Commit Graph

24385 Commits

Author SHA1 Message Date
Gyorgy Sarvari ccb734ae47 evince: upgrade 42.3 -> 42.4
Changelog:

build:
  * Narrow the version to enable nautilus plugin
  * Disable nautilus extension by default [NB: it is controlled by PACKAGECONFIG in meta-oe]]

comics:
  * Avoid critical when pixbuf can't be rendered
  * Better debug on archive error
  * Fix crash that can happen if archive is damaged
  * Still try to open broken comics

shell:
  * Fix use-after-free on a modified document
  * Use default color when annotation has no color
  * recent-view: Update for new gnome-desktop API

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari bd76c44c9e mutter: upgrade 42.0 -> 42.9
These releases contain many bugfixes.

Changelog:

42.9
====
* Do not overwrite previously set offsets on attach
* Don't disable KMS modifiers on newer i915 systems
* Reduce memory bandwidth usage in some GPUs
* Fix pointer constrains with subsurfaces
* Fix partial updates on offscreen rotated screens
* Do not require a physical device to update pointer visibility
* Fix Xwayland focus regressions

42.8
====
* Skip resize effects for tiled windows during user grabs
* Disable direct scanout during drag-n-drop operations
* Ignore unmapped subsurfaces in direct scanout check
* Fix cursor disappearing over windows during grabs
* Fix cursor position in window screencasts
* Fix initialization of keyboard accessibility
* Don't allow window activation to break global grabs
* Fixed crashes
* Plugged leak
* Misc. bug fixes and cleanups

42.7
====
* Always send modifiers to clients if supported
* Make NVIDIA + gbm use atomic mode setting
* Disable client modifiers with amdgpu driver
* Handle stage view updates without allocation more gracefully
* Fix window screenshots being cut off at the bottom right
* Implement wl_output v3 and v4
* Fix recalculating viewport after window resize
* Fixed crashes
* Misc. bug fixes and cleanups

42.6
====
* Add quirk to work around issue with Mali GPUs
* Stop sending frame callbacks to minimized clients
* Fixed crashes
* Misc. bug fixes and cleanups

42.5
====
* Improve heuristics for adding fallback monitor modes
* Fixed crash
* Misc. bug fixes and cleanups

42.4
====
* screencast: Set correct stride when using dmabufs
* Fix glitches in apps using subsurfaces
* Reduce client work when entering overview
* Highlight actors becoming reactive under the pointer
* Fall back to ARGB if XRGB is not supported
* Support direct scanout on GPUs without modifiers support
* Fix registering as X11 window manager if GDK_BACKEND is set
* Fixed crash
* Plugged leak
* Misc. bug fixes and cleanups

42.3
====
* wayland: Fix rotation transform
* Fix dma-buf screencast regression
* Fix monitor mirroring in some cases
* Fixed crash
* Plugged leak

42.2
====
* Don't use direct scanout for transparent windows
* Fix initialization of privacy mode in displays that support it
* Fix --replace again
* Improve picking a window for direct scanout
* Do not allow windows to steal focus when the shell has a grab
* Fix night light without GAMMA_LUT property
* Fixed crash
* Misc. bug fixes

42.1
====
* Send correct LEAVE events when entering windows
* Be more forgiving with wrongly sized clients
* Add ClutterInputCapabilities enum and device property
* Fall back if COPY_MODE_SECONDARY_GPU fails to init
* Fix missing root window properties after XWayland start
* wayland/shm: Add support for ABGR8888 and XBGR8888 formats
* Keep actors dirty if a redraw was queued up during paint()
* Fix overview painting of shaped texture with layer snippets
* Survive missing GAMMA_LUT KMS property
* Record current event when going through event filters
* Pass events to pointer a11y before going through filters
* Update cursor when scaled or transformed
* Fix screen cast when DMA buffer fails or can't be used
* Repick when pointer actor goes unmapped
* Improve IM support
* Allow using dumb buffers for cursor sprites
* wayland/dma-buf: Only advertise supported formats
* Fix screen cast cursor metadata with unthrottled input
* Fixed crashes
* Plugged memory leak
* Misc. bug fixes and cleanups

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 8697354f8f tracker-miners: update 3.2.1 -> 3.2.2
Changelog:
- Backport seccomp rules for rseq and mbind syscalls
- Translation updates

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari f53ab67e47 yelp: patch CVE-2025-3155
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-3155

Pick the patch that refers to this CVE explicitly in its description.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Wang Mingyu 6c5f2e9e50 sanlock: upgrade 3.8.4 -> 3.8.5
setuptools.patch
removed since it's included in 3.8.5.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit cc532b9d4e)

Shortlog:
python: Replace distutils with setuptools
sanlock: fix memory leak of lockspace renewal_history
sanlock: fix pthread_create error check
Revert "sanlock: Shrink thread pool when there is no work"
sanlock: fix pthread_create error paths
sanlock: acquire should ignore unused options str
sanlock: use helper to set max_sectors_kb

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 7adb0931bc python3-paramiko: upgrade 2.10.3 -> 2.10.6
Bugfix releases.

Changelog:
2.10.4:
- Servers offering certificate variants of hostkey algorithms
  (eg ssh-rsa-cert-v01@openssh.com) could not have their host
  keys verified by Paramiko clients, as it only ever considered
  non-cert key types for that part of connection handshaking.
  This has been fixed.
- PKey instances’ __eq__ did not have the usual safety guard in
  place to ensure they were being compared to another PKey object,
  causing occasional spurious BadHostKeyException (among other
  things). This has been fixed.
- Update camelCase method calls against the threading module to
  be snake_case; this and related tweaks should fix some deprecation
  warnings under Python 3.10.

2.10.5:
- Windows-native SSH agent support as merged in 2.10 could encounter
  Errno 22 OSError exceptions in some scenarios (eg server not cleanly
  closing a relevant named pipe). This has been worked around and
  should be less problematic.
- OpenSSH 7.7 and older has a bug preventing it from understanding
  how to perform SHA2 signature verification for RSA certificates
  (specifically certs - not keys), so when we added SHA2 support it
  broke all clients using RSA certificates with these servers. This
  has been fixed in a manner similar to what OpenSSH’s own client
  does: a version check is performed and the algorithm used is
  downgraded if needed.
- Align signature verification algorithm with OpenSSH re: zero-padding
  signatures which don’t match their nominal size/length. This shouldn’t
  affect most users, but will help Paramiko-implemented SSH servers
  handle poorly behaved clients such as PuTTY.

2.10.6:
- Raise SSHException explicitly when blank private key data is loaded,
  instead of the natural result of IndexError. This should help more
  bits of Paramiko or Paramiko-adjacent codebases to correctly handle
  this class of error.
- Update SSHClient so it explicitly closes its wrapped socket object
  upon encountering socket errors at connection time. This should help
  somewhat with certain classes of memory leaks, resource warnings,
  and/or errors (though we hasten to remind everyone that Client and
  Transport have their own .close() methods for use in non-error
  situations!).

https://www.paramiko.org/changelog.html

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 5e331f8434 freerdp: patch CVE-2024-32658
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32658

Backport the patch that was marked to resolve this issue by the
relevant Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vpv3-m3m9-4c2v

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari eb9c9730a4 freerdp: patch CVE-2024-32460
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32460

Backport the patch that is marked to resolve this vulnerability
by the relevant Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4rr8-gr65-vqrr

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari fe05b2e186 freerdp: patch CVE-2024-32459
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32459

Pick the patch that is marked to resolve this vulnerability by
the relevant Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cp4q-p737-rmw9

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 8bce3cf874 freerdp: patch CVE-2024-32458
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32458

Pick the patch that is marked to resolve this vulnerbility by the
relevant Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vvr6-h646-mp4p

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari dda2b96cb2 freerdp: mark CVE-2024-32041 patched
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32041

Both the relevant Github Advisory[1] and Debian[2] states that the
same patch fixes this vulnerability as CVE-2024-32039.

Therefore add this CVE ID to the same patch's CVE tag.

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5r4p-mfx2-m44r
[2]: https://security-tracker.debian.org/tracker/CVE-2024-32041

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 23a46eae5f freerdp: patch CVE-2024-32040
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32040

Pick the patch that is marked to resolve this vulnerability, from
the related Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-23c5-cp23-h2h5

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari cebeb9b1a6 freerdp: patch CVE-2024-32039
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32039

Pick the commit that is marked to resolve this vulerability, mentioned
by the Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5h8-7j42-j4r9

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 86566fac39 freerdp: patch CVE-2024-22211
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-22211

Pick the patch that is referenced by the NVD report as the solution.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 99ffae0ed0 freerdp: patch CVE-2023-40589
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-40589

Pick the patch that was identified[1] by Debian to solve the issue
on the 2.x branch.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-40589

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari d3eea640d3 freerdp: add ptest support
The tests take about 50s to execute on my machine.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari bb987740aa freerdp: patch CVE-2023-40569
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-40569

Pick the patch that was identified[1] by Debian as the solution.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-40569

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari d4e1c145e6 freerdp: patch CVE-2023-40181
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-40181

Pick the patch that was identified[1] by Debian as the solution.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-40181

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari c9affa4bd5 freerdp: patch CVE-2023-39353
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-39353

Pick the patch that was identified[1] by Debian as the solution.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-39353
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari c793926ade freerdp: patch CVE-2023-39352
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-39352

Backport the commit that was identified[1] by Debian as the solution.

Note: WINPR_ASSERT macro calls have been changed to assert calls, as this
macro doesn't exist yet in this version. Looking at the implementation[2],
it is basically an assert call with a bit verbose logs.
Even though the original implementation also defines a no-op version, the
assert version is enabled by default.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-39352
[2]: https://github.com/FreeRDP/FreeRDP/blob/2.11.0/winpr/include/winpr/assert.h#L31

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari f4a93a4c96 freerdp: patch CVE-2023-39351
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-39351

Pick the patch that is mentioned by Debian[1] to solve the problem.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-39351

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 9e67ae18b0 freerdp: patch CVE-2023-39350
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-39350

Pick the patch that was identified[1] by Debian as the solution.
Note that the NVD report also references a commit as a patch - however
that seems to be incorrect. Although the NVD patch also solves a
vulnerability, it solves a different CVE (CVE-2023-39353), not this.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-39350

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari f0e689ff4d freerdp: patch CVE-2022-39320
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-39320

Take the patch that Debian has determined[1] to solve the issue.

[1]: https://security-tracker.debian.org/tracker/CVE-2022-39320

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 8cea479b35 freerdp: mark CVE-2022-39317 patched
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-39317

Both Ubuntu[1] and Red Hat[2] confirms that this vulenrability is
fixed by the same patch as CVE-2022-39316.

Therefore add this CVE ID to the patch's tag also.

[1]: https://ubuntu.com/security/CVE-2022-39317
[2]: https://bugzilla.redhat.com/show_bug.cgi?id=2143643

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari af8f2af56b freerdp: patch CVE-2022-39282
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-39282

Pick the patch that's description matches the CVE description.
(Debian also considers the same patch[1] the fix)

[1]: https://security-tracker.debian.org/tracker/CVE-2022-39282

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari ee510136eb freerdp: patch CVE-2022-24883
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-24883

Pick the patch that is mentioned in teh NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Ankur Tyagi f4ed05a423 influxdb: ignore CVE-2024-30896
As mentioned in the comment[1], vulnerability is in
/api/v2/authorizations API which only exists in 2.x, 1.x is not affected.

Details: https://nvd.nist.gov/vuln/detail/CVE-2024-30896

[1] https://github.com/influxdata/influxdb/issues/24797#issuecomment-2514690740

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 2f1d7a8597)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari b1794b6239 boinc-client: mark CVE-2013-2018 patched
Details: https://nvd.nist.gov/vuln/detail/CVE-2013-2018

According to oss-security email[1], version 7.0.45 included
the fixes[2][3][4]

[1]: https://www.openwall.com/lists/oss-security/2013/04/29/11
[2]: https://github.com/BOINC/boinc/commit/6e205de096da83b12ffb2f0183b43e51261eb0c4
[3]: https://github.com/BOINC/boinc/commit/e8d6c33fe158129a5616e18eb84a7a9d44aca15f
[4]: https://github.com/BOINC/boinc/commit/ce3110489bc139b8218252ba1cb0862d69f72ae3

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 2a78ad8813)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Gyorgy Sarvari 680570c8b6 fluidsynth: patch CVE-2025-56225
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-56225

Pick the PR content referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Gyorgy Sarvari f1cfd1ec5d openvpn: ignore CVE-2024-4877 and CVE-2025-13751
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-4877
https://nvd.nist.gov/vuln/detail/CVE-2025-13751

The vulnerabilities are specific to Windows platform, not relevant to OE.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Gyorgy Sarvari c03adad7ea python3-blivet: upgrade 3.4.3 -> 3.4.4
Bugfix release.

Changelog:
 - Use LVM PV format current_size in LVMVolumeGroupDevice._remove
 - Correctly set vg_name after adding/removing a PV from a VG
 - Do not crash when changing disklabel on disks with active devices
 - ActionDestroyDevice should not obsolete ActionRemoveMember
 - Correctly set compression and deduplication for existing VDO pools
 - Correctly cancel configure actions in cancel()
 - Set partition flags after setting parted filesystem

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
wangmy 8a3e79cf68 python3-croniter: upgrade 1.3.5 -> 1.3.7
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 546ccc4a5b)

Changelog:
 - fix tests
 - Fix croniter_range infinite loop

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Xu Huan b2cd699bbb python3-croniter: upgrade 1.3.4 -> 1.3.5
Signed-off-by: Xu Huan <xuhuan.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 94f564fc96)

Changelog:
Add Python 3.10 support.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Jackson eb933671af tcpreplay 4.4.4: Fix CVE-2025-9384
There is a NULL Pointer Dereference in ports2PORT when the user passes ill-formatted
portmap string to tcprewrite with option -r or --portmap

Upstream Repository: https://github.com/appneta/tcpreplay.git

Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-9384
CVE: CVE-2025-9384

Signed-off-by: Jackson <jacksonj2@kpit.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Wang Mingyu 70b16622ab python3-smpplib: upgrade 2.2.2 -> 2.2.3
Changelog:
Fix: correct UCS2 part length following #184

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d4cb5d585d)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Wang Mingyu 126d5246db python3-smpplib: upgrade 2.2.1 -> 2.2.2
Changelog:
==========
 Added python 3.10 tests to CircleCI
 fix socket recv error being silently ignored
 Refactored Client.read_pdu()
 Refactored Client.send_pdu()
 increment sequence of commands as spec (fixes #214)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 50bbe6ab5f)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Xu Huan b7ab23179d python3-werkzeug: upgrade 2.1.1 -> 2.1.2
Changelog:
==========
    The development server does not set Transfer-Encoding: chunked for 1xx, 204, 304, and HEAD responses.
    Response HTML for exceptions and redirects starts with <!doctype html> and <html lang=en>.
    Fix ability to set some cache_control attributes to False.
    Disable keep-alive connections in the development server, which are not supported sufficiently by Python’s http.server.

Signed-off-by: Xu Huan <xuhuan.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0704ebad0d)

Rebased patches in Kirkstone.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Wang Mingyu 01098510f3 python3-bidict: upgrade 0.22.0 -> 0.22.1
Changelog:
==========
-Only include the source code in the source distribution. This reduces the
 size of the source distribution from 200kB to 30kB.
-Fix the return type hint of bidict.inverted() to return an Iterator, rather
 than an Iterable.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Gyorgy Sarvari 12d4f40a4a python3-twisted: patch CVE-2022-24801
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-24801

Pick the commits from the pull request that is referenced by the NVD report.

(The full set is consisting of 13 patches, but the ones that only updated
news/readme/typo fixes in comments were not backported)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:07 +01:00
Gyorgy Sarvari d29ee9b387 python3-werkzeug: ignore CVE-2026-21860
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-21860

The issue affects only Windows operating systems.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:06 +01:00
Gyorgy Sarvari 6d01018250 python3-ldap: patch CVE-2025-61912
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-61912

Pick the patch that's mentioned by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:05 +01:00
Gyorgy Sarvari 3a9a13832b python3-ldap: patch CVE-2025-61911
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-61911

Pick the patch referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:04 +01:00
Gyorgy Sarvari e07db81979 python3-eventlet: patch CVE-2025-58068
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-58068

Pick the patch mentioned in the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:04 +01:00
Gyorgy Sarvari a14d2e2df1 python3-eventlet: upgrade 0.33.0 -> 0.33.3
Bugfix releases.

Changelog:
0.33.3:
* dnspython 2.3.0 raised AttributeError: module 'dns.rdtypes' has no
  attribute 'ANY' https://github.com/eventlet/eventlet/issues/781

0.33.2:
* greenio: GreenPipe/fdopen() with 'a' in mode raised io.UnsupportedOperation:
  File or stream is not writable https://github.com/eventlet/eventlet/pull/758

0.33.1:
* Prevent deadlock on logging._lock https://github.com/eventlet/eventlet/issues/742

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:03 +01:00
Gyorgy Sarvari e660c4f8dc squid: upgrade 4.15 -> 4.17
These are bugfix releases.

Changelogs:
4.17:
- WCCP: Validate packets better

4.16:
- Regression Fix: --with-valgrind-debug build broken since 4.15
- Bug 5129 pt1: remove Lock use from HttpRequestMethod
- Bug 5128: Translation: Fix '% i' typo in es/ERR_FORWARDING_DENIED
- Bug 4528: ICAP transactions quit on async DNS lookups

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:02 +01:00
Gyorgy Sarvari 4ccb9bf4ac raptor2: patch CVE-2024-57823
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-57822

Pick the patch mentioned in the related github issue[1].
The issue contains fixes for 2 issues, but only the second
patch is related to this vulnerability.

[1]: https://github.com/dajobe/raptor/issues/70

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:02 +01:00
Gyorgy Sarvari 542c269b5a raptor2: patch CVE-2024-57822
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-57822

Pick the patch mentioned in the related github issue[1].
The issue contains fixes for 2 issues, but only the first
patch is related to this vulnerability.

[1]: https://github.com/dajobe/raptor/issues/70

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:01 +01:00
Gyorgy Sarvari f3af7f8f02 raptor2: patch CVE-2020-25713
Details: https://nvd.nist.gov/vuln/detail/CVE-2020-25713

Pick the git cmmit that is mentioned as a solution in the related bug[1]
from the NVD advisory.

[1]: https://bugs.librdf.org/mantis/view.php?id=650

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:00 +01:00
Gyorgy Sarvari 7b4d42c640 raptor2: patch CVE-2017-18926
Details: https://nvd.nist.gov/vuln/detail/CVE-2017-18926

NVD advisory mentions the original announcement on oss-security
mailing list[1]. This mentions a bug link[2] related to this
vulnerability. The bug mentions the revision of the fix - pick
that patch from the project's git repository.

[1]: https://www.openwall.com/lists/oss-security/2017/06/07/1
[2]: https://bugs.librdf.org/mantis/view.php?id=617

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:21:58 +01:00
Gyorgy Sarvari 8f5f5cf4b3 python3-django: (4.2.27) add back setuptools3 support
The upstream project has switched to build_meta build backend with
version 4.2.21, and when the recipe was update to 4.2.26, the build
backend was changed in the layer also.

Even though the recipe compilation didn't fail, it didn't install the required
files (it pretty much produced empty folders), because the build backend
required a much newer setuptools version than the one provided by oe-core,
it errored out silently. This problem may be hidden by other layers that
ship a newer version of setuptools, like the kirkstone-rust branch in
meta-lts-mixins layer.

To be able to install the recipe (without adding extra layers), this patch
partially reverts the build backend change from upstream, and adds back
setuptools build support.

Ptest summary after this patch:
Ran 16377 tests in 353.124s
OK (skipped=1287, expected failures=5)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-19 15:24:39 +01:00