Upgrade to release 2026.4:
- This release reverts the static delta decompression-size safety
margin introduced in 2026.3, which turned out to reject legitimate
large deltas at apply time -- most visibly, Flathub Firefox
updates were failing with Decompressed delta part exceeds
configured limit
Both the margin heuristic and the flat 512 MiB per-part
decompression cap it fed into have been dropped for now. This
deliberately reopens GHSA-7cgc-gp99-6jmm (unbounded decompression
of a given delta part) until a precise, per-part exact-size-based
replacement lands in a future release. The LZMA decoder memory
limit (100 MiB) from that same advisory's fix is unaffected and
remains in place.
- core: fixed a double-increment bug in
_ostree_validate_structureof_xattrs that caused every other xattr
entry to be skipped during validation, letting a crafted xattr
array hide unsorted or duplicate entries in odd-indexed slots.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 9.1.2:
Security Fixes
- GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection
handling that could allow an authenticated client to crash the
server using CLIENT KILL. Only affects servers built with
USE_RDMA and configured with an RDMA listener
- GHSA-fq2f-crmw-q97r: Fix an unauthenticated use-after-free of the
Lua interpreter state, caused by a process-global script debugger
command table that cached a raw pointer to a freed interpreter
and was never invalidated
Bug Fixes
- Fix a double-free crash when a module timer callback stops its
own timer with ValkeyModule_StopTimer
- Fix torn RESP3 push frames when a client publishes to a channel
it is also subscribed to, which could desync client libraries
- Listpacks are now always validated on RDB load and RESTORE,
preventing deferred assertion crashes; sanitize-dump-payload and
its ACL flags become no-ops
- Fix crashes, hangs, and CPU spinning when the RDMA transport is
used together with I/O threads
- RESET now clears the CLIENT IMPORT-SOURCE flag, so reused pooled
connections return to normal expiration semantics
- Truncate a partially written MULTI block from the AOF on short
read, preventing loss of newer writes after a later restart
- Fix an ACL bypass where duplicate STORE/STOREDIST options let
GEORADIUS write or delete keys outside the user's permitted patterns
- Fix command log redaction leaking between commands in a MULTI
transaction and missing for commands executed from scripts
- Fix a use-after-free crash when a module's cluster message type
is received after the module is unloaded
- Fix out-of-bounds access for cluster module message type 255,
which is now a valid, dispatchable message type
- AOF loading no longer performs ACL checks on replayed commands,
preventing silent data loss when the default user is disabled
- Fix a client memory accounting leak on replicas that inflated
the mem_clients_normal INFO field after primary disconnections
- Fix a permanent client deadlock when a blocking command like
BLPOP is followed by a partially delivered pipelined command
- HGETEX now requires write permission on the key, closing an
ACL gap that let read-only users change field TTLs or delete
fields
- Compare the whole TLS certificate CN during authentication,
so an embedded NUL can no longer impersonate another ACL user
- Fix atomic slot migration failures with I/O threads by not
offloading the export job's writes while snapshotting
- Reject invalid slot import ranges when loading an RDB, so
corrupted files can no longer create bad migration jobs
- Reject RDB slot import records with an invalid job name length,
preventing an out-of-bounds read at startup
- MOVE and COPY now check ACL access to the current database, so
users can no longer exfiltrate keys from an unauthorized DB
- Fix a crash on COPY with a trailing DB option during slot
migration, and block cross-DB COPY regardless of option order
- Fix a server panic when pipelined commands with invalid arity
reach the key prefetcher with I/O threads enabled
- HPERSIST, HTTL, HPTTL, HEXPIRETIME, and HPEXPIRETIME now return a
syntax error when the FIELDS keyword is missing
- Fix a race between TLS I/O-thread writes and reads that could
leave slot migration export jobs stuck until timeout
- Fix a signed overflow that let very large hash field expiration
times (e.g. via HPEXPIREAT) crash the server
- Fix a frozen monotonic clock on hosts with unsynchronized TSC
that stopped background tasks and key expiration
- Fix a stack overflow crash when retrying a failed TLS write
with a large reply
- Fix the --check-system clocksource check to skip hosts using a
hardware clock and suggest only actually available clocksources
- Fix an assertion failure with I/O threads when a blocked
client's pending command was processed again before unblocking
- Sentinel no longer loads the built-in Lua scripting engine,
removing a spurious warning at startup
- Validate channel, message, and module payload lengths in cluster
bus packets, preventing forged packets from crashing nodes
- Harden stream validation on RDB load and RESTORE so crafted
payloads can no longer crash the server on later commands
- Reject stream payloads with mismatched live/deleted record
counts, preventing XDEL from destroying unaccounted entries
- Skip unnecessary post-read processing with I/O threads on socket
and TLS connections, restoring small-payload throughput
- Fix a use-after-free crash when serving clients blocked on the
same key if one client is freed during processing
- Avoid an unneeded client lookup per write completion with I/O
threads on socket and TLS connections, improving pipelined
throughput
- Fix CLUSTER SLOT-STATS ORDERBY returning wrong ordering when slot
counters differ by more than 2^31
- Fix slot migration failures with I/O threads and TLS by keeping
the export job's ACK reads on the main thread while snapshotting
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
clang 23 added -Wunused-but-set-global to the -Wunused warning group, so
the -Werror that meson.build adds for git builds turns it into a hard
error:
osinfo/osinfo_avatar_format.c:24:1: error: variable
'osinfo_avatar_format_parent_class' set but not used
[-Werror,-Wunused-but-set-global]
Add -Wno-error=unused-but-set-global to libosinfo_check_cflags so the
warning stays visible but is not fatal. The flag is placed in the list
that meson.build filters through compiler.has_argument(), so it is
dropped on compilers that do not know the warning group
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
clang 23 enables -Wunused-template as part of -Wall (via -Wmost ->
-Wunused), where previously neither -Wall nor -Wextra turned it on.
libcamera builds with -Werror, so this now breaks the build:
In file included from include/libcamera/ipa/core_ipa_serializer.h:18:
include/libcamera/internal/ipa_data_serializer.h:57:3: error: unused
function template 'readPOD' [-Werror,-Wunused-template]
57 | T readPOD(std::vector<uint8_t> &vec, size_t pos)
| ^~~~~~~
The POD helpers sit in an anonymous namespace, so they have internal
linkage and clang diagnoses them per translation unit. appendPOD() and
the iterator overload of readPOD() are referenced by the
IPADataSerializer specialisations in the header itself, so they count as
used everywhere. The std::vector overload of readPOD() is not: nothing
in libcamera calls it, its only callers are the IPA proxies and proxy
workers generated at build time from the mojom templates. So it is
genuinely unused in every translation unit that is not generated proxy
code, which is what [[maybe_unused]] exists for.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
ASSIMP_WARNINGS_AS_ERRORS defaults to ON, which builds the library with
-Wall -Werror. That leaves the build at the mercy of whatever a new
compiler adds to -Wall: clang 23 enables -Wunused-template there, and the
bundled openddlparser copy carries a template that is never called, so the
build fails with
contrib/openddlparser/code/DDLNode.cpp:34:20: error: unused function
template 'releaseDataType' [-Werror,-Wunused-template]
Neither assimp master nor openddl-parser upstream has removed that dead
template, and there is no pending pull request for it, so there is nothing
to backport. Debian, Fedora, Arch and Alpine all turn this option off
rather than patch individual warnings; do the same, which also keeps the
next addition to -Wall from breaking the build again.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Add two new recipes from the CentOS Automotive SIG
boot-time-analysis-tools project to enable boot time profiling
and measurement.
boot-time-analysis-tools:
Python-based toolset for collecting, analyzing and visualizing system
boot timing data from the systemd journal. Provides the 'boot_timings'
CLI utility which queries D-Bus and the systemd journal to produce
structured boot time reports. Depends on python3-dbus and python3-systemd
for runtime journal and D-Bus access.
cntvct-log:
Userspace C utility built with Meson that logs ARM CNTVCT_EL0 virtual
counter timestamps to correlate hardware-level timing with systemd boot
events. Installs cntvct@.service as a systemd template unit (disabled
by default) for on-demand per-instance activation. The service preset
file (98-cntvct-log.preset) is installed for system-preset-based enablement.
Both recipes fetch from the same upstream git repository:
https://gitlab.com/CentOS/automotive/src/boot-time-analysis-tools
Signed-off-by: Chitti Babu Theegala <ctheegal@qti.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Both packages provide the org.gnome.Settings D-Bus name that GNOME
applications use to open the online accounts settings. Only one of them
can own it, so keep them from being installed together.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
GNOME Online Accounts only provides the daemon and library that
applications such as gnome-calendar, gnome-contacts and evolution use
for their calendar, mail and contact accounts. The only user interface
for adding accounts is the online-accounts panel of gnome-control-center,
which pulls in gnome-shell and its settings daemon. Desktops built on
wlroots compositors or other GTK environments have no way to configure
these accounts at all.
gnome-online-accounts-gtk from the xapp project is a standalone GTK4 and
libadwaita application for exactly that job and works without GNOME
Shell.
GNOME applications open the accounts settings by activating the
"launch-panel" action of org.gnome.Settings on the session bus. The
included patch provides that name and action from
gnome-online-accounts-gtk together with a D-Bus service file, so these
buttons work here too. Since only one package can own the bus name, the
package conflicts with gnome-control-center.
Build tested on corei7-64.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The old patch pointed the compiled-in build tree paths at made-up
locations and disabled the landlock in-tree rules with #if 0, which left
the real BUILDROOT definition in libtracker-miners-common in place. It
also touched test-only values that never reach the installed files.
The new patch adds an "uninstalled_helpers" meson option that leaves out
the build tree defines and compiles the in-tree code paths away. It
keeps the developer workflow intact by default and can be sent upstream.
Build tested on corei7-64, the packaged binaries contain no build paths.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
blueprint-compiler-native is a new build dependency.
Build tested on corei7-64.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
fribidi and blueprint-compiler-native are new build dependencies. The
libical 4 patch still applies with an offset.
Build tested on corei7-64.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
glycin and blueprint-compiler-native are new build dependencies, gexiv2
0.16 is required for the extensions. The selinux and cloudproviders meson
options became features and are exposed as PACKAGECONFIG, the packagekit
option is deprecated and dropped. blueprint-compiler needs the GLib
typelib at configure time, so export GI_TYPELIB_PATH like epiphany does.
Build tested on corei7-64.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The library, pkg-config module (gexiv2-0.16), headers and GIR namespace
are versioned now. Users of the old API are on the gexiv2-0.14 recipe.
Build tested on corei7-64, together with localsearch which prefers
gexiv2-0.16.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
gnome-photos looks for the unversioned gexiv2 pkg-config module, which
only the 0.14 series provides.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
gegl looks for the unversioned gexiv2 pkg-config module, which only the
0.14 series provides.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
GIMP requires gexiv2 >= 0.14 and < 0.15, also on its master branch.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
gexiv2 0.16 switched to a versioned library, pkg-config module, header
directory and GIR namespace, so it installs in parallel to 0.14. GNOME 50
applications need 0.16 while GIMP still requires gexiv2 < 0.15, so keep
the 0.14 series under its own name. The command line tool and the python
override are disabled here to avoid file clashes with the main recipe.
Build tested on corei7-64.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
krb5 is a new hard dependency of the RDP backend.
Build tested on corei7-64.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The x11 meson option was removed upstream, drop the corresponding
PACKAGECONFIG. The sysroot patch still applies with an offset.
Build tested on corei7-64.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The X11 session support and its x11 meson option were removed upstream,
drop the corresponding PACKAGECONFIG.
Build tested on corei7-64.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The x11 meson option is gone together with the X11 session support, so
drop the x11 PACKAGECONFIG. The new systemd-units option is tied to the
systemd PACKAGECONFIG. The reproducibility patch for the smartcard enum
types is included upstream.
Build tested on corei7-64.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
clang 23 enables DFAJumpThreading by default and takes over 90
minutes on the switch based state machine loops in the lib-json
tests, where clang 22 needs under a second. Reported upstream with a
bisect and reduced testcase:
https://github.com/llvm/llvm-project/issues/221391
Disable just that pass for clang builds until the fix lands. gcc
builds are not affected.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The oauth PACKAGECONFIG only controls the embedded webview of the built-in
OAuth2 credentials prompter (ENABLE_OAUTH2_WEBKITGTK4, guarded by
WITH_WEBKITGTK in e-credentials-prompter-impl-oauth2.c). OAuth2 support
itself does not depend on it: json-glib is a hard requirement of the build
and without WebKit the prompter offers the authentication URI for opening
in the default browser, receiving the response over the
org.gnome.evolution.dataserver.OAuth2Response D-Bus service.
Drop oauth from the default PACKAGECONFIG so that webkitgtk is not pulled
into every build that needs evolution-data-server. The option stays
available for those who want the in-dialog browser.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HiauLCu6cken5wf44PijzQ
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upstream removed the embedded webview along with the WebKit dependency in
3.49.0 ("Remove the webview and WebKit dependency"). The 3.58.1 sources do
not reference webkit outside of NEWS anymore, so goabackend no longer needs
webkitgtk to build. OAuth2 logins are handed to the default browser via
g_app_info_launch_default_for_uri_async() instead.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HiauLCu6cken5wf44PijzQ
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
configure.ac appends -Werror on top of -Wall unless --disable-werror is
passed, so every warning a newer compiler learns turns into a hard build
failure.
clang 23 added -Wunused-but-set-global and enabled it under -Wall. It
fires on the "static gpointer <t_n>_parent_class = NULL" that glib's
G_DEFINE_TYPE() emits, which is assigned in the generated class_intern_init
but never read unless the type chains up to a parent vfunc. PrefObject in
thd_dbus_interface.cpp never does:
src/thd_dbus_interface.cpp:48:1: error: variable 'pref_object_parent_class'
set but not used [-Werror,-Wunused-but-set-global]
48 | G_DEFINE_TYPE(PrefObject, pref_object, G_TYPE_OBJECT)
Pass --disable-werror, the escape hatch upstream added for exactly this,
rather than suppressing the individual warning - gcc does not know
-Wno-unused-but-set-global. OE's own -Werror=format-security is unaffected.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
LLVM 23 changed the MCContext constructor to take MCAsmInfo,
MCRegisterInfo and MCSubtargetInfo by reference rather than by pointer,
so bcc no longer builds:
src/cc/bcc_debug.cc:151:68: error: no matching function for call to
'llvm::MCContext::MCContext(...)'
Backport the upstream fix. It is guarded on LLVM_VERSION_MAJOR so older
Clang keeps working. There is no release carrying it yet; v0.37.0 is
still the newest tag.
Co-authored-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Clang 23 renamed ASTContext::getRawCommentForDeclNoCache to
getRawCommentNoCache, so castxml no longer builds:
src/Output.cxx:1976:47: error: 'const class clang::ASTContext' has no
member named 'getRawCommentForDeclNoCache'; did you mean
'getRawCommentNoCache'?
Backport the upstream fix. It is guarded on LLVM_VERSION_MAJOR so older
Clang keeps working. There is no release carrying it yet; v0.7.0 is
still the newest tag.
Co-authored-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Ensure that symbolic links (${IMAGE_LINK_NAME}) are created for both
sparse images, matching standard Yocto image deployment behavior
Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.5.6:
Bugs corrected:
- Alert level decided by dict ordering: a failing+slow URL is
downgraded to WARNING, an unscanned URL reports CRITICAL
- GPU plugin duplicates card name and omits N/A for unavailable
metrics in multi-GPU
- GPU plugin duplicates the utilisation value and paints it with
the memory colour in multi-GPU
- IP plugin displays wrong interface: outer loop in get_ip_address()
never breaks
- VideoCore (v3d) memory shows ~93% on Raspberry Pi 5 with
gpu_mem=4M - misleading denominator from drm-total-memory
- CSV export: --stdout-csv data rows desync from header when
network interfaces change count at runtime
- Glances Network plugin with mismatched schema not logging in
TimescaleDB export
Security patches:
- as_dict_secure() Value-Level Bypass Leaks Credentials in URL
Values via /api/4/config - CVE-2026-68520
- --disable-config-exec does not cover on-alert action commands
- CVE-2026-68519
- Command injection bypass of action-template sanitizer via
cross-field shell-operator reconstruction - CVE-2026-68518
- Incomplete fix of CVE-2026-32608: action-template sanitizer is
bypassed by nested stat values - CVE-2026-62982
- REST API CORS Credentials Guard Uses Exact-Match Instead of
Membership Test - CVE-2026-68517
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.2.3:
- Fix ty unresolved-attribute warnings and add mypy back
- Update ruff to version 0.16.5
- Bump github/codeql-action
- Update readme
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Both S and UPSTREAM_CHECK_PYPI_PACKAGE are set to the default values, so
remove them.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The need for PYPI_PACKAGE_HASH was removed in 2016[1].
[1] meta-oe 7edad4def4 ("pypi: update the base pypi url to use the
package info without requiring the hash")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Leon Anavi
Khem Raj
Jason Schonberg
Chitti Babu Theegala
Markus Volk
Khem Raj
Ross Burton
Sunil DoraandDeepesh Varatharajan
AshishKumar Mishra