mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-13 15:47:23 +00:00
Code Issues Projects Releases Wiki Activity
40,605 Commits 65 Branches 0 Tags
6df0b8c57663e0aee6e405dd7e4624c8e0817dfd
Commit Graph
40605 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ankur Tyagi 6df0b8c576 openvpn: patch CVE-2026-84790 
Backport commit identified by Debian[1], also mentioned in the release note
https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8

[1]https://security-tracker.debian.org/tracker/CVE-2026-84790

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 7bd75dc53f openvpn: patch CVE-2026-88964 
Backport commit identified by Debian[1], also mentioned in the release note
https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8

[1]https://security-tracker.debian.org/tracker/CVE-2026-88964

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 2f0a62d30c openvpn: ignore CVE-2026-84256 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84256

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 41441be1ce swagger-ui: upgrade 5.33.0 -> 5.33.1 
Changelog:
https://github.com/swagger-api/swagger-ui/releases/tag/v5.33.1

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 50c590bebc)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 15b8501f24 python3-zeroconf: upgrade 0.151.3 -> 0.151.5 
Changelog:
https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.151.4
https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.151.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 92fff73409)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi ff9a42b633 python3-werkzeug: upgrade 3.1.8 -> 3.1.9 
Changelog:
https://github.com/pallets/werkzeug/releases/tag/3.1.9

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0d101e1633)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi e56c9807f2 python3-tzdata: upgrade 2026.4 -> 2026.5 
Changelog:
https://github.com/python/tzdata/releases/tag/2026.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 01bd918ea8)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 962410d82f python3-django: upgrade 5.2.17 -> 5.2.18 
Changelog:
https://docs.djangoproject.com/en/dev/releases/5.2.18/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0640fa901d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi e987e0bfde python3-django: upgrade 6.0.8 -> 6.0.9 
Changelog:
https://docs.djangoproject.com/en/dev/releases/6.0.9/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c39562d398)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 783752d9f0 python3-astroid: upgrade 4.3.2 -> 4.3.3 
Changelog:
https://github.com/pylint-dev/astroid/releases/tag/v4.3.3

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 486ef820db)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 9c7e3a2ba9 smarty: upgrade 5.8.4 -> 5.8.5 
Changelog:
https://github.com/smarty-php/smarty/releases/tag/v5.8.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 3fe4c22474)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 48393460ad pgpool2: upgrade 4.7.2 -> 4.7.3 
Changelog:
https://www.pgpool.net/docs/latest/en/html/release-4-7-3.html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 192d012d9a)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 359cbb2b7d python3-gunicorn: mark CVE-2024-1135 patched 
Debian[1] also identified the commit.

Details:
https://nvd.nist.gov/vuln/detail/cve-2024-1135

[1]https://security-tracker.debian.org/tracker/CVE-2024-1135

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi d7ca8eef26 wolfssl: mark CVEs patched 
CVE-2023-6937[1] and CVE-2024-5814[2] are patched in current version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-6937
https://nvd.nist.gov/vuln/detail/cve-2024-5814

[1]https://github.com/wolfSSL/wolfssl/blob/v5.6.6-stable/ChangeLog.md#vulnerabilities
[2]https://github.com/wolfSSL/wolfssl/blob/v5.7.2-stable/ChangeLog.md#vulnerabilities

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit c12fcc9b48)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 7c8cd0805f tinyproxy: patch CVE-2026-55202 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55202

[1]https://security-tracker.debian.org/tracker/CVE-2026-55202

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 233e6a56e5)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 1247ca6a89 tinyproxy: patch CVE-2026-54387 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54387

[1]https://security-tracker.debian.org/tracker/CVE-2026-54387

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 33649b0657)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 53ec96a06c tinyproxy: patch CVE-2026-31842 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-31842

[1]https://security-tracker.debian.org/tracker/CVE-2026-31842

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 985acd9e7c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi c829548246 libyang: patch CVE-2026-41401 
Backport patch identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41401

[1]https://security-tracker.debian.org/tracker/CVE-2026-41401

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 6b06704ac1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 25ed071362 miniupnpd: patch CVE-2026-107159 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-107159

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi dc56cbbc02 libssh: ignore CVE-2026-59851 
GSSAPI Key Exchange was introduced in v0.12.0[1].
Debian also confirmed the same[2].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59851

[1]https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.12.0
[2]https://security-tracker.debian.org/tracker/CVE-2026-59851

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 26f0474644 libssh: mark CVEs patched 
Changelog[1] also confirms the fix.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59843
https://nvd.nist.gov/vuln/detail/cve-2026-59844
https://nvd.nist.gov/vuln/detail/cve-2026-59845
https://nvd.nist.gov/vuln/detail/cve-2026-59846
https://nvd.nist.gov/vuln/detail/cve-2026-59848
https://nvd.nist.gov/vuln/detail/cve-2026-59850

[1]https://gitlab.com/libssh/libssh-mirror/-/blob/libssh-0.11.5/CHANGELOG?ref_type=tags

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi d1b13ec2ac libssh: ignore CVE-2025-14821 
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-14821

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 6541aefe60)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 5a964c11f8 libnfs: patch CVE-2026-57918 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57918

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit bb3f5628f1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 8abdf08b09 libnfs: patch CVE-2026-53689 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-53689

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 6ace2f0b5e)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 15d002f266 libiec61850: mark CVE-2024-45969 patched 
NVD[1] mentions commit[2] for v1.5 but is also present in v1.6[3]

[1] https://nvd.nist.gov/vuln/detail/cve-2024-45969
[2] https://github.com/mz-automation/libiec61850/commit/7afa40390b26ad1f4cf93deaa0052fe7e357ef33
[3] https://github.com/mz-automation/libiec61850/commit/d1ab50298fcba3f87b1e58dabff92f8615b14ee7

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit a7088b0fda)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 1dac3dca9d jq: ignore already fixed CVEs 
All these CVEs are already fixed in the recipe version[1].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-33948
https://nvd.nist.gov/vuln/detail/cve-2026-39979
https://nvd.nist.gov/vuln/detail/cve-2026-40164
https://nvd.nist.gov/vuln/detail/cve-2026-44777

[1]https://github.com/jqlang/jq/releases/tag/jq-1.8.2

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi a7b6f19ac6 iniparser: mark CVE-2025-0633 pached 
Also mentioned in the release notes[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2025-0633

[1] https://gitlab.com/iniparser/iniparser/-/releases/v4.2.6

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 86fba2b580)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 38078503c1 hdf5: patch CVE-2026-19025 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].

[1] https://github.com/HDFGroup/hdf5/pull/6508
[2] https://github.com/HDFGroup/hdf5/issues/6491
[3] https://nvd.nist.gov/vuln/detail/cve-2026-19025

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit df3f814ab8)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 20416114de hdf5: patch CVE-2026-17574 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-17574

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 637f437de9)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi a0cb67f356 hdf5: patch CVE-2026-17573 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.

[1] https://github.com/HDFGroup/hdf5/pull/6160
[2] https://github.com/HDFGroup/hdf5/issues/6124
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17573
[4] https://security-tracker.debian.org/tracker/CVE-2026-17573

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit f46990293c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi f449fa597a hdf5: patch CVE-2026-17572 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.

[1] https://github.com/HDFGroup/hdf5/pull/6499
[2] https://github.com/HDFGroup/hdf5/issues/6501
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17572
[4] https://security-tracker.debian.org/tracker/CVE-2026-17572

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit c279e9e688)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 041660ffc5 libde265: patch CVE-2026-54240 and CVE-2026-54241 
Debian identified same commit as fix for both CVEs[1][2].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54240
https://nvd.nist.gov/vuln/detail/cve-2026-54241

[1]https://security-tracker.debian.org/tracker/CVE-2026-54240
[2]https://security-tracker.debian.org/tracker/CVE-2026-54241

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 3745d07efc libde265: patch CVE-2026-49346 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49346

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 4a63a2afa1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi c4a222a650 libde265: patch CVE-2026-49337 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49337

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit c83399f83f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 70486f9176 libde265: patch CVE-2026-49295 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49295

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit bd09bb41b4)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi dfc809f9c9 gerbera: ignore CVE-2025-23386 
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-23386

This vulnerability is due to openSUSE specific packaging issue.

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 369d962967)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 5a3355e3ae gpm: ignore CVE-2025-4558 
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-4558

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit e134adc8f3)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 1ea608311d haveged: ignore CVE-2026-41054 
Debian[1] also confirms the fixed version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41054

[1] https://security-tracker.debian.org/tracker/CVE-2026-41054

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 086a780db0)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 63363b3ec9 dool: patch CVE-2026-56652 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-56652

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 53bbf2771b)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 6dc6984b6c dool: patch CVE-2026-56651 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-56651

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 2e1445decd)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 2883998669 bcc: correct CVE_PRODUCT mapping 
Use "iovisor:bpf_compiler_collection", the exact NVD identity for the
https://github.com/iovisor/bcc source.

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi a6d9fb0284 gpsd: patch CVE-2026-58459 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-58459

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 57e1f7d3d2)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 4581170802 eject: ignore CVE-2026-28065 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-28065

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit e6d111c169)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi f4785e05f8 dovecot: ignore already fixed CVEs 
Upstream has confirmed that these vulnerabilities are fixed,
and Debian has also identified the relevant commits:

CVE-2025-59028: https://security-tracker.debian.org/tracker/CVE-2025-59028
CVE-2025-59032: https://security-tracker.debian.org/tracker/CVE-2025-59032
CVE-2026-27859: https://security-tracker.debian.org/tracker/CVE-2026-27859
CVE-2026-27851: https://security-tracker.debian.org/tracker/CVE-2026-27851
CVE-2026-33603: https://security-tracker.debian.org/tracker/CVE-2026-33603
CVE-2026-40016: https://security-tracker.debian.org/tracker/CVE-2026-40016
CVE-2026-40020: https://security-tracker.debian.org/tracker/CVE-2026-40020
CVE-2026-42006: https://security-tracker.debian.org/tracker/CVE-2026-42006

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 86a9ad852a)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi fb5b535db7 civetweb: ignore CVE-2026-5789 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-5789

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit db080436aa)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 110844e1f0 capnproto: ignore CVE-2026-59704 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59704

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Peter Marko e371d72ea8 nginx: set status for CVE-2026-90439 
CVE information now contains separate version range for mainline and
stable nginx version.
Problem is that mainline version range includes stable verion fix and
since cve-check marks CVE as applicable if one of ranges contains
current recipe version, it's reported as vulnerable.

* Affected 1.29.2 < 1.31.6 (semver) < matches 1.30.5, so false positive
* Affected 1.30.4 < 1.30.5 (semver) < correct fix version, but overridden

Add also a note to remove these explicit entries when new minor stable
version is available which does not fall into the mainline version range
(for all 3 currently explicitly handled CVEs).

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(From meta-oe rev: 13915b76c5)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 10:21:55 +13:00
Peter Marko 9aeb9f5689 libwebsockets: patch CVE-2026-78161 
Pick patch per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-78161

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 10:21:12 +13:00
Ankur Tyagi a6bf82202a libwebsockets: patch CVE-2026-19773 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-19773

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(From meta-oe rev: b8399ae07a)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 10:21:06 +13:00
Markus Volk 8199790102 Revert "mutter: upgrade 50.4 -> 51.0" 
This reverts commit 6f735ce8ac.

mutter 51.0 needs gsettings-desktop-schemas >= 51.rc, but oe-core
blacksail has 50.1. Tested by building gnome-image against oe-core
blacksail.

AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 10:21:01 +13:00