Commit Graph

36974 Commits

Author SHA1 Message Date
Tim Orling
5ccbf5d552 python3-orjson: upgrade 3.10.17 -> 3.11.6
Update python3-orjson-crates.inc

Add patches to fix compilation for arm64/riscv64 by gating x86/x86_64 only
AVX512 feature(s). The approach has thus far been rejected by upstream:
https://github.com/ijl/orjson/pull/609.

Release Notes:
https://github.com/ijl/orjson/blob/master/CHANGELOG.md#3116---2026-01-29

* orjson now includes code licensed under the Mozilla Public License 2.0
  (MPL-2.0).
* Drop support for Python 3.9.
* ABI compatibility with CPython 3.15 alpha 5.
* Build now depends on Rust 1.89 or later instead of 1.85.
* Fix sporadic crash serializing deeply nested list of dict.
* Show simple error message instead of traceback when attempting to build
  on unsupported Python versions.
* ABI compatibility with CPython 3.15 alpha 1.
* Publish PyPI wheels for 3.14 and manylinux i686, manylinux arm7, manylinux
  ppc64le, manylinux s390x.
* Build now requires a C compiler.
* Fix PyPI project metadata when using maturin 1.9.2 or later.
* Fix build using Rust 1.89 on amd64.
* Build now depends on Rust 1.85 or later instead of 1.82.
* Publish PyPI wheels for CPython 3.14.
* Fix str on big-endian architectures. This was introduced in 3.11.0.
* Use a deserialization buffer allocated per request instead of a shared
  buffer allocated on import.
* ABI compatibility with CPython 3.14 beta 4.
* Fix incorrect escaping of the vertical tabulation character. This was
  introduced in 3.10.17.

Comparing changes:
https://github.com/ijl/orjson/compare/3.10.17...3.11.6

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-06 10:06:18 -08:00
Gyorgy Sarvari
bfbd962813 nodejs: extend libatomic patch to x86
This patch isn't intended to introduce new behavior, rather it
changes the order of some existing LDFLAGS to fix a workaround that
stopped working at some point in the past.

LDFLAGS:x86 contains libatomic, because linking with this library
is required for this platform.

However when gyp links, it invokes the following (pseudo-)command:
$LD $LDFLAGS $RESOURCES_TO_LINK $EXTRA_LIBS $EXTRA_LDFLAGS

The EXTRA* arguments are coming from the gyp config. Since
LDFLAGS appears very early in the command, libatomic also
appears early amongst the resources, and the linker couldn't
find the relevant symbols when compiled for x86 platform (as
it was processed the very last):

| [...] undefined reference to `__atomic_compare_exchange'

Using this patch the library appears at the end, along with
the other EXTRA_LIBS, after the list of linked resources,
allowing linking to succeed.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-06 10:06:18 -08:00
Etienne Cordonnier
5ff9251b94 uutils-coreutils: upgrade 0.5.0 -> 0.6.0
See https://github.com/uutils/coreutils/releases/tag/0.6.0

Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-04 20:53:30 -08:00
Gianfranco Costamagna
04ce4bf518 vboxguestdrivers: Upgrade to 7.2.6
Signed-off-by: Gianfranco Costamagna <locutusofborg@debian.org>
Signed-off-by: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-04 20:53:30 -08:00
Yogesh Tyagi
0feab39283 abseil-cpp: Set CMAKE_CXX_STANDARD to 17
The compiler defaults to C++ < 17 which causes build failures.
Abseil requires C++17 or higher, so explicitly set CMAKE_CXX_STANDARD=17
to ensure the build uses the correct C++ standard.

Error:
CMake Error at CMake/AbseilDll.cmake:745 (message):
  The compiler defaults to or is configured for C++ < 17.  C++ >= 17 is
  required and Abseil and all libraries that use Abseil must use the same C++
  language standard

Signed-off-by: Yogesh Tyagi <yogesh.tyagi@intel.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-04 20:53:30 -08:00
Gyorgy Sarvari
7c54c935cb xrdp: upgrade 0.10.4.1 -> 0.10.5
Contains fix for CVE-2025-68670.
Drop patch that is included in this release.

Changelog:
Security fixes:
- CVE-2025-68670

New features:
- It is now possible to start the xrdp daemon entirely unprivileged from the service manager.
  If you do this certain restrictions will apply. See
  https://github.com/neutrinolabs/xrdp/wiki/Running-the-xrdp-process-as-non-root for details.
- TLS pre-master secrets can now be recorded for packet captures
- Add a FuseRootReportMaxFree to work around 'no free space' issues with some file managers
- Alternate shell names can now be passed to startwm.sh in an environment variable for more
  system management control
- Updated Xorg paths in sesman.ini to include more recent distros
- Add Slovenian keyboard
- xrdpapi: Add a way to monitor connect/disconnect events

Bug fixes:
- Allow an empty X11 UTF8_STRING to be pasted to the clipboard
- Fix a regression introduced in v0.10.x, where it became impossible to connect to a VNC server
  which did not support the ExtendedDesktopSize encoding
- Fix a regression introduced in v0.10.x related to PAM groups handling
- Inconsistencies with [MS-RDPBCGR] have been addressed
- A reference to uninitialised data within the verify_user_pam_userpass.c module has been fixed
- Prevent some possible crashes when the RFX encoder is resized
- Fixes a regression introduced by GFX development which prevented the JPEG encoder from working
  correctly
- Fixes a regression introduced by #2974 which resulted in the xrdp PID file being deleted
  unexpectedly
- Do not overwrite a VNC port set by the user when not using sesman
- Fix regression from 0.9.x when freerdp client uses /workarea
- Fixes a crash where a resize is attempted with drdynvc disabled
- getgrouplist() now compiles on MacOS
- Various Coverity warnings have been addressed
- Documentation improvements

Internal changes:
- An unnecessary include of sys/signal.h causing a compile warning on MUSL-C has been removed

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-04 20:53:30 -08:00
Gyorgy Sarvari
9205d2c95e python3-pyjwt: upgrade 2.10.1 -> 2.11.0
Changelog: https://github.com/jpadilla/pyjwt/releases/tag/2.11.0
- Fixed type error in comment
- Make note of use of leeway with nbf
- Validate key against allowed types for Algorithm family
- Add iterator for PyJWKSet
- Add iss, issuer type checks
- Improve typing/logic for options in decode, decode_complete; Improve docs
- Map algorithm=None to "none"
- Correct PyJWKClient.get_signing_key_from_jwt annotation
- Fixed doc string typo in _validate_jti() function
- Update SECURITY.md
- Typing fix: use float instead of int for lifespan and timeout
- Fix TYP header documentation
- doc: Document claims sub and jti
- Resolve package build warnings
- Support Python 3.14, and test against PyPy 3.10+
- Fix a SyntaxWarning caused by invalid escape sequences
- Standardize CHANGELOG links to PRs
- Migrate from pep517, which is deprecated, to build
- Fix incorrectly-named test suite function
- Fix Read the Docs builds
- Escalate test suite warnings to errors
- Add pyupgrade as a pre-commit hook
- Simplify the test suite decorators
- Improve coverage config and eliminate unused test suite code
- Build a shared wheel once in the test suite
- Thoroughly test type annotations, and resolve errors
- Fix leeway value in usage documentation

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-04 20:53:30 -08:00
Gyorgy Sarvari
3988e13c0a python3-pyjwt: ignore CVE-2025-45768
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-45768

The CVE is disputed: though the vulnerability is there, but it comes
from incorrect configuration of the library by the main application.

Due to this, ignore this CVE.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-04 20:53:30 -08:00
Gyorgy Sarvari
2865b67e29 proftpd: ignore CVE-2021-47865
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-47865

This CVE was opened based on a 5 years old Github issue[1], and has been made
public recently. The CVE wasn't officially disputed (yet?), but based on
the description and the given PoC the application is working as expected.

The vulnerability description and the PoC basically configures proftpd to
accept maximum x connections, and then when the user tries to open x + 1
concurrent connections, it refuses new connections over the configured limit.

See also discussion in the Github issue.

It seems that it won't be fixed, because there is nothing to fix.

[1]: https://github.com/proftpd/proftpd/issues/1298

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-04 20:53:29 -08:00
Gyorgy Sarvari
c08c81ae29 ndpi: ignore CVE-2025-25066
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-25066

The vulnerable code was introduced in version 4.12[1], and
the recipe version is not vulnerable yet. Due to this,
ignore this CVE for now, until the recipe is upgraded.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-04 20:53:29 -08:00
Gyorgy Sarvari
5a74edf28b libcupsfilters: patch CVE-2025-64503
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-64503

Pick the patch that explicitly refernces the CVE ID in its message.
(The NVD advisory mentions only the cups-filters patch, but
the developer indicated the CVE ID in the libcupsfilters patch also)

Between this recipe version and the patch the project has decided to
eliminate c++ from the project, and use c only. The patch however
is straightforward enough that it could be backported with very small
modifications.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-04 20:53:29 -08:00
Gyorgy Sarvari
1a31d20cea libcdio: upgrade 2.2.0 -> 2.3.0
Includes fix for CVE-2024-36600

Changelog: https://github.com/libcdio/libcdio/releases/tag/2.3.0

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-04 20:53:29 -08:00
Gyorgy Sarvari
d92fa873e5 hiawatha: upgrade 11.7 -> 11.8
Drop patches that are included in this release.

Changes:
  * mbed TLS updated to 3.6.4.
  * Small bugfixes.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-04 20:53:29 -08:00
Gyorgy Sarvari
14f88522a1 gimp: mark CVE-2025-15059 patched
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15059

The patch that is referenced by the NVD report has been backported[1]
to the recipe version, and is included already.

[1]: c9eb407485

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-04 20:53:28 -08:00
Gyorgy Sarvari
713739da29 fontforge: patch CVE-2025-15270
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15270

Pick the patch that mentions this vulnerbaility explicitly
in its description.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-02 19:54:39 -08:00
Gyorgy Sarvari
dd81ffdb68 ez-ipupdate: patch CVE-2003-0887
Details: https://nvd.nist.gov/vuln/detail/CVE-2003-0887

The vulnerability is about the default (example) configurations,
which place cache files into the /tmp folder, that is world-writeable.
The recommendation would be to place them to a more secure folder.

The recipe however does not install these example configurations,
and as such it is not vulnerable either.

Just to make sure, patch these folders to a non-tmp folder
(and also install that folder, empty).

Some more discussion about the vulnerability:
https://bugzilla.suse.com/show_bug.cgi?id=48161

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-02 19:54:39 -08:00
Wang Mingyu
e39458314e exiftool: upgrade 13.46 -> 13.48
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-02 19:54:39 -08:00
Wang Mingyu
9111684d67 cryptsetup: upgrade 2.8.3 -> 2.8.4
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-02 19:54:39 -08:00
Wang Mingyu
94e431dfa1 babl: upgrade 0.1.120 -> 0.1.122
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-02 19:54:38 -08:00
Gyorgy Sarvari
ec5cbced92 unicode-ucd: rename license file
After the previous hash update the license file was not renamed,
which causes it to clash in the DL_DIR if it was already downloaded
with the previous hash.

This change renames the file to avoid this clash.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-02 00:23:13 -08:00
Markus Volk
e0839aed46 libsdl2-compat: update 2.32.58 -> 2.32.62
- Starting with [https://github.com/libsdl-org/sdl2-compat/pull/536], it
  is possible to compile without x11. Remove x11 from
  REQUIRED_DISTRO_FEATURES

Changelog:

2.32.62:
This is a stable bugfix release, with the following changes:
Improved support for GNU/Hurd
Fixed crash if hidapi strings are not available

2.32.60:
This is a stable bugfix release, with the following changes:
Fixed crash at startup in Dwarf Fortress
Fixed crash at startup in Stellaris
Fixed mouse stuttering in Amiberry
Fixed the viewport not being reset when the window is resized

Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-02 00:23:13 -08:00
Gyorgy Sarvari
19fdc49db3 libx86-1: upgrade 1.1 -> 1.1.1
Bugfix release, mostly with patches applied from other distros.
Also fixes the SRC_URI which became inaccessible over time.
Drop patches that are included in this release.

Shortlog:
https://gitlab.archlinux.org/grawlinson/libx86/-/compare/v1.1...v1.1.1

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-02 00:23:13 -08:00
Peter Marko
ad890c16e8 protobuf: upgrade 6.31.1 -> 6.33.5
* rebase existing patches
* drop mips clang patch as this was fixed upstream via [1] to build only
  for platforms supporting it.
* add PV to SRC_URI
* add variables to automatically calculate branch and tag
* fix includedir for utf8_range in ptest compilation

[1] 719f303703

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-02 00:23:13 -08:00
Peter Marko
5eab3aebe2 python3-protobuf: upgrade 6.33.4 -> 6.33.5
Solves CVE-2026-0994.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-02 00:23:13 -08:00
Gyorgy Sarvari
3a8beb7eef media-types: add recipe
This recipe is one of the successors of mime-support, which
provided mailcap and mime.types files. This recipe contains
only the mime.types portion.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-01 14:08:50 -08:00
Gyorgy Sarvari
10f3a928ab mailcap: add recipe
This recipe is one of the successors of the mime-support, which
provided mailcap and mime.types files. This recipe contains
only the mailcap portion.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-01 14:08:49 -08:00
Gyorgy Sarvari
25eab2bf01 mime-support: drop recipe
Debian has split this package into two sepatare packages:
media-types and mailcap. This package hasn't been updated
since 2020 (but the other two packages are regularly updated).

Beside this the SRC_URI has been inaccessible since a while also.

Drop this recipe (and substitute it with the up to date packages
in followup patches).

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-02-01 14:08:49 -08:00
Gyorgy Sarvari
2fafea2aa7 krb5: upgrade 1.21.3 -> 1.22.2
Drop the patches that are included in this release.

License-Update: copyright year bump

Changelog:
1.22.2:
Fix a SPNEGO packet parsing bug which could cause GSS mechanism negotiation failure.

1.22.1:
Fix a vulnerability in GSS MIC verification [CVE-2025-57736]

1.22.0:
User experience
- The libdefaults configuration variable "request_timeout" can be set to limit the
  total timeout for KDC requests. When making a KDC request, the client will now
  wait indefinitely (or until the request timeout has elapsed) on a KDC which
  accepts a TCP connection, without contacting any additional KDCs. Clients will
  make fewer DNS queries in some configurations.
- The realm configuration variable "sitename" can be set to cause the client to
  query site-specific DNS records when making KDC requests.

Administrator experience
- Principal aliases are supported in the DB2 and LMDB KDB modules and in the
  kadmin protocol. (The LDAP KDB module has supported aliases since release 1.7.)
- UNIX domain sockets are supported for the Kerberos and kpasswd protocols.
- systemd socket activation is supported for krb5kdc and kadmind.

Developer experience
- KDB modules can be be implemented in terms of other modules using the new
  krb5_db_load_module() function.
- The profile library supports the modification of empty profiles and the copying
  of modified profiles, making it possible to construct an in-memory profile and
  pass it to krb5_init_context_profile().
- GSS-API applications can pass the GSS_C_CHANNEL_BOUND flag to gss_init_sec_context()
  to request strict enforcement of channel bindings by the acceptor.

Protocol evolution
- The PKINIT preauth module supports elliptic curve client certificates, ECDH key
  exchange, and the Microsoft paChecksum2 field.
- The IAKERB implementation has been changed to comply with the most recent draft
  standard and to support realm discovery.
- Message-Authenticator is supported in the RADIUS implementation used by the OTP
  kdcpreauth module.

Code quality
- Removed old-style function declarations, to accomodate compilers which have
  removed support for them.
- Added OSS-Fuzz to the project's continuous integration infrastructure.
- Rewrote the GSS per-message token parsing code for improved safety.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-31 00:13:44 -08:00
Gyorgy Sarvari
8ba0a9e49a libimobiledevice: upgrade to 1.4.0
Delete patch that's included in this release.

Changelog:
  - Add support for MbedTLS
  - Add Reverse Proxy implementation
  - Add support for wireless pairing (AppleTV)
  - Embed 3rd party libraries for ed25519 and SRP6a
  - Fixes in idevicedebug
  - idevicecrashreport: Allow filtering crash reports by filename
  - Add idevicedevmodectl tool
  - Fixes for idevicebackup2
  - Add property_list_client_get_service_client() and service_get_connection() functions
  - Add idevicebtlogger
  - Add new idevice_events_subscribe/unsubscribe API
  - Move LIBIMOBILEDEVICE_API to public headers
  - Add afc_strerror function
  - Add libimobiledevice_version() function
  - Use libimobiledevice-glue's SHA1 implementation
  - Add support for iOS 17+ Personalized Developer Disk image mounting
  - Fix compilation on MSVC
  - Add idevice_strerror() to interface
  - Add new idevice_get_device_version() to interface
  - Add os_trace_relay service implementation
  - Fixes for idevicesyslog
  - afc: Add afc_get_file_info_plist and afc_get_device_info_plist functions
  ... and several other internal changes

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-31 00:13:43 -08:00
Gyorgy Sarvari
cb9d043f46 paho-mqtt-c: upgrade 1.3.14 -> 1.3.15
Drop patch to fix gcc15 compatibility - the problem has been solved by upstream.

Changelog:
- Update getaddrinfo options to support IPv6 hostname resolution
- Removed unnecessary _WIN64 conditional checks
- Fixed condition variable timed wait
- Support tls:// prefix

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-31 00:13:43 -08:00
Gyorgy Sarvari
4323fc8507 libtorrent-rasterbar: upgrade 2.0.10 -> 2.0.11
Changelog: https://github.com/arvidn/libtorrent/releases/tag/v2.0.11

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-31 00:13:43 -08:00
Liu Yiding
2b4ea93889 qpdf: upgrade 12.3.0 -> 12.3.2
ChangeLog
  https://github.com/qpdf/qpdf/releases/tag/v12.3.2

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-31 00:13:43 -08:00
Liu Yiding
785336405d python3-sqlalchemy: upgrade 2.0.45 -> 2.0.46
1.Changelog:
https://github.com/sqlalchemy/sqlalchemy/releases/tag/rel_2_0_46

2.LICENSE checksum has changed as Copyright year changed:
997cdf9cad

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-31 00:13:43 -08:00
Liu Yiding
5f6dbb284a minizip-ng: 4.0.8 -> 4.0.10
1.Changelog:
  https://github.com/zlib-ng/minizip-ng/releases/tag/4.0.10

2.Remove 0001-crypt.h-Remove-register-keyword.patch as it was merged upstream.

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-31 00:13:43 -08:00
Liu Yiding
6605c61301 python3-pywbem: 1.7.3 -> 1.9.0
Changelog:
  https://pywbem.readthedocs.io/en/1.9.0/changes.html

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-31 00:13:42 -08:00
Gyorgy Sarvari
dfd6cf901a fwupd: upgrade 2.0.16 -> 2.0.19
Ptests passed.

Note: plugin_uefi_capsule_splash PACKAGECONFIG is broken, it fails to configure:

| ../sources/fwupd-2.0.16/plugins/uefi-capsule/meson.build:83:4: ERROR: Problem encountered: Error: missing dependency python gobject introspection (python3-gi)
| Error: missing dependency python cairo (python3-cairo)

This doesn't seem to be a regression from this update, was present before the upgrade also.
(The PACKAGECONFIG is disabled by default)

Changelogs:

2.0.19:
This release adds the following features:
    Add two commands to fwupdtool to calculate and find CRCs
    Allow systems to use the udev event source without using systemd

This release fixes the following bugs:
    Always show the correct new firmware version in 'fwupdmgr get-history'
    Fix an integer underflow when parsing a malicious PE file
    Fix a regression when enumerating the dell-dock status component
    Fix the fuzzer timeout when parsing a synaptics-rmi SBL container
    Fix updating the Intel GPU FWDATA section
    Respect 'fwupdmgr --force' when installing firmware

This release adds support for the following hardware:
    Lenovo Sapphire Folio Keyboard

2.0.18:
This release adds the following features:
    Add a MOTD message for devices needing reboot after staged updates
    Create the reboot-required file when a firmware update requires reboot
    Record the system state for each composite emulation
    Update USI docking station firmware without requiring a manual replug

This release fixes the following bugs:
    Add a MTD device problem if the Intel SPI BIOS lock is set
    Allow changing the child name when using PARENT_NAME_PREFIX
    Allow UpdateCapsule to work on systems that do not support SecureBoot
    Correctly parse the EFI_CAPSULE_RESULT_VARIABLE_HEADER
    Fall back to the SMBIOS version for BIOS MTD devices
    Fix a crash when trying to record an i2c emulation
    Fixed Huddly upgrade problems with major version changes
    Fix man page compatibility with apropos and whatis
    Fix parsing USB BOS descriptors
    Fix up the x86_64-specific capsule flags when deploying UEFI firmware
    Improve firmware stream searching speed by a huge amount
    Only convert the release uint32_t to device version format for UEFI devices
    Only handle SIGINT in fwupdtool when required
    Refactor the hypervisor and container detection to be usable from plugins
    Set PlatformArchitecture as the CPU architecture for RISC-V machines
    Use a sensible timeout when doing qc-s5gen2 HID requests

This release adds support for the following hardware:
    HP Portable USB-C 4K HDMI Hub
    Lenovo Legion Go 2 (as a HID device)
    Synaptics HapticsPad

2.0.17:
This release adds the following features:
    Add support for client-side phased update deployment
    Add support for post-quantum signatures
    Allow clearing the cache dirirectory
    Allow fwupdtpmevlog to dump the raw eventlog data
    Build a NVMe GUID derived from the serial number
    Make fwupdtool extract work with deeply nested images
    Parse VSS and FTW variable stores from EFI volumes
    Reintroduce the FreeBSD CI target
    Support very old versions of UDisks

This release fixes the following bugs:
    Add 'fwupdmgr hwids' by exposing another daemon property
    Add offline hashes for the Microsoft 20250902 dbx
    Add the Framework-specific KEK and db hashes
    Allow updating IFD BIOS region via parent MTD
    Avoid showing reinstall prompts for composite devices
    Clean up the fwupdtool lock file in all cases
    Correctly match the correct historical composite component
    Do not allow PK or KEK updates when system has a test key installed
    Do not allow reinstalling when using ONLY_VERSION_UPGRADE
    Do not require AC power to run the installed tests
    Do not scan EFI volumes when constructing MTD BIOS devices
    Ensure REGION is always set for MTD IFD children
    Ensure SCSI instance IDs are valid ASCII values
    Fix a critical warning when parsing invalid Jabra firmware
    Fix an Ilitek parsing crash found when fuzzing
    Fix an inotify race when refreshing metadata
    Fix a pending-activation problem with Dell docking stations
    Fix a potential hang when creating a chunk array with aligned sizes
    Fix MTD emulation recording for PCI-backed devices
    Fix the device order when the parent specifies install-parent-first
    Fix the FLMSTR layout when reading IFD partitions
    Fix the thunderbolt controller rushing to finalize before onlining retimers
    Fix writing Intel GPU OptionROM data and OptionROM code
    Flush stale events to make the Logitech Rallybar more reliable
    Ignore all the Intel GPU MTD devices
    Ignore errors when writing the last page of Dell dock firmware
    Make an error message more specific
    Modify the Dell dock needs-activation flag after updates are installed
    Only add one devlink device for each PCI card
    Parse the FMAP SBOM area as uSWID when required
    Relax the USI dock DMC child device checks for new firmware
    Revert back to the flashrom deprecated API as the new API is unusable
    Rewrite the fwupdmgr manpage to be more useful
    Use higher delay when update status for Logitech peripheral devices

This release adds support for the following hardware:
    ASUS CX9406 (touch controller)
    Framework Copilot keyboard
    Genesys GL352530 and GL352360
    Huddly C1
    Lexar and Maxio NVMe SSDs
    Primax Ryder mouse 2

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-30 23:59:13 -08:00
Gyorgy Sarvari
92c8880aa3 nvme-cli: upgrade 2.12 -> 2.16
Changelogs:
https://github.com/linux-nvme/nvme-cli/releases/tag/v2.16
https://github.com/linux-nvme/nvme-cli/releases/tag/v2.15
https://github.com/linux-nvme/nvme-cli/releases/tag/v2.14
https://github.com/linux-nvme/nvme-cli/releases/tag/v2.13

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-30 23:59:13 -08:00
Gyorgy Sarvari
c7ec976a3c dediprog-flasher: upgrade 1.14.20 -> 1.14.21
Drop the patches that are included in this release.

Changelog: https://github.com/DediProgSW/SF100Linux/compare/V1.14.20.x...V1.14.21,x

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-30 23:59:13 -08:00
Gyorgy Sarvari
d30eb4156b edac-utils: bump to latest revision
Changelog:
Add loongarch64 support

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-30 23:59:13 -08:00
Gyorgy Sarvari
35bc104317 iozone3: upgrade 507 -> 508
Changelog:
- Put an end to the (&*% stupid GCC breaking builds for no valid reason.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-30 23:59:12 -08:00
Gyorgy Sarvari
444f704d03 fio: upgrade 3.39 -> 3.41
Changelog:
3.41:
- engines/io_uring: remove unnecessary SQ full check
- io_uring: ensure accurate real_file_size setup for full device access with PI enabled
- Fix: parse.c opt_len() to use minimal distance to delimiter to determine option length
- io_u: fix offset calculation in randtrimwrite
- engines/http: fix file name
- engines/http: Add S3 security token support
- io_u: get io_u from io_u_freelist when TD_FSYNCING
- io_uring CQ reap cleanup
- Add 'filetype' option
- handle out-of-order write completions in verify state (Issue #1950)
- engines/http: Add support for range reads
- Makefile: fix man and share install paths on MacOS
- Sprandom
- Fix mandoc warnings
- fio: fix formats under MIPS64/PPC
- sprandom: Fix several issues found in the sprandom implementation
- t/verify-state.c fixes/improvements

3.40:
- t/read-to-pipe-async: fix -DNDEBUG support
- docs: update docs for verify_mode=compare of io_uring_cmd
- dfs: fix fail to load dfs engine
- Fix spelling error in IO uring engine.
- Fix hang on Windows when multiple --client args are present
- Add important info about http_host and file formatting to s3 example
- oslib: blkzoned: add missing blkzoned_move_zone_wp() stub

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-30 23:59:12 -08:00
Liu Yiding
52b76013e8 tigervnc: upgrade 1.15.0 -> 1.16.0
1.ChangeLog
  https://github.com/TigerVNC/tigervnc/releases/tag/v1.16.0

2.Update 0002-add-missing-dynamic-library-to-FLTK_LIBRARIES.patch for 1.16.0

3.Update xorg-server to 21.1.21

4.Fix do_install error

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-30 23:59:12 -08:00
Liu Yiding
6354dcfaa8 multipath-tools: upgrade 0.12.1 -> 0.12.2
1. Changelog
  https://github.com/opensvc/multipath-tools/releases/tag/0.12.2

2. Update 0004-RH-use-rpm-optflags-if-present.patch for 0.12.2

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-30 23:59:12 -08:00
Gyorgy Sarvari
1b4b952b51 freerdp: ignore CVE-2025-68118
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-68118

The vulnerability is specific to the usage of Microsoft specific sprintf
implementation. Because of this, ignore this vulnerability.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-30 23:59:12 -08:00
Gyorgy Sarvari
c0af251f34 wireshark: upgrade 4.2.14 -> 4.6.3
Contains fix for CVE-2025-0962.

Removed CVE-2025-9817.patch because it is included in this release.

Add a patch that allows it building for native: it is looking for iconv.h
header as a new dependency for (optional) zlib-ng support, however it
is not installed in the sysroot for native builds. Add a patch that removes
this hard dependency for native builds.

Changelogs:
https://www.wireshark.org/docs/relnotes/wireshark-4.6.3.html
https://www.wireshark.org/docs/relnotes/wireshark-4.6.2.html
https://www.wireshark.org/docs/relnotes/wireshark-4.6.1.html
https://www.wireshark.org/docs/relnotes/wireshark-4.6.0.html

Overall changelogs (including 4.4 also): https://www.wireshark.org/docs/relnotes/

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-30 23:59:11 -08:00
Liu Yiding
2ce95a4d88 fbida: upgrade 2.14 -> 2.15
1. Changelog
   a0d75fbab3

2. Drop following patches as they were merged upstream.
   fbida-gcc10.patch
   0001-meson.build-install-fbgs-shell-script.patch
   0001-fbida-Include-missing-sys-types.h.patch
   0002-meson.build-add-features-options-for-png-gif-tiff-we.patch
   0001-meson.build-make-fbpdf-build-optional.patch

3. Drop 0003-meson.build-do-not-require-xkbcommon.patch as xkbcommon was added as DEPEND.

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-30 23:59:11 -08:00
Shoudi Li
c276518790 android-tools-conf-configfs: remove this recipe without selinux dependency
For the boards with multiple UDC ports, when compiling with meta-selinux
layer adb funtion will be impacted due to below error. Remove the recipe
under dynamic-layers/selinux/ as it's not required anymore, and ensure
adb work normally on the boards with multiple UDC ports.

ls /sys/class/udc/ > /sys/kernel/config/usb_gadget/adb/UDC
ls: write error: Device or resource busy

Signed-off-by: Shoudi Li <shoudil@qti.qualcomm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-30 23:59:11 -08:00
Jason Schonberg
8089168196 Use https when accessing archive.xfce.org
While using devtool to check available versions, I noticed a 301 http error.

Specifically :

$ devtool latest-version libxfce4ui

Resolving archive.xfce.org (archive.xfce.org)... 217.70.191.87
Connecting to archive.xfce.org (archive.xfce.org)|217.70.191.87|:80... connected
.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://archive.xfce.org/src/xfce/libxfce4ui/4.20/ [following]

With this patch, we change to make the SRC_URI an https request.

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-30 23:59:11 -08:00
Trevor Gamblin
f0f02434c8 hdf5: fix shasum, downloadfilename
Fixes: #1023

Upstream seems to have regenerated the archive, as the checksum no
longer matches the one specified in the recipe:

|WARNING: hdf5-2.0.0-r0 do_fetch: Checksum failure encountered with download of https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/hdf5-2.0.0.tar.gz - will attempt other sources if available
|WARNING: hdf5-2.0.0-r0 do_fetch: Checksum mismatch for local file /buildcache/downloads/hdf5-2.0.0.tar.gz
|Cleaning and trying again.
|WARNING: hdf5-2.0.0-r0 do_fetch: Renaming /buildcache/downloads/hdf5-2.0.0.tar.gz to /buildcache/downloads/hdf5-2.0.0.tar.gz_bad-checksum_a7a8f43e76e825ea22234bc735d5b184e880d305e33e4c9bb93a3912421c9973
|ERROR: hdf5-2.0.0-r0 do_fetch: Checksum failure fetching https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/hdf5-2.0.0.tar.gz
|ERROR: hdf5-2.0.0-r0 do_fetch: Bitbake Fetcher Error: ChecksumError('Checksum mismatch!\nFile: \'/buildcache/downloads/hdf5-2.0.0.tar.gz\' has sha256 checksum \'a7a8f43e76e825ea22234bc735d5b184e880d305e33e4c9bb93a3912421c9973\' when \'6e45a4213cb11bb5860)
|ERROR: Logfile of failure stored in: /home/tgamblin/workspace/yocto/openembedded-core/build/tmp/work/x86-64-v3-poky-linux/hdf5/2.0.0/temp/log.do_fetch.2054297

However, the tarballs look identical. Update the hash and be explicit
about downloadfilename to avoid any mirroring issues. A note has been
left that this measure can be removed with a future upgrade.

Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Reviewed-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-30 23:59:11 -08:00
Markus Volk
b43a9e6897 mutter: fix build without x11 in DISTRO_FEATURES
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2026-01-30 23:59:11 -08:00