ssh client path differs from
the gvfs target's path - as is common for OE/buildroot builds - gvfs can
fail at runtime. Further, build machines cannot configure gvfs without
an ssh client, even though nothing *uses* the client during the build.

The .patch in this commit has been upstreamed with gvfs, and modifies
the configuration to instead pass the string-literal `ssh` to the sftp
backend. With this change, gvfs will instead rely on PATH-expansion to
locate the user's ssh-client at runtime.

This obviates the requirement that the build machine have an ssh-client.

Signed-off-by: Alex Stewart <alex.stewart@ni.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b3ace96246)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Markus Volk 771e52b8f0 gvfs: fix dependencies
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 216b7002cc)

Adapted for Kirkstone.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Markus Volk d925fda759 gvfs: fix polkit homedir
- remove double slashes

Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c6168d98ed)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
Alex Stewart 77a5621e44 gvfs: stylize DEPENDS
Use multiline styling in the gvfs DEPENDS variable assignment, so that
diffs are easier to understand.

Also alpha-sort the DEPENDS, since their order isn't meaningful.

Signed-off-by: Alex Stewart <alex.stewart@ni.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9e725dfee3)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00
wangmy a03014e28c gvfs: upgrade 1.50.0 -> 1.50.2
Changelog:
==========
* smb: Rework anonymous handling to avoid EINVAL
* http: Unescape prefix to fix handling of encoded URIs
* build: Fix build without Avahi support
* dav: Drop user from URI as a workaround for Nextcloud bug
* dav: Port DNS-SD resolver to async API to fix hangs when mounting
* smb: Ignore EINVAL for kerberos/ccache login
* dav: Rewrite to libsoup async API to fix crashes
* dav: Do not lose userinfo when copying URIs

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 92d4a5374b)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-09-26 13:17:10 +02:00