Upgrade to release 4.15.1:
- Implemented a compatibility fix for supporting direct access of
anyio.* submodules from the main package even when those
submodules were not directly imported first.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.20.0:
usecase:
- [usecase] [batch] Added a warning for the case where an unnamed
CHECK constraint on a reflected table is omitted from a batch
"recreate" operation. An unnamed CHECK constraint can't be
reliably carried over in a batch recreate as it may refer to
columns that are being dropped or changed. This omission was
previously a silent operation. The presence of any
~sqlalchemy.schema.CheckConstraint in
Operations.batch_alter_table.table_args is taken to indicate that
the case has been accommodated, and no warning is emitted.
- [usecase] [autogenerate] Autogenerate now renders a warning
comment above any rendered Operations.drop_constraint() directive
for which the constraint name is None, as is the case when a
constraint that has no name in the model is dropped, most
typically within the downgrade() function of a migration that
adds an unnamed constraint. A warning is also emitted on the
console when the migration script is generated. The directive
requires a non-None name in order to be able to emit a "DROP
CONSTRAINT" command.
bug:
- [bug] [batch] Fixed bug in batch mode where adding a column with
a type that generates its own CHECK constraint, such as
~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum with
~sqlalchemy.types.Boolean.create_constraint set to True, would
emit the constraint twice when the table was recreated, once
under the name generated by the naming convention in use and once
under the name given to the type. The constraint is now emitted
once, using the same name that would be used outside of batch
mode.
- [bug] [batch] Fixed bug in batch mode where a CHECK constraint
generated by a type such as ~sqlalchemy.types.Boolean or
~sqlalchemy.types.Enum would lose the name established for it by
the naming convention in use when the table was recreated, as the
constraint was regenerated against the temporary table used for
the recreate operation. The naming convention is now resolved
against the name of the table being replaced.
As part of this change, a type that generates a CHECK constraint
but has no name of its own, used in conjunction with a naming
convention that includes the %(constraint_name)s token, now emits a
warning, as the convention has no name to interpolate; the
constraint continues to be emitted without a name. As noted at
batch_check_constraints, these datatypes should be given a name in
order to participate fully in batch mode.
- [bug] [batch] Fixed bug in batch mode where the
Operations.batch_alter_table.naming_convention parameter would
re-generate the names of constraints that already had a name when
reflected, in the case where the convention included the
%(constraint_name)s token, leading to a name that included the
convention's own prefix twice. The convention is now applied
only to those constraints that are reflected without a name,
which is the use case the parameter is documented for.
- [bug] [mysql] Fixed bug where autogenerate with
EnvironmentContext.configure.compare_server_default would report
a persistent server default change for Float, Numeric and other
decimal columns on MySQL. MySQL reports a literal server default
for such a column either in quoted form, e.g. '1', or, when the
value is fractional, as a parenthesized expression, e.g. (2.5);
neither form was accommodated for columns other than those of
Integer affinity, so that a default such as server_default="1" on
a sqlalchemy.Float column would never compare as equal to the
reflected value.
- [bug] [mysql] Fixed bug where autogenerate with
EnvironmentContext.configure.compare_server_default would report
a persistent server default change for an expression server
default such as (rand()). MySQL reports such a default with the
surrounding parenthesis included whereas MariaDB reports it
without them, so that the parenthesis are now disregarded when
comparing.
misc:
- [change] [general] Support for SQLAlchemy 1.4 is dropped as of
Alembic 1.20.0; SQLAlchemy 2.0.0 is now the minimum required
version. SQLAlchemy 1.4 has no support for Python 3.13 and above,
and the version-conditional code paths it required throughout
Alembic have been removed in favor of the SQLAlchemy 2.0 API.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.5.1:
- A LazyObjectProxy created with an interface argument that declared
a path-like type, such as os.PathLike or pathlib.Path, did not
define the __fspath__() special method on the class it generated.
Because os.fspath() looks up __fspath__() on the type of the
object, passing such a proxy to os.fspath(), the builtin open()
or other standard library functions accepting paths raised
TypeError before the factory callable had been invoked to create
the wrapped object. The __fspath__() special method is now added
when the declared interface provides it, in the same way as is
already done for the other special methods looked up on the type,
so the first path conversion triggers creation of the wrapped
object and succeeds. With thanks to Muneeb Sheikh.
- A callback passed to wrapt.WeakFunctionProxy which was callable
but evaluated as false, such as an event emitter object which
reports its number of subscribers via __len__() and is empty when
first created, was passed the underlying weak reference object
instead of the proxy when the wrapped function expired. Where the
wrapped function was a bound method, such a callback could also
be called twice, once each when the instance and the function
expired. Only None is now treated as meaning no callback was
supplied, which mirrors the behaviour of weakref.ref() and
weakref.proxy() in the standard library, so these callbacks now
receive the proxy and are called only once, as for any other
callback. With thanks to Huanyi Xie.
- A wrapt.AdapterFactory instance passed as the adapter argument
to wrapt.decorator was ignored, and so never called, if the
instance evaluated as false, such as when the factory class
defined __bool__() or __len__(). The decorated function then
retained its original signature instead of that produced by the
factory. Whether an adapter factory was supplied is now
determined by type before the truth value of the adapter is
considered, so such factories are always called. As a consequence
of this change a factory can now also return None, or any other
false value, to indicate that no adapter should be used for a
particular function, where previously this failed with an obscure
error. With thanks to Luochenchen.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
GNU coreutils installs these in ${base_bindir}, so match it. This only
matters when usrmerge is not enabled, as otherwise ${base_bindir} and
${bindir} are the same directory and the generated links are unchanged.
Only the path of the update-alternatives symlinks changes (from ${bindir}
to ${base_bindir}); they still point to ${bindir}/coreutils.
Checked that the generated postinstall now links all six in /bin.
AI-Generated: Uses Claude Sonnet 5.5
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
posix_ipc decides at build time whether it needs librt and whether
message queues are available by compiling small probe programs in
build_support/discover_system_info.py. Its does_build_succeed() splices
the linker option into the compiler argv verbatim, so when no extra
library is wanted the compiler is called with a literal empty argument:
$CC -Wall -o foo foo.c '' -lpthread
GNU ld treats '' as an input file and fails ("cannot find : No such
file or directory"); lld ignores it. With the gcc toolchain every probe
without -lrt therefore fails, the prober wrongly decides librt is
required, and on a C library without a usable librt message queue
support is dropped - which is how posix_ipc.MessageQueue went missing
(issue #916). The result depends on the linker rather than on what the
C library provides.
The previous LDFLAGS += "-lrt" workaround only papered over this, and
is itself libc specific: it forces linking librt even where mq_* live
in libc (glibc >= 2.34, musl).
Fix the prober to split linker_options with shlex, like it already does
for CC, so an empty value adds no argument, and drop the forced -lrt so
the probes decide per C library.
Verified on qemux86-64 for glibc and musl, each with the clang and gcc
toolchains: src/system_info.h defines MESSAGE_QUEUE_SUPPORT_EXISTS,
SEM_GETVALUE_EXISTS and SEM_TIMEDWAIT_EXISTS, and the extension module
imports all mq_* from libc with no librt NEEDED entry.
Fixes: https://github.com/openembedded/meta-openembedded/issues/916
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The 3.85 README ends at line 996, so the existing license checksum
covers only a blank line. Checksum the shipped LICENSE file instead.
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
64-bit time was turned off for all of libcamera because v4l2-compat.
libcamera fixed this upstream in v0.3.0 by also
undefining _TIME_BITS for v4l2-compat (commit 705601 "v4l2:
Unset _TIME_BITS in addition to _FILE_OFFSET_BITS"), so the
workaround is no longer needed.
v4l2-compat.so still uses 32-bit APIs on purpose, so keep the
32bit-time QA skip for it.
Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Both ptests get killed by the OOM killer with the default 1G:
Out of memory: Killed process 390 (python3) total-vm:946408kB, anon-rss:909840kB
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
arrow/parser.py imports zoneinfo, falling back to backports.zoneinfo
which is not available either, so importing arrow fails on target:
ModuleNotFoundError: No module named 'zoneinfo'
Seen in python3-construct ptests.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
These CVEs are fixed in latest release however still show-up in open
CVE reports. Reason is that the DB contains entries:
{
"lessThan": "*",
"status": "affected",
"version": "1.23.3",
"versionType": "custom"
}
Which should mean that the first affected release is 1.23.3, however
without the upper limit it will match all higher releases.
The entry with >= 1.30.0 && < 1.30.6 cannot change the result as it
works by flagging CVEs where at least one version match is present.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-14 nginx-1.30.6 stable and nginx-1.31.7 mainline versions have
been released, with fixes for buffer overflow vulnerability when using
alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when
evaluating string expressions with variables (CVE-2026-93479), request
body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery
vulnerability when using TLS session ticket key rotation
(CVE-2026-97629), and use-after-free vulnerability when using
ngx_http_ssi_module with AIO (CVE-2026-97205).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Update tiobench from the legacy 0.3.3 SourceForge release to the
actively maintained upstream at github.com/mkuoppal/tiobench, pinned
to 11c965c8 (35 commits past v0.4.2). Picks up Clang build support,
random I/O test enhancements and cache handling updates.
Remove obsolete downstream patches, now fixed upstream:
avoid-glibc-clashes.patch - helper renamed to tt_aligned_alloc
0001-Specify-printf-formats.patch - format specifiers fixed
0001-Drop-inline-of-crc32-*.patch - crc32 inlining fixed
tiobench-makefile.patch - CC?= and LDFLAGS now upstream
Pass CFLAGS via EXTRA_OEMAKE. The upstream Makefile hardcodes
CFLAGS=-O2 -Wall and oe_runmake does not pass -e, so OE flags never
reached the compiler, losing -g (empty -dbg package), the hardening
flags, -ffile-prefix-map and the tune flags. DEFINES is separate, so
-DUSE_LARGEFILES is unaffected.
Install from do_install() rather than the upstream install target,
which has no DESTDIR support and installs tiosum.pl and README, both
long gone from the tree. COPYING is dropped from docdir as licenses
are handled by the license manifest.
Trim RDEPENDS to perl and perl-module-getopt-long; tiobench.pl only
uses warnings, strict and Getopt::Long, and strict is RPROVIDED by
perl. Data::Dumper and Term::ProgressBar are only reachable via the
opt-in --dump and --progress flags. Drop the redundant PV, already
set by the recipe filename.
Runtime validated on IQ-9075 EVK with tiotest and tiobench.pl across
multiple benchmark configurations, including tiobench.pl --help on an
image carrying only the trimmed RDEPENDS.
Build tested with gcc against glibc on aarch64 (armv8-2a).
Signed-off-by: Vaibhav Jindal <vaibjind@qti.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 0.23.95:
- fix: undefined behavior (UBSan) warnings in QR decoder and
scanner
- ci: address some issues for artifact generation
From 0.23.94:
- zbar now uses meson;
- ci was improved to allow unit tests on MacOS and Windows;
- Windows artifact now generate statically linked files;
- documentation updates.
- other minor changes to cleanup it a little bit after meson
migration.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
If polkit is enabled as distro feature, it makes sense to recommend the
polkit-group-rule-network package for the networkmanager-daemon package to
allow members of the network group to modify NetworkManager settings.
Signed-off-by: Weisser, Pascal <pascal.weisser.ext@karlstorz.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
kmscon builds with -std=gnu99 -Werror, and clang rejects the
declaration directly after the default: label in font_psf.c as a C23
extension. Give that case its own block scope.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The plugin imports modules from the datetime, json, misc, netclient,
numbers, profile and statistics python3 packages, so ptests of recipes
using it fail on images that don't pull those in otherwise.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
parse 1.22.2 made {:f} also accept nan/inf, which changed the generated
regex. Update the copied parse test expectation to match.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The live resolver tests use the system resolver configuration. When the
network is configured by the kernel ip= parameter and nothing in userspace
writes /etc/resolv.conf, the nameserver is only available in /proc/net/pnp
and the tests fail with "no nameservers". Seed resolv.conf from it when
it has no nameserver entry.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The final rpcbind check chained 'which systemctl && systemctl status ||
service rpcbind status', so on sysvinit images without systemctl it fell
back to 'service', which may not exist, and the tests were skipped even
though rpcbind was running. Check the status with the same init system
that was used to start it.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The GPU software ISP renders with GLES 2 through EGL and never uses
desktop GL, so depend on virtual/libgles2 instead of virtual/libgl.
Requiring virtual/libgl breaks machines whose GPU stack only provides
EGL and GLES, e.g. StarFive JH7110 with the PowerVR mesa-pvr.
Also carry a patch so libcamera doesn't redefine EGL_NO_X11 when an
older Mesa's egl.pc already passes -DEGL_NO_X11, which fails the build
with -Werror.
Signed-off-by: Joel Winarske <joel.winarske@linux.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.104.1:
- WireGuard packet buffering uses less memory while waiting for
peer handshakes.
- WireGuard packet queue depth scales with CPU core count, reducing
peak memory usage under heavy traffic.
- Client-side netmap caching improves start up speed and
connectivity when the Tailscale control plane is unreachable.
- WireGuard allocates a single packet buffer for batched I/O,
improving throughput and reducing memory usage.
- An issue that could prevent traffic over IPv6 link-local
addresses from flowing through direct and Tailscale Peer Relay
connections is resolved.
- An issue preventing Linux desktop detection from working on
Wayland environments is resolved.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
dumpcap is a lightweight capture tool which carries no dependencies on
wireshark. Break it into its own package, with an RDEPENDS back to
wireshark.
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 7.991:
- Upgraded included OpenSSL t- version 3.0.21 on all platforms.
- Fixed a memory-consumption hang in Ncat's HTTP proxy code that
affected both connect and listen modes, reported by kumama_nui.
- Patched our included libssh2 source with upstream fixes for
CVE-2025-15661, CVE-2026-7598, CVE-2026-55199, CVE-2026-55200,
CVE-2026-58050, and CVE-2026-58051. The version number has been
annotated as 1.11.1_NMAP1
- [Zenmap][GH#3347] Fixed several issues leading t- crashes when
parsing, editing, or saving command profiles containing '%'
characters.
- [NSE][GH#2272] smb-enum-shares failed t- produce output for valid
shares when an error was encountered on one share.
- [GH#3410] Fixed an issue where DNS resolution would incorrectly
fail t- match the same name in a different case.
- [NSE][GH#1066] Added service names for SSL-protected services
like amt-soap-https t- portrules for several scripts, ensuring
they run on these as well as the standard unencrypted services.
- Audited and converted most instances of strcat, strcpy, and
sprintf t- use bounded functions instead.
- [NSE][GH#2221] mysql-dump-hashes now uses the correct column name
for MySQL 5.7+
- [NSE][GH#2238] http-referer-checker was incorrectly fetching
off-host URLs. Now only URLs on the target are fetched.
- [GH#2122] When an interface is specified with -e, als- bind t-
the IP address for that device s- that it works for non-Linux
systems and non-root users.
- [Nsock][GH#1939] When nsock_iod_set_localaddr() is used,
nsock_connect_*() will now treat errors in bind(2) as connection
failure.
- [GH#2732] Fix a potential crash on 32-bit platforms in debug mode
due to incorrect format specifier for 64-bit integer type.
[Christopher Chavez]
- [GH#3201][GH#3367] Increase line length limit for
nmap-service-probes and correctly handle lines that are to- long.
[@liquidpele, Ashutosh Kumar Singh]
- [GH#3414] Avoid out-of-bounds read when parsing PTR domain names.
[@toor11 (Juri)]
- [GH#2245] Ensure variables updated by signal handlers are
volatile sig_atomic_t.
- [Ncat][GH#1410] Fix an assertion failure (count <= INT_MAX) in
ncat -lk in some cases where stdin or a listening socket produces
an error.
- [NSE][GH#1946] Fix a cryptic error in smb-enum-services, "Server
returned less data than needed for header" when smb.start_smb()
failed.
- Fixed an issue with parsing nmap-service-probes that could cause
a corrupted file t- crash Nmap. Reported by Muhammed Hussein.
- [NSE][GH#2016] Removed hostmap-bfk.nse, since the service it used
shut down.
- Fixed several issues reported by Himanshu Anand: infinite loop in
TCP options parsing and out-of-bounds memory read in IPv4 OS
detection; integer underflow in IPv6 extension header processing;
and undefined behavior in DNS label parsing.
- [GH#2721] Added checks for returned pointers from OpenSSL
allocation functions.
- [GH#1546] Fix an incorrect assertion "timeout / 1000 <= (long)
o.scan_delay" in traceroute which failed for timeouts greater
than 1 second when there was n- scan delay.
- [GH#3175] The --stats-every option can now be used in conjunction
with --noninteractive. Previously, n- stats messages were printed
if a TTY was not attached.
- [GH#3375] Nmap can now be built with OpenSSL 4.0
- [Nping][GH#1751] The --rate option will not accept a rate higher
than 1000 packets per second, since Nsock timers have millisecond
resolution. Use --delay 0 for unlimited rate.
- [Nping] Fixed several issues with Nping in IPv6 mode including:
+ [GH#1261] Incorrect BPF generated leading t- "expression
rejects all packets"
+ [GH#3215] Incorrect constant used t- check for IP version in
Ech- Server
- [NSE][GH#3368] Fixed an out-of-memory issue in packet.lua when
parsing a zero-length TCP header option. [Maxim Suhanov]
- Fixed an issue where Nmap OS scan trusts a packet's ip_len t-
size a CRC32 computation over TCP RST payload data, which may
result in reading arbitrary heap data. Reported by Michael
Bommarito.
- [Ncat][GH#3005] Correctly report listening port number. `ncat -l
-p 0` will cause Ncat t- listen on an ephemeral port, but it was
reporting itself as listening on port 0.
- [Ncat][GH#1672] Fixed an issue where Ncat in server mode would
quit without printing the last received data on a connection,
particularly affecting SCTP.
- [Ncat][GH#2827] Fixed an issue where Ncat in --send-only mode
would ignore disconnects and crash when it tries t- send data t-
a disconnected client.
- [Ncat][GH#3291] Fixed an issue where Ncat on Windows would quit
after 2 minutes due t- an OS-enforced timeout on the half-open
TCP socket used to emulate STDIN.
- [Nping][GH#564] Allow Nping t- fall back t- TCP Connect mode on
Windows when Npcap is not installed.
- [Ncat] Fixed several issues reported by Muhammed Hussein
involving crashes in Ncat's server-mode HTTP proxy, as well as
one code-quality issue with its Telnet negotiation code.
- [Nsock][GH#2595] Fix an issue where Nsock's SOCKS4 proxy code
would send additional null bytes on Windows and other platforms
where the compiler does not understand __attribute__((packed)).
[Daniel Miller]
- The --release-memory option is now a no-op. Nmap will always run
finalization routines that release allocated memory before
closing.
- Fixed an integer underflow in service_scan.cc that would cause
little-endian integers extracted from the beginning of a service
banner t- be interpreted as 0. Discovered with AFL++ by Malek
Althubiany.
- [Nsock][GH#583] Use OpenSSL security levels and callbacks t-
prevent errors connecting t- certain insecure targets when using
NSOCK_SSL_MAX_SPEED. The default, as used in Ncat, now uses
stricter-than-default security level.
- [GH#410] If a target times out due t- --host-timeout, d- not
perform traceroute.
- [Nping][GH#380] Disallow combining Ethernet-related options like
--dest-mac with --send-ip
- [NSE][GH#3250][GH#3206] Fix assertion failures in cases where
connect or send returns immediately with a status other than
ERROR, e.g. TIMEOUT or CANCELED. [Daniel Miller]
- [Ncat][GH#290] Enable ncat -l --ssl t- use DHE and ECDHE cipher
suites for perfect forward secrecy.
- Fix a crash when writing long CPE strings t- output. Reported by
Harshit Gupta. [Daniel Miller]
- [Ncat] Fix several cases where Ncat's SOCKS5 client could
interpret uninitialized data as protocol data, triggered by a
malicious SOCKS5 proxy server. N- code execution or application
crash is possible. Reported by Govind Pratap Singh. [Daniel
Miller]
- [Nping] Fix a out-of-bounds access in Nping Ech- client allowing
a malicious Nping EchoServer t- zer- 32 bytes of memory outside
the packet buffer. Reported by Harshit Gupta. [Daniel Miller]
- Fix a 1-byte overrun (read) while reading certain crafted DNS
labels, reported by Peter Parker. [Daniel Miller]
- [NSE][GH#3317] Function url.build_path was mangling special
characters in URL path segments. [nnposter]
Drop 0004-libdnet-fix-PF_PACKET-conftest-nested-function.patch
because the check for PF_PACKET that failed with clang has been
fixed with commit 33c39cd38 in the upstream of nmap.
Set OEQA_BUILDPATHS_SKIP to ignore upstream HOME path match and
avoid buildpaths QA error.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
- New –format string %{progress-conemu}, and option –conemu, to show
progress in the terminal title tab on terminals with ConEmu OSC 9;4
support
- Eliminate potential for closure of standard output under a combination of
error conditions when using –monitor mode
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Leon Anavi
Etienne Cordonnier
Khem Raj
Darsh Kelaiya
Ankur Tyagi
prasanth
Peter Marko
shenlf
Vaibhav Jindal
Adam Duskett
Weisser, Pascal
Jason Schonberg
Joel Winarske
Alex Kiernan