python3-mpv RDEPENDS on mpv, which requires ffmpeg (LICENSE_FLAGS =
"commercial"). With "commercial" not in LICENSE_FLAGS_ACCEPTED, parsing
the universe target - which ignores EXCLUDE_FROM_WORLD - reports:
WARNING: Nothing RPROVIDES 'mpv' (but .../python3-mpv_1.0.8.bb
RDEPENDS on or otherwise requires it)
NOTE: Runtime target 'python3-mpv' is unbuildable, removing...
Now that mpv carries LICENSE_FLAGS = "commercial" and is skipped, carry
the same flag here so python3-mpv is likewise skipped cleanly in both
world and universe instead of surfacing as an unbuildable dependency.
The redundant EXCLUDE_FROM_WORLD is dropped.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 2ba9dd8823)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
mpv has an unconditional DEPENDS on ffmpeg, which carries
LICENSE_FLAGS = "commercial". When "commercial" is not in
LICENSE_FLAGS_ACCEPTED (the default), ffmpeg is skipped, and parsing the
universe target - which, unlike world, ignores EXCLUDE_FROM_WORLD -
reports mpv as an unbuildable dependency chain:
WARNING: Nothing PROVIDES 'ffmpeg' (but .../mpv_0.41.0.bb DEPENDS on
or otherwise requires it)
ffmpeg was skipped: Has a restricted license 'commercial' ...
NOTE: Runtime target 'mpv' is unbuildable, removing...
Since mpv cannot be built or shipped without accepting ffmpeg's terms,
propagate the flag onto mpv itself. bitbake then skips mpv cleanly (in
both world and universe) with the same "restricted license" note as
ffmpeg, and no longer emits the confusing unbuildable-dependency
warnings. This mirrors how oe-core's gstreamer1.0-libav (which also
DEPENDS on ffmpeg) carries LICENSE_FLAGS = "commercial".
The explicit EXCLUDE_FROM_WORLD is now redundant - a recipe skipped for
its license flags is already excluded from world - so drop it.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 5f4e021e2d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This fixes:
WARNING: hyprland-image-1.0-r0 do_rootfs: User colord has been defined as (colord, 998, 998, -, /home/colord, /bin/false) but sysusers.d expects it as (colord, -, -, colord colour management daemon, /var/lib/colord, -)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit f4f7c09deb)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
============
- Fixed a 'TypeError' on PHP 8 when 'Security::$static_classes' was set to a
non-array value (e.g. the string ''none'') to disable static class access;
any non-array value now cleanly denies access. Use 'Security::$static_classes =
null' to disable access to all static classes.
- Security: the built-in 'stream:' resource type now validates the nested
stream wrapper against the security policy, so a template such as
'stream:php://filter/...' can no longer bypass 'Security::$streams' (including
'Security::$streams = null') to read local files
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 43fc425c32)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Backport patch to fix CVE-2026-55971.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-55971
Upstream fix:
https://github.com/apache/thrift/commit/db4a473f3a984eee27273256fe737be5dd175595
Testing:
The backported fix ships with a C++ Boost regression test,
test_theadertransport_zlib_roundtrip, in
lib/cpp/test/ThrifttReadCheckTests.cpp. The recipe builds with
-DBUILD_TESTING=OFF, so the C++ test suite is not compiled during a
normal build. To verify the fix, the suite was built with
BUILD_TESTING=ON (using the native thrift compiler for codegen via
THRIFT_COMPILER) and the resulting UnitTests binary was executed
against the target sysroot for MACHINE=qemux86-64.
Result: test_theadertransport_zlib_roundtrip passed. Full C++ UnitTests
suite: 79 of 80 test cases passed, 107659 of 107660 assertions passed.
The single failure (ToStringTest/locale_de_DE_floating_point_to_string)
is unrelated to this fix and is caused by the de_DE locale not being
present in the minimal test sysroot.
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The backport dropped the "j++" body of the delpaths_sorted() grouping
loop while adding the "== 1" guard, turning "while (...) j++;" into an
empty-bodied "while (...);". The index never advances, so any update
that produces "empty" (which reaches _modify() -> delpaths()) hangs,
e.g. "map_values(. // empty)" and ".a |= empty". This also hangs the jq
ptest suite.
Restore the "j++" body while keeping the "== 1" guard.
Assisted-by: kiro:claude-opus-4.8
Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
csysdig fails to link when stock Lua is also present in the sysroot:
ld.lld: error: undefined symbol: luaL_openselectedlibs
>>> referenced by chisel.cpp:1190
ld.lld: error: undefined symbol: lua_pcallk
ld.lld: error: undefined symbol: lua_setglobal
sysdig's chisel code does #include "lua.h" and links against LuaJIT
(lua${JIT}), but the recipe-sysroot also carries stock Lua headers
(openembedded-core lua installs lua.h into ${includedir}). Those headers
win the include search over ${includedir}/luajit-2.1, so the chisel
objects are compiled against stock Lua while the binary links
libluajit-5.1.so. In Lua >= 5.4.4 luaL_openlibs is a macro for
luaL_openselectedlibs and lua_setglobal/lua_pcallk are real symbols,
none of which LuaJIT (a Lua 5.1 ABI) provides, hence the undefined
references. -DLUA_INCLUDE_DIR does not help: sysdig's luajit.cmake only
consults it in its stock-Lua fallback, not when it finds LuaJIT.
Prepend ${STAGING_INCDIR}/luajit-2.1 to CFLAGS/CXXFLAGS. These land in
CMAKE_CXX_FLAGS, which precede CMake's generated -I includes, so LuaJIT's
lua.h is found first and matches the linked library.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 00e7a91180)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The pypi class default python:h11 doesn't match how h11 is tracked
in the CVE databases. NVD has no CPE for it yet; the only existing
record (CVE-2025-43859) carries python-hyper:h11 in its CNA affected
entry [1], so set that pair.
CVE-2025-43859 (request smuggling) is fixed in 0.16.0, the version
we ship, so it resolves as not affected.
[1] https://www.cve.org/CVERecord?id=CVE-2025-43859
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a9bfe001bd)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
lens_default.c defines PRIb64 through a fallback that hardcodes
__PRI64_PREFIX as "ll". That is only correct where uint64_t is unsigned
long long (ILP32). On LP64 musl targets uint64_t is unsigned long, so the
resulting "%llb" conversion does not match the argument and do_compile
aborts under -Werror=format:
lens_default.c:90:48: error: format '%llb' expects argument of type
'long long unsigned int', but argument 3 has type 'uint64_t'
{aka 'long unsigned int'}
glibc never reaches the fallback: it defines __PRI64_PREFIX itself,
wordsize aware, in <inttypes.h>. musl provides the same modifier there
under the name __PRI64 but not __PRI64_PREFIX, so the hardcoded "ll" is
used and is wrong on 64-bit. Reuse musl's __PRI64 when __PRI64_PREFIX is
absent, keeping "ll" as a last resort. glibc builds are unaffected: the
block is skipped entirely.
Signed-off-by: Alejandro Mery <amery@apptly.co>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 09a7b15072)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
===========
* Fix to set VERSION_INFO to create .so.3 instead of .so.11 which will
be reserved for a future 1.10.0 release
* Bugfix: Insufficient verification that responses belong to a
query (CVE-2026-10846). Thanks Pablo Ruiz from 'codecome.ai'
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a5a18fe23f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
===========
- Fixed timing leak vulnerability in EdDSA/Ed25519 signatures.
- Various minor documentation fixes.
- Various minor build system fixes.
- Various minor compiler warning fixes.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 25cfd0324c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Ankur Tyagi
Jason Schonberg
Khem Raj
Markus Volk
Wang Mingyu
Adarsh Jagadish Kamini
Hetvi Thakar
Tugrul Kukul
mark.yang
He Zhe
Alejandro Mery