A vulnerability in corydolphin/flask-cors version 4.0.1 allows the
`Access-Control-Allow-Private-Network` CORS header to be set to true
by default, without any configuration option. This behavior can expose
private network resources to unauthorized external access, leading to
significant security risks such as data breaches, unauthorized access
to sensitive information, and potential network intrusions.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-6221
Upsteam-Patch:
7ae310c56a
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Debug packages of klibc-based recipe contains reference to TMPDIR and
fail to build since "buildpaths" is a ERROR_QA: For example, from [0]:
stdio: ERROR: kexec-tools-klibc-2.0.18+git-r0 do_package_qa: QA Issue: File /usr/sbin/.debug/kexec in package kexec-tools-klibc-dbg contains reference to TMPDIR
stdio: ERROR: kexecboot-klibc-0.6+git-r0 do_package_qa: QA Issue: File /usr/bin/.debug/kexecboot in package kexecboot-klibc-dbg contains reference to TMPDIR [buildpaths]
stdio: ERROR: ubi-utils-klibc-2.0.2-r0 do_package_qa: QA Issue: File /usr/sbin/.debug/ubirename in package ubi-utils-klibc-dbg contains reference to TMPDIR
Fix this by adding DEBUG_PREFIX_MAP to the klibc build CFLAGS to rewrite
these paths in a reproducible way.
[0]: https://autobuilder.yoctoproject.org/typhoon/#/builders/155/builds/40
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
INSANE_SKIP:gcab-src doesn't work with multilib where the package is
named ${PN}-src (e.g. lib32-gcab-src) and it's better to just lower
buildpaths from ERROR_QA to WARN_QA instead of skipping it completely,
because it's still an issue which should be fixed (at least to improve
hashserv efficiency if you don't care about reproducibility itself)
The backport to scarthgap from:
https://lists.openembedded.org/g/openembedded-devel/message/111739
should IMHO be just reverted there as buildpaths QA issues
aren't fatal in scarthgap.
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
OE-core has moved to ffmpeg7, vlc3 needs to be ported to work
with this version and vlc4 is not released yet.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changes between 3.0.20 and 3.0.21:
----------------------------------
Decoders:
* Improve Opus ambisonic support
* Fix some ASS subtitle rendering issues
* Fix Opus in MP4 behaviour
* Fix VAAPI hw decoding with some drivers
Input:
* Add support for HTTP content range handling according to RFC 9110
* Fix some HLS Adaptive Streaming not working in audio-only mode
Video Output:
* Super Resolution scaling with AMD GPUs
* The D3D11 HDR option can also turn on/off HDR for all sources regardless of
the display
* Improve subtitles rendering on Apple platforms of notably Asian languages
by correcting font fallback lookups
Video Filter:
* New AMD VQ Enhancer filter
* Add D3D11 option to use NVIDIA TrueHDR to generate HDR from SDR sources
Audio Output:
* Fix regression on macOS causing crashes when using audio devices
with more than 9 channels
Services Discovery:
* Fix exposed UPnP directory URL schemes to be compliant with RFC 3986
Contrib:
* Update FFmpeg to 4.4.4
* Update dav1d to 1.4.2
* Update libvpx to 1.14.1
libVLC:
* the HWND passed to libvlc_media_player_set_hwnd must have the WS_CLIPCHILDREN
style set.
* Fix crashes when using caopengllayer
Misc:
* Fix various warnings, leaks and potential crashes
* Fix security integer overflow in MMS module
Signed-off-by: Khem Raj <raj.khem@gmail.com>
PipeWire 1.2.3 (2024-08-22)
This is a bugfix release that is API and ABI compatible with the
previous 1.2.x and 1.0.x releases.
Highlights
- Implement freewheeling support in the FFADO driver. Also improve
buffersize and samplerate handling.
- Improve some locking on spa_loop. Remove a possible deadlock when
the queue was full.
- Allocate more space for the libcamera devices string to properly
deduplicate libcamera and v4l2 devices.
- Some more bugfixes and improvements.
PipeWire
- Improve activation state changes and xrun detection some more.
(#4182)
- Avoid a memory leak when a link in error is destroyed.
Modules
- Improve samplerate and buffersize handling in FFADO driver so that
it is possible to force a rate and buffer size.
- Implement freewheeling support in the ffado driver.
- Always set the server side clock.quantum-limit on nodes. This fixes
a buffer size problem in Midi-bridge. (#4005)
SPA
- Improve some locking on spa_loop. Remove a possible deadlock when
the queue was full. (#4114)
- Allocate more space for the libcamera devices string to properly
deduplicate libcamera and v4l2 devices.
- Fix a potential race when enumerating v4l2 udev devices. (#3960)
Bluetooth
- Improve compatibility with some devices (Soundcore Motion 300).
Tools
- pw-cli can now handle arbitrarily large input and params. (#4166)
- Avoid some compiler warnings in pw-top.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
ChangeLog:
https://github.com/snort3/snort3/releases/tag/3.3.4.0
* appid: notify binder on service change
* appid: replaced hsessions vector of raw pointers into vector of smart
pointers
* ftp_telnet: refactoring ftp-data
* latency, dce, stream_ip: fix max pegs incorrectly declared sum
* telnet: avoid flush when cr or lf is between commands
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
===========
- fix time calculations for dead host
- change paxos_acquire error for initial host state
- fix for lver that was abandoned in dblock
- terminate helper path and args
- fix freeing lvb after io timeout
- add sysusers file
- rem_lockspace EBUSY when orphans exist
- fix SANLK_ACQUIRE_ORPHAN_ONLY
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
============
- omkafka enhance: write Kafka log with level ERROR or higher into errorfile
- net subsusytem bugfix: some config statemens were not accepted
- new "ossl" crypto provider
- imtcp: improve connection error messages
0001-tests-disable-the-check-for-inotify.patch
use-pkgconfig-to-check-libgcrypt.patch
refreshed for 8.2408.0
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
- Update incorrect or incomplete constants in distutils
- Use Generator instead of Iterator for 3rd-party context managers
- Bump mypy to 1.11.1
License-Update:
License changed from "Apache-2.0 license" to "Apache-2.0"
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
===========
- An inconsistency in Float/Rational comparisons was fixed. SymPy 1.13 made it
so that Rational(n) != Float(n) but this was inconsistent in the case of
Rational(0) == Float(0) and Float(0) == Rational(0) which gave different
results.
- Fixed a bug that caused LambertW to hang on specific inputs.
- A regression introduced in SymPy 1.13 in the heurisch integration routine was
fixed. The regression prevented some integrals from being evaluated.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
- Updated test & build matrix to include Python 3.13.
- Dropped wheel support for Python 2.7 on macOS.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
===========
* Properly preserve escaped '{' and '}' in fstrings in logical lines in 3.12+.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
- Fix a 64-bit-ism in the test suite so the tests don't encounter a false
negative on 32-bit systems.
- Modify a test-harness skiptest check to work with newer versions of
Cryptography.
- Massage our import of the TripleDES cipher to support Cryptography >=43;
this should prevent CryptographyDeprecationWarning from appearing upon import.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
- Add many Meta option to Schema so it expects a collection by default
- Refactor hooks
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
- Deferred import of inspect for import performance.
- Disallow passing of 'dist' to EntryPoints.select.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
===========
- minor docs fixes
- worker_class parameter accepts a class
- fix deadlock if request terminated during chunked parsing
- permit receiving Transfer-Encodings: compress, deflate, gzip
- permit Transfer-Encoding headers specifying multiple encodings. note: no parameters, still
- sdist generation now explicitly excludes sphinx build folder
- decode bytes-typed status (as can be passed by gevent) as utf-8 instead of raising TypeError
- raise correct Exception when encounting invalid chunked requests
- the SCRIPT_NAME and PATH_INFO headers, when received from allowed forwarders, are no longer restricted for containing an underscore
- include IPv6 loopback address [::1] in default for forwarded_allow_ips and proxy_allow_ips
- refuse requests where the uri field is empty
- refuse requests with invalid CR/LR/NUL in heade field values
- remove temporary --tolerate-dangerous-framing switch from 22.0
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
