Changelog:
=============
- Documentation issue for Net::DNS::RR::RRSIG::verify()
- Denial of Service via long DNS compression chains
- Remote code injection via EDNS EXTENDED ERROR
- UNIX.pm: Unreachable code warning using Apache/mod_perl
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
* Fix inverted comparisons for strings in DBI::SQL::Nano (CVE-2026-15043)
* Document that IS NULL matches empty strings in DBI::SQL::Nano
* Fix DBD::File to ensure that the table is not a symlink outside of f_dir (CVE-2026-15392)
* Fix an out-of-bounds error when a statement handle has no fields but the source row is not empty (CVE-2026-60082)
* Add an overridable upper bound $MAX_PATH_DEPTH for DBI::ProfileData (CVE-2026-60081)
* *** WARNING: Next release will require perl-5.12
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- avoid possible double free of found in idbm_rec_update_param (#528)
- Modify log function to print session id (#498)
- Add tcp.congestion_control configuration option (#520)
- iscsi-gen-initiatorname use @IQN_PREFIX@ as default
- iscsi-init.service: Use iscsi-gen-initiatorname
- Fix issue with IPv6 adapter interfaces (#508)
- Small cleanups for firmware discovery. (#522)
- Fix unused variable warning in usr/io.c (#524)
- Make iface.example a doc file. (#526)
- Fix security issues recently discovered by Keith at Linneman Labs (#535)
- Makefile: fix "No rule to make target 'iscsiuio/Makefile.in" issue (#506)
- fwparam_ppc.c: Fix the calloc-transposed-args issue (#504)
- Fix incorrect parsing of node.discovery_type "static" and "fw" (#518)
- doc: fixup iscsiadm man page option for -r (#501)
- Fix typo in initiator.c (#507)
- iscsi: validate interface IP against target address family (#527)
- iscsi: delay reconnect until interface has valid IP. (#511)
- Fix minor typo ("authenticaton") (#500)
- iscsi_net_util: avoid copying NULL pointers with strlcpy()
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
chisel does #include "lua.h" and links libluajit-5.1.so, but the link
failed with undefined Lua symbols (luaL_openselectedlibs, lua_setglobal,
lua_getglobal, lua_pcallk). Those come from the stock Lua >= 5.4 header,
not LuaJIT.
The stray stock lua.h reaches the target compile line via ncurses.cmake:
find_package(Curses) resolves CURSES_INCLUDE_DIR to the native sysroot
(recipe-sysroot-native/usr/include, which also carries ncurses.h/form.h
and, dragged in by lua-native, lua.h), then include_directories() places
that dir ahead of the LuaJIT include dir. The prior CXXFLAGS -I workaround
could not win because CMake orders target include_directories before
CMAKE_CXX_FLAGS.
Pin CURSES_INCLUDE_DIR/CURSES_LIBRARIES to the target sysroot so the native
include dir never leaks into the target build; lua.h then resolves through
LUAJIT_INCLUDE and matches the linked library.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
xterm do_configure runs gnu-configize (to refresh config.sub/config.guess),
newer versions of gnu-config needs to specify the directory for configure scripts
Fixes a build error abort in do_configure:
gnu-configize: error: 'configure.ac' is required
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
do_compile panicked in rice-c/build.rs:
thread 'main' panicked at rice-c/build.rs:101:
Could not find rice-proto.h header
rice-c/build.rs builds the internal rice-proto C library in-tree via
"cargo cinstall --prefix <OUT_DIR>/rice-proto-cbuild" and then locates
it through system-deps + pkg-config. The generated rice-proto.pc carries
an absolute prefix pointing into the in-build OUT_DIR. pkgconfig.bbclass
exports PKG_CONFIG_SYSROOT_DIR=${STAGING_DIR_HOST}, and pkgconf prepends
that sysroot onto the already-absolute prefix, yielding a doubled,
non-existent include path (recipe-sysroot/<abs-build-path>/include/rice).
The header search then fails. The internal lib is never staged in the
sysroot, so sysroot rewriting must not be applied to its .pc.
Clear PKG_CONFIG_SYSROOT_DIR so the internal prefix is used verbatim.
openssl-sys is the only other pkg-config consumer in the crate graph and
would break without the sysroot, so point it at the target openssl
directly via OPENSSL_LIB_DIR/OPENSSL_INCLUDE_DIR (openssl-sys returns
those and skips its pkg-config probe when both are set). Verified a clean
build: rice-proto.h is found and librice-proto/librice-io plus the header
are packaged.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
do_compile failed building the userspace mount helper:
mount.vboxsf.c:38:10: fatal error: errno.h: No such file or directory
vbsfmount.c:36:10: fatal error: assert.h: No such file or directory
The kernel modules build fine; only the userspace utility fails. This
recipe inherits module, and module.bbclass sets INHIBIT_DEFAULT_DEPS=1
(kernel modules build -nostdinc and do not need libc). That suppresses
BASE_DEFAULT_DEPS (virtual/cross-cc virtual/compilerlibs virtual/libc)
and only re-adds virtual/cross-cc + virtual/cross-binutils, so the
target libc headers and crt objects are never staged into
recipe-sysroot. But this recipe also compiles an ordinary hosted
userspace program (utils/mount.vboxsf), which needs libc.
Add back virtual/compilerlibs and virtual/libc. Using the same
virtual/* provider names OE lists in BASE_DEFAULT_DEPS keeps this
correct across libc (glibc/musl) and toolchain (gcc/clang) choices.
Verified errno.h is staged and mount.vboxsf compiles, links and is
packaged into ${base_sbindir}.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
do_package failed with a fatal QA error:
QA Issue: ufw: Files/directories were installed but not shipped in
any package: /usr/usr/lib/ufw/... (and on repeated rebuilds
/usr/usr/usr/lib/ufw/...) [installed-vs-shipped]
Under the usrmerge DISTRO_FEATURE, do_configure:prepend rewrites the
single os.path.join('/lib', 'ufw') in setup.py to nonarch_base_libdir
(/usr/lib) with an in-place sed. The pattern '/lib' is not anchored, so
when do_configure re-runs against an already-patched ${S} (cached
unpack/patch, as happens on world rebuilds) it matches the '/lib' inside
the previously substituted '/usr/lib' and prepends another /usr, giving
/usr/usr/lib and then /usr/usr/usr/lib. FILES:${PN} ships
${nonarch_base_libdir}/ufw (/usr/lib/ufw), so the doubled paths are
unshipped and QA fails.
Anchor the substitution to the quoted literal '/lib'. After the first
run the text is '/usr/lib', which no longer contains '/lib', so
re-running do_configure is a no-op. Verified two forced do_configure
runs leave os.path.join('/usr/lib', 'ufw') and do_package succeeds.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Canmatrix implements a "Python Can Matrix Object", which describes the can-communication
and the needed objects (Boardunits, Frames, Signals, Values, ...).
Signed-off-by: Fabian Pfitzner <f.pfitzner@pengutronix.de>
The pypi class default python:h11 doesn't match how h11 is tracked
in the CVE databases. NVD has no CPE for it yet; the only existing
record (CVE-2025-43859) carries python-hyper:h11 in its CNA affected
entry [1], so set that pair.
CVE-2025-43859 (request smuggling) is fixed in 0.16.0, the version
we ship, so it resolves as not affected.
[1] https://www.cve.org/CVERecord?id=CVE-2025-43859
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changes for 1.5.4 'Sonic':
--------------------------
1.5.4 is a minor release of dav1d, focused on optimizations and maintenance:
- Support for OS/2, including API exports and assembly
- Switch to external checkasm
- Add Armv9.3-A GCS (Guarded Control Stack) support
- AArch64: optimize ipred_v, ipred_h and ipred_smooth_* 8bpc functions, and
reduce .text size
- ARM32: optimize prep_neon
- RISC-V: ipred_(dc, h, v, pal) optimizations for 8 and 16bpc,
generate_grain_y for 8bpc, and optimizations (prep/put_8tap, 6-tap and copy paths)
- Portability improvements for non-POSIX systems (signal() fallback)
- Schedule tile tasks for all passes at once, improving threading
- Precompute the quantization matrix tables at build time
- Move loop-invariant computations out of hot loops
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Added a recipe that caps the memory usage of individual systemd
services without modifying those services' own recipes. Services and
limits are given via MEMORY_CONTROL_SERVICES as space-separated
<unit>:<limit>[:<oom_policy>] entries. For each recipe, it generates
a systemd drop-in under ${systemd_system_unitdir} setting MemoryMax,
MemoryHigh (70% of max), and MemorySwapMax=0. The optional "kill" policy
also adds OOMPolicy=continue and OOMScoreAdjust=500.
The service list is empty by default, so the recipe is a no-op until a
distro, machine, or product .bbappend configures it. Drop-ins install to
the system unit directory so systemd reads them at boot with no
daemon-reload. Entries are validated at build time so a bad limit fails
the build.
Signed-off-by: Ishaan Desai <Ishaan.Desai@ibm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Inherit ptest-python-pytest and include tests for invoke.
Use -s because some tests read from stdin while output is
captured. Skip tests that require a real terminal.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add recipe for pytest-relaxed, a relaxed test discovery/organization
for pytest, release 2.0.2:
- Fix dangling compatibility issues with pytest version 8.x.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Fixes:
WARNING: meta-multimedia/recipes-multimedia/mimic/mimic_1.3.0.1.bb: mimic: LICENSE is using an old syntax and should be upgraded to: "Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND MIT AND LicenseRef-BellBird AND LicenseRef-CMU-Tex AND LicenseRef-PD AND LicenseRef-Sun AND LicenseRef-flite AND LicenseRef-rateconv"
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Fixes:
WARNING: meta-oe/recipes-graphics/ktx-software/ktx-software_5.0.0.bb: ktx-software: LICENSE is using an old syntax and should be upgraded to: "Apache-2.0 AND BSD-1-Clause AND BSD-2-Clause AND BSD-3-Clause AND BSL-1.0 AND CC-BY-3.0 AND CC-BY-4.0 AND CC0-1.0 AND MIT AND Zlib AND LicenseRef-Cesium-Trademark-Terms AND LicenseRef-ETCSLA AND LicenseRef-HI-Trademark AND LicenseRef-Kodak AND LicenseRef-PNGSuite AND LicenseRef-fmt"
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Fixes:
WARNING: meta-oe/recipes-support/liboauth/liboauth_1.0.3.bb: liboauth: LICENSE is using an old syntax and should be upgraded to: "GPL-2.0-only OR MIT"
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Fixes:
WARNING: meta-oe/recipes-dbs/influxdb/influxdb_1.8.10.bb: influxdb: LICENSE is using an old syntax and should be upgraded to: "Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND EPL-1.0 AND ISC AND MIT AND MPL-2.0"
WARNING: meta-oe/recipes-support/crucible/crucible_2025.05.28.bb: crucible: LICENSE is using an old syntax and should be upgraded to: "Apache-2.0 AND BSD-3-Clause AND MIT"
WARNING: meta-oe/recipes-test/syzkaller/syzkaller_git.bb: syzkaller: LICENSE is using an old syntax and should be upgraded to: "Apache-2.0 AND BSD-3-Clause AND MIT"
WARNING: meta-oe/recipes-test/syzkaller/syzkaller_git.bb: syzkaller-native: LICENSE is using an old syntax and should be upgraded to: "Apache-2.0 AND BSD-3-Clause AND MIT"
WARNING: meta-oe/recipes-test/syzkaller/syzkaller_git.bb: nativesdk-syzkaller: LICENSE is using an old syntax and should be upgraded to: "Apache-2.0 AND BSD-3-Clause AND MIT"
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade libsimplelog to the latest upstream version 1.1.0.
Drop 0001-allow-build-with-cmake-4.patch as it is now integrated
upstream (commit 4827c4325063266f6d2a7e133a9d3a9050ff6a3c).
Update LIC_FILES_CHKSUM due to upstream updating the copyright year
range from 2024 to 2024-2026 in LICENSE.txt. The project remains fully
under the MIT license.
Append -D__LINUX__=1 and -D_GNU_SOURCE=1 to EXTRA_OECMAKE to enable
Linux and GNU-specific extensions like sched_getcpu() for better
performance effectiveness. These flags are optional; without them,
version 1.1.0 remains fully backward compatible and adapts perfectly
with strictly POSIX musl environments.
Signed-off-by: Thuận Nguyễn-Thái <nguyenthaithuanalg@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Introduce a new binary log feature based on UTF-8 encoding patterns
to optimize logging capabilities.
Add cache hit and miss tracking mechanism to monitor performance
effectiveness.
Signed-off-by: Thuận Nguyễn-Thái <nguyenthaithuanalg@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
lens_default.c defines PRIb64 through a fallback that hardcodes
__PRI64_PREFIX as "ll". That is only correct where uint64_t is unsigned
long long (ILP32). On LP64 musl targets uint64_t is unsigned long, so the
resulting "%llb" conversion does not match the argument and do_compile
aborts under -Werror=format:
lens_default.c:90:48: error: format '%llb' expects argument of type
'long long unsigned int', but argument 3 has type 'uint64_t'
{aka 'long unsigned int'}
glibc never reaches the fallback: it defines __PRI64_PREFIX itself,
wordsize aware, in <inttypes.h>. musl provides the same modifier there
under the name __PRI64 but not __PRI64_PREFIX, so the hardcoded "ll" is
used and is wrong on 64-bit. Reuse musl's __PRI64 when __PRI64_PREFIX is
absent, keeping "ll" as a last resort. glibc builds are unaffected: the
block is skipped entirely.
Signed-off-by: Alejandro Mery <amery@apptly.co>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 3.0.3:
- Reverted the @task return value type hint change; it actually
just makes things worse. Taking this one back to the drawing
table for later.
From 3.0.2:
- Define a custom __repr__ for Promise so it can be displayed in
interactive sessions or other debug contexts, without running
afoul of AttributeError. Thanks to Leonid Shvechikov for the
original bug report.
- Make the return value type hint for @task more specific; as-is it
would trigger typecheck errors when handing regular, decorated
task functions as inputs to add_task and similar methods.
From 3.0.1:
- Minor tweaks to documentation and type hints/inheritance (mostly
around Promise).
From 3.0.0:
- Add access to the core CLI parser's remainder value, via
Context.remainder - this allows for more elegant wrapper tasks.
- Update the return value, and type hint, of run and friends to be
Result instead of Optional[Result].
- run now includes local subprocess PIDs in Result objects (as
.pid), via the new Runner.get_pid method. This may be generally
useful for auditing or similar tasks, but is primarily intended
for users of disown=True who want to perform their own subprocess
management.
- Fix a grab bag's worth of Sphinx doc render problems, among which
were some class attributes (eg Context.command_cwds) that had
silently disappeared from the class' autodoc output after our
2.0 release.
- Expanded mypy type hint checking to more of the codebase &
generally touched up some type hints here and there. More of
this is planned to occur as we go.
- Dropped support for Python versions <3.9. That's right, we've
caught up to Python's own EOL regime... as of late 2024! As part
of this change, we also switched over to using pyproject.toml for
packaging metadata.
Fixes:
WARNING: python3-invoke-3.0.3-r0 do_check_backend: QA Issue:
inherits setuptools3 but has pyproject.toml with setuptools.build_meta,
use the correct class [pep517-backend]
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 26.7.1:
- Fix WebSocket maxMessagePayloadSize being enforced against the
compressed on-the-wire frame length instead of the uncompressed
reassembled message size when permessage-compress
(deflate/bzip2/snappy/brotli) is negotiated. A small compressed
frame could inflate far beyond the configured limit and be
delivered to the application (a decompression-bomb style
denial-of-service; security advisory GHSA-hxp9-w8x3-p566, same
class as CVE-2016-10544). The limit is now re-checked at the
inflation site against the running uncompressed message size,
and the connection is failed with close code 1009 (message too
big) before delivery - for both the whole-message and streaming
receive APIs and every compression backend. Behaviour change:
a compressed message that inflates past maxMessagePayloadSize
is now rejected where it previously passed; uncompressed traffic
and the per-frame maxFramePayloadSize wire guard are unaffected
- Fix the permessage-deflate max_message_size receive cap silently
truncating an over-limit message and raising a zlib error instead
of cleanly rejecting it: the bounded decompress(..., max_length)
left the remaining input in unconsumed_tail undrained, so the
message was corrupted rather than reported. Decompression is now
bounded cumulatively across frames and raises
PayloadExceededError as soon as the uncompressed size would
exceed the cap
- Make bounded decompression backend-agnostic:
decompress_message_data() gains an optional max_output_len
argument (documented on the PerMessageCompress base class) and
every permessage-compress backend now honours it. deflate and
bzip2 stop inflating once the limit is reached (native
incremental cap); snappy and brotli, whose libraries expose no
output-length argument, inflate the frame (already bounded on
the wire by maxFramePayloadSize) and then reject - a weaker but
still clean per-frame guarantee. The WebSocket receive path
passes the remaining maxMessagePayloadSize budget so a
compressed frame no longer expands unbounded into memory before
the size check; the previous post-inflation check remains as a
backstop. Previously only deflate had any decompressed-output
cap, so a snappy/bzip2/brotli frame could inflate fully into
memory first
- Make the asyncio RawSocket receive size limit configurable, at
parity with the Twisted backend. The asyncio
WampRawSocketFactory now exposes
setProtocolOptions(maxMessagePayloadSize=...) /
resetProtocolOptions() (bounds [512, 2**24], default 16 MB), and
the configured value drives both the advertised handshake length
exponent and the enforced receive cap (rounded up to the next
power of two), matching the Twisted factory. Previously the
asyncio receive limit was hardwired to 16 MB (a dead
max_size=None branch), so an asyncio WAMP peer could not tighten
its RawSocket receive limit for DoS hardening and Crossbar's
RawSocket max_message_size had no effect on the asyncio path
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.37.4:
- Set filename parameter of FileNotFoundError exception
- Fix typos in docstrings and comments
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add a new recipe for crash-trace, a crash utility extension that
displays kernel tracing data and traced events prior to a panic.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
update version of xorg-xserver according to oe-core
WARNING: tigervnc-1.16.2-r0 do_configure: TigerVNC xorg-server version (21.1.23) is different from oe-core's xorg-xserver version (21.1.24)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
proxy-libintl provides a Win32 static libintl stub sourced from an
ancient (2010) GNOME win32 dependency zip. It is not used by any target
build and its lone consumer was the meta-oe packagegroup; drop the
recipe and its packagegroup entry.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
"wxWindows" is not a valid SPDX license identifier and has no generic
license file, so do_populate_lic fails the license-exists QA check:
No generic license file exists for: wxWindows in any provider
Spell it as the current SPDX expression, matching the wxwidgets recipe
this binds to: LGPL-2.0-or-later WITH WxWindows-exception-3.1.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
SPDX has deprecated the "wxWindows" license identifier in favour of an
expression combining the main license, the WITH operator and the
WxWindows-exception-3.1 identifier.
The wxWindows Library Licence is the GNU Library GPL v2 "or, at your
option, any later version" plus an exception, so the equivalent
expression is "LGPL-2.0-or-later WITH WxWindows-exception-3.1". Both
license texts already ship in common-licenses.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Wang Mingyu
Khem Raj
Fabian Pfitzner
Markus Volk
mark.yang
Ishaan Desai
Leon Anavi
Martin Jansa
Jason Schonberg
Thuận Nguyễn-Thái
Peter Marko
Alejandro Mery
Ankur Tyagi
Jörg Sommer
Lian Wang