Commit Graph
1365 Commits
Author SHA1 Message Date
Khem Raj 07ee40fb83 x265: Link with libatomic when 64-bit atomics need it
The encoder uses atomic operations on 64-bit counters. On riscv32 these
become __atomic_*_8 libcalls, and libx265 is not linked with libatomic,
so linking the x265 CLI fails:

  ld.lld: error: undefined reference: __atomic_fetch_or_8
  >>> referenced by libx265.so.217 (disallowed by --no-allow-shlib-undefined)

Add a patch that checks in CMake whether 64-bit atomics need libatomic
and adds it to the platform libraries only in that case.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-22 20:34:22 -07:00
Paresh Bhagat 091f9278dd wireplumber: enable systemd service
Add SYSTEMD_SERVICE variable to register wireplumber.service with
systemd to enable automatic service startup and management.

Signed-off-by: Paresh Bhagat <p-bhagat@ti.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-21 08:13:02 -07:00
Einar Gunnarsson 50302335fb pipewire: Remove duplicate avahi from PACKAGECONFIG
avahi is included in PACKAGECONFIG if zeroconf is in DISTRO_FEATURES.
The update to 0.3.63 enabled it unconditionally a second time.

Fixes: c4d52888a0 ("pipewire: update 0.3.62 -> 0.3.63")

Signed-off-by: Einar Jon Gunnarsson <tolvupostur@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-21 08:13:01 -07:00
Markus Volk 45c1f5e0e3 rygel: upgrade 46.0 -> 46.1
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-21 08:12:59 -07:00
Khem Raj 8d9b05049e x265: Fix riscv64 build with clang
The riscv64 ADDPTR assembler macro invokes "stride_shift" while the
macro is defined as STRIDE_SHIFT. GNU as matches macro names
case-insensitively, but the LLVM integrated assembler does not, so
building sad-a.S with high bit depth (the default 10bit PACKAGECONFIG)
fails with clang:

  error: unrecognized instruction mnemonic
  stride_shift a6, a7, t5, t5, 1, 1

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-19 20:33:06 -07:00
Ankur Tyagi 70b4ef1967 mpd: upgrade 0.24.15 -> 0.24.16
Changelog:
https://github.com/MusicPlayerDaemon/MPD/blob/v0.24.16/NEWS

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-19 15:08:27 -07:00
Ankur Tyagi 8afa1293bd pjproject: patch CVE-2026-84975
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84975

(cherry picked from commit a003f0bb5accff83fdd52df110360fae360a2272)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-19 15:08:25 -07:00
Ankur Tyagi 62bdecb9a6 pjproject: patch CVE-2026-77396
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-77396

(cherry picked from commit 2f70c43972c254d1a949dd347f81c412bda92446)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-19 15:08:25 -07:00
Ankur Tyagi f1274b1221 pjproject: patch CVE-2026-57166
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57166

(cherry picked from commit 59a6a134d6)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-19 15:08:25 -07:00
Ankur Tyagi 0851231b2d pjproject: patch CVE-2026-57165
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57165

(cherry picked from commit aac29142ed)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-19 15:08:25 -07:00
Ankur Tyagi ad9e7732e6 pjproject: patch CVE-2026-57164
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57164

(cherry picked from commit 274e935099)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-19 15:08:25 -07:00
Ankur Tyagi 79c6fa05ca pjproject: patch CVE-2026-57163
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57163

(cherry picked from commit 3cc8b60359)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-19 15:08:24 -07:00
Ankur Tyagi 8d3536131c pjproject: patch CVE-2026-57162
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57162

(cherry picked from commit f7758a033e)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-19 15:08:24 -07:00
Ankur Tyagi 8e1643c4b6 pjproject: patch CVE-2026-57161
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57161

(cherry picked from commit 371f20419d)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-19 15:08:24 -07:00
Ankur Tyagi d54112ed60 pjproject: patch CVE-2026-57160
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57160

(cherry picked from commit 78f0ee20cc)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-19 15:08:24 -07:00
Ankur Tyagi 9e5ab43682 pjproject: mark CVE-2026-26967 fixed
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-26967

(cherry picked from commit bb27c215be)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-19 15:08:24 -07:00
Khem Raj c794b5fe79 clight: Fix build with musl
log.c uses open() and O_* flags without including <fcntl.h>, which
glibc pulls in indirectly but musl does not, so clang fails with
-Wimplicit-function-declaration.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-18 17:38:48 -07:00
Khem Raj e4d5a8c1ab x265: Apply the patches with right patch level.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-18 12:53:54 -07:00
Ankur Tyagi dfdd8228b7 x265: upgrade 4.2 -> 4.3
- Update SRC_URI as official repository moved to GitHub[1]
- Replace 0001-json11.cpp-Include-cstdint.patch with upstream backport
- Refresh 0002-x265-fix-build-with-cmake-4.patch

Changelog:
https://github.com/Multicorewareinc/x265/blob/4.3/doc/reST/releasenotes.rst

[1] https://www.x265.org/#contribute

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-16 08:26:54 -07:00
prasanth 0938f25dc9 libcamera: build with 64-bit time_t
64-bit time was turned off for all of libcamera because v4l2-compat.
libcamera fixed this upstream in v0.3.0 by also
undefining _TIME_BITS for v4l2-compat (commit 705601 "v4l2:
Unset _TIME_BITS in addition to _FILE_OFFSET_BITS"), so the
workaround is no longer needed.

v4l2-compat.so still uses 32-bit APIs on purpose, so keep the
32bit-time QA skip for it.

Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:32:06 -07:00
Ankur Tyagi d7d00456d4 python3-pillow-heif: upgrade 1.8.0 -> 1.8.1
Changelog:
https://github.com/bigcat88/pillow_heif/releases/tag/v1.8.1

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:22:01 -07:00
Ankur Tyagi 045c4788d2 libheif: upgrade 1.23.5 -> 1.23.6
Changelog:
https://github.com/strukturag/libheif/releases/tag/v1.23.6

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:22:01 -07:00
Joel Winarske 3dea2c8e48 libcamera: fix softisp-gpu build on GLES-only EGL stacks
The GPU software ISP renders with GLES 2 through EGL and never uses
desktop GL, so depend on virtual/libgles2 instead of virtual/libgl.
Requiring virtual/libgl breaks machines whose GPU stack only provides
EGL and GLES, e.g. StarFive JH7110 with the PowerVR mesa-pvr.

Also carry a patch so libcamera doesn't redefine EGL_NO_X11 when an
older Mesa's egl.pc already passes -DEGL_NO_X11, which fails the build
with -Werror.

Signed-off-by: Joel Winarske <joel.winarske@linux.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-15 22:22:01 -07:00
Khem Raj 7a14b1e465 Revert "pipewire: add pw-voiceui SVA voice-UI control/listen client"
This reverts commit a09474fb9a.

Upstream has rejected this patch [1], it was
added here in hope it will be accepted in pipewire.

[1] https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/2969#note_3631852

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Cc: Nicolas Dechesne <nicolas.dechesne@oss.qualcomm.com>
Cc: Kiruthika Vijayasekar <kvijayas@qti.qualcomm.com>
Cc: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
2026-10-12 11:51:12 -07:00
Ankur Tyagi 8cd6a6b15a libde265: patch CVE-2026-54240 and CVE-2026-54241
Debian identified same commit as fix for both CVEs[1][2].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54240
https://nvd.nist.gov/vuln/detail/cve-2026-54241

[1]https://security-tracker.debian.org/tracker/CVE-2026-54240
[2]https://security-tracker.debian.org/tracker/CVE-2026-54241

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:35:56 -07:00
Ankur Tyagi a1a902b3b9 libde265: patch CVE-2026-49346
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49346

(cherry picked from commit 4a63a2afa1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:35:56 -07:00
Ankur Tyagi 6f9970147f libde265: patch CVE-2026-49337
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49337

(cherry picked from commit c83399f83f)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:35:56 -07:00
Ankur Tyagi 2bba25a0e6 libde265: patch CVE-2026-49295
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49295

(cherry picked from commit bd09bb41b4)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:35:56 -07:00
Ankur Tyagi bef03c1c45 gerbera: ignore CVE-2025-23386
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-23386

This vulnerability is due to openSUSE specific packaging issue.

(cherry picked from commit 369d962967)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-11 21:45:41 -07:00
Ross Burton 0a583b3502 recipes: update for PYPI_PACKAGE change
The pypi class has slightly changed the semantics of the PYPI_PACKAGE
variable[1], now PYPI_PACKAGE is the normalised package name and the new
variable PYPI_PACKAGE_SDIST is used when the source tarball doesn't match.

Update recipes as appropriate: this is mostly deleting now-redundant
assignments but some assignments are still needed where packages are not
uploaded using the modern standards.

[1] oe-core 98049bf86b6 ("classes/pypi: change PYPI_PACKAGE to be normalised")

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-08 22:27:01 -07:00
Ankur Tyagi 07527be72a vlc: upgrade 3.0.23 -> 3.0.24
Changelog:
https://github.com/videolan/vlc/blob/3.0.24/NEWS

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-01 07:40:50 -07:00
Ankur Tyagi 3596eab3e0 spandsp: upgrade 3.0.0 -> 3.1.1
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-01 07:40:49 -07:00
Ankur Tyagi f58ad5704a gerbera: upgrade 3.2.1 -> 3.3.0
Dropped patches that are part of the upstream version.

Changelog:
https://github.com/gerbera/gerbera/releases/tag/v3.3.0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-01 07:40:49 -07:00
Ankur Tyagi ebebcaf570 wireplumber: upgrade 0.5.17 -> 0.5.18
Changelog:
https://gitlab.freedesktop.org/pipewire/wireplumber/-/blob/0.5.18/NEWS.rst?ref_type=tags

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-01 07:40:49 -07:00
Ankur Tyagi 8c58d3493f pipewire: upgrade 1.6.8 -> 1.6.9
Changelog:
https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/1.6.9/NEWS?ref_type=tags

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-01 07:40:49 -07:00
Ankur Tyagi 32c2eab0bc aom: upgrade 3.14.1 -> 3.15.1
Changelog:
https://aomedia.googlesource.com/aom/+/refs/tags/v3.15.1/CHANGELOG

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-01 07:40:49 -07:00
Khem Raj 44697b8e3b libdvdread: fix off64_t definition in dvd_filesystem.h for musl
dvd_filesystem.h unconditionally uses the glibc LFS64 off64_t name.
musl's off_t is already 64-bit, so typedef it the same way the other
non-glibc branches already do. This also fixes libdvdnav, which
consumes this staged header.

AI-Generated: Uses Claude Code

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-29 09:57:22 -07:00
Khem Raj 1c6d5598db tinycompress: use unsigned int instead of glibc-only uint
sofprobeclient uses the bare 'uint' typedef, which is a glibc/BSD
extension musl doesn't provide. Use 'unsigned int' instead.

AI-Generated: Uses Claude Code

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-29 09:57:21 -07:00
Ankur Tyagi 8df45e60a6 libsrtp: upgrade 2.8.0 -> 2.8.1
Changelog:
https://github.com/cisco/libsrtp/releases/tag/v2.8.1

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-27 07:53:45 -07:00
Ankur Tyagi 82c58a1fa7 libuvc: upgrade 0.0.7 -> 0.0.8
- Dropped patch that is merged in the upstream version
- Include tag in the SRC_URI
- Introduce packageconfig option for jpeg[1]

Changelog:
https://github.com/libuvc/libuvc/releases/tag/v0.0.8

[1]https://github.com/libuvc/libuvc/commit/94a188c874cd299c4179b58858d06b3a409f2df0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-27 07:53:45 -07:00
Leon Anavi 0d17fff919 x265: Upgrade 4.1 -> 4.2
Switch to the alternate URI from videolan. Upgrade to release 4.2:

- Threaded Motion Estimation (Experimental feature)-It uses a
  dedicated threadpool to precompute Motion Estimation in parallel.
  Improves encoding speed upto 1.5x for 1080p & lower resolution on
  multi core machines with low frequency setting. On high frequency
  systems or on machines with low number of cores, the overhead of
  additional Motion estimation work may outweigh parallelism
- Add new Levels 6.3 to 7.2 specified in ITU-T H.265 (V9) (09/2023)
  and above
- Improve Slices feature with check zeroMv
- Enable frame parallelism with MCSTF feature
- Updated support to signal AOM FGM params
- Improve quality with SBRC feature 6.Updated DolbyVision P5 VUI
  defaults
- API Support to enable Threaded Motion Estimation(-threaded-me)
- RISC V optimizations including SAD, SATD, DCT, IDCT, block copy,
  pixel utilities, SAO, loopfilter, transpose kernels resulting in
  2x encoding speed.
- ARM SIMD optimizations including the use of NEON and SVE
  instruction set extensions. The following algorithms now have
  optimized SIMD implementations: DST, IDCT, SSE, SSD,
  intra_pred_planar, pelFilterLumaStrong, interpolation, planecopy,
  dequant_normal, blockcopy, pixel variance resulting in 8% faster
  encoding speed compared to v4.1
- Fix memory leaks (no command line option, SEI buffer, analysis
  save/load)
- Fix chroma qp offset for non yuv444 inputs
- Fix max supported input resolution
- Fix bugs with ARM SIMD optimizations
- Fix Alpha and Multiview feature flag support in x265_config
- Fix test harness issues, CMake errors
- Fix inconsistent output with aq-motion
- Fix crash with hist-scenecut on high bit-depth builds
- Fix lookahead concurrency bug
- Fix shared link issue (R_X86_64_PC32), yuv recon output issue,
  rd-refine and dynamic-refine issue, inputs for Windows named
  pipe, weighted prediction delta_chroma_offset, crf and vbv issue
  in abr-ladder, psnr and ssim reported with MCSTF feature,
  internally overflowed VBV variables

This work was sponsored by GOVCERT.LU.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-25 10:23:13 -07:00
Leon Anavi fb5c40cf69 python3-pillow-heif: Upgrade 1.5.0 -> 1.8.0
Upgrade to release 1.8.0:

- Reading of entity groups: entity_groups key in info dictionary,
  tells which images form a stereo pair in spatial photos.
- Decoding of embedded thumbnails: HeifImage.get_thumbnail method
  and draft in the Pillow plugin, Image.thumbnail() uses them
  instead of decoding the full image.
- Minimum required libheif version is 1.23.4.
- libheif was updated from the 1.23.3 to 1.23.4 version.
- libde265 was updated from the 1.1.2 to 1.1.3 version.
- Segmentation fault when opening a file whose metadata item type
  is not valid UTF-8.
- Pillow plugin: load() of a multi-frame image reloaded the frame
  data on every call, discarding in-place changes and failing after
  thumbnail().
- A depth image of an item type that libheif cannot decode made the
  whole file unreadable with libheif 1.23.4, such depth images are
  now skipped.
- Type checkers treated the names imported from pillow_heif as
  private since the py.typed marker was added in 1.7.0:
  Pyright/Pylance and mypy --strict reported them as not exported,
  Pyright/Pylance autocompletion did not offer them.

This work was sponsored by GOVCERT.LU.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-24 21:56:18 -07:00
Leon Anavi 6076c421a0 libheif: Upgrade 1.23.2 -> 1.23.5
Upgrade to release 1.23.5 with the following security issues:

- CVE-2026-XXXXX (GHSA-v8qw-hwjv-44hw) Memory exhaustion through a
  mismatch between the container and the bitstream image size. A
  crafted image can declare a small size in its ispe property while
  the bitstream declares a much larger coded frame. The
  container-level checks used the ispe size, so the oversized
  bitstream reached the decoder, which allocated a frame buffer for
  the in-band size before libheif rejected the mismatch. The
  advisory demonstrated this for AV1 with the libaom backend (a
  351-byte AVIF declaring 64x64 but coding up to 27648x27648,
  allocating hundreds of MB to more than 10 GB), but the same class
  affects every codec whose real frame size lives in the bitstream.
  The coded size is now checked against max_image_size_pixels in
  the codec-independent decode path, before any bytes reach a
  decoder plugin: all AV1 sequence headers, all HEVC/AVC/VVC SPS
  NAL units (including those carried in the item data, not only the
  ones in the configuration record), the JPEG SOF marker and the
  JPEG 2000 SIZ reference grid are scanned for the largest coded
  size. (high)
- CVE-2026-XXXXX (GHSA-qwpf-5wf7-r996) Heap use-after-free and
  double free when encoding an image that carries a TAI timestamp,
  including transcoding a file with an itai property.
  ImageDescription shallow-copied its raw heif_tai_timestamp_packet
  pointer, and a temporary in ImageItem::encode_to_bitstream_and_boxes()
  freed the packet while the item and the source image still held
  it. The timestamp is now stored by value. (medium)
- CVE-2026-XXXXX (GHSA-9c75-9g8r-4728) Memory amplification through
  a JPEG 2000 pclr box declaring zero palette columns. The
  entry-count bound was skipped for zero columns, so an 11-byte box
  allocated 65,535 empty palette entries, and nested j2kH containers
  could repeat this within the child and nesting limits: a 3 KB file
  reached about 330 MB RSS, none of it charged to max_total_memory.
  Zero columns are rejected (ISO/IEC 15444-1 requires 1 to 255),
  the byte bound is unconditional, and the palette storage is
  charged to the memory limits. (medium)
- CVE-2026-XXXXX (GHSA-r7gr-2xm2-23wf) Heap out-of-bounds read in
  alpha compositing for uncompressed (unci) images whose colour
  planes have different bit depths. Op_flatten_alpha_plane read
  every plane through the sample type of the first colour plane, so
  an 8-bit blue plane next to 16-bit red and green planes was read
  with a halved stride past its end, and the bytes ended up in the
  composited output. ColorState now tracks one bit depth per plane,
  and the operator declines mixed sample widths at planning time.
  (medium)
- CVE-2026-XXXXX (GHSA-q492-cfcm-895h) The OpenJPEG decoder
  plugin's pre-decode size check bounded the JPEG 2000 window span
  (x1-x0)*(y1-y0) but not the absolute reference-grid coordinates,
  so a codestream with a 17-pixel window on a grid near the 32-bit
  boundary reached opj_decode(). Against OpenJPEG 2.3.1 this
  produced a heap-buffer-overflow write inside OpenJPEG (the class
  of CVE-2020-6851); OpenJPEG 2.5.4 rejects the input. The
  reference-grid area is now bounded as well. (low)
- (GHSA-qfj5-c4pq-q998) Heap out-of-bounds read in the uncompressed
  encoder when an application attached a separate alpha plane to an
  image with an interleaved chroma format. The interleaved encoders
  took their component list from the chroma format (three entries)
  but decided whether to write alpha from the presence of an alpha
  plane, and indexed the list at [3]. heif_image_add_plane() now
  rejects a separate alpha plane on interleaved images, and the
  encoders derive both decisions from the chroma format. Only
  reachable through the public API; decoding never produces such an
  image. (low)
- (GHSA-7pwf-qh74-p35w) The caller's heif_security_limits were not
  applied when parsing a mini box (the MIAF minimized image format)
  or the av1C/hvcC blob embedded in it; the built-in defaults were
  used instead. An application that tightened the limits got no
  enforcement of its max_memory_block_size or max_total_memory on
  such files. The allocations are bounded by the bytes present in
  the box, so this could not amplify memory use. (low)

This work was sponsored by GOVCERT.LU.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-23 14:11:07 -07:00
Khem Raj b0f5a9a3ea wireplumber: only build the dbus tests when dbus-daemon is available
test-dbus-connection and test-reserve-device spawn a private bus through
GLib's GTestDBus, which executes dbus-daemon. When VIRTUAL-RUNTIME_dbus
is dbus-broker, dbus-daemon is not installable (dbus-broker RCONFLICTS
dbus) and both tests abort with:

  GLib-GIO-FATAL-ERROR: Error spawning dbus-daemon: Failed to spawn
  child process "dbus-daemon" (No such file or directory)

Enable the dbus-tests meson option only when dbus provides the message
bus, and make the ptest package depend on dbus in that case instead of
relying on it being pulled in indirectly.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-23 13:10:18 -07:00
Khem Raj 40455d6dbc layers: Update to use blacksail release series name
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-23 13:10:17 -07:00
Markus Volk 939eabd003 rygel: upgrade 45.2 -> 46.0
The RUIH plugin is gone upstream, so drop its PACKAGECONFIG along with
the RYGEL_PLUGINS entry that referenced it.

Two new native dependencies: meson now looks for a python3 that provides
the yaml module, and the manpages are rst sources built with rst2man.

The library API version is still 2.8, so the engine and plugin paths in
FILES and do_install keep working. HOMEPAGE follows the project to its
own domain.

AI-Generated: Uses Claude Code
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-22 11:36:19 -07:00
Ross Burton a1c7a93355 mycroft: remove obsolete recipe
Mycroft made its last release in 2021 and was formally abandoned in 2024:

  Mycroft core is no longer maintaiend and probably likely not work on
  your computer anymore. Open Voice OS and Neon-core are both spiritual
  successors to Mycroft. (And some of the old code may live on there.)

The version we packaged was from 2019 and nobody cared enought to upgrade
it to any of the sixteen later releases, so I don't believe anyone is
using it.

Signed-off-by: Ross Burton <ross.burton@arm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-21 08:13:54 -07:00
Leon Anavi b97afd3d5f rygel: Upgrade 45.2 -> 46.0
Upgrade to release 46.0:

- Translation updates
- Add missing "dlnaprofile" description for GstLaunch
- Fix rendering issues for web docs
- Remove RUIH implementation
- Allow proper boolean settings through environment variables
- Align list definition through environment with config file
- Remove BasicManagement and EnergyManagement

Remove RUIH from PACKAGECONFIG. Add Python packages PyYAML and
Docutils to the dependencies.

Change HOMEPAGE to https://rygel-project.org which redirects to
the Rygel 46.0 documentation.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-21 08:13:49 -07:00
Markus Volk 10ace918c2 wireplumber: update 0.5.15 -> 0.5.17
0.5.16 is skipped because it contains a regression that broke object
destruction in the monitor scripts; upstream recommends to avoid it.

WirePlumber 0.5.17
~~~~~~~~~~~~~~~~~~

Fixes:

  - Fixed factory-created device, node and link objects to stop sharing
    ownership with their registry global, fixing a regression from the
    ``WpClientContext`` introduced in 0.5.16 that broke proper object
    destruction in the monitor scripts (#999; !890, !891)

  - Improved ``default-nodes`` to also rank on the object.serial of a node's
    device and on the node's own object.serial, so that route priorities are
    only compared between nodes of the same card, and the election no longer
    changes for no apparent reason when all other keys are equal (!893)

  - Fixed ``m-lua-scripting`` to include the offending Lua type name in POD
    build errors (!889)

WirePlumber 0.5.16
~~~~~~~~~~~~~~~~~~

Additions & Enhancements:

  - Added ``WpClientContext``, a second PipeWire connection running on its own
    thread that hosts WirePlumber's in-process media objects (loopback and
    filter-chain modules, ``LocalNode()``, ``SpaDevice()``), so that slow Lua
    event hooks on the main thread no longer stall their control path; the
    export core is retired in favor of this new client context (!873)

  - Added new ``WpDynamicRules`` class for matching rules with conditions, and
    updated ``filter-graph.lua`` to use it, allowing filter-graphs to be loaded
    and unloaded dynamically depending on whether other objects exist or not
    (!872)

  - Added ``wp_impl_module_unload()`` and ``LocalModule:unload()``, giving
    scripts control to unload implemented modules at any time (!881)

  - Added a ``volume-set`` action to ``module-mpris`` to allow adjusting the
    volume of a remote MPRIS2 player from Lua (!860)

  - Added ``--yes`` flag to ``wpctl reset`` to skip the confirmation prompt
    (!850)

  - Added ``device.form-factor`` ALSA node property for use in ALSA rules, and
    made HDMI node descriptions include the name of the connected display when
    available (!862, !874)

  - Refactored the Bluetooth monitor to use event hooks for handling devices
    and nodes, matching the design already used by the v4l2 and libcamera
    monitors (#916; !803)

  - Overhauled the documentation: filled in every stub and missing Lua API and
    C API page, added a getting started guide, new ``wireplumber(1)`` and
    ``wpexec(1)`` man pages, and removed stale pages describing features
    renamed or removed in the 0.4 to 0.5 transition (!877)

Fixes:

  - Fixed monitors to always activate all device and node features, and made
    monitors wait for successful device activation before storing the devices
    and nodes as a managed objects (#986, #996; !883, !886, !876)

  - Fixed ``find-preferred-profile`` to skip a configured preferred profile
    that is not available, instead of leaving no profile selected (#993; !884)

  - Fixed ``permission-manager`` to not include destroyed globals when
    rebuilding the permissions array on ``objects-changed``, fixing some
    pipewire warnings in the log (!882, !888)

  - Fixed a memory leak in ``WpSpaDevice`` by only collecting params from our
    own requests (#988; !879)

  - Fixed ``filter-graph`` to correctly apply graphs defined for the same node
    across multiple configuration files (!870)

  - Fixed several nil-related crashes and correctness issues in Lua scripts
    (#972; !861, !864, !866, !869)

  - Improved ``apply-access`` to directly attach an already-active permission
    manager to the client instead of wastefully re-running activation on it
    (#973; !868)

  - Improved ``state-stream`` change detection to avoid spurious state writes
    from volume rounding and from unset or empty properties (#974; !867)

  - Fixed ``default-nodes`` to ignore smart filters when selecting the best
    default node (!857)

  - Removed the ``node.filter.forward-format`` setting and its script, which
    only worked with 0.4 and never really worked with 0.5 (!878)

AI-Generated: Uses Claude Code (Claude Opus 5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-11 07:44:20 -07:00
Khem Raj b3d8c68897 libcamera: Fix build with clang 23
clang 23 enables -Wunused-template as part of -Wall (via -Wmost ->
-Wunused), where previously neither -Wall nor -Wextra turned it on.
libcamera builds with -Werror, so this now breaks the build:

  In file included from include/libcamera/ipa/core_ipa_serializer.h:18:
  include/libcamera/internal/ipa_data_serializer.h:57:3: error: unused
      function template 'readPOD' [-Werror,-Wunused-template]
     57 | T readPOD(std::vector<uint8_t> &vec, size_t pos)
        |   ^~~~~~~

The POD helpers sit in an anonymous namespace, so they have internal
linkage and clang diagnoses them per translation unit. appendPOD() and
the iterator overload of readPOD() are referenced by the
IPADataSerializer specialisations in the header itself, so they count as
used everywhere. The std::vector overload of readPOD() is not: nothing
in libcamera calls it, its only callers are the IPA proxies and proxy
workers generated at build time from the mojom templates. So it is
genuinely unused in every translation unit that is not generated proxy
code, which is what [[maybe_unused]] exists for.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-09-07 19:06:03 -07:00