Commit Graph

36211 Commits

Author SHA1 Message Date
Jan Claußen
4f461e4985 python3-soundcard: Add recipe
SoundCard is a library for playing and recording audio without resorting to a CPython extension.

Signed-off-by: Jan Claußen <jan.claussen10@web.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-29 08:32:47 -08:00
Patrick Wicki
9cf103dc85 fluentbit: unbundle msgpack, sqlite3 and zstd
With https://github.com/fluent/fluent-bit/pull/9572 it is now possible
to unbundle these and use the system libs instead.

Signed-off-by: Patrick Wicki <patrick.wicki@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-29 08:32:24 -08:00
Patrick Wicki
aaebfe4452 fluentbit: upgrade 4.0.1 -> 4.2.0
Refresh patches and drop one for musl which is no longer required.

Release notes:
- https://fluentbit.io/announcements/v4.1.0/
- https://fluentbit.io/announcements/v4.2.0/

This addresses CVE-2025-12977.

Signed-off-by: Patrick Wicki <patrick.wicki@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-29 08:32:24 -08:00
Gyorgy Sarvari
54ca51b6c6 xrdp: add ptest support
It takes under 10 seconds to run the suite.
Executed succesfully on x86-64, with musl and glibc.

The recipe requires pam DISTRO_FEATURE to be present.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-29 08:32:24 -08:00
Gyorgy Sarvari
75fad30c62 dbus-broker: rework EXTRA_OEMESON opts to PACKAGECONFIG
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-28 13:44:01 -08:00
Gyorgy Sarvari
05230420ab dbus-broker: add ptest support
It takes less than 30 seconds to execute.

Add a backported patch that fixes a broken test.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-28 13:44:01 -08:00
Gyorgy Sarvari
c7812d7f9f dbus-broker: upgrade 36->37
Changelog:
- Add `/etc` and `/run` to the search-paths for system services. This
  change is aligned with recent changes to the reference
  implementation.
- Support systemd's `notify-reload` to trigger a reload operation.
  This replaces the old `busctl call ...ReloadConfig` operation.
- Extend `org.freedesktop.DBus.Debug.Stats.GetStats` with all the
  fields defined by the specification.
- Fix a bug in match-rule processing which caused argument processing
  to fail for any but the first message argument.
- Fix a memory leak in configuration processing when parsing invalid
  user or group IDs.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-28 13:44:01 -08:00
Gyorgy Sarvari
2f913279d4 tigervnc: fix typo in CVE_STATUS
Forgot to add the CVE- prefix in previous patch.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-28 13:44:01 -08:00
Alper Ak
1175d5c8c1 proj: Fix do_package QA issue for unshipped bash-completion files
Add bash-completion directory to FILES to resolve the installed-vs-shipped QA error.

Fix:

ERROR: proj-9.7.0-r0 do_package: QA Issue: proj: Files/directories were installed but not shipped in any package:
  /usr/share/bash-completion
  /usr/share/bash-completion/completions
  /usr/share/bash-completion/completions/projinfo
Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install.
proj: 3 installed and not shipped files. [installed-vs-shipped]
ERROR: proj-9.7.0-r0 do_package: Fatal QA errors were found, failing task.

Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-28 12:02:53 -08:00
Dan McGregor
91389e4d5a netcat-openbsd: update to 1.228
A version newer than 1.195 is required for certain features of newer
versions of cloud-init.  May as well bump to the version in Debian
Testing.

I also noticed it appears the licence was incorrectly specified, and is
indeed BSD-3-Clause.

License-update: Added copyright holders and clarified man page licence
Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-28 11:39:52 -08:00
Anthony Del Frari
3304914228 python3-requests-unixsocket: Update to 0.4.1
python3-requests broke the http+unix url scheme with version 2.32.
Their position is that it's the responsibility of consuming libraries
to adopt their new interface. requests-unixsocket 0.4 adapts to the
new interface.

Signed-off-by: Dan McGregor <dan.mcgregor@vecima.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-28 11:39:51 -08:00
Khem Raj
c6618c38da sdbus-c++: Ignore CreatesGenericErrorWhenErrnoIsUnknown test on non-glibc systems
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-27 08:49:32 -08:00
Leon Anavi
3c40f787eb openjpeg: Add nativesdk to BBCLASSEXTEND
Add nativesdk to BBCLASSEXTEND because python3-pillow requires
nativesdk-openjpeg.

This work was sponsored by GOVCERT.LU.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-27 08:49:32 -08:00
Leon Anavi
fa702ab398 qpdf: Add native and nativesdk to BBCLASSEXTEND
Add native and nativesdk to BBCLASSEXTEND because python3-pikepdf
requires nativesdk-qpdf.

This work was sponsored by GOVCERT.LU.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-27 08:49:32 -08:00
Leon Anavi
9245fda941 python3-pillow: Add nativesdk to BBCLASSEXTEND
Add nativesdk to BBCLASSEXTEND because python3-pikepdf requires
nativesdk-python3-pillow.

This work was sponsored by GOVCERT.LU.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-27 08:49:32 -08:00
Changqing Li
39ccbba725 hdf5: fix do_package failure when multilib enabled
After upgrading hdf5 to 2.0.0, h5cc and h5hlcc will only be generated
when pkg-config is found. With current default config, it will not be
generated, remove related configs to fix do_package failure

| DEBUG: Executing shell function multilibscript_rename
| mv: cannot stat '/tmp/work/cortexa72-wrs-linux/hdf5/2.0.0/package/usr/bin/h5cc': No such file or directory

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-27 08:49:31 -08:00
Khem Raj
32a029dae1 fuse3: Add missing rdep on file for ptests
Fixes

E  FileNotFoundError: [Errno 2] No such file or directory: 'file'

../../python3.13/subprocess.py:1972: FileNotFoundError

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-26 20:39:55 -08:00
Khem Raj
53192e70ed libplist: Upgrade to 2.7.0
Fix failing ptests

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Ankur Tyagi <ankur.tyagi85@gmail.com>
2025-11-26 19:07:04 -08:00
Khem Raj
3a6b83c075 libplist: Fix buildpaths in ptests
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Ankur Tyagi <ankur.tyagi85@gmail.com>
2025-11-26 19:07:04 -08:00
Tom Geelen
367faf98ac python3-pytest-picked: Add recipe for version 0.5.1
Python package description: Run the tests related to the unstaged files or the current branch (according to Git)
More information: https://pypi.org/project/pytest-picked/

Signed-off-by: Tom Geelen <t.f.g.geelen@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-26 19:07:04 -08:00
Ankur Tyagi
5551a12170 python3-django: upgrade 4.2.25 -> 4.2.26
Release Notes:
https://docs.djangoproject.com/en/dev/releases/4.2.26/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-26 19:07:04 -08:00
Ankur Tyagi
8247a68d54 python3-django: upgrade 5.2.7 -> 5.2.8
Release Notes:
https://docs.djangoproject.com/en/dev/releases/5.2.8/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-26 19:07:04 -08:00
Khem Raj
20c00a5b19 python3-wxgtk4: Upgrade to 4.2.4
inherit cython to not rebuild _nanosvg.c

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-26 19:07:03 -08:00
Khem Raj
e4003aed55 wxwidgets: Upgrade to 3.2.8.1 bugfix release
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-26 19:06:59 -08:00
Gyorgy Sarvari
185ff8cbcc breakpad: correct SRC_URI branch
master was renamed to main

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-26 15:28:08 -08:00
Randy MacLeod
bd5202a0a0 librelp: Upgrade to 1.12.0
This upgrade is mostly bug fixes according to:
   https://github.com/rsyslog/librelp/blob/master/ChangeLog
but there is one new API:
   add ability to communicate source port back to caller

Drop the backported patch:
   0001-Fix-function-inline-errors-in-debug-optimization-Og.patch
Drop patches merged upstream:
   0001-tests-Include-missing-sys-time.h.patch
   ->  8c96857 tests: Include missing sys/time.h
   0001-relp-fix-build-against-upcoming-gcc-14-Werror-calloc.patch
   -> baf992f relp: fix build against upcoming `gcc-14` ...
   0001-tests-Fix-callback-prototype.patch
   -> a4cb0bd tests: Fix callback prototype
   0001-tcp-fix-some-compiler-warnings-with-enable-tls-opens.patch
   -> 6e9b27f tcp: fix some compiler warnings with enable-tls-openssl

Ptest for qemux86-64, qemuarm64 with glibc and musl:
 TOTAL: 30
 PASS:  27
 SKIP:  3
 XFAIL: 0
 FAIL:  0
 XPASS: 0
 ERROR: 0

Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-26 15:28:08 -08:00
Gyorgy Sarvari
89a119a273 xorgxrdp: upgrade 0.9.19 -> 0.10.4
Changelog:
0.10.4: https://github.com/neutrinolabs/xorgxrdp/releases/tag/v0.10.4
0.10.3: https://github.com/neutrinolabs/xorgxrdp/releases/tag/v0.10.3
0.10.2: https://github.com/neutrinolabs/xorgxrdp/releases/tag/v0.10.2
0.10.1: https://github.com/neutrinolabs/xorgxrdp/releases/tag/v0.10.1
0.10.0: https://github.com/neutrinolabs/xorgxrdp/releases/tag/v0.10.0

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-26 15:28:08 -08:00
Gyorgy Sarvari
07c05145fa xrdp: upgrade 0.9.20 -> 0.10.4.1
Contains fixes for the following vulnerabilities:
CVE-2022-23468, CVE-2022-23477, CVE-2022-23478, CVE-2022-23479,
CVE-2022-23480, CVE-2022-23481, CVE-2022-23482, CVE-2022-23483,
CVE-2022-23484, CVE-2022-23493, CVE-2023-40184, CVE-2023-42822,
CVE-2024-39917

Added a new patch to fix compiling with musl.

Dropped 0001-Fix-the-compile-error.patch: it's an 8 years old patch,
claiming to fix a compile error. I did not see an error when I removed
it (tried glibc and musl, gcc and clang).

Changelogs:
0.10.4.1: https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.4.1
0.10.4: https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.4
0.10.3: https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.3
0.10.2: https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.2
0.10.1: https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.1
0.10.0: https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.0

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-26 15:28:08 -08:00
Liu Yiding
b84c199327 rasdaemon: upgrade 0.8.3 -> 0.8.4
1.Changelog:
5a1efb8f32

2.Remove 0001-rasdaemon-fix-post-processing-options.patch as it was merged upstream.

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-26 15:28:07 -08:00
Liu Yiding
32cc671e03 python3-pytest-cov: upgrade 6.2.1 -> 7.0.0
Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-26 15:28:07 -08:00
Jan Vermaete
5489b73633 python3-tenacity: new recipe version 9.1.2
Moved the recipe from meta-homeassistant
  - all credits to them
Added ptest
  - skip one test that fails on qemu

Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 15:32:28 -08:00
Khem Raj
0856c56132 e2tools: Fix buildpaths in ptests
Currently the path checks are escaping QA check for buildpath detection but config.status
still has paths which show up in reproduciblity failures, comparing build in path A and
build in path B, content of config.status don't end up same.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 14:59:17 -08:00
Leon Anavi
a51b5f4540 valkey: Upgrade 8.1.4 -> 9.0.0
Upgrade to release 9.0.0:

- HSETEX with FXX should not create an object if it does not exist
- Fix crash when aborting a slot migration while child snapshot is
  active
- Fix double MOVED reply on unblock at failover
- Fix memory leak with CLIENT LIST/KILL duplicate filters
- Fix incorrect accounting after completed atomic slot migration
- Fix Lua VM crash after FUNCTION FLUSH ASYNC + FUNCTION LOAD
- Fix invalid memory address caused by hashtable shrinking during
  safe iteration

Replace dependency hiredis with libvalkey.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:44 -08:00
Wang Mingyu
387707f7b8 sanlock: upgrade 4.1.0 -> 4.2.0
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:44 -08:00
Wang Mingyu
d897aa1e1f python3-types-psutil: upgrade 7.0.0.20250601 -> 7.1.1.20251122
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:44 -08:00
Wang Mingyu
9b01199ed5 python3-stevedore: upgrade 5.5.0 -> 5.6.0
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:43 -08:00
Wang Mingyu
18aaa7d8a6 python3-rich-argparse: upgrade 1.7.1 -> 1.7.2
Changelog:
 Fix colors overlapping with Python 3.14.0+ which enabled colors by default in the help formatter.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:43 -08:00
Wang Mingyu
4b297312d7 python3-psycopg: upgrade 3.2.12 -> 3.2.13
Changelog:
==============
- Show the host name in the error message in case of name resolution error
- Fix Cursor.copy() and AsyncCursor.copy() to hold the connection lock for the
  entire operation, preventing concurrent access issues
- Fix GSSAPI check with C extension built with libpq < v16

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:43 -08:00
Wang Mingyu
ddca2bae90 python3-moteus: upgrade 0.3.95 -> 0.3.96
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:43 -08:00
Wang Mingyu
dc53efed84 python3-gpt-image: upgrade 0.9.0 -> 0.9.1
Changelog:
  Partition commit offset calculation

License-Update: file type changed to "ASCII text"

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:43 -08:00
Wang Mingyu
98420b06a7 python3-dirty-equals: upgrade 0.10.0 -> 0.11
Changelog:
===========
- Fix nested dataclass comparison
- uprev in preparation for release
- Add tests for 3.14

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:43 -08:00
Liu Yiding
2c9a4075ef python3-pytest-mock: upgrade 3.14.1 -> 3.15.1
1. Changelog:
   https://github.com/pytest-dev/pytest-mock/releases/tag/v3.15.1

2. Remove 0001-Add-asyncio-fixture-to-test_instance_async_method_sp.patch as it has been mergerd upstream.

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:42 -08:00
Wang Mingyu
7433f87f32 python3-coverage: upgrade 7.11.3 -> 7.12.0
Changelog:
============
- The HTML report now shows separate coverage totals for statements and
  branches, as well as the usual combined coverage percentage.
- The JSON report now includes separate coverage totals for statements and
  branches
- Fix: except* clauses were not handled properly under the "sysmon" measurement
  core, causing KeyError exceptions
- Fix: we now defend against aggressive mocking of open() that could cause
  errors inside coverage.py.
- Fix: in unusual cases where a test suite intentionally exhausts the system's
  file descriptors to test handling errors in open(), coverage.py would fail
  when trying to open source files
- A small tweak to the HTML report: file paths now use thin spaces around
  slashes to make them easier to read.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:42 -08:00
Wang Mingyu
ab1216dde2 python3-cmake: upgrade 4.1.2 -> 4.2.0
Changelog:
=============
- ci: build with clang instead of gcc
- docs: improve links back to GitHub
- chore: add changelog exclusion for bots

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:42 -08:00
Wang Mingyu
7c760f0b54 python3-cfgv: upgrade 3.4.0 -> 3.5.0
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:42 -08:00
Wang Mingyu
361c98e554 python3-bleak: upgrade 1.1.1 -> 2.0.0
Added
------
- Added bleak.backends.get_default_backend() and BleakBackend enum for a
  centralized backend detection.
- Added BleakClient().backend_id and BleakScanner().backend_id properties to
  identify the backend in use.

Changed --------
- Use "AcquireNotify" rather than "StartNotify" for Linux backend on supported
  characteristics
- Allow multiple calls to disconnect() on Windows to align behavior over all
  backends.
- Raise new BleakBluetoothNotAvailableError when Bluetooth is not supported,
  turned off or permission is denied.

Fixed ------
- Fixed potential race condition causing timeout while connecting in WinRT
  backend.
- Fixed file handle leak in BlueZ backend when D-Bus connection is lost and
  re-established.
- Fixed crash in CoreBluetooth backend if an ObjC delegate callback is called
  after the asyncio run loop stops.
- Fixed possible deadlock when starting scanning on Windows when Bluetooth is
  turned off.
- Fixed "Bluetooth device is turned off" Exception on macOS, when a Bluetooth
  permission request popup is shown to the user by the OS.

Removed ---------
- Removed support for Python 3.9.
- Removed support for macOS < 10.15.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:42 -08:00
Wang Mingyu
2e73a5158c python3-bandit: upgrade 1.8.6 -> 1.9.2
Changelog:
==========
- Add instructions for Maintainers to create/publish a release
- Replace deprecated datetime.datetime.utcnow()
- Fix typos
- Support of Python 3.14
- Drop support of end-of-life Python 3.9
- More Python version related fixes
- Argparse Python 3.14 enhancements
- Check whether Constant value is str

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:41 -08:00
Wang Mingyu
cb3b22adc4 python3-asyncinotify: upgrade 4.2.1 -> 4.3.2
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:41 -08:00
Wang Mingyu
eb786d6314 python3-asgiref: upgrade 3.10.0 -> 3.11.0
Changelog:
=============
- "sync_to_async" gains a "context" parameter, similar to those for
  "asyncio.create_task", "TaskGroup" &co, that can be used on Python 3.11+ to
  control the context used by the underlying task.
  The parent context is already propagated by default but the additional
  control is useful if multiple "sync_to_async" calls need to share the same
  context, e.g. when used with "asyncio.gather()".

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:41 -08:00
Wang Mingyu
351ac66213 openvpn: upgrade 2.6.15 -> 2.6.16
Code maintenance / Compat changes
---------------------------------
- adapt to new "encrypt-then-mac" cipher suites in OpenSSL 3.6.0 - these
  need special handling which we don't do, so the t_lpback self-test
  failed on them.  Exclude from list of allowed ciphers, as there is no
  strong reason today to make OpenVPN use these.
- fix various compile-time warnings

Documentation updates
---------------------
- fix outdated and non-HTTPS URLs throughout the tree (doxygen, warnings,
  manpage, ...)

Bugfixes
--------
- Fix memcmp check for the hmac verification in the 3way handshake.
  This bug renders the HMAC based protection against state exhaustion on
  receiving spoofed TLS handshake packets in the OpenVPN server inefficient.
  CVE: 2025-13086
- fix invalid pointer creation in tls_pre_decrypt() - technically this is
  a memory over-read issue, in practice, the compilers optimize it away
  so no negative effects could be observed.
- Windows: in the interactive service, fix the "undo DNS config" handling.
- Windows: in the interactive service, disallow using of "stdin" for the
  config file, unless the caller is authorized OpenVPN Administrator
- Windows: in the interactive service, change all netsh calls to use
  interface index and not interface name - sidesteps all possible attack
  avenues with special characters in interface names.
- Windows: in the interactive service, improve error handling in
  some "unlikely to happen" paths.
- auth plugin/script handling: properly check for errors in creation on
  $auth_failed_reason_file (arf).
- for incoming TCP connections, close-on-exec option was applied to
  the wrong socket fd, leaking socket FDs to child processes.
- sitnl: set close-on-exec flag on netlink socket
- ssl_mbedtls: fix missing perf_pop() call (optional performance profiling)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2025-11-25 07:44:41 -08:00