Commit Graph

30915 Commits

Author SHA1 Message Date
Peter Marko 604a54d742 spice: set CVE-2016-2150 status to fixed
Debian has fixed this CVE with [1].
That patch is taken from [2].

.../tmp/work/core2-64-poky-linux/spice/0.15.2/git$ git describe 69628ea13
v0.13.1-190-g69628ea1
.../tmp/work/core2-64-poky-linux/spice/0.15.2/git$ git tag --contains 69628ea13
v0.13.2

[1] https://sources.debian.org/patches/spice/0.12.5-1%2Bdeb8u5/CVE-2016-2150/0002-improve-primary-surface-parameter-checks.patch/
[2] https://gitlab.freedesktop.org/spice/spice/-/commit/69628ea1375282cb7ca5b4dc4410e7aa67e0fc02

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e44f3251b5)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:52:04 +05:30
Peter Marko bc575f49a2 spice: ignore CVE-2016-0749
NVD tracks this as version-less CVE for spice.
It was fixed by [1] and [2] included in 0.13.2.

[1] https://gitlab.freedesktop.org/spice/spice/-/commit/6b32af3e1746988bb5a5123263bcf61b65e5be7e
[2] https://gitlab.freedesktop.org/spice/spice/-/commit/359ac42a7ac02dcd1013757559292006647cd5c4

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 073e845274)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:52:04 +05:30
Peter Marko 0e38edb85d spice-gtk: mark CVE-2012-4425 as fixed
It is fixed by [1] since 0.15.3.
NVD tracks this CVE as version-less.

[1] https://cgit.freedesktop.org/spice/spice-gtk/commit/?id=efbf867bb88845d5edf839550b54494b1bb752b9

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 7e17f8cec0)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:52:03 +05:30
Gyorgy Sarvari 213a390d5d streamripper: ignore CVE-2020-37065
Details: https://nvd.nist.gov/vuln/detail/CVE-2020-37065

The vulnerability is about a 3rd party Windows-only GUI frontend for
the streamripper library, and not for the CLI application that the
recipe builds. Due to this ignore this CVE.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 1571c1a8e5)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:52:03 +05:30
Gyorgy Sarvari 67a8fe4a1a python3-django: upgrade 4.2.28 -> 4.2.29
Contains fiuxes for CVE-2026-25673 and CVE-2026-25674.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:52:03 +05:30
Gyorgy Sarvari c73a2a0435 protobuf: ignore CVE-2026-0994
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-0994

The vulnerability impacts only the python bindings of protobuf, which
is in a separate recipe (python3-protobuf, where it is patched).

Ignore this CVE in this recipe due to this.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 398fa05aa8)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:52:02 +05:30
Gyorgy Sarvari 24e8a09f65 libjxl: upgrade 0.10.2 -> 0.10.5
Bug fix release, mostly CVE fixes.
Drop patches that are included.

Changelog:
0.10.5:
fix tile dimension in low memory rendering pipeline (CVE-2025-12474)
fix number of channels for gray-to-gray color transform (CVE-2026-1837)
djxl: reject decoding JXL files if "packed" representation size overflows size_t

0.10.4:
Huffman lookup table size fix (CVE-2024-11403)
Check height limit in modular trees (CVE-2024-11498)

0.10.3:
fixed decoding of some special images

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:52:02 +05:30
Gyorgy Sarvari a0a3169b2b keepalived: patch CVE-2024-41184
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-41184

Backport the patches referenced by upstream in the bug
mentioned by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:52:01 +05:30
Gyorgy Sarvari ad6ea218ae gnome-shell: ignore CVE-2021-3982
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-3982

The vulnerability is about a privilege escalation, in case
the host distribution sets CAP_SYS_NICE capability on the
gnome-shell binary.

OE distros don't do that, and due to this this recipe is not
affected by this issue. The CVE is ignored.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 4d6e24106c)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:52:01 +05:30
Gyorgy Sarvari 1a6816e20f gimp: patch CVE-2026-2048
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-2048

Pick the patch from the relevant upstream issue[1];

[1]: https://gitlab.gnome.org/GNOME/gimp/-/issues/15554

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:52:00 +05:30
Gyorgy Sarvari fb8e5b9659 gimp: ignore CVE-2026-2047
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-2047

The vulnerability exists in ICNS importer, which was first introduced in
version 3.0 [1], and the code is not present in the recipe version.

Due to this, ignore this CVE.

[1]: https://gitlab.gnome.org/GNOME/gimp/-/commit/00232e17875d4676a2c797a429db23b1a9815db8

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:51:51 +05:30
Gyorgy Sarvari 210ce6945c gimp: patch CVE-2026-2045
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-2045

Pick the patch associated with the relevant upstream issue[1].

[1]: https://gitlab.gnome.org/GNOME/gimp/-/issues/15293

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:47:06 +05:30
Gyorgy Sarvari 276a3b7195 gimp: patch CVE-2026-2044
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-2044

Pick the patch referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:47:05 +05:30
Gyorgy Sarvari 74f6a2e5ac gimp: patch CVE-2026-0797
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-0797

The patch referenced in the NVD report looks incorrect.
This change in this patch was taken from the related upstream issue[1].

[1]: https://gitlab.gnome.org/GNOME/gimp/-/issues/15555

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:47:05 +05:30
Gyorgy Sarvari 3dd2d0dc98 gimp: patch CVE-2025-2761
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-2761

Pick the patch from the relevant upstream bug[1].

[1]: https://gitlab.gnome.org/GNOME/gimp/-/issues/13073

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:47:04 +05:30
Gyorgy Sarvari 50d7ec475b gimp: patch CVE-2025-2760
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-2760

Use the fixes from Debian.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:47:04 +05:30
Gyorgy Sarvari 42d1f2f681 gimp: patch CVE-2025-15059
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15059

Backport the patch that is referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:47:03 +05:30
Gyorgy Sarvari 077dad4b6d gimp: ignore CVE-2025-14424
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-14424

The vulnerbaility was introduced in version 3.0.0, with commit[1].
The recipe version isn't vulnerable - ignore this CVE.

[1]: https://gitlab.gnome.org/GNOME/gimp/-/commit/a0fc5a025ae3579609730ebabc3c84146385da76

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:47:03 +05:30
Gyorgy Sarvari e7dcdee568 freerdp: upgrade 2.11.7 -> 2.11.8
Drop patch that is included in this release.

Changelog: https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.8

Backported #12319 bugfixes from 3.x
Fix incompatible pointer type issues
X11: fix pointer/integer type mismatch
Warn backport
[core] eliminate rdpRdp::instance
X11 client: ignore grab related LeaveNotify events
[winpr,pubsub] add NULL parameter checks
fix: correct server port assignment logic

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:47:02 +05:30
Gyorgy Sarvari a831c03427 exiftool: ignore CVE-2026-3102
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-3102

The vulnerability impacts only MacOS - ignore it.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-24 08:46:57 +05:30
haonguyen-qualgo 1bdb7dc121 mbedtls: Do not set LIB_INSTALL_DIR to an absolute path to make MbedTLSTargets.cmake relocateable
Signed-off-by: haonguyen-qualgo <hao.nna@qualgo.net>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-23 14:14:58 +05:30
Alexandre Truong 4d3e2639de source-han-sans-*-fonts: rename downloaded files in SRC_URI
In commit [0], we've switched away from SVN fetcher in SRC_URI.
The archives downloaded are named SourceHanSans*.zip
They are named this way regardless of the version 1.004 or 2.004.
So when the new archives checksums are tested, the fetcher will
look for the old archives with the same name in the DL_DIR.
>From [1], there are checksum failures due to given checksums not
matching the ones in DL_DIR. Thus, downloaded archives are renamed
following their package name and version.

[0]: https://git.openembedded.org/meta-openembedded/commit/?id=36a1e36e1272ca50e5dba0c4cf25ee3ff8b8f1c9
[1]: https://autobuilder.yoctoproject.org/typhoon/#/builders/156/builds/367/steps/16/logs/errors

Signed-off-by: Alexandre Truong <alexandre.truong@smile.fr>
Reviewed-by: Yoann Congal <yoann.congal@smile.fr>
Reviewed-by: Alexandre Truong <alexandre.truong@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 08e414d496)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-03-03 13:08:08 +05:30
Anuj Mittal 6ce6448ebc README: update listed maintainer
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:58:47 +05:30
Anil Dongare 2160609b5b wireshark 4.2.14: Fix CVE-2026-0962
Upstream Repository: https://gitlab.com/wireshark/wireshark.git

Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2026-0962
Type: Security Fix
CVE: CVE-2026-0962
Score: 6.5
Patch: https://gitlab.com/wireshark/wireshark/-/commit/825b83e1ed14

Signed-off-by: Anil Dongare <adongare@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:45:44 +05:30
Peter Marko 4e4ad54c9a fcgi: add follow-up patch for CVE-2025-23016
New release [1] added additional fir for this CVE.

[1] https://github.com/FastCGI-Archives/fcgi2/releases/tag/2.4.7

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:00:46 +05:30
Tafil Avdyli c88db38ad6 python3-pybind11-json: fix Targets.cmake trying to reference host
The resulting pybind11_jsonTargets.cmake in the dev-package adds an
absolute path to python include directories in the target properties:

  set_target_properties(pybind11_json PROPERTIES
    INTERFACE_INCLUDE_DIRECTORIES "/usr/include/python3.13;${_IMPORT_PREFIX}/include"
  )

The patch removes ${PYTHON_INCLUDE_DIRS} which is set by pybind11 from
set_target_properties to remove the poisonous host path.

Signed-off-by: Tafil Avdyli <tafil@tafhub.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0332dae9bb)
Signed-off-by: Tafil Avdyli <tafil@tafhub.de>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:00:45 +05:30
Martin Jansa 560eef1dc2 nodejs: add missing Upstream-Status
The patch was introduced in:
https://git.openembedded.org/meta-openembedded/commit/?h=scarthgap&id=3f9623aaefed5b070294a0d52a54a50ea709b389
and it's the only one in missing it (as default ERROR_QA in scarthgap
doesn't have patch-status).

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:00:45 +05:30
Gyorgy Sarvari 83e564a365 nginx: patch CVE-2026-1642
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-1642

Pick the commit that was identified by the reporter on the oss-sec
mailing list[1]

[1]: https://www.openwall.com/lists/oss-security/2026/02/05/1

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:00:44 +05:30
Vijay Anusuri 8c9f62ea1b postgresql: upgrade 16.11 -> 16.12
License-Update: Update license year to 2026

Includes fix for CVE-2026-2003 CVE-2026-2004 CVE-2026-2005 CVE-2026-2006

Changelog:
https://www.postgresql.org/docs/release/16.12/

Refreshed 0003-configure.ac-bypass-autoconf-2.69-version-check.patch for
16.12

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:00:44 +05:30
Ankur Tyagi c9662d5451 dovecot: ignore CVE-2025-30189
Vulnerable versions are 2.4.0, 2.4.1 according to the full disclosure[1]

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-30189

[1] https://seclists.org/fulldisclosure/2025/Oct/29

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:00:40 +05:30
Geoff Parker f243689cda python3-m2crypto: fix python3-m2crypto-native do_configure:prepend()
The recent workaround for https://github.com/swiftlang/swift/issues/69311
breaks python3-m2crypto-native, with error about missing e_os2.h file in
recipe-sysroot-native.

Apply do_configure:prepend to class-target only to fix.

Signed-off-by: Geoff Parker <geoffrey.parker@arthrex.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c1693752d7)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 12:36:08 +05:30
Yoann Congal 50292b4331 polkit: Switch PAM files to common-*
Add a new OS option to polkit meson: "openembedded" and use this to
set PAM include to common-* which matches OE-Core libpam.

This also may fix a non-reproducibility since polkit meson system tried
to detect the host (compiling) OS and changed PAM config from the
detected value.

Fixes: https://github.com/openembedded/meta-openembedded/issues/860

Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9bdff5feb6)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 10:37:54 +05:30
Daniel Klauer 26fe9ce9f1 nbench-byte: Fix sysinfo generation in parallel build
The project Makefile uses a script (sysinfo.sh) to non-atomically generate
two .c files (sysinfo.c, sysinfoc.c) which are then included in the build.
Since the script always overwrites both .c files, the Makefile should only
invoke it once, not twice in parallel. Otherwise the .c files may be
corrupted and cause random build failures in parallel builds.

Requires at least GNU make 4.3, for Grouped Targets support [1].

[1] https://lists.gnu.org/archive/html/info-gnu/2020-01/msg00004.html

Reviewed-by: Silvio Fricke <silvio.fricke@gin.de>
Signed-off-by: Daniel Klauer <daniel.klauer@gin.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit add2d94ab7)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 10:27:47 +05:30
Hongxu Jia ec0469748b nodejs: fix gcc compile failed for 32 bit arm target
Use gcc to compile failed for 32 bit arm target

$ echo 'MACHINE = "qemuarm"' >> conf/local.conf
$ bitbake nodejs
...
 2645 |         );
      |         ^
../deps/llhttp/src/llhttp.c:2643:11: error: incompatible type for argument 1 of 'vandq_u16'
 2643 |           vcgeq_u8(input, vdupq_n_u8(' ')),
      |           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |           |
      |           uint8x16_t
...

Use '-flax-vector-conversions' to permit conversions between vectors
with differing element types or numbers of subparts

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit fe7aaabb1c)

Adapted to Scarthgap

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 15:59:04 +05:30
Gyorgy Sarvari 3f9623aaef nodejs: upgrade 20.18.2 -> 20.20.0
Part of nodejs LTS release, contains many security- and bugfixes.

Ptests passed successfully.

Full changelog:
https://github.com/nodejs/node/blob/v20.x/doc/changelogs/CHANGELOG_V20.md

Dropped patches that are included in this release.

Added 0001-Revert-stop-using-deprecated-ares_query.patch:
Nodejs has changed a deprecated c-ares call to a newer version,
however this newer method is not available in the c-ares shipped
in meta-oe, and it failed to compile (the new call was added to c-ares
in v1.28.0, but Scarthgap comes with v1.27.0). This patch reverts this
failing commit completely. Based on the PR/issue discussions, the
only goal was to eliminate deprecation warnings. There seem to be
no logic change from this change.

License-Update:
- The license file was regenerated, to ensure it is up to date.
  It contains all licenses from all vendored dependecies. This
  resulted in adding nlohmann-json license to the file, which
  is MIT. There were already other MIT dependencies, so this
  didn't change the overall license declaration.
- base64 related license was removed, because base64 code was
  simplified, so it doesn't depend on this library anymore.
  (It was BSD-2-Clause, but there ar other dependencies using
  this license, so the overall license didn't change)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 15:58:49 +05:30
Gyorgy Sarvari 11dfc31f83 gnome-commander: upgrade 1.16.1 -> 1.16.2
Drop patch that is included in this version.

Changes:
 - Fix double g_error_free call in remote_close_callback
 - Fix build with taglib 2.0
 - Set project gnu++11 c++ language version explicitely

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:13 +05:30
Gyorgy Sarvari 6d53b607b2 python3-django: upgrade 4.2.27 -> 4.2.28
Contains fixes for CVE-2025-13473, CVE-2025-14550, CVE-2026-1207,
CVE-2026-1285, CVE-2026-1287 and CVE-2026-1312

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:13 +05:30
Gyorgy Sarvari 7e98075d47 tigervnc: mark CVE-2024-0408 and CVE-2024-0409 patched
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-0408
https://nvd.nist.gov/vuln/detail/CVE-2024-0409

Both of these vulnerabilities were fixed[1][2] in xserver 21.1.11,
just mark them patched.

[1]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/8d825f72da71d6c38cbb02cf2ee2dd9e0e0f50f2
[2]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/a4f0e9466f3bc7073a8f0c28a581211c2d7adf0e

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:13 +05:30
Wang Mingyu b64c7c68a0 gnome-text-editor: upgrade 46.1 -> 46.3
Changelog:
===========
- Fix a trivial build error when -Werror=implicit-function-declaration is
- specified.
- Fix an issue with cancellation of closing a page
- Try harder to ensure a buffer disposes associated resources when
  the page is closed.
- Translation updates

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0562755261)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:13 +05:30
Wang Mingyu fe4ef3f878 eog: upgrade 45.3 -> 45.4
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 4181632bc1)

Changes:
- Regenerate thumbnails on save
- Use "fast" content type as fallback if normal content type
  is unavailable
- docs: Replace dead links to developer-old.gnome.org (Andre Klapper)
- Updated translations

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:13 +05:30
Markus Volk acebc13ce7 gnome-disk-utility: update 46.0 -> 46.1
46.1 - September 03, 2024
=========================

Alexandre Franke:
 * metainfo: fix URLs
 * metainfo: replace screenshots

Athmane MOKRAOUI:
 * Add Kabyle translation

Updated translations:
 * Alexandre Franke (fr), Anders Jonsson (sv), Andi Chandler (en_GB),
   Andika Triwidada (id), Artur S0 (ru), Asier Sarasua Garmendia (eu),
   Athmane MOKRAOUI (kab), Aurimas Černius (lt), Balázs Úr (hu), Boyuan
   Yang (zh_CN), Danial Behzadi (fa), Daniel Rusek (cs), Daniel Șerbănescu
   (ro), Efstathios Iosifidis (el), Ekaterine Papava (ka), Guntupalli
   Karunakar (hi), Hugo Carvalho (pt), Jordi Mas i Hernandez (ca), Juliano de
   Souza Camargo (pt_BR), Jürgen Benvenuti (de), Martin (sl), Matej Mrenica
   (sk), Piotr Drąg (pl), Rachida SACI (kab), Sabri Ünal (tr), Seong-ho Cho
   (ko), Vasil Pupkin (be), Vincent Chatelain (fr), Yaron Shahrabani (he),
   Yuri Chornoivan (uk)

Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8233ca7595)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:13 +05:30
Gyorgy Sarvari c7e6992a39 gnome-tweaks: upgrade 40.0 -> 40.10
Changes (note that there were no intermediate releases):

40.10:
This release includes a fix for the broken GNOME Extensions link and
several translation updates.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari 6c2b2225c5 nautilus: upgrade 45.1 -> 45.2.1
Changes:
45.2.1:
* Fix a crash in sidebar code
* Fix build without optional cloudproviders dependency

45.2:
* Bugfixes:
  - Don't crash when reconnecting to remove server
  - Actually detect unmount on some non-native mounts
  - Don't crash on image properties
  - Allow types and sizes in Properties to expand
  - Don't corrupt toast messages
* Translation updates

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari 3f350dbe1a gnome-shell-extensions: upgrade 46.1 -> 46.4
Changes:
46.4:
* Update template CI images to fix release pipeline

46.3:
* places-menu: Fix a11y labelling
* places-menu: Fix opening drives with mount operations
* window-list: Fix hiding when entering overview with gestures
* workspace-indicator: Only show previews of regular windows
* Misc. bug fixes and cleanups

46.2:
* apps-menu: Fix a11y of category labels
* window-list: Fix long-press support
* Misc. bug fixes and cleanups

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari 82e02ae980 gnome-bluetooth: upgrade 46.0 -> 46.2
Changes:
ver 46.2:
This version contains a fix for the devices page staying empty on load
in some circumstances, as well as translation updates.

ver 46.1:
This version contains translation updates and a bug fix for some device
icons not appearing correctly.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari cdde87bb97 mutter: fix profiler PACKAGECONFIG
In case "profiler" PACKAGECONFIG is enabled, the build fails with
the following error:

| ninja: error: '/usr/share/dbus-1/interfaces/org.gnome.Sysprof3.Profiler.xml', needed by 'src/meta-dbus-sysprof3-profiler.c', missing and no known rule to make it

meson.build script is looking explicitly for a required file using the
sysroot of the build system instead of ${RECIPE_SYSROOT}. To avoid this,
patch meson.build to prefix this path with ${RECIPE_SYSROOT}.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit ead8f7b327)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari fe7623f3bb mutter: upgrade 46.1 -> 46.9
Contains many bugfixes: https://gitlab.gnome.org/GNOME/mutter/-/blob/46.9/NEWS

46.9
====
* Support presentation-time version 2
* Honor wl_surface.offset on cursor surfaces
* Fix crash

46.8
====
* Use BT709 coefficients and limited range for YUV conversion by defaults
* Also request high priority secondary EGL context
* Fix applying initial _NET_WM_WINDOW_OPACITY on Xwayland
* Misc. bug fixes and cleanups

46.7
====
* Default to high thread instead of realtime priority for KMS thread
* Fix updating cursor immediately when starting window drag
* Prefer GPUs with built-in panels connected as primary GPU
* Fix cursor glitches when using virtual monitors
* Ensure frame events are sent for cursor surfaces
* Allow BGRX8888 format on big endian
* Fix touchscreen drag-and-drop on wayland
* Fixed crashes
* Misc. bug fixes and cleanups

46.6
====
* Fix grabbing tablet devices
* Fix explicit sync with virtual monitors w/o pipewire streams
* Improve detecting preferred primary devices
* Fixed crashes
* Misc. bug fixes and cleanups

46.5:
* Fix drag and drop between X11 and wayland clients
* Fix drag and drop from grabbing popups
* Fix EGLDevice support
* Fix frozen cursor on some hybrid machines
* Fix touch window dragging with pointer lock enabled
* Fix propagating tablet device removals to clients
* Fix tablet input in maximized windows
* Reduce damage on window movement
* Fix frozen cursor after suspend
* Fix using modifiers on multi-GPU setups
* Fixed crashes
* Misc. bug fixes and cleanups

46.4:
* Fix nested popovers on wayland
* Misc. bug fixes and cleanups

46.3.1:
* Fix visibility of Xwayland windows
* Misc. bug fixes

46.3:
* Fix performance issues with second virtual monitor
* Fix missing unmap animation of some windows
* Fix placement/resizing regression
* Fix possible out of sync primary selections and clipboard
* Fix ibus support in popups
* Fix hardware accelerated rendering when headless
* Add back support for legacy X11 cursor themes
* Fix preedit offsets
* Use character offsets to specify surrounding text
* Don't force titlebar on screen on all interactive resizes
* Fixed crashes
* Misc. bug fixes and cleanups

46.2:
* Fix hardware cursor with non-atomic KMS drivers
* Fix night light state getting stuck on monitor changes
* Fix sending preferred buffer transform
* Fix key press events with immediate release being ignored
* Fix unsetting clipboard on screen lock
* Fix wrong input region of undecorated X11 windows
* Fix windows potentially shrinking unexpectedly on configure
* Fix popup menus sometimes closing immediately
* Fixed crashes
* Misc. bug fixes and cleanups

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Wang Mingyu 01f91cef8d gnome-keyring: upgrade 46.1 -> 46.2
Changelog:
=========
* Don't use 'bool' as variable name
* autogoo: replace AC_HELP_STRING with AS_HELP_STRING
* Default "automatically unlock" checkbox to false
* build: Fix distcheck with systemd unit
* rpc-layer: Fix undefined reference to g_strlcpy
* Updated translations

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0e55ce901a)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Khem Raj 4808353b95 libgweather4: Upgrade to 4.4.4
- Fix deprecation warnings [!300]
- Fix introspection annotation for async functions [!318]
- Plug some memory leaks [!321]
- Translation updates

Use GI_TYPELIB_PATH to point to typlib paths in target sysroot

Fixes
| FAILED: data/Locations.bin
| /mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux-musl/libgweather4/4.4.4/libgweather-4.4.4/build-aux/meson/gen_locations_variant.py ../libgweather-4.4.4/data/Locations.xml data/Locations.bin
| Traceback (most recent call last):
|   File "/mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux-musl/libgweather4/4.4.4/libgweather-4.4.4/build-aux/meson/gen_locations_variant.py", line 7, in <module>
|     from gi.repository import GLib
|   File "/mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux-musl/libgweather4/4.4.4/recipe-sysroot-native/usr/lib/python3.13/site-packages/gi/importer.py", line 133, in create_module
|     raise ImportError('cannot import name %s, '
|                       'introspection typelib not found' % namespace)
| ImportError: cannot import name GLib, introspection typelib not found

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Andreas Müller <schnitzeltony@gmail.com>
(cherry picked from commit 054716edca)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Wang Mingyu 35c2478920 tracker-miners: upgrade 3.7.2 -> 3.7.3
0001-fix-reproducibility.patch
refreshed for 3.7.3

Changelog:
============
* Fix possible crashes handling live changes to extractor
  configuration
* Make it easier to run tracker-extract-3 under Valgrind
* Plug a leak on misdetected JPEG files
* Many further metadata extraction tests

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9cc20a0203)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30