Commit Graph

24340 Commits

Author SHA1 Message Date
Gyorgy Sarvari 57e41a048e gnome-settings-daemon: upgrade 42.1 -> 42.2
Changelog:
- Translation updates
- Drop direct uses of GSlice

A11y-settings:
- Enable toolkit-accessibility when using the magnifier

Xsettings:
- Simplify fetching string for an enum value
- Remove direct mapping from gtk-im-module to Gtk/IMModule

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 417d021654 gnome-desktop: upgrade 42.0 -> 42.10
Bug fix release.

https://gitlab.gnome.org/GNOME/gnome-desktop/-/blob/42.10/NEWS

Changelog:
Version 42.10
- Updated translations

Version 42.9
- No changes

Version 42.8
- No changes

Version 42.7
- No changes

Version 42.6
- No changes

Version 42.5
- Translation updates

Version 42.4
- No changes

Version 42.3
- No changes

Version 42.2
- Don't try to use bubblewrap inside snaps

Version 42.1
- Fix build_gtk4 option
- Translation updates

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 3c0ab96b27 gnome-control-center: upgrade 42.0 -> 42.10
These are bugfix releases.

(Note that there were no 42.6, 42.7 and 42.8 tags)

================
Version 42.10
================

- Fix monitor order in display settings
- Add 32:9 aspect ration in display settings
- Fix warning in user  panel in initialization of avatar widget
- Updated translations

================
Version 42.9
================

- Updated translations

Network:
- Fix possible race in tests

================
Version 42.5
================

- Updated translations
- Added various accessibility labels
- Initialize locale early

About
- Don't load version.xml info we don't use

Applications
- Don't recurse into symlinks when clearing app cache

Color
- Fix crash when there's no device rows to show

Cellular
- Improve dbus error messaging
- Handle cases when SIM ID is not present
- Prevent duplicate entries in the SIM providers list

Keyboard
- Fix activation of input source toggle button
- Fix permission_acquired always returning FALSE

Mouse
- Set rows as actiavatable widgets

Network
- Fix crashes when EAP password is missing
- Fix wrong signal of SEA password visibility toggle
- Prevent crash when disconnecting wifi device
- Use mime-types for file chooser filtering TLS files

Online Accounts
- Fix crash when failing to find GOA helper executable

Power
- Prevent terminal from getting spammed with ALS logs

Printers
- Fix loading of UI resources
- Show empty-state when removing the last printer

Region
- Fix creating rows for locales without a country
- Fix critical when changing language
- Fix permission_acquired always returning FALSE

Search
- Fix reordering of list rows

Users
- Show a fallback avatar when failing to load one

Wifi
- Allow accessing settings of known wifi networks

================
Version 42.4
================

- Updated translations

Background
- Restore support for multiple file selection
- Allow more image formats

Display
- Fix primary monitor selection

Network
- Fix network profiles shown on wrong device
- Various crash fixes

Power
- Fix blank-screen settings not applying
- Fix "Power Button Behavior" setting not applying

User Accounts
- Disconnect fingerprint reading devices when closing dialog

Sharing
- Don't set remote-desktop password entry if pw_generate fails
- Don't assert if we can't find the widget for a profile

================
Version 42.3
================

- Updated translations

Display
- Use virtual clone modes when mirroring

Network
- Prevent crash by disconnecting device.
- Fix Wi-Fi network with "&" in name not appearing.
- Fix warning when panel closed.

================
Version 42.2
================

- Updated translations

Applications
- Fix Snap permissions support failing to compile
- Fix CcInfoRow having the wrong parent
- Fix crash crash when switching between two apps

Background
- Make sure the size of the light/dark previews are the same

Keyboard
- Fix crash resetting all keyboard shortcuts

Network:
- Stop freeze when closing wired connection properties with Escape

Sharing
- Fix close button on Verify Encryption dialog
- Turn off RDP gsettings key when turning off RDP

Shell
- Initialise locale early

Sound
- Update theme correctly so other apps respond to change

================
Version 42.1
================

- Updated translations

Display
- Various small behavior improvements
- Fix monitor labels

Network
- Improve handling of VPN connections

Online Accounts
- Fix behavior of helper application on X11
- Fix changes to online accounts services not applying correctly

User Accounts
- Various small polishments

Wacom
- Properly translate various strings

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 264e4d8266 gnome-bluetooth: upgrade 42.3 -> 42.8
Changelog:
ver 42.8:
This update fixes problems with some devices not disappearing from the list
of quick settings in GNOME Shell.

ver 42.7:
This version fixes bugs that stopped the Obex Push server from automatically
accepting files from paired devices and caused the device's Connection switch to
appear out of sync with the connection state. This version also contains build
fixes and updated translations.

ver 42.6:
This version fixes problems with icons for mice and tablets, updates status labels
to be dimmed by default, and contains updated translations.

ver 42.5:
This version fixes the pairing dialogue misbehaving for some Bluetooth Classic
keyboards, with the passkey disappearing after the first digit is typed.

ver 42.4:
This version switches the power state API added in version 42.3 to be backed
by the experimental PowerState property in bluetoothd. The API will not show
transitional states if the version of bluetoothd is too old.

The battery API now exports the battery information for all Bluetooth devices
listed in UPower, not just the ones re-exported from bluetoothd.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 2d4f0e11a8 gjs: upgrade 1.72.2 -> 1.72.4
Changelog:
1.72.3:
- Fix for crash after build against libffi 3.4.2 ported from the development
  branch.

1.72.4:
- Various fixes ported from the development branch.

- Closed bugs and merge requests:
  * log_set_writer_func is not safe to use
  * Gnome-Shell 42 - crash after login (general protection fault)
  * Static methods on classes from GObject introspection are now present on JS
    classes that inherit from those classes.
  * Enabling window-list extension causes gnome-shell to crash when running
    "dconf update" as root
  * Possible errors in cairo enums
  * cairo.SVGSurface need finish() and flush() to finalize painting
  * Handle transfer-none string return value from vfunc implemented in JS
  * GJS freezes, program stops responding, error states Gtk4 EventController
    GestureClick returns incorrect state- Gdk.ModifierType on mouse button press
    in X11
  * gnome-shell crashes on exit in js::gc::Cell::storeBuffer
  * Memory leak with GError
  * GVariant return values leaked
  * GBytes's are leaked when passed as-is to a function
  * Transformed GValues are leaking temporary instances
  * GHash value infos are leaked
  * "flat" arrays of GObject's are leaked
  * Gjs console leaks invalid option errors

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari ccb734ae47 evince: upgrade 42.3 -> 42.4
Changelog:

build:
  * Narrow the version to enable nautilus plugin
  * Disable nautilus extension by default [NB: it is controlled by PACKAGECONFIG in meta-oe]]

comics:
  * Avoid critical when pixbuf can't be rendered
  * Better debug on archive error
  * Fix crash that can happen if archive is damaged
  * Still try to open broken comics

shell:
  * Fix use-after-free on a modified document
  * Use default color when annotation has no color
  * recent-view: Update for new gnome-desktop API

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari bd76c44c9e mutter: upgrade 42.0 -> 42.9
These releases contain many bugfixes.

Changelog:

42.9
====
* Do not overwrite previously set offsets on attach
* Don't disable KMS modifiers on newer i915 systems
* Reduce memory bandwidth usage in some GPUs
* Fix pointer constrains with subsurfaces
* Fix partial updates on offscreen rotated screens
* Do not require a physical device to update pointer visibility
* Fix Xwayland focus regressions

42.8
====
* Skip resize effects for tiled windows during user grabs
* Disable direct scanout during drag-n-drop operations
* Ignore unmapped subsurfaces in direct scanout check
* Fix cursor disappearing over windows during grabs
* Fix cursor position in window screencasts
* Fix initialization of keyboard accessibility
* Don't allow window activation to break global grabs
* Fixed crashes
* Plugged leak
* Misc. bug fixes and cleanups

42.7
====
* Always send modifiers to clients if supported
* Make NVIDIA + gbm use atomic mode setting
* Disable client modifiers with amdgpu driver
* Handle stage view updates without allocation more gracefully
* Fix window screenshots being cut off at the bottom right
* Implement wl_output v3 and v4
* Fix recalculating viewport after window resize
* Fixed crashes
* Misc. bug fixes and cleanups

42.6
====
* Add quirk to work around issue with Mali GPUs
* Stop sending frame callbacks to minimized clients
* Fixed crashes
* Misc. bug fixes and cleanups

42.5
====
* Improve heuristics for adding fallback monitor modes
* Fixed crash
* Misc. bug fixes and cleanups

42.4
====
* screencast: Set correct stride when using dmabufs
* Fix glitches in apps using subsurfaces
* Reduce client work when entering overview
* Highlight actors becoming reactive under the pointer
* Fall back to ARGB if XRGB is not supported
* Support direct scanout on GPUs without modifiers support
* Fix registering as X11 window manager if GDK_BACKEND is set
* Fixed crash
* Plugged leak
* Misc. bug fixes and cleanups

42.3
====
* wayland: Fix rotation transform
* Fix dma-buf screencast regression
* Fix monitor mirroring in some cases
* Fixed crash
* Plugged leak

42.2
====
* Don't use direct scanout for transparent windows
* Fix initialization of privacy mode in displays that support it
* Fix --replace again
* Improve picking a window for direct scanout
* Do not allow windows to steal focus when the shell has a grab
* Fix night light without GAMMA_LUT property
* Fixed crash
* Misc. bug fixes

42.1
====
* Send correct LEAVE events when entering windows
* Be more forgiving with wrongly sized clients
* Add ClutterInputCapabilities enum and device property
* Fall back if COPY_MODE_SECONDARY_GPU fails to init
* Fix missing root window properties after XWayland start
* wayland/shm: Add support for ABGR8888 and XBGR8888 formats
* Keep actors dirty if a redraw was queued up during paint()
* Fix overview painting of shaped texture with layer snippets
* Survive missing GAMMA_LUT KMS property
* Record current event when going through event filters
* Pass events to pointer a11y before going through filters
* Update cursor when scaled or transformed
* Fix screen cast when DMA buffer fails or can't be used
* Repick when pointer actor goes unmapped
* Improve IM support
* Allow using dumb buffers for cursor sprites
* wayland/dma-buf: Only advertise supported formats
* Fix screen cast cursor metadata with unthrottled input
* Fixed crashes
* Plugged memory leak
* Misc. bug fixes and cleanups

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 8697354f8f tracker-miners: update 3.2.1 -> 3.2.2
Changelog:
- Backport seccomp rules for rseq and mbind syscalls
- Translation updates

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari f53ab67e47 yelp: patch CVE-2025-3155
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-3155

Pick the patch that refers to this CVE explicitly in its description.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Wang Mingyu 6c5f2e9e50 sanlock: upgrade 3.8.4 -> 3.8.5
setuptools.patch
removed since it's included in 3.8.5.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit cc532b9d4e)

Shortlog:
python: Replace distutils with setuptools
sanlock: fix memory leak of lockspace renewal_history
sanlock: fix pthread_create error check
Revert "sanlock: Shrink thread pool when there is no work"
sanlock: fix pthread_create error paths
sanlock: acquire should ignore unused options str
sanlock: use helper to set max_sectors_kb

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 7adb0931bc python3-paramiko: upgrade 2.10.3 -> 2.10.6
Bugfix releases.

Changelog:
2.10.4:
- Servers offering certificate variants of hostkey algorithms
  (eg ssh-rsa-cert-v01@openssh.com) could not have their host
  keys verified by Paramiko clients, as it only ever considered
  non-cert key types for that part of connection handshaking.
  This has been fixed.
- PKey instances’ __eq__ did not have the usual safety guard in
  place to ensure they were being compared to another PKey object,
  causing occasional spurious BadHostKeyException (among other
  things). This has been fixed.
- Update camelCase method calls against the threading module to
  be snake_case; this and related tweaks should fix some deprecation
  warnings under Python 3.10.

2.10.5:
- Windows-native SSH agent support as merged in 2.10 could encounter
  Errno 22 OSError exceptions in some scenarios (eg server not cleanly
  closing a relevant named pipe). This has been worked around and
  should be less problematic.
- OpenSSH 7.7 and older has a bug preventing it from understanding
  how to perform SHA2 signature verification for RSA certificates
  (specifically certs - not keys), so when we added SHA2 support it
  broke all clients using RSA certificates with these servers. This
  has been fixed in a manner similar to what OpenSSH’s own client
  does: a version check is performed and the algorithm used is
  downgraded if needed.
- Align signature verification algorithm with OpenSSH re: zero-padding
  signatures which don’t match their nominal size/length. This shouldn’t
  affect most users, but will help Paramiko-implemented SSH servers
  handle poorly behaved clients such as PuTTY.

2.10.6:
- Raise SSHException explicitly when blank private key data is loaded,
  instead of the natural result of IndexError. This should help more
  bits of Paramiko or Paramiko-adjacent codebases to correctly handle
  this class of error.
- Update SSHClient so it explicitly closes its wrapped socket object
  upon encountering socket errors at connection time. This should help
  somewhat with certain classes of memory leaks, resource warnings,
  and/or errors (though we hasten to remind everyone that Client and
  Transport have their own .close() methods for use in non-error
  situations!).

https://www.paramiko.org/changelog.html

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 5e331f8434 freerdp: patch CVE-2024-32658
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32658

Backport the patch that was marked to resolve this issue by the
relevant Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vpv3-m3m9-4c2v

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari eb9c9730a4 freerdp: patch CVE-2024-32460
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32460

Backport the patch that is marked to resolve this vulnerability
by the relevant Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4rr8-gr65-vqrr

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari fe05b2e186 freerdp: patch CVE-2024-32459
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32459

Pick the patch that is marked to resolve this vulnerability by
the relevant Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cp4q-p737-rmw9

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 8bce3cf874 freerdp: patch CVE-2024-32458
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32458

Pick the patch that is marked to resolve this vulnerbility by the
relevant Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vvr6-h646-mp4p

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari dda2b96cb2 freerdp: mark CVE-2024-32041 patched
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32041

Both the relevant Github Advisory[1] and Debian[2] states that the
same patch fixes this vulnerability as CVE-2024-32039.

Therefore add this CVE ID to the same patch's CVE tag.

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5r4p-mfx2-m44r
[2]: https://security-tracker.debian.org/tracker/CVE-2024-32041

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 23a46eae5f freerdp: patch CVE-2024-32040
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32040

Pick the patch that is marked to resolve this vulnerability, from
the related Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-23c5-cp23-h2h5

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari cebeb9b1a6 freerdp: patch CVE-2024-32039
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32039

Pick the commit that is marked to resolve this vulerability, mentioned
by the Github advisory[1].

[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5h8-7j42-j4r9

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 86566fac39 freerdp: patch CVE-2024-22211
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-22211

Pick the patch that is referenced by the NVD report as the solution.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 99ffae0ed0 freerdp: patch CVE-2023-40589
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-40589

Pick the patch that was identified[1] by Debian to solve the issue
on the 2.x branch.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-40589

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari d3eea640d3 freerdp: add ptest support
The tests take about 50s to execute on my machine.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari bb987740aa freerdp: patch CVE-2023-40569
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-40569

Pick the patch that was identified[1] by Debian as the solution.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-40569

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari d4e1c145e6 freerdp: patch CVE-2023-40181
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-40181

Pick the patch that was identified[1] by Debian as the solution.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-40181

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari c9affa4bd5 freerdp: patch CVE-2023-39353
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-39353

Pick the patch that was identified[1] by Debian as the solution.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-39353
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari c793926ade freerdp: patch CVE-2023-39352
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-39352

Backport the commit that was identified[1] by Debian as the solution.

Note: WINPR_ASSERT macro calls have been changed to assert calls, as this
macro doesn't exist yet in this version. Looking at the implementation[2],
it is basically an assert call with a bit verbose logs.
Even though the original implementation also defines a no-op version, the
assert version is enabled by default.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-39352
[2]: https://github.com/FreeRDP/FreeRDP/blob/2.11.0/winpr/include/winpr/assert.h#L31

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari f4a93a4c96 freerdp: patch CVE-2023-39351
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-39351

Pick the patch that is mentioned by Debian[1] to solve the problem.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-39351

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 9e67ae18b0 freerdp: patch CVE-2023-39350
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-39350

Pick the patch that was identified[1] by Debian as the solution.
Note that the NVD report also references a commit as a patch - however
that seems to be incorrect. Although the NVD patch also solves a
vulnerability, it solves a different CVE (CVE-2023-39353), not this.

[1]: https://security-tracker.debian.org/tracker/CVE-2023-39350

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari f0e689ff4d freerdp: patch CVE-2022-39320
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-39320

Take the patch that Debian has determined[1] to solve the issue.

[1]: https://security-tracker.debian.org/tracker/CVE-2022-39320

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari 8cea479b35 freerdp: mark CVE-2022-39317 patched
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-39317

Both Ubuntu[1] and Red Hat[2] confirms that this vulenrability is
fixed by the same patch as CVE-2022-39316.

Therefore add this CVE ID to the patch's tag also.

[1]: https://ubuntu.com/security/CVE-2022-39317
[2]: https://bugzilla.redhat.com/show_bug.cgi?id=2143643

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari af8f2af56b freerdp: patch CVE-2022-39282
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-39282

Pick the patch that's description matches the CVE description.
(Debian also considers the same patch[1] the fix)

[1]: https://security-tracker.debian.org/tracker/CVE-2022-39282

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari ee510136eb freerdp: patch CVE-2022-24883
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-24883

Pick the patch that is mentioned in teh NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Ankur Tyagi f4ed05a423 influxdb: ignore CVE-2024-30896
As mentioned in the comment[1], vulnerability is in
/api/v2/authorizations API which only exists in 2.x, 1.x is not affected.

Details: https://nvd.nist.gov/vuln/detail/CVE-2024-30896

[1] https://github.com/influxdata/influxdb/issues/24797#issuecomment-2514690740

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 2f1d7a8597)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:29 +01:00
Gyorgy Sarvari b1794b6239 boinc-client: mark CVE-2013-2018 patched
Details: https://nvd.nist.gov/vuln/detail/CVE-2013-2018

According to oss-security email[1], version 7.0.45 included
the fixes[2][3][4]

[1]: https://www.openwall.com/lists/oss-security/2013/04/29/11
[2]: https://github.com/BOINC/boinc/commit/6e205de096da83b12ffb2f0183b43e51261eb0c4
[3]: https://github.com/BOINC/boinc/commit/e8d6c33fe158129a5616e18eb84a7a9d44aca15f
[4]: https://github.com/BOINC/boinc/commit/ce3110489bc139b8218252ba1cb0862d69f72ae3

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 2a78ad8813)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Gyorgy Sarvari 680570c8b6 fluidsynth: patch CVE-2025-56225
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-56225

Pick the PR content referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Gyorgy Sarvari f1cfd1ec5d openvpn: ignore CVE-2024-4877 and CVE-2025-13751
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-4877
https://nvd.nist.gov/vuln/detail/CVE-2025-13751

The vulnerabilities are specific to Windows platform, not relevant to OE.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Gyorgy Sarvari c03adad7ea python3-blivet: upgrade 3.4.3 -> 3.4.4
Bugfix release.

Changelog:
 - Use LVM PV format current_size in LVMVolumeGroupDevice._remove
 - Correctly set vg_name after adding/removing a PV from a VG
 - Do not crash when changing disklabel on disks with active devices
 - ActionDestroyDevice should not obsolete ActionRemoveMember
 - Correctly set compression and deduplication for existing VDO pools
 - Correctly cancel configure actions in cancel()
 - Set partition flags after setting parted filesystem

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
wangmy 8a3e79cf68 python3-croniter: upgrade 1.3.5 -> 1.3.7
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 546ccc4a5b)

Changelog:
 - fix tests
 - Fix croniter_range infinite loop

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Xu Huan b2cd699bbb python3-croniter: upgrade 1.3.4 -> 1.3.5
Signed-off-by: Xu Huan <xuhuan.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 94f564fc96)

Changelog:
Add Python 3.10 support.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Jackson eb933671af tcpreplay 4.4.4: Fix CVE-2025-9384
There is a NULL Pointer Dereference in ports2PORT when the user passes ill-formatted
portmap string to tcprewrite with option -r or --portmap

Upstream Repository: https://github.com/appneta/tcpreplay.git

Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-9384
CVE: CVE-2025-9384

Signed-off-by: Jackson <jacksonj2@kpit.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Wang Mingyu 70b16622ab python3-smpplib: upgrade 2.2.2 -> 2.2.3
Changelog:
Fix: correct UCS2 part length following #184

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d4cb5d585d)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Wang Mingyu 126d5246db python3-smpplib: upgrade 2.2.1 -> 2.2.2
Changelog:
==========
 Added python 3.10 tests to CircleCI
 fix socket recv error being silently ignored
 Refactored Client.read_pdu()
 Refactored Client.send_pdu()
 increment sequence of commands as spec (fixes #214)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 50bbe6ab5f)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Xu Huan b7ab23179d python3-werkzeug: upgrade 2.1.1 -> 2.1.2
Changelog:
==========
    The development server does not set Transfer-Encoding: chunked for 1xx, 204, 304, and HEAD responses.
    Response HTML for exceptions and redirects starts with <!doctype html> and <html lang=en>.
    Fix ability to set some cache_control attributes to False.
    Disable keep-alive connections in the development server, which are not supported sufficiently by Python’s http.server.

Signed-off-by: Xu Huan <xuhuan.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0704ebad0d)

Rebased patches in Kirkstone.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Wang Mingyu 01098510f3 python3-bidict: upgrade 0.22.0 -> 0.22.1
Changelog:
==========
-Only include the source code in the source distribution. This reduces the
 size of the source distribution from 200kB to 30kB.
-Fix the return type hint of bidict.inverted() to return an Iterator, rather
 than an Iterable.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-30 18:59:28 +01:00
Gyorgy Sarvari 12d4f40a4a python3-twisted: patch CVE-2022-24801
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-24801

Pick the commits from the pull request that is referenced by the NVD report.

(The full set is consisting of 13 patches, but the ones that only updated
news/readme/typo fixes in comments were not backported)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:07 +01:00
Gyorgy Sarvari d29ee9b387 python3-werkzeug: ignore CVE-2026-21860
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-21860

The issue affects only Windows operating systems.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:06 +01:00
Gyorgy Sarvari 6d01018250 python3-ldap: patch CVE-2025-61912
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-61912

Pick the patch that's mentioned by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:05 +01:00
Gyorgy Sarvari 3a9a13832b python3-ldap: patch CVE-2025-61911
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-61911

Pick the patch referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:04 +01:00
Gyorgy Sarvari e07db81979 python3-eventlet: patch CVE-2025-58068
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-58068

Pick the patch mentioned in the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:04 +01:00
Gyorgy Sarvari a14d2e2df1 python3-eventlet: upgrade 0.33.0 -> 0.33.3
Bugfix releases.

Changelog:
0.33.3:
* dnspython 2.3.0 raised AttributeError: module 'dns.rdtypes' has no
  attribute 'ANY' https://github.com/eventlet/eventlet/issues/781

0.33.2:
* greenio: GreenPipe/fdopen() with 'a' in mode raised io.UnsupportedOperation:
  File or stream is not writable https://github.com/eventlet/eventlet/pull/758

0.33.1:
* Prevent deadlock on logging._lock https://github.com/eventlet/eventlet/issues/742

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:03 +01:00
Gyorgy Sarvari e660c4f8dc squid: upgrade 4.15 -> 4.17
These are bugfix releases.

Changelogs:
4.17:
- WCCP: Validate packets better

4.16:
- Regression Fix: --with-valgrind-debug build broken since 4.15
- Bug 5129 pt1: remove Lock use from HttpRequestMethod
- Bug 5128: Translation: Fix '% i' typo in es/ERR_FORWARDING_DENIED
- Bug 4528: ICAP transactions quit on async DNS lookups

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2026-01-20 18:22:02 +01:00