mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-13 15:47:23 +00:00
Code Issues Projects Releases Wiki Activity
38,675 Commits 65 Branches 0 Tags
9129c27a01a4b07b341b11cf9b21169466deba94
Commit Graph
38675 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Yogita Urade 9129c27a01 python3-pillow: Fix CVE-2026-59205 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:51 +05:30
Yogita Urade 1cec74bf36 python3-pillow: Fix CVE-2026-59203 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:51 +05:30
Yogita Urade 8963cc4576 python3-pillow: Fix CVE-2026-59200 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:50 +05:30
Yogita Urade 1d22c2e3b3 python3-pillow: Fix CVE-2026-59199 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:49 +05:30
Yogita Urade dbf1a37262 python3-pillow: Fix CVE-2026-59198 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:49 +05:30
Yogita Urade 293c0ee6ef python3-pillow: Fix CVE-2026-59197 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:48 +05:30
Yogita Urade 6c5fed0692 python3-pillow: Fix CVE-2026-55380 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:48 +05:30
Yogita Urade c782505854 python3-pillow: Fix CVE-2026-54059 CVE-2026-54060 CVE-2026-55379 
This patch applies the upstream fix as referenced in [2], [3]
and [4], using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d
[2] https://nvd.nist.gov/vuln/detail/cve-2026-54059
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-54060
[4] https://nvd.nist.gov/vuln/detail/cve-2026-55379

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:47 +05:30
Yogita Urade 11d0cfd949 redis: fix CVE-2026-66373 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/redis/redis/commit/4f62a8bf15c634187d8a87d874f8988032f90b6c
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-66373

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:47 +05:30
Yogita Urade bb81197434 redis: fix CVE-2026-25243 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/redis/redis/commit/b9dde6fc25dec6191b18374335a076a7b31e3d02
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-25243

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:46 +05:30
Yogita Urade 77ca1bfa10 redis: fix CVE-2026-23631 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/redis/redis/commit/0cca172a174642bdae03b871615227896274d9bb
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-23631

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:46 +05:30
Yogita Urade 0d975df7da redis: fix CVE-2026-23479 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/redis/redis/commit/c14e9925e571c3c8ecbeb8632fe834faa32175ea
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-23479

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:45 +05:30
Hetvi Thakar 66ad06b673 nginx: Ignore CVE-2026-60005 
Analysis:
- CVE-2026-60005 affects the optional ngx_http_slice_module [1].
- The slice module is not built by default and requires the explicit
  --with-http_slice_module configure option, which neither Wrynose nginx
  recipe enables by default [1][2].
- Mark the CVE not applicable only when that option is absent; report it
  as unpatched when a bbappend enables the module.

Reference:
[1] https://github.com/advisories/GHSA-vxcv-h5wj-jxr5
[2] https://nginx.org/en/docs/configure.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:45 +05:30
Hetvi Thakar 9b332333cd nginx: Ignore CVE-2026-40460 
Analysis:
- CVE-2026-40460 affects nginx only when the HTTP/3
  QUIC module is enabled [1].
- The module requires the explicit --with-http_v3_module configure
  option, which neither Wrynose nginx recipe enables by default [2].
- Mark the CVE not applicable only when that option is absent; report it
  as unpatched when a bbappend enables the module.

Reference:
[1] https://nginx.org/en/security_advisories.html
[2] https://nginx.org/en/docs/configure.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:44 +05:30
Hetvi Thakar 29166e9b7a nginx: fix CVE-2026-56434 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/ddde692db11ab8238e9ca661007f64c9f6d764d2
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:43 +05:30
Hetvi Thakar a34e2f8489 nginx: fix CVE-2026-42533 
These patches apply the upstream fix sequence as referenced in [6],
using the commits shown in [1] through [5].

Use version-specific fourth patches: nginx 1.28.3 lacks
ngx_http_proxy_v2_module, while the nginx 1.29.7 backport retains the
applicable proxy-v2 bounds checks with its older request-body layout.

[1] https://github.com/nginx/nginx/commit/ea47fabf55e2bc9192ddc27f52486b4e58d5e007
[2] https://github.com/nginx/nginx/commit/7ac67898bdfed2140a1bedcda252074cca11f494
[3] https://github.com/nginx/nginx/commit/78950bdcd443830bde00f6844dba3033c18862b1
[4] https://github.com/nginx/nginx/commit/326b17b0038321c29252e79bf4c53d4773fcb8b5
[5] https://github.com/nginx/nginx/commit/97e40e59b7b4ad6aa36f54ce4f1e64d1e98f24cb
[6] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:43 +05:30
Hetvi Thakar a4a3880b71 nginx: fix CVE-2026-48142 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/60c4243eb8775d51662a01def8a7dad5d9fb34a7
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:42 +05:30
Hetvi Thakar cd674e9d15 nginx: fix CVE-2026-42055 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

Use version-specific backports: nginx 1.28.3 contains only the affected
gRPC module, while nginx 1.29.7 also contains ngx_http_proxy_v2_module
and therefore carries the complete upstream changes for both modules.

[1] https://github.com/nginx/nginx/commit/131be8514da8985b15b74150521afedbf9cc4ea3
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:41 +05:30
Hetvi Thakar ed51539d6e nginx: fix CVE-2026-9256 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/3f135ae2eb60ce376196c898a6c7cb4d774f7068
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:41 +05:30
Hetvi Thakar 67bd79fa89 nginx: fix CVE-2026-42945 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/524977e7c534e87e5b55739fa74601c9f1102686
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:40 +05:30
Hetvi Thakar c20a117ce1 nginx: fix CVE-2026-42946 
These patches apply the upstream fix sequence as
referenced in [3], using the commits shown in [1] and [2].

[1] https://github.com/nginx/nginx/commit/baef7fdac28e4e1fe26509b50b8d15603393e28e
[2] https://github.com/nginx/nginx/commit/39d7d0ba0799fcff6baee52b6525f45739593cfd
[3] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:40 +05:30
Hetvi Thakar 3c92a9dd3a nginx: fix CVE-2026-42934 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/54b7945961b2eaafc480d6b85d9635d0db1c126a
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:39 +05:30
Hetvi Thakar d023b652ac nginx: Fix CVE-2026-40701 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/nginx/nginx/commit/d2b8d47741820c9fb134c6731ecb40b21f3085b1
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:39 +05:30
Hetvi Thakar 578ad71dfe wireshark: upgrade 4.6.4 -> 4.6.8 
Upgrade Wireshark to the latest 4.6 stable release. This brings
security and bug fixes from releases 4.6.5 through 4.6.8.

Release notes:
[1] https://www.wireshark.org/docs/relnotes/wireshark-4.6.5.html
[2] https://www.wireshark.org/docs/relnotes/wireshark-4.6.6.html
[3] https://www.wireshark.org/docs/relnotes/wireshark-4.6.7.html
[4] https://www.wireshark.org/docs/relnotes/wireshark-4.6.8.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:38 +05:30
Hetvi Thakar 88e41d1f3b python3-pyjwt: fix CVE-2026-101918 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:38 +05:30
Hetvi Thakar f1444be16f python3-pyjwt: fix CVE-2026-102275 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:37 +05:30
Hetvi Thakar 395753da37 python3-pyjwt: fix CVE-2026-101917 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:37 +05:30
Hetvi Thakar 95a0df87a1 python3-pyjwt: fix CVE-2026-102271 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:36 +05:30
Hetvi Thakar 2d80df4fa5 python3-pyjwt: fix CVE-2026-102268 and CVE-2026-102270 
This patch applies the shared upstream fix as referenced in [2] and [3],
using the commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9
[3] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:36 +05:30
Hetvi Thakar 6febd066de python3-pyjwt: fix CVE-2026-102267 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:35 +05:30
Hetvi Thakar fb76c963d9 python3-pyjwt: fix CVE-2026-102269 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/e6f48401001609a8f99e71fcaf355fb895d508a8
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:35 +05:30
Hetvi Thakar e93a40cd9d python3-pyjwt: fix CVE-2026-102274 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:34 +05:30
Hetvi Thakar e9ab64a631 python3-pyjwt: fix CVE-2026-103001 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:34 +05:30
Hetvi Thakar 36cb562576 python3-grpcio-tools: set status for CVE-2026-33186 
The vulnerability only affects the Go implementation of the library,
not the Python one. Ignore this CVE due to this.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-33186
https://github.com/advisories/GHSA-p77j-4mvh-x3m3

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:33 +05:30
Hetvi Thakar 594491969e python3-grpcio-tools: set status for CVE-2024-37168 
CVE-2024-37168 affects @grpc/grpc-js, the pure JavaScript
implementation, not the gRPC core code included in grpcio-tools.
Therefore the grpc:grpc CPE association is incorrect.

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-37168

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:32 +05:30
Hetvi Thakar 785cc82130 python3-grpcio-tools: set status for CVE-2023-33953 
CVE-2023-33953 is fixed since 1.56.2 per [1].
FKIE sets "defaultStatus": "unknown" so it needs to be set explicitly.

[1] https://nvd.nist.gov/vuln/detail/CVE-2023-33953

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:32 +05:30
Darsh Kelaiya 5b746f28bb libdbi-perl: fix CVE-2026-73193 
These patches apply the upstream fix as referenced in [2], using the
commit shown in [1]. The STRLEN correction [3] is a separate patch.

[1] https://github.com/perl5-dbi/dbi/commit/c751ae5a5a6f56c2f8284f37c1f4d43500352ef1
[2] https://access.redhat.com/security/cve/cve-2026-73193
[3] https://github.com/perl5-dbi/dbi/commit/afba6751f2acbc1f55ad55aac9f0b58d4f511308

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:31 +05:30
Darsh Kelaiya 26dc43e3df libdbi-perl: fix CVE-2026-73194 
These patches apply the upstream fix as referenced in [2], using the
commit shown in [1]. The overflow correction [3] and portable 32-bit
regression assertion [4] are separate patches.

[1] https://github.com/perl5-dbi/dbi/commit/29b72ae7d2a8114a734a55840bf1c45b89207809
[2] https://access.redhat.com/security/cve/cve-2026-73194
[3] https://github.com/perl5-dbi/dbi/commit/9ffafab2369d7214f88967645feb3beadb900712
[4] https://github.com/perl5-dbi/dbi/commit/acc903db3086a737936643a5dbbc0e22f9d5c421

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:31 +05:30
Ankur Tyagi b9bbc9b1d2 postfix: upgrade 3.10.13 -> 3.10.14 
Changelog:
http://www.postfix.org/announcements/postfix-3.11.7.html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:30 +05:30
Ankur Tyagi 78ee5c7877 libspdm: upgrade 3.8.2 -> 3.8.3 
Changelog:
https://github.com/DMTF/libspdm/releases/tag/3.8.3

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:30 +05:30
Ankur Tyagi 6fb9fc9a7c udisks2: patch CVE-2026-7867 
Backport commits from the PR[1].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-7867

[1]https://github.com/storaged-project/udisks/pull/1530

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:29 +05:30
Ankur Tyagi 08bb24edb7 tmate: patch CVE-2026-4751 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-4751

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:29 +05:30
Ankur Tyagi 9a4f48d6b0 zeroconf: ignore CVEs 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-47180
https://nvd.nist.gov/vuln/detail/cve-2026-47183
https://nvd.nist.gov/vuln/detail/cve-2026-47184
https://nvd.nist.gov/vuln/detail/cve-2026-48045
https://nvd.nist.gov/vuln/detail/cve-2026-48487

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:28 +05:30
Ankur Tyagi 06e4cebb34 tinyproxy: patch CVE-2026-54388 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54388

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:28 +05:30
Ankur Tyagi cb2794d5f8 python3-django: upgrade 6.0.8 -> 6.0.9 
Changelog:
https://docs.djangoproject.com/en/dev/releases/6.0.9/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c39562d398)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:27 +05:30
Ankur Tyagi 5f28f1b1fa python3-django: upgrade 5.2.17 -> 5.2.18 
Changelog:
https://docs.djangoproject.com/en/dev/releases/5.2.18/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0640fa901d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:27 +05:30
Ankur Tyagi 2ea8ff2166 python3-tzdata: upgrade 2026.4 -> 2026.5 
Changelog:
https://github.com/python/tzdata/releases/tag/2026.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 01bd918ea8)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:26 +05:30
Ankur Tyagi 82049f7938 xdg-dbus-proxy: upgrade 0.1.7 -> 0.1.9 
Changelog:
https://github.com/flatpak/xdg-dbus-proxy/blob/0.1.9/NEWS

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:25 +05:30
Ankur Tyagi 224b39660f apache2: upgrade 2.4.68 -> 2.4.69 
Changelog:
https://downloads.apache.org/httpd/CHANGES_2.4.69
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:25 +05:30
Ankur Tyagi a3ff185867 python3-werkzeug: upgrade 3.1.8 -> 3.1.9 
Changelog:
https://github.com/pallets/werkzeug/releases/tag/3.1.9

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 11:01:34 +05:30