mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-13 17:39:57 +00:00
Code Issues Projects Releases Wiki Activity
24,342 Commits 64 Branches 0 Tags
631e0ac2f08dc3db4554f9602e7da257929e8107
Commit Graph

11161 Commits

Author SHA1 Message Date
Hitendra Prajapati 631e0ac2f0 postgresql: upgrade 14.20 -> 14.21 
It contains Security fixes for CVE-2026-2003, CVE-2026-2004,
CVE-2026-2005, CVE-2026-2006 and CVE-2026-2007.
It also contains other bug fixes and for more details refer Release note.

0001-configure.ac-bypass-autoconf-2.69-version-check.patch
refreshed for 14.21

Release notes: https://www.postgresql.org/docs/release/14.21/

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-02-26 13:36:29 +01:00
Gyorgy Sarvari 8a598a2bc9 poppler: mark CVE-2022-38171 patched 
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-38171

This is the same as CVE-2021-30860, but that one was primarily filed
against Apple software (and some other related projects).

The patch that fixes this vulenrability is already added to the recipe,
just extend its CVE tag

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-02-15 15:30:54 +01:00
Gyorgy Sarvari b54893d226 mercurial: ignore CVE-2022-43410 
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-43410

The vulnerability affects only the Mercurial Jenkins plugin, which
is a different project. This CVE can be ignored in this recipe.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-02-15 15:30:54 +01:00
Vijay Anusuri 518ff6ef48 mariadb: Fix CVE-2025-30693 
Upstream-Status: Backport from https://github.com/MariaDB/server/commit/1c9f64e54ffb109bb6cf6a189e863bfa54e46510

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-02-11 11:30:12 +01:00
Gyorgy Sarvari 8e5a4c1a26 tigervnc: mark CVE-2024-0408 and CVE-2024-0409 patched 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-0408
https://nvd.nist.gov/vuln/detail/CVE-2024-0409

Both of these vulnerabilities were fixed[1][2] in xserver 21.1.11,
just mark them patched.

[1]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/8d825f72da71d6c38cbb02cf2ee2dd9e0e0f50f2
[2]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/a4f0e9466f3bc7073a8f0c28a581211c2d7adf0e

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-02-10 00:16:53 +01:00
Gyorgy Sarvari 84457b29af tigervnc: ignore CVE-2025-26594...26601 
Ignore the following CVEs: CVE-2025-26594, CVE-2025-26595, CVE-2025-26596,
CVE-2025-26597, CVE-2025-26598, CVE-2025-26599, CVE-2025-26600, CVE-2025-26601

Details:
https://nvd.nist.gov/vuln/detail/CVE-2025-26594
https://nvd.nist.gov/vuln/detail/CVE-2025-26595
https://nvd.nist.gov/vuln/detail/CVE-2025-26596
https://nvd.nist.gov/vuln/detail/CVE-2025-26597
https://nvd.nist.gov/vuln/detail/CVE-2025-26598
https://nvd.nist.gov/vuln/detail/CVE-2025-26599
https://nvd.nist.gov/vuln/detail/CVE-2025-26600
https://nvd.nist.gov/vuln/detail/CVE-2025-26601

TigerVNC compiles its own xserver, this is why these CVEs are associated
with it - despite the vulnerabilities being in xserver.

All of these vulnerabilities were fixed by the same PR[1], which has
been part of xserver since version 21.1.16 (the currently used xserver
version in TigerVNC is 21.1.18).

Due to this, ignore these vulnerabilities, and just mark them as patched.

[1]: https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 4924e89bb7)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-02-10 00:16:43 +01:00
Gyorgy Sarvari e51b233d2e tigervnc: ignore CVE-2023-6478 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-6478

TigerVNC compiles its own xserver, this is why this CVE is associated
with it - despite the vulnerability being in xserver.

The vulnerability was fixed by [1] (from the nvd report), which has been
backported[2] to the xserver version used by the recipe - so ignore the
CVE, since it's patched already.

[1]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632
[2]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/58e83c683950ac9e253ab05dd7a13a8368b70a3c

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 62a78f8ba7)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-02-10 00:16:33 +01:00
Gyorgy Sarvari 03a67156a4 tigervnc: ignore CVE-2023-6377 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-6377

TigerVNC compiles its own xserver, this is why this CVE is associated
with it - despite the vulnerability being in xserver.

The vulnerability was fixed by [1] (from the nvd report), which has been
backported[2] to the xserver version used by the recipe - so ignore the
CVE, since it's patched already.

[1]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd
[2]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/a7bda3080d2b44eae668cdcec7a93095385b9652

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f691f2178b)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-02-10 00:16:21 +01:00
Gyorgy Sarvari c0766dbf4b tigervnc: sync xserver component with oe-core 
oe-core has a newer version of xserver than this recipe used to compile
TigerVNC with. This recipe updates xserver to the same version, 21.1.18.

TigerVNC only started to support this xserver version 2 versions later,
with 1.13. Due to this 3 commits were backported that add the missing
changes.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-02-10 00:16:12 +01:00
Gyorgy Sarvari a817392c05 faad2: patch CVE-2021-32276 
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-32276

Pick the patches from the PR[1] that resolved the issue[2] referenced by
the NVD advisory.

[1]: https://github.com/knik0/faad2/pull/66
[2]: https://github.com/knik0/faad2/issues/58

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-02-01 15:30:31 +01:00
Gyorgy Sarvari 44247b3cb0 libass: patch CVE-2020-24994 
Details: https://nvd.nist.gov/vuln/detail/CVE-2020-24994

Backport the commit that is referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari bcac2eef54 gpsd: patch CVE-2025-67268 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-67268

Pick the patch that is referenced by the NVD advisory.

The original commit also contains a lot of commenting style
changes (// vs /* */) and whitespace changes which were removed from
the backport.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 510ac35c7d libvncserver: patch CVE-2020-29260 
Details: https://nvd.nist.gov/vuln/detail/CVE-2020-29260

Pick the patch referenced by the NVD report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Wang Mingyu 6c5f2e9e50 sanlock: upgrade 3.8.4 -> 3.8.5 
setuptools.patch
removed since it's included in 3.8.5.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit cc532b9d4e)

Shortlog:
python: Replace distutils with setuptools
sanlock: fix memory leak of lockspace renewal_history
sanlock: fix pthread_create error check
Revert "sanlock: Shrink thread pool when there is no work"
sanlock: fix pthread_create error paths
sanlock: acquire should ignore unused options str
sanlock: use helper to set max_sectors_kb

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 5e331f8434 freerdp: patch CVE-2024-32658 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32658

Backport the patch that was marked to resolve this issue by the
relevant Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vpv3-m3m9-4c2v

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari eb9c9730a4 freerdp: patch CVE-2024-32460 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32460

Backport the patch that is marked to resolve this vulnerability
by the relevant Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4rr8-gr65-vqrr

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari fe05b2e186 freerdp: patch CVE-2024-32459 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32459

Pick the patch that is marked to resolve this vulnerability by
the relevant Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cp4q-p737-rmw9

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 8bce3cf874 freerdp: patch CVE-2024-32458 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32458

Pick the patch that is marked to resolve this vulnerbility by the
relevant Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vvr6-h646-mp4p

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari dda2b96cb2 freerdp: mark CVE-2024-32041 patched 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32041

Both the relevant Github Advisory[1] and Debian[2] states that the
same patch fixes this vulnerability as CVE-2024-32039.

Therefore add this CVE ID to the same patch's CVE tag.

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5r4p-mfx2-m44r
[2]: https://security-tracker.debian.org/tracker/CVE-2024-32041

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 23a46eae5f freerdp: patch CVE-2024-32040 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32040

Pick the patch that is marked to resolve this vulnerability, from
the related Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-23c5-cp23-h2h5

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari cebeb9b1a6 freerdp: patch CVE-2024-32039 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32039

Pick the commit that is marked to resolve this vulerability, mentioned
by the Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5h8-7j42-j4r9

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 86566fac39 freerdp: patch CVE-2024-22211 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-22211

Pick the patch that is referenced by the NVD report as the solution.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 99ffae0ed0 freerdp: patch CVE-2023-40589 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-40589

Pick the patch that was identified[1] by Debian to solve the issue
on the 2.x branch.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-40589

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari d3eea640d3 freerdp: add ptest support 
The tests take about 50s to execute on my machine.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari bb987740aa freerdp: patch CVE-2023-40569 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-40569

Pick the patch that was identified[1] by Debian as the solution.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-40569

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari d4e1c145e6 freerdp: patch CVE-2023-40181 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-40181

Pick the patch that was identified[1] by Debian as the solution.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-40181

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari c9affa4bd5 freerdp: patch CVE-2023-39353 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-39353

Pick the patch that was identified[1] by Debian as the solution.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-39353
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari c793926ade freerdp: patch CVE-2023-39352 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-39352

Backport the commit that was identified[1] by Debian as the solution.

Note: WINPR_ASSERT macro calls have been changed to assert calls, as this
macro doesn't exist yet in this version. Looking at the implementation[2],
it is basically an assert call with a bit verbose logs.
Even though the original implementation also defines a no-op version, the
assert version is enabled by default.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-39352
[2]: https://github.com/FreeRDP/FreeRDP/blob/2.11.0/winpr/include/winpr/assert.h#L31

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari f4a93a4c96 freerdp: patch CVE-2023-39351 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-39351

Pick the patch that is mentioned by Debian[1] to solve the problem.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-39351

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 9e67ae18b0 freerdp: patch CVE-2023-39350 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-39350

Pick the patch that was identified[1] by Debian as the solution.
Note that the NVD report also references a commit as a patch - however
that seems to be incorrect. Although the NVD patch also solves a
vulnerability, it solves a different CVE (CVE-2023-39353), not this.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-39350

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari f0e689ff4d freerdp: patch CVE-2022-39320 
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-39320

Take the patch that Debian has determined[1] to solve the issue.

[1]: https://security-tracker.debian.org/tracker/CVE-2022-39320

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 8cea479b35 freerdp: mark CVE-2022-39317 patched 
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-39317

Both Ubuntu[1] and Red Hat[2] confirms that this vulenrability is
fixed by the same patch as CVE-2022-39316.

Therefore add this CVE ID to the patch's tag also.

[1]: https://ubuntu.com/security/CVE-2022-39317
[2]: https://bugzilla.redhat.com/show_bug.cgi?id=2143643

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari af8f2af56b freerdp: patch CVE-2022-39282 
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-39282

Pick the patch that's description matches the CVE description.
(Debian also considers the same patch[1] the fix)

[1]: https://security-tracker.debian.org/tracker/CVE-2022-39282

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari ee510136eb freerdp: patch CVE-2022-24883 
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-24883

Pick the patch that is mentioned in teh NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Ankur Tyagi f4ed05a423 influxdb: ignore CVE-2024-30896 
As mentioned in the comment[1], vulnerability is in
/api/v2/authorizations API which only exists in 2.x, 1.x is not affected.

Details: https://nvd.nist.gov/vuln/detail/CVE-2024-30896

[1] https://github.com/influxdata/influxdb/issues/24797#issuecomment-2514690740

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 2f1d7a8597)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:29 +01:00
Gyorgy Sarvari b1794b6239 boinc-client: mark CVE-2013-2018 patched 
Details: https://nvd.nist.gov/vuln/detail/CVE-2013-2018

According to oss-security email[1], version 7.0.45 included
the fixes[2][3][4]

[1]: https://www.openwall.com/lists/oss-security/2013/04/29/11
[2]: https://github.com/BOINC/boinc/commit/6e205de096da83b12ffb2f0183b43e51261eb0c4
[3]: https://github.com/BOINC/boinc/commit/e8d6c33fe158129a5616e18eb84a7a9d44aca15f
[4]: https://github.com/BOINC/boinc/commit/ce3110489bc139b8218252ba1cb0862d69f72ae3

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 2a78ad8813)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-30 18:59:28 +01:00
Gyorgy Sarvari 4ccb9bf4ac raptor2: patch CVE-2024-57823 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-57822

Pick the patch mentioned in the related github issue[1].
The issue contains fixes for 2 issues, but only the second
patch is related to this vulnerability.

[1]: https://github.com/dajobe/raptor/issues/70

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-20 18:22:02 +01:00
Gyorgy Sarvari 542c269b5a raptor2: patch CVE-2024-57822 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-57822

Pick the patch mentioned in the related github issue[1].
The issue contains fixes for 2 issues, but only the first
patch is related to this vulnerability.

[1]: https://github.com/dajobe/raptor/issues/70

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-20 18:22:01 +01:00
Gyorgy Sarvari f3af7f8f02 raptor2: patch CVE-2020-25713 
Details: https://nvd.nist.gov/vuln/detail/CVE-2020-25713

Pick the git cmmit that is mentioned as a solution in the related bug[1]
from the NVD advisory.

[1]: https://bugs.librdf.org/mantis/view.php?id=650

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-20 18:22:00 +01:00
Gyorgy Sarvari 7b4d42c640 raptor2: patch CVE-2017-18926 
Details: https://nvd.nist.gov/vuln/detail/CVE-2017-18926

NVD advisory mentions the original announcement on oss-security
mailing list[1]. This mentions a bug link[2] related to this
vulnerability. The bug mentions the revision of the fix - pick
that patch from the project's git repository.

[1]: https://www.openwall.com/lists/oss-security/2017/06/07/1
[2]: https://bugs.librdf.org/mantis/view.php?id=617

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-20 18:21:58 +01:00
Peter Marko 7d4507f226 libsodium: patch CVE-2025-69277 
Pick patch per [1].

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-69277

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-12 13:48:02 +01:00
Jeroen Hofstee ab68fc6dd9 php: ignore CVE-2024-3566 
CVE-2024-3566 only effects Microsoft Windows.

Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d68c56e1ed)

Adapted to Kirkstone.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari 80ed7802ad spitools: upgrade 1.0.1 -> 1.0.2 
This is a bugfix release, with some ioctl handling fixes.

Changelog:
- Adjust the handling of SPI_IOC_RD_LSB_FIRST ioctl call
- Parameter for SPI_IOC_WR_LSB_FIRST ioctl is {0, 1}.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari bd17a0d132 tree: upgrade 2.0.2 -> 2.0.4 
Changelog:
2.0.4:
- Fix missing comma in JSON output.

2.0.3:
- Fix segfault when filelimit is used and tree encounters a directory it
  cannot enter.
- Use += when assigning CFLAGS and LDFLAGS in the Makefile allowing
  them to be modified by environment variables during make. (Ben Brown)
  Possibly assumes GNU make.
- Fixed broken -x option (stops recursing.)
- Fix use after free (causing segfault) for dir/subdir in list.c
- Fixes for .gitignore functionality
  - Fixed * handing in patmatch. Worked almost like ** before, now properly
    stops at /'s.  These issues were the result of forgetting that patmatch()
    was just to match filenames to patterns, not paths.
  - Patterns starting with / are actually relative to the .gitignore file,
    not the root of the filesystem, go figure.
  - Patterns without /'s in .gitignore apply to any file in any directory
    under the .gitignore, not just the .gitignore directory
- Remove "All rights reserved" from copyright statements.  A left-over from
  trees original artistic license.
- Add in --du and --prune to --help output
- Fixed segfault when an unknown directory is given with -X
- Fixed output up for -X and -J options.
- Remove one reference to strnlen which isn't necessary since it may not
  be available on some OS's.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari 3f9744d6b2 usb-modeswitch: upgrade 2.6.0 -> 2.6.2 
Changelog:
2.6.2:
- Bug in C code (with gcc 1.5) fixed

2.6.1:
- Wrapper now handles devices with non-continuous interface numbering:
  www.draisberghof.de/usb_modeswitch/bb/viewtopic.php?f=2&t=2915&p=19605
- catch error with retrieving the active configuration, exit gracefully:
  https://bugs.launchpad.net/bugs/1880191

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari ecf59eb1a1 xdg-user-dirs: upgrade 0.17 -> 0.18 
Changelog:
- Fixed minor leak
- Documentation fixes
- Updated translations

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Sanjay Chitroda 672f5f28e8 recipes-core/toybox: Switch SRC_URI to HTTPS for reliable fetch 
The upstream site (landley.net) serves inconsistent content when using HTTP,
causing checksum mismatches during do_fetch. Using HTTPS ensures stable
downloads and resolves checksum failures.

Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari 3dc63bce4d nodejs: ignore CVE-2024-36137 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-36137

The vulnerability affects the permission model, which was introduced[1]
in v20 - the recipe version isn't vulerable yet.

[1]: https://github.com/nodejs/node/commit/00c222593e49d817281bc88a322f41f8dca95885

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari e88e353f30 nodejs: ignore CVE-2024-3566 and CVE-2024-36138 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-3566
https://nvd.nist.gov/vuln/detail/CVE-2024-36138

This vulnerabilities affect Windows only.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Peter Marko 9e38c37a62 sassc: ignore CVE-2022-43357 
This CVE is fixed in current libsass recipe version.
So wrapper around it will also not show this problem.
It's usual usecase is to be statically linked with libsass which is
probably the reason why this is listed as vulnerable component.

[1] links [2] as issue tracker which points to [3] as fix.
[4] as base repository for the recipe is not involved and files from [3]
    are not present in this repository.

[1] https://nvd.nist.gov/vuln/detail/CVE-2022-43357
[2] https://github.com/sass/libsass/issues/3177
[3] https://github.com/sass/libsass/pull/3184
[4] https://github.com/sass/sassc/

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 576b84263b)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)

Kirkstone has also the fixed libsass version (3.6.6), the CVE can
be considered fixed.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00