Upgrade to release 0.17.4:
Preview features:
- [flake8-logging-format] Avoid behavior changes and syntax errors
in fixes (G004)
- [security] Implement tarfile-ignore-zeros-true
Bug fixes:
- Accept a bare raise before a semicolon
- Allow match identifiers after a semicolon
- Fix panic on BOM-prefixed files in diagnostic renderer
- [flake8-simplify] Report collapsible elif clauses after a
multi-statement if branch (SIM102)
Rule changes:
- Show more nonprinting characters in diagnostic fix diffs
Performance:
- Coalesce source slices when formatting attributes
- Collect return statements with a statement-only visitor
- [pyflakes] Defer value comparisons for repeated dictionary keys
(F601, F602)
- Format node fields directly when comment handling is unnecessary
- Reduce formatter source-slice overhead
- Reuse a callee's qualified name across lint rules
- Skip invalid string character checks when the source contains
none
- Use a Bloom filter for formatter comment lookups
- Use a concrete buffer for ordinary writes
CLI:
- Give NO_COLOR precedence in Ruff and ty diagnostics
- Honor CLICOLOR=0 in Ruff and ty diagnostics
Documentation:
- Correct the documented version and src defaults for ruff-action
- [flake8-bugbear] Make B014 example error out-of-the-box
- [flake8-no-pep420] Document preview behavior (INP001)
- [isort] Expand I001 documentation
Other changes:
- [syntax-errors] Extend __debug__ write check to attribute targets
This work was sponsored by GOVCERT.LU.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
0.5.19 moved the script tests into subdirectories, so ptest-list now
has entries like linking/non-default-device-node.lua. run-ptest
redirects each test's output to $arg2.out, and that directory does not
exist next to script-tester, so the redirection fails, script-tester
never runs and all 28 tests are reported as failed.
Flatten the path for the output file name.
The new node/suspend-* tests also require suspend-test-utils, which
upstream finds through WIREPLUMBER_DATA_DIR in the source tree. Install
it next to test-utils.lua.
All 64 tests pass on qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
tests/test_docstrings.py imports pytest_examples and
tests/test_tzinfo.py imports pydantic, neither of which the ptest
package depends on. pytest stops at the collection errors, so no test
ran at all:
E ModuleNotFoundError: No module named 'pytest_examples'
E ModuleNotFoundError: No module named 'pydantic'
Add both. test_docstrings.py then looks for core_schema.py and
README.md relative to the source tree, so install README.md and point
it at the installed core_schema.py.
Skip the ruff lint step of the docstring examples, as python3-pydantic
does. Outside the source tree ruff doesn't treat pydantic_core as first
party and flags the import order (I001) of 23 examples, plus a couple
of style rules newer than the examples. The examples are still run.
6025 tests pass and 126 are skipped on qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
tests/test_docs.py imports time_machine. The collection error stops
pytest before any test runs:
E ModuleNotFoundError: No module named 'time_machine'
With it, 6892 tests pass and 242 are skipped on qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
tests/test_pep517_backend.py imports the in-tree build backend from
packaging/pep517_backend, which pytest.ini puts on the path when run
from the source tree but which is not installed. Collection fails and
pytest stops without running any test:
E ModuleNotFoundError: No module named 'pep517_backend'
The test checks the CFLAGS/CPPFLAGS handling of the build backend,
which has no use on the target, so remove it.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
mongodb was re-enabled after having been skipped, and no longer builds
with the current toolchain and dependencies:
- setuptools 84 does not provide pkg_resources anymore; use
packaging.version to parse versions
- SCons 4.11 added an extra_libs parameter ahead of call in
CheckLibWithHeader(), so the positional call snippet was split into
bogus -l options and the OpenSSL check failed; pass call as a keyword
- clang 23 rejects out of range enum values in the bundled Boost 1.70
mpl::integral_c uses and a typo in Boost.Thread; backport the fixes
from newer Boost
- OpenSSL 4 makes ASN1_STRING opaque and removes ASN1_STRING_data() and
ERR_remove_state(); use the accessors available since OpenSSL 1.1
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The moduleconfig.py build script uses the 'imp' module which
is deprecated in favor of 'importlib' in python 3.12. This fixes
the build issue by replacing the affected portion of the code
and the package now builds fine on hosts with python 3.12.
Signed-off-by: Awais Belal <awais.belal@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Build the vala bindings when gobject-introspection data is enabled.
simple-scan uses colord when it is found and needs colord.vapi for it.
Tested by building colord and simple-scan for x86-64.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Build with meson, which 1.5.35 ships. The tools that generate the
compose table and the unicode dictionaries are built for the target and
run through the meson exe wrapper, so the bundled ax_prog_cc_for_build.m4
and its patch go away, and so does PKG_CONFIG_FOR_BUILD. The compose
table is read from libx11's locale data in the target sysroot, so
libx11-native is no longer needed.
Drop the two IBusAttrList backports, which are part of the release, and
rebase the dbus-launch patch onto the reworked make-dconf-override-db.sh.
Add a patch that defines pyoverridesdir without pygobject-3.0, which the
meson summary needs (Upstream-Status: Pending).
ibus-setup gets the path of the python3 used at build time, so point it
at ${bindir}/python3.
Tested by building ibus for x86-64.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
systemd-repart copies the rootfs into a temporary directory from
var_tmp_dir() to populate the filesystems. With $TMPDIR, $TEMP and $TMP
unset in the task, that is the host's /var/tmp, which the class adds to
PSEUDO_INCLUDE_PATHS for the faked ownership to apply there. pseudo
then tracks a host-wide directory shared by all builds and users, and
an interrupted run can leave its staging tree outside the build
directory.
Stage into ${WORKDIR}/repart-tmp instead, recreated on every run, and
cover only that with pseudo. The location is passed through $TMP rather
than $TMPDIR, because pseudo derives its own runtime paths from $TMPDIR.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
do_image_ddi depends on do_unpack of every recipe in DEPENDS. do_unpack
has no setscene task, so whenever do_image_ddi runs, do_fetch and
do_unpack are executed for all of them, even if everything else comes
from sstate.
The sources are not used: the DDI is built from IMAGE_ROOTFS, and
systemd-repart, erofs-utils and openssl come from the native sysroot,
which do_prepare_recipe_sysroot already populates through DEPENDS.
Suggested-by: Roman Nazarenko <roman.nazarenko@leica-geosystems.com>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 11.13.2:
- Fixed a secondary instance with open_files_async = true getting
stuck after TryCatchUpWithPrimary() returned PathNotFound for a
table file that the primary deleted before the background opener
reached it.
- Fixed blob direct write with more than one concurrent flush of a
column family: a later flush sealed and published the blob files
of the oldest pending memtable instead of its own, so flushes
failed with Corruption: VersionBuilder: Blob file #N already
added and the database stopped.
Change the the SRC_URI from https://github.com/facebook the new
Meta organization in GitHub: https://github.com/meta
Remove the following patches:
1. 0001-CMakeLists.txt-Make-the-test-discovery-occur-on-targ.patch
Because the change has been applied with commit 6d8370e:
https://github.com/meta/rocksdb/commit/6d8370ec56256c9f70daed364cdba9d1edabd417
2. 0001-checkpoint.h-Add-missing-includes-cstdint.patch
Because the change has been applied with commit 0a2ba2a:
https://github.com/meta/rocksdb/commit/0a2ba2a16441c1edd2a3d520e7d574e7ce78dbb2
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2.19.1 declares protobuf < 6, while meta-python provides 7.36, and
google-cloud-pubsub 2.39.2, which Home Assistant 2026.11 uses, requires
google-api-core >= 2.25.0.
New runtime dependencies: proto-plus and opentelemetry-api. pytz is no
longer used. The package is built with setuptools.build_meta now. The
sdist on PyPI was renamed from google-api-core-2.19.1.tar.gz to
google_api_core-2.44.0.tar.gz; the underscore form is the pypi.bbclass
default, so PYPI_PACKAGE_SDIST, which pointed at the old name, is
dropped.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
1.63.2 declares protobuf < 6, while meta-python provides 7.36. The new
release accepts protobuf < 8. Needed by the google-api-core upgrade.
The package is built with setuptools.build_meta now. The sdist on PyPI
was renamed from googleapis-common-protos-1.63.2.tar.gz to
googleapis_common_protos-1.76.0.tar.gz; the underscore form is the
pypi.bbclass default, so PYPI_PACKAGE_SDIST, which pointed at the old
name, is dropped.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
python3-google-api-core 2.x requires proto-plus. A recipe for 1.27.1
exists in meta-python-ai, but meta-python cannot depend on that layer.
Only protobuf is a runtime dependency; google-api-core is needed by the
test suite only.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pydantic 2.14.1 in its test requirements and
package constraints. Upgraded together with python3-pydantic-core
2.50.1, which it pins.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
pydantic 2.14.1 pins pydantic-core 2.50.1; with 2.46.5, "import pydantic"
raises SystemError because the versions do not match.
Refresh 0001-cargo.toml-Update-bitvec-to-use-radium-1.x.patch and
regenerate python3-pydantic-core-crates.inc with
bitbake -c update_crates.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins orjson 3.13.0.
Refresh the two x86 guard patches and regenerate
python3-orjson-crates.inc with bitbake -c update_crates.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pylint 4.1.3 in its test requirements.
Drop patches that are no longer needed:
- 0002-pyproject.toml-Keep-tool.setuptools.license-files.patch rewrote
the PEP 639 license and license-files keys into the older
tool.setuptools form. 4.1.3 requires setuptools >= 77, which handles
the PEP 639 keys, and OE-Core provides 84.0.0.
- 0003-astroid-4.1.2-endlineno.patch adjusted functional test
expectations for astroid 4.1.2 (for example MyClass instead of
MyClass.my_method). 4.1.3 ships the same expectations.
- 0004-checkers-variables-do-not-pass-asname-to-Import.infer.patch was
a backport of upstream commit 554b1d192434, which is part of 4.1.3.
Refresh 0001-Adjust-test-expectations-for-ptest.patch. The expected
output was regenerated by running the functional test with pylint 4.1.3
and astroid 4.3.4 installed into a virtualenv and the tests outside the
source tree, which is how the ptest sees pylint.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pytest-socket 0.8.1 in its test
requirements.
0.8.x builds with uv_build instead of poetry-core. Backport the upstream
change that allows uv_build < 0.14, since OE-Core provides 0.13.7.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins lru-dict 1.4.1.
The sdist is now published as lru_dict-*.tar.gz, the default name, so
drop PYPI_PACKAGE_SDIST. 1.4.x pins the build to setuptools==80.9.0 and
no longer needs wheel; relax the setuptools pin with a patch and drop
the python3-wheel-native dependency.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins SQLAlchemy 2.0.54 (core and the recorder
integration).
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pychromecast 14.1.1 for its cast integration.
Drop 0001-pyproject.toml-relax-build-requirements.patch. It removed the
upper bounds setuptools < 83 and wheel < 0.47 from the build
requirements. 14.1.1 allows setuptools < 85 and wheel < 0.49, and
OE-Core provides setuptools 84.0.0 and wheel 0.48.0, which are within
the new bounds.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Needed together with the Cython 3.3.1 upgrade in OE-Core: 0.4.1, with the
backported "Update Cython to version 3.2.3" patch, requires
Cython ~= 3.2.0 and does not build with Cython 3.3. Home Assistant
2026.11 also pins propcache 0.5.4.
Drop both local patches:
- 0001-Update-Cython-to-version-3.2.3-184.patch backported the change
from Cython ~= 3.1.0 to Cython ~= 3.2.0. 0.5.4 requires
Cython >= 3.2.0 (packaging/pep517_backend/_backend.py), so the
backport is not needed; it would even pin the build back to
Cython ~= 3.2.0.
- 0001-build-wheel-in-place.patch hardcoded build_inplace=True in the
in-tree build backend. 0.5.4 adds the build-inplace config setting
for this, so the recipe passes "-C build-inplace=true" in
PEP517_BUILD_OPTS instead.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
httpx2 requires httpcore2, anyio and truststore, so "import httpx2"
fails with "No module named 'httpcore2'". Home Assistant 2026.11 imports
httpx2 at startup and does not start without them.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
httpx2 imports httpcore2, which is released as a separate package from
the same repository and with the same version.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
httpx2 and httpcore2 require truststore. Home Assistant 2026.11 pins
truststore 0.10.4.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
numba is optional for haversine, but haversine only catches
ModuleNotFoundError. With the NumPy 2.5 from OE-Core, numba 0.66 (as in
meta-python-ai) raises
ImportError: Numba needs NumPy 2.4 or less. Got NumPy 2.5.
which makes "import haversine" fail. Catch ImportError instead.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
pint requires flexcache, flexparser and typing-extensions, but only the
ptest package pulled in flexcache and flexparser, so "import pint" fails
with "No module named 'flexcache'" on an image without the ptest.
pint is extended to native and nativesdk, so flexcache and flexparser
are as well.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The upgrade to 1.4.4 only changed SRC_URI[sha256sum], which is unused
since the recipe fetches from git, so SRCREV still pointed at a 1.4.2
era commit and the package installed pika 1.4.2 under version 1.4.4.
Point SRCREV at the 1.4.4 tag commit and drop the unused checksum. Add
tag=${PV} to SRC_URI so that the fetcher checks that SRCREV is the
commit of the release tag.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
- mod_authnz_ldap: Fix crashes in 2.4.69 reported on Windows
- mod_cgid: Increase limits for number and length of environment variables,
URI and arguments
- mod_substitute: Fix an integer overflow that can happen in very special
setups
- mod_cache: Do not store a response whose "Vary: *" was set via
"Header always"
- mod_dav_lock: Fix a heap buffer overflow in dav_size_indirect(), which
under-reserved space for the stored key length field, written as
apr_size_t but sized as int
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2.7 is the new release series; library ABI is unchanged (libldap.so.2,
liblber.so.2). It also builds the symbol version map through the
preprocessor (ITS#9739), which drops most entries for code that is not
configured in.
- back-perl and back-sql were removed upstream, drop their
PACKAGECONFIGs.
- Refresh remove-user-host-pwd-from-version.patch for the
LDAP_GCCATTR((unused)) attribute added in build/mkversion.
- Add a patch to guard the remaining SASL-only symbols in ldap.map.in;
without Cyrus SASL lld fails:
ld.lld: error: version script assignment of 'OPENLDAP_2.200' to
symbol 'ldap_int_sasl_config' failed: symbol not defined
This replaces the -Wl,--undefined-version workaround meta-clang
carried for openldap.
License checksums are unchanged. Tested on qemux86-64 with clang/lld:
openldap and samba (with ldap) build.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
wafsamba generates version scripts that name symbols which may not
exist in the library: _end, __bss_start and _edata are always listed as
local, and the per-version nodes carry symbols from older ABI signature
files that were later removed (e.g. tdb_do_delete). GNU ld ignores
these, but lld rejects them by default:
ld.lld: error: version script assignment of 'local' to symbol '_end'
failed: symbol not defined
meta-clang used to add -Wl,--undefined-version for libtalloc, libtdb,
libtevent, libldb and samba. Since the scripts are generated by design
this way, do it once in the class for all its users; binutils accepts
the option too. FreeBSD ports do the same for talloc and tdb.
Tested: libtalloc, libtdb, libtevent, libldb ptest images pass on
qemux86-64 with clang/lld; samba builds.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog
---------
Changes for version 20261020
Update from Mozilla repository to 2026-10-20
Denylisted certificates:
emSign ECC Root CA - G3
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add -M30% -C --find-copies-harder to the git send-email example in
README.md so that git format-patch detects renames and copies more
aggressively.
Patches that move or copy files then show only the changed lines
instead of full file deletions and additions, which makes them
smaller and easier to review.
Suggested-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.4:
Breaking changes:
- CMake:
- The minimum CMake version is now 3.15, up from 3.12.
- Library file names changed on MSVC: z is now libz, as in
libz.dll, libz.lib, and the static libzs.lib. minizip's
libraries changed the same way.
- On Cygwin, the libraries now use the lib prefix.
- Contrib targets and tests built as part of zlib are now
prefixed with zlib_. Several test targets were renamed to one
scheme, for example zlib_examplestatic and minigzipstatic.
- The zlib1.dll option ENABLE_BZIP2 is now
ZLIB1_DLL_ENABLE_BZIP2.
- When not otherwise determined, z_off_t is again long, as in
1.3.1, instead of 1.3.2's long long. Windows applications built
with 1.3.2 headers should be recompiled; see Enhancements for
64-bit offsets.
- deflateReset() now resets the gzip header set by
deflateSetHeader(), as zlib.h has always said. Code relying on
the header persisting must set it again.
- Raw deflate that completes exactly at the end of the output
buffer now returns Z_STREAM_END instead of Z_OK, as documented.
- gzopen() with "x" now fails where O_EXCL isn't available, instead
of truncating an existing file (Trail of Bits TOB-ZLIB-009).
- gzip reading now delivers the data decompressed before a read
error, and only then reports the error.
Security fixes:
- Non-blocking gzwrite() had a buffer overflow; CVE-2026-85091
(reported by mat-mo; also TOB-ZLIB-003).
- inflateGetDictionary() could write up to 8 MB past the caller's
32K buffer (Theorem THM-ZLIB-001). This took a zlib header with
an invalid window size, then inflateReset() or inflateSync().
Affects 1.3.1 and 1.3.2.
- inflateSync() before the window size was known allocated a
one-byte window that could later be overrun (TOB-ZLIB-004).
- inflatePrime() could lead inflate() to read before the start of
the input (TOB-ZLIB-014).
- Repeated deflatePrime() calls could write past the pending buffer
(TOB-ZLIB-013).
- inflateBack() failed to detect distances too far back, and copied
uninitialized memory to the output (reported by Kornel Lesiński).
- gzseek() forward before any data was written could write
uninitialized memory to the gzip output (found by Claude Opus
5.5).
- deflateResetKeep() used mid-stream could read outside the window
(reported by Jason Gross).
- gzdopen() now sets close-on-exec with the correct flag
(TOB-ZLIB-008).
- minizip:
- A double free in block_central_name() (reported by Oculytic),
and a NULL dereference on repeated zipAlreadyThere() calls
after a bad central directory (reported by Naveed Khan).
- Validation of extra-field sizes, plus portable, alignment-safe
reading, in zipRemoveExtraInfoBlock() (reported by Naveed Khan
and jmestwa-coder).
- unzip no longer reads Zip64 values from outside their
extra-field record (reported by Mohamed Elnady). It also uses
only the Zip64 locator immediately before the end of central
directory record (reported by snajafov). Crafted archives could
make minizip report different entries than other readers.
- miniunz could create directories outside the extraction
directory (reported by Naveed Khan), and on Windows write files
anywhere (reported by Trail of Bits). Fixed by Naveed Khan.
Path names are now processed by component.
- contrib/infback9: removed out-of-bounds pointer arithmetic in
inftree9.c; CVE-2026-4738 (fix by npt-1707, submitted by
CrossVR). The pointers return in bounds before use and no known
compiler mishandles this, so the critical rating overstates it,
though it could trap on capability hardware such as CHERI.
Bug fixes:
- gzip reading:
- Restored the detection of truncated gzip streams, part of which
was lost in 1.3.2. Also fixed a complete stream being reported
as truncated.
- An error in the first member is no longer treated as trailing
garbage.
- Corrected pending-skip handling in gz_skip(), gzdirect() and
forced seeks at EOF.
- gzgets() now returns an empty string when promised.
- gzip writing:
- Successive SEEK_CUR seeks no longer lose zero fill.
- Zero fill is now handled correctly after a write error.
- gzprintf() is now all-or-nothing when blocked, and is no longer
a stub when compiled as C++.
- gzseek() leaves the position unchanged on failure.
- gzopen_w() now works with paths not representable in the
locale.
- inflate:
- total_in was short six bytes on Z_NEED_DICT.
- inflateReset() now restores the requested window size, and the
wrap after inflateSync().
- inflateSetDictionary() rejects a null dictionary.
- With PKZIP_BUG_WORKAROUND, the code tables were slightly too
small.
- deflate:
- A bad deflateSetDictionary() call is now detected as promised.
- A failed deflateCopy() or inflateCopy() leaves the destination
safe to end.
- Removed a possible overflow in deflate_stored() comparisons.
- Undefined behavior removed in gzwrite.c, gzseek, gz_vacate() and
mztools.c.
- minizip:
- zip.c no longer writes corrupt headers when a Zip64 field
overflows an extra field (reported by mzfr and itsgaldoron), or
for Zip64 entries with file comments.
- zipOpen3() no longer leaks memory or returns a freed comment
pointer on failure.
- Added allocation checks.
- Build:
- configure now builds the shared library with linkers such as
lld that reject undefined symbols in zlib.map, including for
--solo.
- zlib.h no longer depends on NULL being defined.
- zip.c builds with NO_ADDFILEINEXISTINGZIP.
- The test programs use the generated zconf.h when building out
of tree.
- Many CMake fixes: pkg-config files, installation of headers and
of minizip's configuration, symbol prefixing, assembler
detection, and parallel testing. It also works with CMake 4.
Enhancements:
- 64-bit offsets on Windows with MSVC or MinGW, by compiling the
application with _FILE_OFFSET_BITS=64 or _LARGEFILE64_SOURCE. The
library itself needs no changes.
- Platforms:
- Android large file support.
- An export list on AIX.
- -Wno-psabi, only where the PowerPC note would appear.
- s390x VGFMAFLAG in configure.
- Win32 Makefile.msc builds for ARM64.
- minigzip's mmap code uses POSIX types.
- CMake:
- Package components, with _FOUND variables.
- Installation and export of zlib1.dll and zlibwapi.dll.
- Contribs build standalone, with zlib's defaults.
- Tests consolidated, and tests on Windows.
- minizip:
- The traditional encryption header uses a PCG generator instead
of rand().
- Fewer compiler warnings.
- Documentation:
- Clarified that undocumented functions are not part of the API.
- inflateGetHeader() header reuse.
- deflateBound() and deflateSetDictionary() ordering.
- The application's responsibilities in unzip.h.
Known issues:
- contrib/iostream2 is unsafe on untrusted input (reported by Trail
of Bits). When reading a string, it uses the length stored in the
compressed data without checking it, so a crafted file can write
past the end of the destination buffer. Use contrib/iostream3
instead.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.1.0:
Changes:
- Add tss_request_add_bora_tags() and tss_request_add_durant_tags()
to the API
- Update auth client version and add Ap,Timestamp to requests
- Restrict Yonkers tag selection to SysTopPatch
Fixes:
- Handle realloc() failure in tss_write_callback()
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 3.4.20:
- Fixed mouse wheel direction in mouse relative mode on Windows
- Improved Wayland clipboard handling
- Fixed color cursor alpha mask on X11
- Fixed a crash when Vulkan texture memory binding fails
- Fixed transparent windows using the Vulkan renderer
- Improved handling of Nintendo Switch controller calibration
- Fixed Nintendo Switch controllers failing because of missing
stick and IMU calibration
- Fixed reports stopping on the Flydigi Vader 5 Pro while the
Flydigi Space Station service is running
- Added support for rumble and trigger rumble on the Flydigi Vader
5 Pro
- Added support for the 8BitDo Ultimate 2C Wireless controller via
HIDAPI
- Fixed a crash recording float audio on Android 10
- Improved relative mouse mode handling on Android
- Fixed window orientation on iOS 27
- Fixed keyboard focus when using the latest Xcode on iOS
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.3.0:
- Remove paperconf(1) and support for
{/etc,$XDG_CONFIG_HOME}/papersize
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 0.1.24:
- API: nice_agent_attach_recv_ex() to retrieve extra message data
in recv callback
- API: nice_message_extra_data_get_tos() to enable access to
IP_TOS/IPV6_TCLASS IP header field of incoming packets; requires
GLib 2.88
- API: stun_usage_bind_run_compat() to allow specifying
compatibility mode when sending a binding request
- Nicesrc: Attach GstNetControlMessageMeta containing the TOS
header field to buffers
- Ensure NICE_CANDIDATE_MAX_TURN_SERVERS is obeyed
- Ensure nice_agent_get_local_credentials() returns FALSE on error
- Fix random crashes
- Fix potential heap buffer overflow in UDP-TURN over TCP
- Fix compilation on FreeBSD
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.656:
- Prevent dbi_profile crash (CVE-2026-108518) (Henrik Teichmann)
- Fix lock file not removed when DBD::DBM check for bad serializer
class fails. (CVE-2026-111879)
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.20:
- Added a plug-in type for profile header parsing.
- Fixed premultiplied alpha on planar 16 bit and optimized
matrix-shaper transforms.
- Fixed planar half float and Lab double formatters, and planar
strides in fast_float.
- Fixed gamut checking with two profiles and a possible crash with
malformed profiles.
- Recovered neutrality correction in black point detection.
- Made cmsCreateLab2Profile white point handling consistent with
cmsCreateLab4Profile.
- Fixed UTF8 buffer size calculation.
- CGATS parser is now more permissive on certain properties.
- Fixed callback type mismatch in resampled CLUT evaluation.
- Fixed a crash in PostScript CSA generation.
- Fixed memory leaks in black preserving intents and .cube loading.
- cmsChangeBuffersFormat now correctly rejects format changes on
floating point transforms.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Leon Anavi
Khem Raj
Gyorgy Sarvari
Awais Belal
Markus Volk
Johannes Schneider
Thomas Roos
Ankur Tyagi
Jason Schonberg