Commit Graph

13353 Commits

Author SHA1 Message Date
Bastian Krause f79cb5d445 canutils: use https instead of git protocol
The git server at git.pengutronix.de no longer supports the git
protocol, so switch to https.

Signed-off-by: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-06-23 17:03:17 -04:00
Bastian Krause 4f79df7459 libsocketcan: use https instead of git protocol
The git server at git.pengutronix.de no longer supports the git
protocol, so switch to https.

Signed-off-by: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-06-23 17:03:14 -04:00
Vijay Anusuri 9a0a923b64 redis: upgrade 7.2.7 -> 7.2.8
ChangeLog:
https://github.com/redis/redis/releases/tag/7.2.8

Update urgency: SECURITY: There are security fixes in the release.

Security fixes
==================
* (CVE-2025-21605) An unauthenticated client can cause an unlimited growth of output buffers

Bug fixes
=================
* #12817, #12905 Fix race condition issues between the main thread and module threads
* #13863 RANDOMKEY - infinite loop during client pause
* #13877 ShardID inconsistency when both primary and replica support it

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-06-23 16:57:55 -04:00
Leonard Anderweit 154b5010be lmsensors: Fix build without sensord
When building with sensord disabled (PACKAGECONFIG = ""), do_install
would fail because it tried to build sensord which was skiped in
do_compile.
Error log:
make: *** No rule to make target 'rrd.h', needed by 'prog/sensord/rrd.rd'. Stop.

Avoid building sensord in do_install by explicitly setting PROG_EXTRA.

(master rev: fc88c96c4e)

Fixes: 86b20b84ec (lmsensors: Clean stale files for sensord to avoid
incorrect GCC header dependencies)

Signed-off-by: Leonard Anderweit <l.anderweit@phytec.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-06-23 16:52:32 -04:00
Jeroen Hofstee c1c33c3a4b can-utils: handle CAN_ERR_CNT correctly
If CAN_ERR_CNT is set, the snprintf_can_error_frame() bails out, as it
cannot decode CAN_ERR_CNT.

Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-05-21 09:17:20 -04:00
Yogita Urade 923a8b73b8 syslog-ng: fix CVE-2024-47619
syslog-ng is an enhanced log daemo. Prior to version 4.8.2,
`tls_wildcard_match()` matches on certificates such as `foo.*.bar`
although that is not allowed. It is also possible to pass partial
wildcards such as `foo.a*c.bar` which glib matches but should be
avoided / invalidated. This issue could have an impact on TLS
connections, such as in man-in-the-middle situations. Version
4.8.2 contains a fix for the issue.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-47619

Upstream patch:
https://github.com/syslog-ng/syslog-ng/commit/12a0624e4c275f14cee9a6b4f36e714d2ced8544

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-05-21 09:17:17 -04:00
Zhang Peng 1947ae04c0 iperf3: upgrade 3.16 -> 3.18
License-Update: Copyright year updated to 2024.
Include security update: CVE-2024-26306 and CVE-2024-53580
drop backported patch: do-not-listen-to-old-udp-prot-listener.patch

ChangeLog:
https://github.com/esnet/iperf/releases/tag/3.18
https://github.com/esnet/iperf/releases/tag/3.17.1
https://github.com/esnet/iperf/releases/tag/3.17

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-05-21 09:17:10 -04:00
Yogita Urade 56bca04831 poppler: fix CVE-2025-43903
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify
the adbe.pkcs7.sha1 signatures on documents, resulting in potential
signature forgeries.

CVE-2025-43903-0001 is the dependent commit and
CVE-2025-43903-0002 is the actual CVE fix.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-43903

Upstream patches:
https://gitlab.freedesktop.org/poppler/poppler/-/commit/33672ca1b6670f7378e24f6d475438f7f5d86b05
https://gitlab.freedesktop.org/poppler/poppler/-/commit/f1b9c830f145a0042e853d6462b2f9ca4016c669

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-05-17 12:20:48 -06:00
Yogita Urade a0b54655b5 poppler: fix CVE-2025-32365
Poppler before 25.04.0 allows crafted input files to trigger
out-of-bounds reads in the JBIG2Bitmap::combine function in
JBIG2Stream.cc because of a misplaced isOk check.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-32365

Upstream patch:
https://gitlab.freedesktop.org/poppler/poppler/-/commit/1f151565bbca5be7449ba8eea6833051cc1baa41

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-05-17 12:20:27 -06:00
Yogita Urade 7c900fa798 poppler: fix CVE-2025-32364
A floating-point exception in the PSStack::roll function of
Poppler before 25.04.0 can cause an application to crash when
handling malformed inputs associated with INT_MIN.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-32364

Upstream patch:
https://gitlab.freedesktop.org/poppler/poppler/-/commit/d87bc726c7cc98f8c26b60ece5f20236e9de1bc3

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-05-17 12:19:53 -06:00
Peter Marko bc6cafa570 libmodbus: ignore CVE-2023-26793 and CVE-2024-34244
See discussions in closed/rejected issues linked from NVD CVE reports:
* CVE-2023-26793: https://github.com/stephane/libmodbus/issues/683#issuecomment-2615601890
* CVE-2024-34244: https://github.com/stephane/libmodbus/issues/743#issuecomment-2222214256

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-05-17 12:11:21 -06:00
Jeroen Hofstee ef74a629a8 can-utils: fix printing / reading timestamps
Backport a patch to correctly handle 64bit timestamps.

Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-05-17 12:11:18 -06:00
Jeroen Hofstee 54c92c9e89 nodejs: backport a patch to prevent brotli crashing nodejs
Brotli can crash nodejs (on ARM), because the memory allocated for
brotli wasn't properly aligned.

https://github.com/google/brotli/issues/1159
https://github.com/nodejs/node/commit/dc035bbc9b310ff8067bc0dad22230978489c061

Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-05-17 12:11:15 -06:00
Soumya Sambu 9d60102153 iniparser: Fix CVE-2025-0633
Heap-based Buffer Overflow vulnerability in iniparser_dumpsection_ini() in
iniparser allows attacker to read out of bound memory

References:
https://nvd.nist.gov/vuln/detail/CVE-2025-0633
https://ubuntu.com/security/CVE-2025-0633

Upstream patch:
https://gitlab.com/iniparser/iniparser/-/commit/072a39a772a38c475e35a1be311304ca99e9de7f

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-04-26 15:50:19 -04:00
Haixiao Yan e92d0173a8 lmsensors: Clean stale files for sensord to avoid incorrect GCC header dependencies
After upgrading GCC—for example, from 14.1.0 to 14.2.0—building lmsensors that
was previously compiled with GCC 14.1.0 may fail with an error like:
lmsensors/3.6.0/recipe-sysroot-native/usr/lib/x86_64-wrs-linux/gcc/x86_64-wrs-linux/
14.1.0/include/stddef.h can't find, which is needed by 'prog/sensord/args.rd'.

This occurs because prog/sensord/args.rd still references stale headers from the
older GCC version.
The root cause is that stale *.rd and *.ro files under prog/sensord are not
properly cleaned during do_configure. This patch ensures those files are removed
to prevent broken dependencies when GCC is upgraded.
Also remove the same statement in do_compile.

(master rev: 86b20b84ec)

Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-04-16 20:33:56 -04:00
Soumya Sambu 01eb9fb907 php: Upgrade 8.2.26 -> 8.2.28
Includes fix for - CVE-2025-1219, CVE-2025-1736, CVE-2025-1861,
CVE-2025-1734 and CVE-2025-1217

Changelog:
https://www.php.net/ChangeLog-8.php#8.2.28

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-04-16 20:33:53 -04:00
Khem Raj 2e15d22767 sharutils: Let POSIX_SHELL be overridable from environment
This helps fix
WARNING: sharutils-4.15.2-r0 do_package_qa: QA Issue: File /usr/bin/shar in package sharutils contains reference to TMPDIR

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
2025-04-16 20:30:24 -04:00
Martin Jansa 1189cafbd0 gcab: fix buildpaths QA issue
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
2025-04-16 20:30:24 -04:00
Wang Mingyu a85ae7a7fb nana: Fix buildpaths warning.
WARNING: nana-2.5+git-r0 do_package_qa: QA Issue: File /usr/bin/nana-c++lg in package nana contains reference to TMPDIR
File /usr/bin/nana-clg in package nana contains reference to TMPDIR
File /usr/bin/nana in package nana contains reference to TMPDIR [buildpaths]

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
2025-04-16 20:30:24 -04:00
Khem Raj 5e235fb2cb lprng: Specify target paths for needed utilities
pr,openssl,chown,chgrp are guessed during configure and they are
found on host, sometimes under native sysroot and some under HOSTTOOLS
which is not right, therefore point to target locations of these tools

Fixes all errors like below

File /usr/sbin/lprng_certs in package lprng contains reference to TMPDIR

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
2025-04-16 20:30:23 -04:00
alperak 91d5bfb3dc boinc-client: Fix contains reference to TMPDIR [buildpaths] warning
WARNING: boinc-client-7.20.5-r0 do_package_qa: QA Issue: File /usr/include/boinc/svn_version.h in package boinc-client-dev contains reference to TMPDIR [buildpaths]

Signed-off-by: alperak <alperyasinak1@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
2025-04-16 20:30:23 -04:00
alperak 6f92234d8e hplip: Fix contains reference to TMPDIR [buildpaths] warning
Make sure that the OE provided CFLAGS are passed to the compiler.

WARNING: hplip-3.22.10-r0 do_package_qa: QA Issue: File /usr/lib/python3.12/site-packages/cupsext.so in package hplip contains reference to TMPDIR [buildpaths]

Signed-off-by: alperak <alperyasinak1@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
2025-04-16 20:30:23 -04:00
alperak b808d471d7 perfetto: Fix contains reference to TMPDIR [buildpaths] warning
WARNING:perfetto-31.0-r0 do_package_qa: QA Issue: File /usr/bin/.debug/tracebox in package perfetto-dbg contains reference to TMPDIR [buildpaths]

Signed-off-by: alperak <alperyasinak1@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
2025-04-16 20:30:23 -04:00
Khem Raj e71b2ad9bf ldns: Fix buildpaths QA issues
MJ: Backported from 'ldns: Upgrade to 1.8.4' commit without the upgrade.

Fix buildpaths QA errors while here

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
2025-04-16 20:30:23 -04:00
Khem Raj 9ae36f125b botan: Make it reproducible
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
2025-04-16 20:30:23 -04:00
Awais Belal fdd1894976 mongodb: update to 4.4.29
Move on to 4.4.29 and drop a patch that is not applicable anymore.

Signed-off-by: Awais Belal <awais.belal@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-27 14:04:48 -04:00
Divya Chellam 67ad83dd7c krb5: fix CVE-2025-24528
In MIT krb5 release 1.7 and later with incremental propagation
enabled, an authenticated attacker can cause kadmind to write beyond
the end of the mapped region for the iprop log file, likely causing a
process crash.

Reference:
https://security-tracker.debian.org/tracker/CVE-2025-24528

Upstream-patch:
https://github.com/krb5/krb5/commit/78ceba024b64d49612375be4a12d1c066b0bfbd0

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-27 14:04:21 -04:00
Jinfeng Wang f23c8d7362 netplan: Fix CVE-2022-4968
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2022-4968

Upstream-patch:
https://github.com/canonical/netplan/commit/4c39b75b5c6ae7d976bda6da68da60d9a7f085ee

Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-23 15:29:29 -04:00
Libo Chen 6f488ab715 libgpiod: fix gpiod-cxx-test failed test case
Patch from:
https://web.git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/commit/?id=3e224d885b1de54fe5510b9c5e7296260a1a4507

Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-23 15:27:19 -04:00
Vijay Anusuri 32ddea6c36 postgresql: upgrade 16.5 -> 16.8
License-Update: Update license year to 2025

Includes fix for CVE-2025-1094

Changelog:
https://www.postgresql.org/docs/release/16.8/

Refreshed 0003-configure.ac-bypass-autoconf-2.69-version-check.patch for
16.8

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-23 15:27:04 -04:00
Claus Stovgaard 5412412b97 lcov: Add missing RDEPENDS
Found by just adding lcov to core-image-minimal, running geninfo and
getting errors like.

Can't locate Module/Load.pm in @INC (you may need to install the Module::Load module)
... at /usr/bin/geninfo line 63.
BEGIN failed--compilation aborted at /usr/bin/geninfo line 63.

Can't locate Module/Metadata.pm in @INC (you may need to install the Module::Metadata module)
... at /usr/lib/perl5/5.38.2/Module/Load/Conditional.pm line 14.
BEGIN failed--compilation aborted at /usr/lib/perl5/5.38.2/Module/Load/Conditional.pm line 14.
Compilation failed in require at /usr/bin/geninfo line 64.

Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e7f560b9b8)
Signed-off-by: Akash Hadke <akash.hadke27@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-23 15:27:02 -04:00
Claus Stovgaard c06d8dc3e5 lcov: sort RDEPENDS alphabetical
It is easier to get an overview of the perl modules needed for running
lcov if they are sorted alphabetically

Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 7ec1c9afdf)
Signed-off-by: Akash Hadke <akash.hadke27@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-23 15:26:58 -04:00
Alexandre Truong 990f47a614 lcov: include UPSTREAM_CHECK_* to fix UNKNOWN_BROKEN status
Adding UPSTREAM_CHECK_URI and UPSTREAM_CHECK_REGEX fix
UNKNOWN_BROKEN status from running devtool check-upgrade-status.

The next version of the package can be found from upstream
sources.

Signed-off-by: Alexandre Truong <alexandre.truong@smile.fr>
Reviewed-by: Yoann Congal <yoann.congal@smile.fr>
(cherry picked from commit e71a678f4d)
Signed-off-by: Akash Hadke <akash.hadke27@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-23 15:26:55 -04:00
Awais Belal edd1a1e284 mongodb: fix build with python 3.12
The moduleconfig.py build script uses the 'imp' module which
is deprecated in favor of 'importlib' in python 3.12. This fixes
the build issue by replacing the affected portion of the code
and the package now builds fine on hosts with python 3.12.

Signed-off-by: Awais Belal <awais.belal@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-07 19:40:51 -05:00
Peter Marko 73e6789fdf libmodbus: patch CVE-2024-10918
Pick commit mentioning the bug and two follow-up commits mentioning the
first commit as well as commit to adapt tests for these.

Tested by running the test-suite.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-07 19:40:47 -05:00
Trevor Woerner c204166dac iperf3: throughput fix
This is a backport of a fix to iperf3. The author saw a 40% improvement in
their network throughput, we've seen around a 55% improvement in our tests.

Link: https://github.com/esnet/iperf/pull/1708/commits/ac6b9f7fd335ddebc5212eed40083ef4cd3cb86d
Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-03 08:07:54 -05:00
Changqing Li 48980f26fe abseil-cpp: upgrade 20240116.2 -> 20240116.3
This upgrade include security fix for CVE-2025-0838, refer:
https://github.com/abseil/abseil-cpp/releases?page=1

git log:
54fac219 (tag: 20240116.3) Fix potential integer overflow in hash container create/resize (#1812)
d7aaad83 (tag: 20240116.2) Abseil LTS Branch, Jan 2024, Patch 2 (#1650)
2f9e432c (tag: 20240116.1) Prepare 20240116.1 patch for Apple Privacy Manifest (#1623)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-03 08:05:48 -05:00
Peter Kjellerstedt 01e14fb8d9 libeigen: Remove LGPL code
Since libeigen is a header-only library, LGPL effectively has the same
properties as GPL when it comes to affecting the licensing of the code
that uses libeigen. To avoid the problem, backport a patch to remove all
LGPL-2.1 code from the library.

Also correct the licenses for ${PN}, ${PN}-dbg and ${PN}-dev to reflect
that they do not contain any GPL code (the GPL code is only used for
benchmark tests and does not affect what is installed).

License-Update: Correct the license information
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-03 08:04:01 -05:00
Etienne Cordonnier cc425a989b uutils-coreutils: fix compilation with selinux
- The scarthgap branch of poky contains Rust 1.75.
- uutils-coreutils 0.0.28 requires rust 1.77 when selinux is enabled, even though the project's README.md
  of release 0.0.28 mistakenly indicates 1.70 as MSRV.
This fixes the build of uutils-coreutils 0.0.28 when meta-selinux is included.

Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-03 08:00:42 -05:00
Changqing Li 653a615bc9 dlt-daemon: make DLT_WatchdogSec configurable
On slow system, dlt service may fail since watchdog timeout, backport a
patch to make DLT_WatchdogSec configurable, so that this service can
start successfully during boot.

(cherry-picked from 1cf7700303)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-03 08:00:21 -05:00
Vijay Anusuri 0468aae77f openjpeg: upgrade 2.5.0 -> 2.5.3
Includes fix for CVE-2024-56826 and CVE-2024-56827

ChangeLog:
https://github.com/uclouvain/openjpeg/blob/v2.5.3/NEWS.md

* Refresh 0002-Do-not-ask-cmake-to-export-binaries-they-don-t-make-.patch

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-03 07:58:15 -05:00
Alexandre Truong 81e606b329 source-han-sans-*-fonts: Switch away from SVN fetcher in SRC_URI
We get fetch errors from the SRC_URI provided. See errors at [0].
svn protocol was used but it's not supported by github anymore
So, an http url will be passed instead.

* For the record the svn protocol itself isn't deprecated in bitbake
fetcher, just github no longer provides a svn access as mentioned in [1]

* github no longer provides support for subversion clients [2]
it was shut down on 2024-01-08 [3]

* The sha256sum has also been changed since the previous one was
for the 1.004 release's archive, while we are on 2.004.

[0]: https://autobuilder.yoctoproject.org/typhoon/#/builders/156/builds/353/steps/16/logs/errors
[1]: https://git.openembedded.org/bitbake/commit/?h=master&id=a735898abcf056f897c9350bb128a5637e6b4617
[2]: https://docs.github.com/en/enterprise-server@3.11/get-started/working-with-subversion-on-github/support-for-subversion-clients
[3]: https://github.blog/2023-01-20-sunsetting-subversion-support/

Signed-off-by: Alexandre Truong <alexandre.truong@smile.fr>
Reviewed-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-03 07:57:49 -05:00
Chris Laplante a513ea31ed poco: fix branch: master => poco-1.12.5
Upstream renamed branch to 'main', however this commit isn't found on
main. Thankfully the poco-1.12.5 branch exists.

This patch is not suitable for 'master' on meta-oe because it uses a
newer version of poco, which *is* on 'main' branch.

Signed-off-by: Chris Laplante <chris.laplante@agilent.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-03 07:57:24 -05:00
Leon Anavi b06d04ee6f sip: Fix homepage and license
After the migration from Mercurial to GitHub the homepage has
changed and SIP has been licensed under the BSD-2-Clause license
since Feb 9, 2024, including for release 6.8.6.

This work was sponsored by GOVCERT.LU.

License-Update: SIP is licensed under the BSD-2-Clause license.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-03 07:56:57 -05:00
Archana Polampalli 4f11a12b23 modejs: upgrade 20.18.0 -> 20.18.2
Below list of CVEs are addressed in this release
CVE-2025-23083
CVE-2025-23084
CVE-2025-23085
CVE-2025-22150

Changelog:
https://github.com/nodejs/node/releases/tag/v20.18.2
https://github.com/nodejs/node/releases/tag/v20.18.1

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-02-04 15:04:57 -08:00
J. S 653bbb3e29 nodejs: upgrade 20.17.0 -> 20.18.0
License checksum change due to whitespace changes.
https://github.com/nodejs/node/commit/1dfd238781

libatomic.patch change due to changes in node.gyp
https://github.com/nodejs/node/commit/25c788009f1fa7a392af51cb97d0a55f0f4a6983

Changelog :
https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.18.0

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-02-04 15:04:53 -08:00
Khem Raj 5bcd695a81 nodejs: Fix build with libc++ 19
As noted in the libc++ 19 release notes [1], std::char_traits<> is now
only provided for char, char8_t, char16_t, char32_t and wchar_t, and any
instantiation for other types will fail.

This causes nodejs-20 to fail to compile with clang 19 and libc++ 19,
resulting in errors similar to:

    /usr/include/c++/v1/string:820:42: error: implicit instantiation of undefined template 'std::char_traits<unsigned short>'
      820 |   static_assert(is_same<_CharT, typename traits_type::char_type>::value,
          |                                          ^
    ../deps/v8/src/inspector/string-16.h:114:28: note: in instantiation of template class 'std::basic_string<unsigned short>' requested here
      114 |   std::basic_string<UChar> m_impl;
          |                            ^
    /usr/include/c++/v1/__fwd/string.h:23:29: note: template is declared here
       23 | struct _LIBCPP_TEMPLATE_VIS char_traits;
          |                             ^

Upstream v8 has fixed this in commit 182d9c05e78 [2], so add it as a
backported patch, until the next version of node is released.

[1] https://libcxx.llvm.org/ReleaseNotes/19.html#deprecations-and-removals
[2] https://chromium.googlesource.com/v8/v8.git/+/182d9c05e78

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-02-04 15:04:49 -08:00
J. S e0b2884ad3 nodejs: upgrade 20.16.0 -> 20.17.0
commit c1ddc60fd25456da07d8402c89157c4354fde5ac
Author: Jason Schonberg <schonm@gmail.com>
Date:   Wed Aug 21 17:40:03 2024 -0400

    License change - remove highlight.js
    https://github.com/nodejs/node/commit/1c5fe040a0a73b483cc3e3fef76efe2d1712205b

    Changelog :
    https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.17.0

nodejs: upgrade 20.16.0 -> 20.17.0
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-02-04 15:04:46 -08:00
Hongxu Jia d483bcbc30 nodejs: support cross compile without qemu user conditionally
Due to the scope of supported BSPs by qemu-user is limited, such
as a segment fault on armv9 after qemu apply commit [target/arm:
Convert LDAPR/STLR (imm) to decodetree][1]
```
|tmp-glibc/work/neoversen2-crypto-wrs-linux/nodejs/20.5.1/node-v20.5.1/out/
Release/v8-qemu-wrapper.sh: line 7: 3179613 Segmentation fault      (core dumped)
PSEUDO_UNLOAD=1 qemu-aarch64 -r 5.15 -L tmp-glibc/work/neoversen2-crypto-wrs-linux/
nodejs/20.5.1/recipe-sysroot -E LD_LIBRARY_PATH=tmp-glibc/work/neoversen2-crypto-wrs-linux/
nodejs/20.5.1/recipe-sysroot/usr/lib64:tmp-glibc/work/neoversen2-crypto-wrs-linux/
nodejs/20.5.1/recipe-sysroot/usr/lib64 "$@"
```

Upstream nodejs have cross compile support, but it needs host and target
have same bit width (e.g. a x86_64 host targeting arrch64 to produce a
64-bit binary). So:
1. If host and target have different bit width, build with QEMU user as usual;

2. If host and target have same bit width, enable notejs cross compile support:
- The build tools of nodejs is GYP[2], set CC_host, CFLAGS_host,
  CXX_host, CXXFLAGS_host, LDFLAGS_host, AR_host for host build
  which is separated with target build [3]
- Satisfy layer compatibility, set GYP variables in prefuncs of do_configure,
  do_compile and do_install other than in recipe parsing
- Add missing native packages to fix library missing on host build
- Rework libatomic.patch, explicitly link to libatomic for clang
  conditionally

[1] https://github.com/qemu/qemu/commit/2521b6073b7b4b505533a941d4f9600f7585dc78
[2] https://github.com/nodejs/node-gyp
[3] https://github.com/nodejs/node-gyp/blob/main/gyp/docs/UserDocumentation.md#cross-compiling

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-02-04 15:04:40 -08:00
Jason Schonberg 87bd8bed70 nodejs: upgrade 20.13.0 -> 20.16.0
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-02-04 15:04:36 -08:00