gexiv2 0.16 switched to a versioned library, pkg-config module, header
directory and GIR namespace, so it installs in parallel to 0.14. GNOME 50
applications need 0.16 while GIMP still requires gexiv2 < 0.15, so keep
the 0.14 series under its own name. The command line tool and the python
override are disabled here to avoid file clashes with the main recipe.
Build tested on corei7-64.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
krb5 is a new hard dependency of the RDP backend.
Build tested on corei7-64.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The x11 meson option was removed upstream, drop the corresponding
PACKAGECONFIG. The sysroot patch still applies with an offset.
Build tested on corei7-64.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The X11 session support and its x11 meson option were removed upstream,
drop the corresponding PACKAGECONFIG.
Build tested on corei7-64.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The x11 meson option is gone together with the X11 session support, so
drop the x11 PACKAGECONFIG. The new systemd-units option is tied to the
systemd PACKAGECONFIG. The reproducibility patch for the smartcard enum
types is included upstream.
Build tested on corei7-64.
AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
clang 23 enables DFAJumpThreading by default and takes over 90
minutes on the switch based state machine loops in the lib-json
tests, where clang 22 needs under a second. Reported upstream with a
bisect and reduced testcase:
https://github.com/llvm/llvm-project/issues/221391
Disable just that pass for clang builds until the fix lands. gcc
builds are not affected.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The oauth PACKAGECONFIG only controls the embedded webview of the built-in
OAuth2 credentials prompter (ENABLE_OAUTH2_WEBKITGTK4, guarded by
WITH_WEBKITGTK in e-credentials-prompter-impl-oauth2.c). OAuth2 support
itself does not depend on it: json-glib is a hard requirement of the build
and without WebKit the prompter offers the authentication URI for opening
in the default browser, receiving the response over the
org.gnome.evolution.dataserver.OAuth2Response D-Bus service.
Drop oauth from the default PACKAGECONFIG so that webkitgtk is not pulled
into every build that needs evolution-data-server. The option stays
available for those who want the in-dialog browser.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HiauLCu6cken5wf44PijzQ
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upstream removed the embedded webview along with the WebKit dependency in
3.49.0 ("Remove the webview and WebKit dependency"). The 3.58.1 sources do
not reference webkit outside of NEWS anymore, so goabackend no longer needs
webkitgtk to build. OAuth2 logins are handed to the default browser via
g_app_info_launch_default_for_uri_async() instead.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HiauLCu6cken5wf44PijzQ
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
configure.ac appends -Werror on top of -Wall unless --disable-werror is
passed, so every warning a newer compiler learns turns into a hard build
failure.
clang 23 added -Wunused-but-set-global and enabled it under -Wall. It
fires on the "static gpointer <t_n>_parent_class = NULL" that glib's
G_DEFINE_TYPE() emits, which is assigned in the generated class_intern_init
but never read unless the type chains up to a parent vfunc. PrefObject in
thd_dbus_interface.cpp never does:
src/thd_dbus_interface.cpp:48:1: error: variable 'pref_object_parent_class'
set but not used [-Werror,-Wunused-but-set-global]
48 | G_DEFINE_TYPE(PrefObject, pref_object, G_TYPE_OBJECT)
Pass --disable-werror, the escape hatch upstream added for exactly this,
rather than suppressing the individual warning - gcc does not know
-Wno-unused-but-set-global. OE's own -Werror=format-security is unaffected.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
LLVM 23 changed the MCContext constructor to take MCAsmInfo,
MCRegisterInfo and MCSubtargetInfo by reference rather than by pointer,
so bcc no longer builds:
src/cc/bcc_debug.cc:151:68: error: no matching function for call to
'llvm::MCContext::MCContext(...)'
Backport the upstream fix. It is guarded on LLVM_VERSION_MAJOR so older
Clang keeps working. There is no release carrying it yet; v0.37.0 is
still the newest tag.
Co-authored-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Clang 23 renamed ASTContext::getRawCommentForDeclNoCache to
getRawCommentNoCache, so castxml no longer builds:
src/Output.cxx:1976:47: error: 'const class clang::ASTContext' has no
member named 'getRawCommentForDeclNoCache'; did you mean
'getRawCommentNoCache'?
Backport the upstream fix. It is guarded on LLVM_VERSION_MAJOR so older
Clang keeps working. There is no release carrying it yet; v0.7.0 is
still the newest tag.
Co-authored-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Ensure that symbolic links (${IMAGE_LINK_NAME}) are created for both
sparse images, matching standard Yocto image deployment behavior
Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.5.6:
Bugs corrected:
- Alert level decided by dict ordering: a failing+slow URL is
downgraded to WARNING, an unscanned URL reports CRITICAL
- GPU plugin duplicates card name and omits N/A for unavailable
metrics in multi-GPU
- GPU plugin duplicates the utilisation value and paints it with
the memory colour in multi-GPU
- IP plugin displays wrong interface: outer loop in get_ip_address()
never breaks
- VideoCore (v3d) memory shows ~93% on Raspberry Pi 5 with
gpu_mem=4M - misleading denominator from drm-total-memory
- CSV export: --stdout-csv data rows desync from header when
network interfaces change count at runtime
- Glances Network plugin with mismatched schema not logging in
TimescaleDB export
Security patches:
- as_dict_secure() Value-Level Bypass Leaks Credentials in URL
Values via /api/4/config - CVE-2026-68520
- --disable-config-exec does not cover on-alert action commands
- CVE-2026-68519
- Command injection bypass of action-template sanitizer via
cross-field shell-operator reconstruction - CVE-2026-68518
- Incomplete fix of CVE-2026-32608: action-template sanitizer is
bypassed by nested stat values - CVE-2026-62982
- REST API CORS Credentials Guard Uses Exact-Match Instead of
Membership Test - CVE-2026-68517
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.2.3:
- Fix ty unresolved-attribute warnings and add mypy back
- Update ruff to version 0.16.5
- Bump github/codeql-action
- Update readme
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Both S and UPSTREAM_CHECK_PYPI_PACKAGE are set to the default values, so
remove them.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The need for PYPI_PACKAGE_HASH was removed in 2016[1].
[1] meta-oe 7edad4def4 ("pypi: update the base pypi url to use the
package info without requiring the hash")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Remove assignments to PYPI_PACKAGE where the value is the default value,
that is the recipe name with any python3- prefix removed.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Remove assignments to PYPI_PACKAGE where the value is the default value,
that is the recipe name with any python3- prefix removed.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Remove redundant UPSTREAM_CHECK_PYPI_PACKAGE assignments of PYPI_PACKAGE,
which is the default value.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Don't set PYPI_SRC_URI explicitly, instead of PYPI_PACKAGE so the correct
SRC_URI is generated.
Also remove the unused variable SRCNAME.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
There's a variable to handle tarball conflicts, so use it instead of
appending to the SRC_URI directly.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
meta-oe now carries mozjs-140 (140.15.0) in place of mozjs-128, so point
the gjs PACKAGECONFIG dependency at it.
Refresh disable-lgi-check.patch
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Dropped versus mozjs-128, both now fixed upstream in 140:
0002-moz.configure-do-not-look-for-llvm-objdump.patch
The LLVM_OBJDUMP check_prog block is gone from moz.configure entirely.
0011-Link-with-icu-uc-to-fix-build-with-ICU-76.patch
js/moz.configure already asks for "icu-uc icu-i18n >= 76.1".
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.2.1:
- Fixed safety issues up to 2026-08-23.
- Development: Tolerate premature deletion of local release/start
branches.
- Docs: Migrated from our own support for generating summary tables
in the documentation to using autodocsumm to fix an import error
with Sphinx 9.
- Development: Added a GitHub Actions workflow named 'backport'
that creates a backport PR to the latest stable branch stable_M.N
when a PR labeled with the 'backport' label is merged.
- Development: Upgraded GitHub Actions plugins to versions that use
node.js 24.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 3.5.1:
- Raised upper bound of setuptools to v84 (#794)
- Cache performance access optimization for our CharInfo struct
(prebuilt only).
- No longer decoding large content when the noise detector output
give a high entropy. Only impacted large content input >1M bytes.
Deploy sample data files to fix tests.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 21.7.8:
- A missing source needed by both install modes now disables the
builtin creator through meta.error. The check compared RefWhen
values against RefMust members, so creation went on to fail with
a FileNotFoundError or a dangling symlink
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The recipe produces static archives only, and does not compile them PIC, so
linking capnp or kj into a shared library fails:
libkj.a(exception.c++.o): relocation R_X86_64_TPOFF32 against
`kj::(anonymous namespace)::threadLocalCallback' can not be used when making
a shared object; local-exec is incompatible with -shared
kj/exception.c++ has a file-scope thread_local, which non-PIC code compiles to
the local-exec TLS model. A shared object cannot use that model, so the link
fails on any consumer that puts capnp inside a .so. Debian and Fedora do not
hit this because they ship shared libcapnp.
Set CMAKE_POSITION_INDEPENDENT_CODE. Packaging is unchanged: still static,
still no .so, no new packages and no ABI surface, only the code model differs.
Signed-off-by: Joel Winarske <joel.winarske@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Markus Volk
Khem Raj
Khem Raj
Ross Burton
Sunil DoraandDeepesh Varatharajan
AshishKumar Mishra
Leon Anavi
Joel Winarske
Wang Mingyu