Commit Graph

38206 Commits

Author SHA1 Message Date
Ankur Tyagi 7b02248200 python3-django: upgrade 6.0.5 -> 6.0.6
https://docs.djangoproject.com/en/dev/releases/6.0.6/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 4d1b287447)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:44 +05:30
Ankur Tyagi 7dd3328dd8 python3-django: upgrade 5.2.14 -> 5.2.15
https://docs.djangoproject.com/en/dev/releases/5.2.15/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 18576ace94)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:43 +05:30
Wang Mingyu ce5b8f8b22 python3-soupsieve: upgrade 2.8.3 -> 2.8.4
Changelog:
=============
- FIX: Fix another inefficient attribute pattern
- FIX: Limit total number of selectors processed in a pattern to prevent massive selector requests

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit b25cc6b7a9)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:43 +05:30
Wang Mingyu 797f67c613 python3-vector: upgrade 1.8.0 -> 1.8.1
Changelog:
==========
- fix: get rid of cupy<14 quick fix
- fix: _wrap_results skips momentum equivalents
- ci: bump setup-uv to maintained tag scheme
- ci: enable numba testing in 3.14t

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 9966cea909)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:42 +05:30
Markus Volk e4e0d0f38c pipewire: update 1.6.5 -> 1.6.6
- ncurses is not a required dependency -> make it a PACKAGECONFIG

PipeWire 1.6.6 (2026-05-26)

This is a bugfix release that is API and ABI compatible with the previous
1.6.x releases.

Highlights
  - Fix a bug in the server code that could leave snap clients without
    sound. (#5270)
  - Relax LADSPA path loading again, absolute paths are only blocked in
    unsafe cases.
  - Fix a volume restore issue in filter-graph when using custom volume
    controls.
  - Small fixes and improvements.

PipeWire
  - Fix the meta permission check on metadata.
  - Make sure we don't accept too many fds.
  - Fix potential race with buffer allocation and Suspend. (#3547)

SPA
  - Relax LADSPA path loading. Absolute paths are allowed when loading
    modules from a config file. They are now only blocked when loading
    the pulse ladspa modules and filter-chains in nodes because those
    can load ladspa plugins in other processes. (#5222)
  - Fix a regression in the dither noise that was silent when no input
    was available. (#5260)
  - Fix volume initialization in filter-graph. (#5192)

Pulse-server
  - Fix a bug in the server code that could leave snap clients without
    sound. (#5270)
  - Be more careful with the stream suspend messages and only send them
    when the stream is monitoring. (#5273)
  - Fix monitor mode in pavucontrol.

Tools
  - Fix midifile SysEx writing in pw-cat and ensure the header is written
    correctly on close.
  - Make sure pw-cat does not try to convert Midi to UMP.

Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit d712bc991a)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:42 +05:30
Wang Mingyu 48bce03482 gdm: upgrade 50.0 -> 50.1
Changelog:
===========
* Fixed issue where GDM failed to properly terminate conflicting graphical sessions
  started outside of GDM (e.g. ThinLinc, TigerVNC). GDM now queries logind directly
  to find and terminate all conflicting sessions
* Fixed plymouth hanging indefinitely on headless systems or systems without monitors,
  which prevented the system from reaching graphical.target
* Fixed XDG_DATA_DIRS construction to prevent gnome-shell from failing to find its
  files when /usr/share had higher precedence than /usr/local/share
* Fixed bug where GDM would set XDG_SESSION_TYPE=wayland on X11 sessions
* Translation updates

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 78e5d3c646)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:41 +05:30
Ankur Tyagi 57609236a3 postfix: upgrade 3.10.9 -> 3.10.10
Dropped 0001-Fix-build-with-musl.patch which is part of upstream
version.

Release Notes:
https://www.postfix.org/announcements/postfix-3.11.3.html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:41 +05:30
Wang Mingyu 99a67bbdae memcached: upgrade 1.6.41 -> 1.6.42
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit aab5fcaf79)

Release Notes:
https://github.com/memcached/memcached/wiki/ReleaseNotes1642

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:41 +05:30
Ankur Tyagi 06e68d3d60 libjs-jquery-cookie: patch CVE-2026-46625
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-46625

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:40 +05:30
Peter Kjellerstedt 24a11f288c ttf-dejavu: Use "Bitstream-Vera" instead of "BitstreamVera" as license
"Bitstream-Vera" is the official SPDX license identifier for the
license.

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 29b6cf792f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:40 +05:30
Wang Mingyu f6b65e17a9 imagemagick: upgrade 7.1.2-23 -> 7.1.2-24
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 2f84b8c1f1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:39 +05:30
Jason Schonberg 0e1248eaea php: upgrade 8.5.6 -> 8.5.7
This is a bug fix release.

Changelog: https://www.php.net/ChangeLog-8.php#8.5.7

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit e14f72c5d7)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:39 +05:30
Peter Kjellerstedt 143ee5e2a0 php: Correct the license to PHP-3.01
The license used by PHP is actually PHP-3.01, not PHP-3.0.

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 8aade001c1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:38 +05:30
Jason Schonberg df07d57939 php: upgrade 8.5.5 -> 8.5.6
This is a security release.

Changelog: https://www.php.net/ChangeLog-8.php#8.5.6

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 4310ecc78f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:38 +05:30
Anton Skorup 50400e9b41 jq: patch CVE-2026-47770
This patch adds the upstream fix for CVE-2026-47770.

CVE details: https://ubuntu.com/security/CVE-2026-47770

Signed-off-by: Anton Skorup <antonsk@axis.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit e4aae1b880)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:37 +05:30
Max Krummenacher 5376a773c6 fio: fix build with musl
Backport the upstream fix.

Signed-off-by: Max Krummenacher <max.oss.09@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 1f265bd73d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:37 +05:30
Wang Mingyu 8bd9783601 haveged: upgrade 1.9.20 -> 1.9.22
Changelog:
===========
* Add ReadWritePaths=/dev/shm to systemd service for semaphore creation
  under ProtectSystem=full sandboxing
* Fix privilege escalation via command socket (CVE-2026-41054)
* Check peer credentials before reading command (CVE-2026-41054)
* Handle failing opening of semaphore
* Fix /dev/shm permissions to use sticky bit
* Use chmod after mkdir to ensure correct /dev/shm permissions
* Update libtool: add lib64 search paths, remove dead code

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Venkatasainath Ravikanti <venkatasainath.ravikanti@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:36 +05:30
Li Zhou bcc1c15a3f haveged: upgrade 1.9.19 -> 1.9.20
ChangeLog:
https://github.com/jirka-h/haveged/releases/tag/v1.9.20

Signed-off-by: Li Zhou <li.zhou@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Venkatasainath Ravikanti <venkatasainath.ravikanti@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:36 +05:30
Abhishek Bachiphale 2a9765bf8f dnsmasq: upgrade 2.92 -> 2.93
- Update package checksum
- Remove obsolete upstreamed patches
- Verify successful build and runtime functionality

Include upstream security fixes:
- CVE-2026-2291
- CVE-2026-4890

Remove following patches as fixes are now included upstream:
- CVE-2026-4891
- CVE-2026-4892
- CVE-2026-4893
- CVE-2026-5172

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:06:35 +05:30
Andrej Kozemcak 3521444a71 poco: fix timezone and data time parser issue
Patch contains tree patches which was merge to poco at once
and fix "time" issues

1 - fix(Foundation): Timezone: invalidate utcOffset cache when /etc/localtime changes

Poco commit 1850dc16aabf5980a490bb1b66086d6695abb823 introduced a
TZInfo cache for the UTC offset to avoid repeated tzset() syscalls.
The cache is invalidated only when the TZ environment variable changes.
However, the TZ variable is process-local: if a different process (e.g.
a timezone configuration daemon or an init script) changes the system
timezone by updating /etc/localtime, the running process is not notified
and its TZ environment variable remains unchanged.

On systems that switch timezone by updating /etc/localtime (a symlink)
without touching the TZ env var, the cache is therefore never invalidated
and Timezone::utcOffset() returns the stale value computed at startup.

Fix by extending cacheTZ()/tzChanged() to also track the inode and
mtime of /etc/localtime via stat(2).  When either changes the cache is
considered stale and reloaded, preserving the performance benefit for
the common case where neither TZ nor /etc/localtime changes between
calls.

2 - fix(Foundation): DateTimeParser: %S consume optional fractional seconds

Parsing ISO 8601 date strings that contain both fractional seconds and a
timezone offset (e.g. "2013-10-07T08:23:19.120-04:00") with the format
"%Y-%m-%dT%H:%M:%S%z" raises a SyntaxException:

  - %S consumes the integer seconds but stops at '.', leaving
    ".120-04:00" unconsumed.
  - %z (parseTZD) is called next but sees '.' and returns without
    consuming anything.
  - The trailing-garbage check then raises SyntaxException.

Extend the %S case to consume and discard an optional fractional-second
suffix ('.' or ',' followed by one or more digits) immediately after
parsing the integer seconds.  This mirrors the existing %s behaviour and
allows %z to see the timezone designator directly, keeping the
trailing-garbage check fully effective for truly invalid input.

3 - test(DateTimeParserTest): add ISO8601 fractional seconds parser test

Add testISO8601FracSeconds to verify that DateTimeParser correctly
handles fractional-second suffixes (dot and comma separated) in
ISO8601_FORMAT strings, and rejects malformed input such as a
bare decimal point with no digits.

Signed-off-by: Andrej Kozemcak <andrej.kozemcak@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-06-18 13:04:41 +05:30
Anuj Mittal a43f0d532c README: update listed maintainer
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Jiaying Song 34debec4d8 layer.conf: remove dead BBFILES_DYNAMIC entry for clang-layer
The dynamic-layers/clang-layer/ directory does not exist under meta-oe.
Remove the stale BBFILES_DYNAMIC references as they match nothing.

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a07b2ddc51)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Adam Duskett 7d1f4b0940 kmscon: fix zlib cross-compiling errors
zlib compression was introduced in version 9.3.3. However, when
cross-compiling kmscon for an architecture other than x86_64, the
genunifont executable tries to use the build-systems zlib instead
of the hosts zlib.

This leads to the following error during compiling:
libz.so: error adding symbols: file in wrong format

Fix this by adding a new native zlib dependency specifically for the
genunifont executable.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 72154f38fc)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Jason Schonberg 74c663dd4e nodejs: upgrade 22.22.2 -> 22.22.3
With this upgrade, nodejs updated the llhttp dependency to version 9.3.1
So some of the patches are nolonger necessary.

Changelog: https://github.com/nodejs/node/releases/tag/v22.22.3

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit ea56a5e3ae)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Ankur Tyagi a1ffc4960b imagemagick: upgrade 7.1.2-22 -> 7.1.2-23
Bug and security fixes
https://github.com/ImageMagick/ImageMagick/compare/7.1.2-22...7.1.2-23

PTEST passed:

root@qemuarm64:~# ptest-runner imagemagick
START: ptest-runner
2026-05-23T03:43
BEGIN: /usr/lib/imagemagick/ptest
...
...
DURATION: 1
END: /usr/lib/imagemagick/ptest
2026-05-23T03:43
STOP: ptest-runner
TOTAL: 1 FAIL: 0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Markus Volk 0537a67fc8 pipewire: update 1.6.3 -> 1.6.5
PipeWire 1.6.5 (2026-05-13)

This is a bugfix release that is API and ABI compatible with the previous
1.6.x releases.

Highlights
  - Fix muted output in some cases.
  - Removed the pipe filter in filter-graph.
  - More fixes and improvements.

PipeWire
  - Fix an issue in pw-filter where it could end up in a loop where buffers
    are stuck on a port and the port becomes silent. (#5249)

Modules
  - Improve ROC receiver start/stop, fixes memory leaks. (#5250)
  - Remove the pipe filter from filter-graph, it's broken by design and a
    security nightmare.
  - Fix the midi buffer size in jack-tunnel.

SPA
  - Rate limit out-of-buffers errors. (#5249)
  - Partially revert the line-out mute patch, it seems to break things and leave
    audio muted when plugging-unplugging jacks.  (#5246)
  - Improve renegotiation in audioconvert when the graph rate changes and the
    resampler was disabled. (#4933).
  - Fix potential crash in alsa when logging.

Pulse-server
  - A whole bunch of extra security checks and hardening fixes.

Older versions:

PipeWire 1.6.4 (2026-04-22)

This is a bugfix release that is API and ABI compatible with the previous
1.6.x releases.

Highlights
  - Small improvements and seqfault fixes.
  - Try to not emit ports that JACK doesn't understand. Fixes glitches in
    ardour and other JACK apps.

PipeWire
  - Refuse to load plugins and crash when pw_init() was not called. (!2784)

SPA
  - Fix LADSPA plugin loading, support LADSPA_PATH ending with /
  - Fix segfault in alsa-seq when removing devices in some cases. (#5221)
  - Allow negative gain in mixer. (#5228)
  - Improve alsa-seq port names, add : between client and port. (#5229)
  - ACP: don’t override user-selected port on availability changes.

Bluetooth
  - Backport some important fixes and minor improvements.

JACK
  - Ignore non DSP ports to avoid emitting extra callbacks.

GStreamer
  - Fix crop metadata.

Tools
  - Fix WAVEX saving in pw-cat. (#5233)

Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit babcd87414)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Abhishek Bachiphale ed946592da dnsmasq: fix CVE-2026-5172
A buffer overflow in dnsmasq’s extract_addresses() function allows
an attacker to trigger a heap out-of-bounds read and crash by
exploiting a malformed DNS response, enabling extract_name()
to advance the pointer past the record’s end.

Reference:
[ https://nvd.nist.gov/vuln/detail/CVE-2026-5172 ]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 44c8962f48)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Abhishek Bachiphale b81fd0e23e dnsmasq: fix CVE-2026-4893
An information disclosure vulnerability in dnsmasq allows remote
attackers to bypass source checks via a crafted DNS packet with
RFC 7871 client subnet information.

Reference:
[ https://nvd.nist.gov/vuln/detail/CVE-2026-4893 ]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit b4c4853624)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Abhishek Bachiphale be8d0f006a dnsmasq: fix CVE-2026-4892
A heap-based out-of-bounds write vulnerability in the DHCPv6
implementation of dnsmasq allows local attackers to execute
arbitrary code with root privileges via a crafted DHCPv6 packet.

Reference:
[ https://nvd.nist.gov/vuln/detail/CVE-2026-4892 ]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 21c3d7eb6f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:32 +05:30
Abhishek Bachiphale 81572e132c dnsmasq: fix CVE-2026-4891
A heap-based out-of-bounds read vulnerability in the
DNSSEC validation of dnsmasq allows remote attackers
to cause a denial of service via a crafted DNS packet.

Reference:
[ https://nvd.nist.gov/vuln/detail/CVE-2026-4891 ]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a9de48a9fa)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:29:30 +05:30
Wang Mingyu 82dc5548d5 lldpd: upgrade 1.0.21 -> 1.0.22
* Fix:
   + Fix out-of-bound read access when removing VLAN tag (CVE-2026-46433, #787)
   + Reject 0-length management address in LLDP
   + Fix race condition when creating the control socket
   + Fix FDP MAC address
   + Fix memory leak in the BSD bridge query path
   + Fix duplicate management addresses when merging EDP VLAN frames

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 74cd808dbd)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Guocai He c51bb39ebf postgresql: upgrade 17.8 -> 17.10
Refreshed 0003-configure.ac-bypass-autoconf-2.69-version-check.patch
for 17.10

Includes fix for CVE-2026-6472, CVE-2026-6473, CVE-2026-6474, CVE-2026-6475,
CVE-2026-6476, CVE-2026-6477, CVE-2026-6478, CVE-2026-6479, CVE-2026-6637,
CVE-2026-6638 CVE-2026-6575

Release Notes:
https://www.postgresql.org/docs/release/17.10/

Signed-off-by: Guocai He <guocai.he.cn@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 83cad3966c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 61931269ec uriparser: upgrade 1.0.1 -> 1.0.2
Changelog:
==============
* Fixed: [CVE-2026-44927]
    Stop truncating 'ptrdiff_t' to 'int'
* Fixed: [CVE-2026-44928]
    Fix 'EqualsUri' with regard to '.absolutePath'
* Fixed: Fix OOM related memory leak in 'CopyUriMm'
* Improved: Simplify internal function 'CompareRange' into 'RangeEquals'
* Improved: Make function 'RangeEquals' use size_t' internally
* Soname: 3:2:2 - see https://verbump.de/ for what these numbers do

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a0589ae5a4)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 343e59e762 uriparser: upgrade 1.0.0 -> 1.0.1
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 03255a83e3)

https://github.com/uriparser/uriparser/blob/uriparser-1.0.1/ChangeLog

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 915cca7078 bit7z: upgrade 4.0.11 -> 4.0.12
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 84d4d96d9f)

https://github.com/rikyoz/bit7z/releases/tag/v4.0.12

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu f9eea94890 imagemagick: upgrade 7.1.2-21 -> 7.1.2-22
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 5063ac8e48)

Bug and security fixes
https://github.com/ImageMagick/ImageMagick/compare/7.1.2-21...7.1.2-22

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 38c0ee7d23 swagger-ui: upgrade 5.32.5 -> 5.32.6
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a86ee0d4f6)

Bugfix release
https://github.com/swagger-api/swagger-ui/releases/tag/v5.32.6

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu d8cfc583c3 swagger-ui: upgrade 5.32.2 -> 5.32.5
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 137e8d240e)

Bugfixes and performance improvements:
https://github.com/swagger-api/swagger-ui/releases/tag/v5.32.3
https://github.com/swagger-api/swagger-ui/releases/tag/v5.32.4
https://github.com/swagger-api/swagger-ui/releases/tag/v5.32.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Ankur Tyagi 815a038905 python3-django: upgrade 6.0.4 -> 6.0.5
https://docs.djangoproject.com/en/dev/releases/6.0.5/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 2f64c27b18)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Ankur Tyagi 9148bf8e3d python3-django: upgrade 5.2.13 -> 5.2.14
https://docs.djangoproject.com/en/dev/releases/5.2.14/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit ef903fca83)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu be10315436 python3-huey: upgrade 3.0.0 -> 3.0.1
Changelog:
==========
- Fix bug in redis version parsing when using Elasticache or any other that
  sends major/minor. redis-py incorrectly parses these as floats because
  there's only a single decimal, so the version check was breaking.
- Rename max task option --max-tasks (previously was --max_tasks).

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c14a56b358)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 4dc835862b python3-typeguard: upgrade 4.5.1 -> 4.5.2
Changelog:
 Fixed IndexError raised from check_signature_compatible when the subject method has no positional parameters

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 537a4c4484)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu eff6fc8cd9 python3-tzdata: upgrade 2026.1 -> 2026.2
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6321202865)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 0f94b8aa14 python3-inline-snapshot: upgrade 0.32.6 -> 0.32.7
Changelog:
============
- Fixed snapshot comparison for dicts where keys are dataclass instances (or
  other custom objects used as dict keys), which previously caused corrupted
  snapshots - either collapsing multiple entries into one or appending duplicate
  keys on subsequent runs
- Fixed tuple snapshot updates to compare elements positionally rather than
  using sequence alignment, so existing expressions (e.g. 3 + 3) are preserved
  when elements are removed from or added to a tuple.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit fe086de31a)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 009207f76f neatvnc: upgrade 0.9.5 -> 0.9.6
0001-Use-aml-v1.patch
refreshed for 0.9.6

Changelog:
===========
- auth: rsa-aes: Fix potential buffer overflow
- auth: vencrypt: Reject excessively long usernames and passwords

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 9222ec03c3)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu ca24d4cbb3 localsearch: upgrade 3.11.0 -> 3.11.1
Changelog:
  Fix possible failures when extracting metadata from EPUB, ODF and OOXML documents

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 5a08d78f85)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Jason Schonberg 563d2c514f Update README.md example with new branch name.
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-29 09:07:25 +05:30
Wang Mingyu 9af4488d46 libtsm: upgrade 4.4.3 -> 4.5.0
Changelog:
=============
- Support for terminal bell and keyboard LEDs
- Fix build musl
- test/vte: fix memory leak in vte tests
- Refactor scrollback and selection
- screen: Fix wrong attribute for new cells when resizing
- Fix remove from sb
- Fix get next line
- Fix scrollback position
- test: robustness, make the test faster.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6d7794e799)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 11:52:30 +05:30
Yi Zhao ce551e0201 nftables: improve reproducibility
Use SOURCE_DATE_EPOCH to set MAKE_STAMP instead of using the current
time, thereby improving reproducibility.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a3b407c982)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 11:44:07 +05:30
Wang Mingyu f543c09d25 python3-ujson: upgrade 5.12.0 -> 5.12.1
Changelog:
==========
- Fix encoding ref leak with non-English character
- Fix memory leak when ujson.dump() is unable to write to its file

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6887661fec)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-05-17 10:20:58 +05:30