Commit Graph

30893 Commits

Author SHA1 Message Date
Anuj Mittal
6ce6448ebc README: update listed maintainer
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:58:47 +05:30
Anil Dongare
2160609b5b wireshark 4.2.14: Fix CVE-2026-0962
Upstream Repository: https://gitlab.com/wireshark/wireshark.git

Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2026-0962
Type: Security Fix
CVE: CVE-2026-0962
Score: 6.5
Patch: https://gitlab.com/wireshark/wireshark/-/commit/825b83e1ed14

Signed-off-by: Anil Dongare <adongare@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:45:44 +05:30
Peter Marko
4e4ad54c9a fcgi: add follow-up patch for CVE-2025-23016
New release [1] added additional fir for this CVE.

[1] https://github.com/FastCGI-Archives/fcgi2/releases/tag/2.4.7

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:00:46 +05:30
Tafil Avdyli
c88db38ad6 python3-pybind11-json: fix Targets.cmake trying to reference host
The resulting pybind11_jsonTargets.cmake in the dev-package adds an
absolute path to python include directories in the target properties:

  set_target_properties(pybind11_json PROPERTIES
    INTERFACE_INCLUDE_DIRECTORIES "/usr/include/python3.13;${_IMPORT_PREFIX}/include"
  )

The patch removes ${PYTHON_INCLUDE_DIRS} which is set by pybind11 from
set_target_properties to remove the poisonous host path.

Signed-off-by: Tafil Avdyli <tafil@tafhub.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0332dae9bb)
Signed-off-by: Tafil Avdyli <tafil@tafhub.de>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:00:45 +05:30
Martin Jansa
560eef1dc2 nodejs: add missing Upstream-Status
The patch was introduced in:
https://git.openembedded.org/meta-openembedded/commit/?h=scarthgap&id=3f9623aaefed5b070294a0d52a54a50ea709b389
and it's the only one in missing it (as default ERROR_QA in scarthgap
doesn't have patch-status).

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:00:45 +05:30
Gyorgy Sarvari
83e564a365 nginx: patch CVE-2026-1642
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-1642

Pick the commit that was identified by the reporter on the oss-sec
mailing list[1]

[1]: https://www.openwall.com/lists/oss-security/2026/02/05/1

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:00:44 +05:30
Vijay Anusuri
8c9f62ea1b postgresql: upgrade 16.11 -> 16.12
License-Update: Update license year to 2026

Includes fix for CVE-2026-2003 CVE-2026-2004 CVE-2026-2005 CVE-2026-2006

Changelog:
https://www.postgresql.org/docs/release/16.12/

Refreshed 0003-configure.ac-bypass-autoconf-2.69-version-check.patch for
16.12

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:00:44 +05:30
Ankur Tyagi
c9662d5451 dovecot: ignore CVE-2025-30189
Vulnerable versions are 2.4.0, 2.4.1 according to the full disclosure[1]

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-30189

[1] https://seclists.org/fulldisclosure/2025/Oct/29

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 13:00:40 +05:30
Geoff Parker
f243689cda python3-m2crypto: fix python3-m2crypto-native do_configure:prepend()
The recent workaround for https://github.com/swiftlang/swift/issues/69311
breaks python3-m2crypto-native, with error about missing e_os2.h file in
recipe-sysroot-native.

Apply do_configure:prepend to class-target only to fix.

Signed-off-by: Geoff Parker <geoffrey.parker@arthrex.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c1693752d7)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 12:36:08 +05:30
Yoann Congal
50292b4331 polkit: Switch PAM files to common-*
Add a new OS option to polkit meson: "openembedded" and use this to
set PAM include to common-* which matches OE-Core libpam.

This also may fix a non-reproducibility since polkit meson system tried
to detect the host (compiling) OS and changed PAM config from the
detected value.

Fixes: https://github.com/openembedded/meta-openembedded/issues/860

Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9bdff5feb6)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 10:37:54 +05:30
Daniel Klauer
26fe9ce9f1 nbench-byte: Fix sysinfo generation in parallel build
The project Makefile uses a script (sysinfo.sh) to non-atomically generate
two .c files (sysinfo.c, sysinfoc.c) which are then included in the build.
Since the script always overwrites both .c files, the Makefile should only
invoke it once, not twice in parallel. Otherwise the .c files may be
corrupted and cause random build failures in parallel builds.

Requires at least GNU make 4.3, for Grouped Targets support [1].

[1] https://lists.gnu.org/archive/html/info-gnu/2020-01/msg00004.html

Reviewed-by: Silvio Fricke <silvio.fricke@gin.de>
Signed-off-by: Daniel Klauer <daniel.klauer@gin.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit add2d94ab7)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-25 10:27:47 +05:30
Hongxu Jia
ec0469748b nodejs: fix gcc compile failed for 32 bit arm target
Use gcc to compile failed for 32 bit arm target

$ echo 'MACHINE = "qemuarm"' >> conf/local.conf
$ bitbake nodejs
...
 2645 |         );
      |         ^
../deps/llhttp/src/llhttp.c:2643:11: error: incompatible type for argument 1 of 'vandq_u16'
 2643 |           vcgeq_u8(input, vdupq_n_u8(' ')),
      |           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |           |
      |           uint8x16_t
...

Use '-flax-vector-conversions' to permit conversions between vectors
with differing element types or numbers of subparts

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit fe7aaabb1c)

Adapted to Scarthgap

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 15:59:04 +05:30
Gyorgy Sarvari
3f9623aaef nodejs: upgrade 20.18.2 -> 20.20.0
Part of nodejs LTS release, contains many security- and bugfixes.

Ptests passed successfully.

Full changelog:
https://github.com/nodejs/node/blob/v20.x/doc/changelogs/CHANGELOG_V20.md

Dropped patches that are included in this release.

Added 0001-Revert-stop-using-deprecated-ares_query.patch:
Nodejs has changed a deprecated c-ares call to a newer version,
however this newer method is not available in the c-ares shipped
in meta-oe, and it failed to compile (the new call was added to c-ares
in v1.28.0, but Scarthgap comes with v1.27.0). This patch reverts this
failing commit completely. Based on the PR/issue discussions, the
only goal was to eliminate deprecation warnings. There seem to be
no logic change from this change.

License-Update:
- The license file was regenerated, to ensure it is up to date.
  It contains all licenses from all vendored dependecies. This
  resulted in adding nlohmann-json license to the file, which
  is MIT. There were already other MIT dependencies, so this
  didn't change the overall license declaration.
- base64 related license was removed, because base64 code was
  simplified, so it doesn't depend on this library anymore.
  (It was BSD-2-Clause, but there ar other dependencies using
  this license, so the overall license didn't change)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 15:58:49 +05:30
Gyorgy Sarvari
11dfc31f83 gnome-commander: upgrade 1.16.1 -> 1.16.2
Drop patch that is included in this version.

Changes:
 - Fix double g_error_free call in remote_close_callback
 - Fix build with taglib 2.0
 - Set project gnu++11 c++ language version explicitely

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:13 +05:30
Gyorgy Sarvari
6d53b607b2 python3-django: upgrade 4.2.27 -> 4.2.28
Contains fixes for CVE-2025-13473, CVE-2025-14550, CVE-2026-1207,
CVE-2026-1285, CVE-2026-1287 and CVE-2026-1312

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:13 +05:30
Gyorgy Sarvari
7e98075d47 tigervnc: mark CVE-2024-0408 and CVE-2024-0409 patched
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-0408
https://nvd.nist.gov/vuln/detail/CVE-2024-0409

Both of these vulnerabilities were fixed[1][2] in xserver 21.1.11,
just mark them patched.

[1]: 8d825f72da
[2]: a4f0e9466f

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:13 +05:30
Wang Mingyu
b64c7c68a0 gnome-text-editor: upgrade 46.1 -> 46.3
Changelog:
===========
- Fix a trivial build error when -Werror=implicit-function-declaration is
- specified.
- Fix an issue with cancellation of closing a page
- Try harder to ensure a buffer disposes associated resources when
  the page is closed.
- Translation updates

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0562755261)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:13 +05:30
Wang Mingyu
fe4ef3f878 eog: upgrade 45.3 -> 45.4
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 4181632bc1)

Changes:
- Regenerate thumbnails on save
- Use "fast" content type as fallback if normal content type
  is unavailable
- docs: Replace dead links to developer-old.gnome.org (Andre Klapper)
- Updated translations

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:13 +05:30
Markus Volk
acebc13ce7 gnome-disk-utility: update 46.0 -> 46.1
46.1 - September 03, 2024
=========================

Alexandre Franke:
 * metainfo: fix URLs
 * metainfo: replace screenshots

Athmane MOKRAOUI:
 * Add Kabyle translation

Updated translations:
 * Alexandre Franke (fr), Anders Jonsson (sv), Andi Chandler (en_GB),
   Andika Triwidada (id), Artur S0 (ru), Asier Sarasua Garmendia (eu),
   Athmane MOKRAOUI (kab), Aurimas Černius (lt), Balázs Úr (hu), Boyuan
   Yang (zh_CN), Danial Behzadi (fa), Daniel Rusek (cs), Daniel Șerbănescu
   (ro), Efstathios Iosifidis (el), Ekaterine Papava (ka), Guntupalli
   Karunakar (hi), Hugo Carvalho (pt), Jordi Mas i Hernandez (ca), Juliano de
   Souza Camargo (pt_BR), Jürgen Benvenuti (de), Martin (sl), Matej Mrenica
   (sk), Piotr Drąg (pl), Rachida SACI (kab), Sabri Ünal (tr), Seong-ho Cho
   (ko), Vasil Pupkin (be), Vincent Chatelain (fr), Yaron Shahrabani (he),
   Yuri Chornoivan (uk)

Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8233ca7595)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:13 +05:30
Gyorgy Sarvari
c7e6992a39 gnome-tweaks: upgrade 40.0 -> 40.10
Changes (note that there were no intermediate releases):

40.10:
This release includes a fix for the broken GNOME Extensions link and
several translation updates.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
6c2b2225c5 nautilus: upgrade 45.1 -> 45.2.1
Changes:
45.2.1:
* Fix a crash in sidebar code
* Fix build without optional cloudproviders dependency

45.2:
* Bugfixes:
  - Don't crash when reconnecting to remove server
  - Actually detect unmount on some non-native mounts
  - Don't crash on image properties
  - Allow types and sizes in Properties to expand
  - Don't corrupt toast messages
* Translation updates

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
3f350dbe1a gnome-shell-extensions: upgrade 46.1 -> 46.4
Changes:
46.4:
* Update template CI images to fix release pipeline

46.3:
* places-menu: Fix a11y labelling
* places-menu: Fix opening drives with mount operations
* window-list: Fix hiding when entering overview with gestures
* workspace-indicator: Only show previews of regular windows
* Misc. bug fixes and cleanups

46.2:
* apps-menu: Fix a11y of category labels
* window-list: Fix long-press support
* Misc. bug fixes and cleanups

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
82e02ae980 gnome-bluetooth: upgrade 46.0 -> 46.2
Changes:
ver 46.2:
This version contains a fix for the devices page staying empty on load
in some circumstances, as well as translation updates.

ver 46.1:
This version contains translation updates and a bug fix for some device
icons not appearing correctly.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
cdde87bb97 mutter: fix profiler PACKAGECONFIG
In case "profiler" PACKAGECONFIG is enabled, the build fails with
the following error:

| ninja: error: '/usr/share/dbus-1/interfaces/org.gnome.Sysprof3.Profiler.xml', needed by 'src/meta-dbus-sysprof3-profiler.c', missing and no known rule to make it

meson.build script is looking explicitly for a required file using the
sysroot of the build system instead of ${RECIPE_SYSROOT}. To avoid this,
patch meson.build to prefix this path with ${RECIPE_SYSROOT}.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit ead8f7b327)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
fe7623f3bb mutter: upgrade 46.1 -> 46.9
Contains many bugfixes: https://gitlab.gnome.org/GNOME/mutter/-/blob/46.9/NEWS

46.9
====
* Support presentation-time version 2
* Honor wl_surface.offset on cursor surfaces
* Fix crash

46.8
====
* Use BT709 coefficients and limited range for YUV conversion by defaults
* Also request high priority secondary EGL context
* Fix applying initial _NET_WM_WINDOW_OPACITY on Xwayland
* Misc. bug fixes and cleanups

46.7
====
* Default to high thread instead of realtime priority for KMS thread
* Fix updating cursor immediately when starting window drag
* Prefer GPUs with built-in panels connected as primary GPU
* Fix cursor glitches when using virtual monitors
* Ensure frame events are sent for cursor surfaces
* Allow BGRX8888 format on big endian
* Fix touchscreen drag-and-drop on wayland
* Fixed crashes
* Misc. bug fixes and cleanups

46.6
====
* Fix grabbing tablet devices
* Fix explicit sync with virtual monitors w/o pipewire streams
* Improve detecting preferred primary devices
* Fixed crashes
* Misc. bug fixes and cleanups

46.5:
* Fix drag and drop between X11 and wayland clients
* Fix drag and drop from grabbing popups
* Fix EGLDevice support
* Fix frozen cursor on some hybrid machines
* Fix touch window dragging with pointer lock enabled
* Fix propagating tablet device removals to clients
* Fix tablet input in maximized windows
* Reduce damage on window movement
* Fix frozen cursor after suspend
* Fix using modifiers on multi-GPU setups
* Fixed crashes
* Misc. bug fixes and cleanups

46.4:
* Fix nested popovers on wayland
* Misc. bug fixes and cleanups

46.3.1:
* Fix visibility of Xwayland windows
* Misc. bug fixes

46.3:
* Fix performance issues with second virtual monitor
* Fix missing unmap animation of some windows
* Fix placement/resizing regression
* Fix possible out of sync primary selections and clipboard
* Fix ibus support in popups
* Fix hardware accelerated rendering when headless
* Add back support for legacy X11 cursor themes
* Fix preedit offsets
* Use character offsets to specify surrounding text
* Don't force titlebar on screen on all interactive resizes
* Fixed crashes
* Misc. bug fixes and cleanups

46.2:
* Fix hardware cursor with non-atomic KMS drivers
* Fix night light state getting stuck on monitor changes
* Fix sending preferred buffer transform
* Fix key press events with immediate release being ignored
* Fix unsetting clipboard on screen lock
* Fix wrong input region of undecorated X11 windows
* Fix windows potentially shrinking unexpectedly on configure
* Fix popup menus sometimes closing immediately
* Fixed crashes
* Misc. bug fixes and cleanups

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Wang Mingyu
01f91cef8d gnome-keyring: upgrade 46.1 -> 46.2
Changelog:
=========
* Don't use 'bool' as variable name
* autogoo: replace AC_HELP_STRING with AS_HELP_STRING
* Default "automatically unlock" checkbox to false
* build: Fix distcheck with systemd unit
* rpc-layer: Fix undefined reference to g_strlcpy
* Updated translations

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0e55ce901a)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Khem Raj
4808353b95 libgweather4: Upgrade to 4.4.4
- Fix deprecation warnings [!300]
- Fix introspection annotation for async functions [!318]
- Plug some memory leaks [!321]
- Translation updates

Use GI_TYPELIB_PATH to point to typlib paths in target sysroot

Fixes
| FAILED: data/Locations.bin
| /mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux-musl/libgweather4/4.4.4/libgweather-4.4.4/build-aux/meson/gen_locations_variant.py ../libgweather-4.4.4/data/Locations.xml data/Locations.bin
| Traceback (most recent call last):
|   File "/mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux-musl/libgweather4/4.4.4/libgweather-4.4.4/build-aux/meson/gen_locations_variant.py", line 7, in <module>
|     from gi.repository import GLib
|   File "/mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux-musl/libgweather4/4.4.4/recipe-sysroot-native/usr/lib/python3.13/site-packages/gi/importer.py", line 133, in create_module
|     raise ImportError('cannot import name %s, '
|                       'introspection typelib not found' % namespace)
| ImportError: cannot import name GLib, introspection typelib not found

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Andreas Müller <schnitzeltony@gmail.com>
(cherry picked from commit 054716edca)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Wang Mingyu
35c2478920 tracker-miners: upgrade 3.7.2 -> 3.7.3
0001-fix-reproducibility.patch
refreshed for 3.7.3

Changelog:
============
* Fix possible crashes handling live changes to extractor
  configuration
* Make it easier to run tracker-extract-3 under Valgrind
* Plug a leak on misdetected JPEG files
* Many further metadata extraction tests

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9cc20a0203)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Wang Mingyu
4ee962960c tracker-miners: upgrade 3.7.1 -> 3.7.2
0001-Set-header-file-to-a-fixed-path-instead-of-a-host-pa.patch
0001-fix-reproducibility.patch
refreshed for 3.7.2

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 59c62576b4)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Wang Mingyu
d6304f05b0 tracker: upgrade 3.7.2 -> 3.7.3
Changelog:
=========
* Bump database version to fix SQLite 3.45.3 issues in existing
  installs
* Fixed possible infinite loop on incomplete/unterminated Turtle/Trig
  data.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c6a9b1559c)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Wang Mingyu
87b5388983 tracker: upgrade 3.7.1 -> 3.7.2
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 3142a9ca94)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Peter Marko
4e51b7c2ac gdm: add missing json-glib dependency
Fixes do_configure error:
| Run-time dependency json-glib-1.0 found: NO (tried pkgconfig)
|
| ../gdm-46.0/meson.build:64:12: ERROR: Dependency "json-glib-1.0" not found, tried pkgconfig

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 97eaa95cf3)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
ef886925f7 gdm: upgrade 46.0 -> 46.2
Changes (note that there was no 46.1 release):
46.2:
- Block suspend when remote displays are active
- Support S0ix suspend when deciding if nvidia should use wayland
- Misc fixes
- Translation updates

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
1388fe826b gnome-calculator: upgrade 46.0 -> 46.2
Changes:
46.2:
    * Updated translations
    * Fixed currency conversions not working

46.1:
    * Updated translations
    * Disable undo action if nothing to undo
    * Keep last conversion options at launch
    * Fixed event controller propagation phase

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
4bf3abf1ec gnuchess: upgrade 6.2.9 -> 6.2.11
Drop patch that was incorporated in this release.
Also, switch to GNU ftp servers to fetch the source from.

Changes:
6.2.11: No changes.
6.2.10:
- Tempo bonus added in the evaluation function.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
14cd52f2e5 gtksourceview5: upgrade 5.12.0 -> 5.12.1
Changes:
 * Update documentation links
 * Specify recoloring hex colors for Adwaita-dark
 * Improve grid drawing positions slightly
 * Use a weak ref for GtkSourceView backpointer in GtkSourceGutterRenderers
   which fixes a potential leak of GtkSourceView
 * Fix a fontconfig check for Windows
 * Fix section name for elixir

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
a76ea8a073 gnome-desktop: upgrade 44.0 -> 44.4
Changes:
Version 44.4
- Support TryExec for thumbnailers
- Translation updates

Version 44.3
- Fix CI regression for release upload

Version 44.2
- Stop using ratio character for time in the wall-clock
- Fix variable initialization
- General CI cleanups
- Only parse XML files as slideshows
- Translation updates

Version 44.1
- Fix compatibility with muslc
- Fix GNOME_DESKTOP_IS_THUMBNAIL_FACTORY
- Update default Indic input methods
- Use ibus-chewing as the default input source for zh_TW
- Translation updates

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
48a89c6f95 python3-virtualenv: patch CVE-2026-22702
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-22702

Backport the patch that is referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
f29101aa4e python3-tornado: mark CVE-2025-67725 patched
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-67725

According to the NVD advisory references the same commit
fixes it as CVE-2025-67726. Just extend the CVE tag to
make the cve-checker also see this.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
alperak
1aa7b56d53 python3-eventlet: switch to PEP-517 build backend
The project has a proper pyproject.toml which declares the hatchling.build PEP-517 backend.

Fix:

WARNING: python3-eventlet-0.36.1-r0 do_check_backend: QA Issue: inherits setuptools3 but has pyproject.toml with hatchling.build, use the correct class [pep517-backend]

Signed-off-by: alperak <alperyasinak1@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 19affc7a21)

This is cherry-picked into Scarthgap, because the Setuptools backend
seems to be broken - it doesn't install the submodules, making import fail:

root@qemux86-64:~# python3
Python 3.12.12 (main, Oct  9 2025, 11:07:00) [GCC 13.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import eventlet
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.12/site-packages/eventlet/__init__.py", line 6, in <module>
    from eventlet import convenience
  File "/usr/lib/python3.12/site-packages/eventlet/convenience.py", line 4, in <module>
    from eventlet import greenpool
  File "/usr/lib/python3.12/site-packages/eventlet/greenpool.py", line 4, in <module>
    from eventlet import queue
  File "/usr/lib/python3.12/site-packages/eventlet/queue.py", line 48, in <module>
    from eventlet.event import Event
  File "/usr/lib/python3.12/site-packages/eventlet/event.py", line 1, in <module>
    from eventlet import hubs

See also https://github.com/eventlet/eventlet/issues/1071

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
a3aef9bbcc raptor2: patch CVE-2024-57822 and CVE-2024-57823
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-57822
https://nvd.nist.gov/vuln/detail/CVE-2024-57823

Pick the patches mentioned in the github issue[1] mentioned
in the NVD advisories (both of them are covered by the same issue)

[1]: https://github.com/dajobe/raptor/issues/70

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit dc2c6a514e)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
4e29baa804 python3-django: patch CVE-2025-64460
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-64460

Backport the patch that explicitly references this CVE in its
commit message.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
ba968dda37 python3-aiohttp: patch CVE-2025-69228
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69228

Backport the patch that is referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
cd71a1e57c python3-aiohttp: patch CVE-2025-69226
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69226

Backport the patch that is referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
0f91805c4b python3-aiohttp: patch CVE-2025-69225
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69225

Backport the patch that is referenced by the NVD report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
d691a39655 proftpd: ignore CVE-2021-47865
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-47865

This CVE was opened based on a 5 years old Github issue[1], and has been made
public recently. The CVE wasn't officially disputed (yet?), but based on
the description and the given PoC the application is working as expected.

The vulnerability description and the PoC basically configures proftpd to
accept maximum x connections, and then when the user tries to open x + 1
concurrent connections, it refuses new connections over the configured limit.

See also discussion in the Github issue.

It seems that it won't be fixed, because there is nothing to fix.

[1]: https://github.com/proftpd/proftpd/issues/1298

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-12 13:38:12 +05:30
Gyorgy Sarvari
a56aafa0a6 netdata: ignore CVE-2024-32019
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32019

The vulnerability affects the ndsudo binary, part of netdata.
This binary was introduced in version 1.45.0[1], and the recipe
contains v1.34.1 - which is not vulnerable yet.

Ignore the CVE due to this.

[1]: 0c8b46cbfd

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-09 09:35:57 +05:30
Gyorgy Sarvari
522a522cb7 mongodb: ignore CVE-2025-14911
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-14911

The CVE is currently tracked without valid CPE. The vulnerability
affects mongo-c-driver component, not mongodb. They are also stored
in different repositories.

Due to this, ignore this CVE.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-09 09:35:57 +05:30
Gyorgy Sarvari
c6b15e6601 mongodb: upgrade 4.4.29 -> 4.4.30
This is a security release to fix CVE-2025-14847:
https://nvd.nist.gov/vuln/detail/CVE-2025-14847

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-09 09:35:56 +05:30
Gyorgy Sarvari
832b983735 libcupsfilters: patch CVE-2025-64503
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-64503

Pick the patch that explicitly refernces the CVE ID in its message.
(The NVD advisory mentions only the cups-filters patch, but
the developer indicated the CVE ID in the libcupsfilters patch also)

Between this recipe version and the patch the project has decided to
eliminate c++ from the project, and use c only. The patch however
is straightforward enough that it could be backported with very small
modifications.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-02-09 09:35:56 +05:30