Contains fix for CVE-2026-21860
Changelog:
- safe_join on Windows does not allow more special device names,
regardless of extension or surrounding spaces.
- The multipart form parser handles a \r\n sequence at a chunk boundary.
This fixes the previous attempt, which caused incorrect content lengths.
- Fix AttributeError when initializing DebuggedApplication with pin_security=False.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit ecf359d256)
From the release notes:
This is the Werkzeug 3.1.5 security fix release, which fixes security issues
and bugs but does not otherwise change behavior and should not result in
breaking changes compared to the latest feature release.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
==============
- safe_join on Windows does not allow special device names. This prevents
reading from these when using send_from_directory. secure_filename already
prevented writing to these.
- The debugger pin fails after 10 attempts instead of 11.
- The multipart form parser handles a \r\n sequence at a chunk boundary.
- Improve CPU usage during Watchdog reloader.
- Request.json annotation is more accurate.
- Traceback rendering handles when the line number is beyond the available
source lines.
- HTTPException.get_response annotation and doc better conveys the distinction
between WSGI and sans-IO responses.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 74aa2bdac6)
Contains fix for CVE-2025-66221.
From the release notes:
This is the Werkzeug 3.1.4 fix release, which fixes bugs but does not otherwise
change behavior and should not result in breaking changes compared to the latest
feature release.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Bug fixes
~~~~~~~~~
- The "in" operator for "HTTPHeaders" was incorrectly case-sensitive, causing
lookups to fail for headers with different casing than the original header name.
This was a regression in version 6.5.3 and has been fixed to restore the intended
case-insensitive behavior from version 6.5.2 and earlier.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit ebca0ae79d)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
Fix incorrect escaping of the vertical tabulation character.
This was introduced in 3.10.17.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Contains fixes for CVE-2025-61911 and CVE-2025-61912
Changelog:
Security fixes:
- CVE-2025-61911 (GHSA-r7r6-cc7p-4v5m): Enforce str input in
ldap.filter.escape_filter_chars with escape_mode=1; ensure proper
escaping.
- CVE-2025-61912 (GHSA-p34h-wq7j-h5v6): Correct NUL escaping in
ldap.dn.escape_dn_chars to \00 per RFC 4514.
Fixes:
- ReconnectLDAPObject now properly reconnects on UNAVAILABLE, CONNECT_ERROR
and TIMEOUT exceptions (previously only SERVER_DOWN), fixing reconnection
issues especially during server restarts
- Fixed syncrepl.py to use named constants instead of raw decimal values
for result types
- Fixed error handling in SearchNoOpMixIn to prevent a undefined variable error
Tests:
- Added comprehensive reconnection test cases including concurrent operation
handling and server restart scenarios
Doc:
- Updated installation docs and fixed various documentation typos
- Added ReadTheDocs configuration file
Infrastructure:
- Add testing and document support for Python 3.13
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9eabbca905)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Contains a fix for CVE-2024-6221 (related patch dropped) and CVE-2024-1681
Changelog:
4.0.1:
- Fix Read the Docs builds
- Update extension.py to clean request.path before logging it
- Update CI to include Python 3.12 and flask 3.0.3
4.0.2:
- Bump requests from 2.31.0 to 2.32.0 in /docs
- Backwards Compatible Fix for CVE-2024-6221
- Add unit tests for Private-Network
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit fbe5524dc8)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
While using devtool to check available versions, I noticed a 301 http error.
Specifically :
$ devtool latest-version libxfce4ui
Resolving archive.xfce.org (archive.xfce.org)... 217.70.191.87
Connecting to archive.xfce.org (archive.xfce.org)|217.70.191.87|:80... connected
.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://archive.xfce.org/src/xfce/libxfce4ui/4.20/ [following]
With this patch, we change to make the SRC_URI an https request.
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8089168196)
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Gimp 3.0.8's meson file detects the presence of libunwind incorrectly,
making it fail on some platforms, even when libunwind is explicitly disabled:
| <snip>i686-oe-linux-musl-ld: app/core/libappcore.a.p/gimpbacktrace-linux.c.o: in function `gimp_backtrace_get_address_info':
| /usr/src/debug/gimp/3.0.8/../sources/gimp-3.0.8/app/core/gimpbacktrace-linux.c:708:(.text+0xbd7): undefined reference to `_ULx86_init_local'
This backported patch fixes this.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Reviewed-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-47865
This CVE was opened based on a 5 years old Github issue[1], and has been made
public recently. The CVE wasn't officially disputed (yet?), but based on
the description and the given PoC the application is working as expected.
The vulnerability description and the PoC basically configures proftpd to
accept maximum x connections, and then when the user tries to open x + 1
concurrent connections, it refuses new connections over the configured limit.
See also discussion in the Github issue.
It seems that it won't be fixed, because there is nothing to fix.
[1]: https://github.com/proftpd/proftpd/issues/1298
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2003-0887
The vulnerability is about the default (example) configurations,
which place cache files into the /tmp folder, that is world-writeable.
The recommendation would be to place them to a more secure folder.
The recipe however does not install these example configurations,
and as such it is not vulnerable either.
Just to make sure, patch these folders to a non-tmp folder
(and also install that folder, empty).
Some more discussion about the vulnerability:
https://bugzilla.suse.com/show_bug.cgi?id=48161
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-64503
Pick the patch that explicitly refernces the CVE ID in its message.
(The NVD advisory mentions only the cups-filters patch, but
the developer indicated the CVE ID in the libcupsfilters patch also)
Between this recipe version and the patch the project has decided to
eliminate c++ from the project, and use c only. The patch however
is straightforward enough that it could be backported with very small
modifications.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
- remove cve fixes which are included in this release
- remove the fix for bzip2. meson.build was improved so this is not
required anymore
- inherit bash-completion
This releases contains a lot of bugfixes. The below list is not
exhaustive.
Core:
- Font handling improvements:
* Font loading on start massively sped up.
* As an exception, Skia font family (apparently quite common on macOS)
is special-cased because it behaves weirdly and was not working with
current font handling.
* Various other fixes related to font handling.
* We now wait for fonts to be fully loaded before loading any file.
- Command Line Interface:
* Option -i / --no-interface is not shown anymore on `gimp-console`
binary (it can still be used — it does nothing there anyway —, which
allows to use the same sets of option with the GUI binary, and also
so that existing shell scripts don't break).
* Option --show-debug-menu is not hidden anymore for discoverability.
* The `gimp-3.0` executable can now run with --no-interface even when
no display is available (ex: virtual terminal with no window
manager/compositor, containers, etc.). This used to only work with
`gimp-console-3.0` executable.
- Windows:
* output CLI messages to the parent console like Linux and macOS.
* Ctrl+C signals are now correctly handled in the attached console.
* The attached console supports color too.
* Interpreters are run conditionally if running in console.
- macOS: default to "quartz" Input Method for emoji keyboard support.
- Wayland: wait before we get our first surface before listing input
devices to work around a Wayland limitation and GTK bug.
- Default "Search" feature in GTK3 is now disabled in the component
editor in the Channels dockable.
- Several fixes related to Quick Mask handling.
- Fixed some cases where config migration from GIMP 2 to GIMP 3 was
problematic.
- Several buggy undo cases were fixed.
- Several fixes related to pass-through group layers.
- Export will now be properly triggered even if no drawables are
selected (this is not a requirement anymore with GIMP 3 API).
- Path import and export respectively from and to SVG improved.
- Serialize colors in legacy GimpRGB format into a XCF when the XCF
version is older than GIMP 3 for backward compatibility.
Tools:
- Symmetry: fix initial stroke symmetry when using pixmap brushes.
- Move tool: fixed weird position jumps in some cases.
Graphical User Interface:
- Center buttons in overlay dialogs.
- Headerbar's (when titlebar and menubar are merged) button colors
now match our theme.
- Dialogs' header icon and view will now scale based on custom icon
size.
- Resize dialog: Canvas Size fill combo set to insensitive if layers
won't be resized.
- Navigation and Selection editor will now properly match the theme
(in particular, in dark mode, they won't show large bright area).
- Do not show outlines when hovering the absent "Fx" icon anymore,
which was confusing people into making it look like you could click
and interact with this empty area.
Plug-ins:
- Fixes on: OpenRaster export, TIFF import, Map Object, PDF export,
Gradient Flare, ANI export, Script-Fu, DDS export, Fractal Explorer,
PSP import, ICO import, XWD import, PSD import, WebP export, ICNS
import, Gimpressionist, JPEG 2000 import, Busy Dialog.
- Scale entries have been replaced by spin scale widgets in a bunch of
plug-ins.
- Fixed vulnerabilities: ZDI-CAN-28376, ZDI-CAN-28311, ZDI-CAN-28273,
ZDI-CAN-28158, ZDI-CAN-28232, ZDI-CAN-28265, ZDI-CAN-28530,
ZDI-CAN-28248, PSP issue 15732.
- Script-Fu improved to not initialize UI code unnecessarily (and
therefore make it unusable on systems without a display).
API:
- libgimp:
* Fixes where made in libgimp metadata object.
* Make GExiv2Metadata as parent of GimpMetadata visible to
Gobject-Introspection tools (bindings were missing this
information).
* Fixes made on: gimp_drawable_get_thumbnail(),
gimp_drawable_get_sub_thumbnail(), gimp_drawable_filter_new(),
gimp_proc_view_new(), gimp_procedure_set_sensitivity_mask(),
gimp_procedure_dialog_get_spin_scale().
* Remove thumbnail metadata before writing it on export, to make
sure we don't cary on metadata written by other software in
thumbnails.
- libgimpconfig:
* Improve error messaging on config deserialization.
* Fix gimp_config_serialize_value() when serializing file objects.
* New functions: gimp_config_get_xcf_version() and
gimp_config_set_xcf_version().
- libgimpcolor:
* gimp_color_is_perceptually_identical() docs clarified.
- libgimpbase:
* The host config directory is now shown in MSIX.
* The host config directory is now shown in flatpak.
- libgimpwidgets:
* Fixes made on: GimpLabelEntry, gimp_widget_free_native_handle().
- libgimpcolor:
* New function: gimp_cairo_surface_get_buffer()
* Deprecated function: gimp_cairo_surface_create_buffer() in favor
of gimp_cairo_surface_get_buffer().
The function implementation was also changed so that it does not
necessarily return a linear-memory backed buffer anymore (it
might, but developers should not have any expectation about this).
Build:
- Third-party binary plug-in support in the Snap backported from the
original third-party snap.
- Snap package for release is now created and submitted on a release
pipeline.
- Release URLs added to AppStream metadata.
- We do not build GEGL with Matting Levin for Windows builds anymore
because of crashes.
- Flatpak nightly builds will now show a pseudo-release visible with
`flatpak list`, showing proper version information.
- Windows installer now has a dark mode.
- Update changelog on MS Store (MSIX) releases.
- AppImage now ships with full MIDI support.
- Make it clearer that GExiv2 0.15.0 and over are incompatible
(because of API breakage).
- Improve build to ensure that the language list (shown in
Preferences) is localized during compilation. This also means that a
build machine should be set up for localization at build time when
optional language selection is enabled.
- We now require the generic C++14 standard, and not the GNU variant
anymore.
- MSVC support added.
- Various tweaks which used to be required to make packages work as
relocatable builds were dropped since babl and GEGL now have a
relocatable option working also on Linux.
- The `man` page of GIMP binaries was updated.
- The `gimp-console` binary is now shipped in the Flatpak.
- macOS pipeline added in our Gitlab CI.
- Make sure that harfbuzz is built with libgraphite2 shaper on macOS.
- Generate file associations for macOS automatically.
- A Bash completion file was added for `gimp` and `gimp-console`
binaries.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f8fcc9ccf5)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Gyorgy Sarvari
Wang Mingyu
Jason Schonberg
Markus Volk