The pypi class default python:h11 doesn't match how h11 is tracked
in the CVE databases. NVD has no CPE for it yet; the only existing
record (CVE-2025-43859) carries python-hyper:h11 in its CNA affected
entry [1], so set that pair.
CVE-2025-43859 (request smuggling) is fixed in 0.16.0, the version
we ship, so it resolves as not affected.
[1] https://www.cve.org/CVERecord?id=CVE-2025-43859
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a9bfe001bd)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
lens_default.c defines PRIb64 through a fallback that hardcodes
__PRI64_PREFIX as "ll". That is only correct where uint64_t is unsigned
long long (ILP32). On LP64 musl targets uint64_t is unsigned long, so the
resulting "%llb" conversion does not match the argument and do_compile
aborts under -Werror=format:
lens_default.c:90:48: error: format '%llb' expects argument of type
'long long unsigned int', but argument 3 has type 'uint64_t'
{aka 'long unsigned int'}
glibc never reaches the fallback: it defines __PRI64_PREFIX itself,
wordsize aware, in <inttypes.h>. musl provides the same modifier there
under the name __PRI64 but not __PRI64_PREFIX, so the hardcoded "ll" is
used and is wrong on 64-bit. Reuse musl's __PRI64 when __PRI64_PREFIX is
absent, keeping "ll" as a last resort. glibc builds are unaffected: the
block is skipped entirely.
Signed-off-by: Alejandro Mery <amery@apptly.co>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 09a7b15072)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
===========
* Fix to set VERSION_INFO to create .so.3 instead of .so.11 which will
be reserved for a future 1.10.0 release
* Bugfix: Insufficient verification that responses belong to a
query (CVE-2026-10846). Thanks Pablo Ruiz from 'codecome.ai'
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a5a18fe23f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
===========
- Fixed timing leak vulnerability in EdDSA/Ed25519 signatures.
- Various minor documentation fixes.
- Various minor build system fixes.
- Various minor compiler warning fixes.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 25cfd0324c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
PipeWire 1.6.8 (2026-07-09)
This is a bugfix release that is API and ABI compatible with the previous
1.6.x releases.
Highlights
- Fix a data race in JACK that could cause lost MIDI events in ardour.
- Fix some unbounded memory allocations.
- Various small fixes.
PipeWire
- Avoid some graph recalcs, which fixes a bug when suspending a node
while it is active.
Modules
- Do Content-Length and allocation check in RAOP to avoid OOM errors.
- Fix a potential memory leak in the error path of client-node. (#5348)
SPA
- Fix filter-graph dynamic graph updates.
- Avoid 100% when unplugging a card.
- Fix filter-graph volumes when the filter is loaded inside a node with
hardware volume. (#5344)
- Add normalize and latency options to the SOFA filter. (#5322)
Bluetooth
- Fix a potential leak when transport fails to start.
Pulse-server
- Avoid stack exhaustion via unbounded alloca.
JACK
- Fix a data race in jack_port_get_buffer() when called from concurrent
threads, like in ardour. (#5324)
GStreamer
- Skip invalid crop metadata.
- Avoid crash because metadata listener was registered twice.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6dbf718454)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
PipeWire 1.6.7 (2026-06-18)
This is a bugfix release that is API and ABI compatible with the previous
1.6.x releases.
Highlights
- Fix a race issue where some ports would stay silent after a rate change.
- Fix sync regressions between ALSA cards in some cases.
- Small fixes and improvements.
PipeWire
- Fix a scheduler regression where some driver nodes would not run
correctly and cause sync issues. (#5210)
- Fix a race issue with suspend on samplerate changes. It can cause ports
to be silent. (#3547)
Modules
- There are some locking issues in the RT portal, for now reduce the
DBus timeout to something more sane. Also disable portal RT for
pipewire and the pulse server. These are not usually run in a sandbox
and can go directly to RTKit.
- Fix potential incorrect delay in combine-stream.
SPA
- Fix a regression in ALSA period_size calculations. For non-power-of-2
periods, it would in some cases round down a a power-of-2, causing a
mismatch between requested and configured period_size. (#5302)
- Fix a potential segfault when removing a card because of bad ALSA api
usage. (#5255)
- Emit a route param update when card properties change. Otherwise, jack
port updates are not always reflected correctly.
Misc
- Make sure we don't deal with uninitialized spa_dict.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit ce604315bc)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upgrade to release 6.5.7:
- CurlAsyncHTTPClient now fully resets the curl object before reusing
it. This prevents incorrectly reusing options from a previous request,
specifically including client SSL and credentials used for accessing
proxies.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 7c11942641)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Analysis:
- The Mbed TLS advisory states the issue occurs when LLVM
select-optimize is enabled. [1]
- The same advisory also states that Arm/x86 builds with
MBEDTLS_HAVE_ASM enabled are not affected. The default mbedtls
configuration in this branch enables MBEDTLS_HAVE_ASM.
- NVD also describes the issue as occurring only with LLVM's
select-optimize feature. [2]
- The mbedtls recipes now evaluate the effective build flags across
target, native, and nativesdk variants, handle the supported
-mllvm spellings, and only mark the CVE unpatched when the
vulnerable LLVM option combination is explicitly enabled and the
Arm/x86 MBEDTLS_HAVE_ASM carve-out does not apply.
- When those conditions are not met, the current mbedtls build
configuration is not affected.
- Hence ignoring/deferred the CVE for now.
Reference:
[1] https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-compiler-induced-constant-time-violations/
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-66442
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0eda0f3c55)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
mark.yang
He Zhe
Alejandro Mery
Wang Mingyu
Jason Schonberg
Ankur Tyagi
Khem Raj
Markus Volk
Leon Anavi
Peter Marko
Darsh Kelaiya
Deepak Rathore