Commit Graph

37888 Commits

Author SHA1 Message Date
Wang Mingyu f81a7251f3 catch2: upgrade 3.13.0 -> 3.14.0
Fixes
======
- Added missing <cstdint> includes.
- Fixed suppression of empty variadic macro arguments warning on Clang <19.
- Fixed catch_discover_tests failing during PRE_TEST discovery if a target does
  not have discoverable tests.
- Fixed build of the main library failing with CATCH_CONFIG_PREFIX_ALL defined.
- JUnit reporter outputs single failed (errored/skipped) assertion per test
  case.

Improvements =============
- The default implementation of --list-tags and --list-listeners has a quiet
  variant.
- Suppressed the new Clang warning about __COUNTER__ usage.
- Line-wrapping counts utf-8 codepoints instead of bytes.
- Combining character sequences are still miscounted, but Catch2 does not aim
  to fully support Unicode.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:52 -07:00
Wang Mingyu 7187db36cc bolt: upgrade 0.9.10 -> 0.9.11
Changelog:
  Updated NHI PCI IDs: added Maple Ridge, ADL, TGL-H, RPL, MTL, and AMD Strix Point USB4 Routers.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:52 -07:00
Changqing Li 2966646af2 protobuf-c: upgrade 1.5.1 to 1.5.2
Changes[1]:
* Chase compatibility issues with Google protobuf 30.0-rc1 by @edmonds in https://github.com/protobuf-c/protobuf-c/pull/762
* protoc-gen-c: Explicitly construct strings where needed for protobuf 30.x by @edmonds in https://github.com/protobuf-c/protobuf-c/pull/768

Remove protobuf-30.patch, this patch already included in 1.5.2

[1] https://github.com/protobuf-c/protobuf-c/compare/v1.5.1...v1.5.2

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:52 -07:00
Peter Kjellerstedt ed33569f82 jq: Use Git to fetch the code
There is a bug (see https://github.com/jqlang/jq/issues/434), which
results in an empty version being used if autoreconf is run on the jq
sources when using a release tar ball. The incorrect assumption is that
autoreconf is only used when fetching the code using Git.

The empty version results in an incorrect libjq.pc file being created
where the version is not set, which results in, e.g.,
`pkgconf --libs 'libjq > 1.6'` failing even if version 1.8.1 of jq is
actually installed.

Switch to fetching the code using Git to workaround the bug.

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:52 -07:00
Harish Sadineni eb16f0631e layer.conf: add bcc into NON_MULTILIB_RECIPES
Here is the setting in bcc recipe:
COMPATIBLE_HOST = "(x86_64.*|aarch64.*|powerpc64.*|riscv64.*)-linux"

bcc only support 64 bit arch, so add it into NON_MULTILIB_RECIPES
to avoid expanding lib32- variant

Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:52 -07:00
Pascal Bach cbd72087e6 fluentbit: upgrade 4.2.3.1 -> 5.0.2
Patches have been refreshed to apply to the new version.

Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:51 -07:00
Liu Yiding 7eb5d48aed python3-ckzg: upgrade 2.1.1 -> 2.1.7
1.Changelog:
  https://github.com/ethereum/c-kzg-4844/releases/tag/v2.1.7

2.Remove python-ckzg-0001-Let-override-CC.patch as it was merged upstream

3.Remove python-ckzg-0002-Disable-Werror.patch as it was dropped in the Fedora package
  https://src.fedoraproject.org/rpms/python-ckzg/blob/rawhide/f/python-ckzg.spec

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:51 -07:00
Peter Marko 8d37aa1b42 poco: add config for fastlogger
It is a new feature in 1.15.0, enabled upstream by default.
It is part of Foundation library.
So this makes it possible to disable it.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:51 -07:00
Peter Marko a322194016 poco: fix powerpc build
Add patch which was also submitted upstream to quill.
Poco should get it when they update quill component.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:51 -07:00
Zhixiong Chi c90f012855 networkmanager: Do not ship initrd specific services into rootfs
Those systemd services were added in 1.54 upstream
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2089

According the comments we can see they are meant for the inird
other than using for rootfs. They will conflict with the main
services and can lead to potentially confusing error messages.
So remove them for now to avoid the following issue.

>$systemd-analyze --man=false verify \
> /lib/systemd/system/NetworkManager-wait-online-initrd.service
  Failed to put bus name to hashmap: File exists
  NetworkManager-initrd.service: Two services allocated for the \
  same bus name org.freedesktop.NetworkManager, refusing operation.

Test:
PASS: bitbake core-image-minimal
PASS: runqemu qemux86-64
PASS: systemd-analyze --man=false verify \
      /lib/systemd/system/NetworkManager.service

Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:51 -07:00
Markus Volk b177ff1454 libcanberra: disable gtk-doc
gkt-doc build uses the deprecated gtkdoc-mktmpl tool, which was dropped by upstream
in version 1.26 of gtk-doc and fails if 'api-documentation' is in DISTRO_FEATURES.

Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:51 -07:00
Liu Yiding 9aed335934 sanlock: upgrade 4.2.0 -> 5.1.0
Change SRC_URI to https://codeberg.org/sanlock/sanlock.git as sanlock source moved to it.

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:50 -07:00
Liu Yiding d477f7e360 python3-tox: upgrade 4.49.0 -> 4.52.0
Changelog:
  https://tox.wiki/en/latest/changelog.html

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:50 -07:00
Liu Yiding 5cd2bb6427 python3-setuptools-git-versioning: upgrade 2.1.0 -> 3.0.1
Changelog:
 https://setuptools-git-versioning.readthedocs.io/en/v3.0.1/changelog/3.0.x.html

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:50 -07:00
Liu Yiding a3b6a0c84d python3-legacy-cgi: upgrade 2.6.2 -> 2.6.4
Add do_install function to resolve following issue.
  python3-legacy-cgi-2.6.4-r0 do_package_qa: QA Issue: /usr/lib/python3.14/site-packages/.pc/0001-cgi.py-fixup-interpreter-according-to-OE.patch/cgi.py contained in package python3-legacy-cgi requires /usr/local/bin/python, but no providers found in RDEPENDS:python3-legacy-cgi? [file-rdeps]

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:50 -07:00
Liu Yiding 998888c826 python3-pyatspi: upgrade 2.46.1 -> 2.58.2
Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:50 -07:00
Gianfranco Costamagna fa1fd093ac ettercap: 0.8.4-> 0.8.4.1
1. Changelog
   https://github.com/Ettercap/ettercap/releases/tag/v0.8.4.1

2. Remove following patches as they were merged upstream
   CVE-2026-3606.patch

Signed-off-by: Gianfranco Costamagna <locutusofborg@debian.org>
Signed-off-by: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:50 -07:00
Peter Marko 6ccd072ec1 spdm-emu: use SkipRecipe instead of fatal error for unsupported architectures
Current code fails to parse meta-oe layer for machine with unsupported
architecture.
This is too restrictive as it requires downstream layers to play tricks
with masking the recipe. Usual way is to skip the recipe instead.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:49 -07:00
Liu Yiding cd7b52861d python3-djangorestframework: upgrade 3.16.1 -> 3.17.1
Changelog:
  https://www.django-rest-framework.org/community/release-notes/#deprecation-policy

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:49 -07:00
Liu Yiding a1efbb73c6 python3-croniter: upgrade 6.0.0 -> 6.2.2
Changelog:
  https://github.com/pallets-eco/croniter/blob/main/CHANGELOG.rst

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:49 -07:00
Liu Yiding 94102dd836 python3-cucumber-tag-expressions: upgrade 6.2.0 -> 9.1.0
1. Changelog
  https://github.com/cucumber/tag-expressions/blob/main/CHANGELOG.md

2. LIC_FILES_CHKSUM changed as line of License info changed in PKG-INFO file.

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-10 07:59:49 -07:00
Etienne Cordonnier aec06eecb4 uutils-coreutils: upgrade 0.7.0 -> 0.8.0
See release notes at https://github.com/uutils/coreutils/releases/tag/0.8.0

Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-07 08:44:51 -07:00
Bai, Haiqing d793c367e0 Revert "python3-stopit: add missing run-time dependencies"
This reverts commit 812f091414.

The runtime dependency on python3-setuptools is no longer needed
since the patch 0001-Drop-the-deprecated-pkg_resources.patch
replaced the pkg_resources usage with importlib.metadata, which
is part of the Python 3.8+ standard library. Keeping this RDEPENDS
pulls in an unnecessary dependency on the target system.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 22:54:18 -07:00
Bai, Haiqing 733b6fc2c6 python3-stopit: Fixed the deprecated pkg_resources issue
pkg_resources is deprecated as an API. The pkg_resources package
has been removed from setuptools, so the way of obtaining the
version needs to be replaced with importlib.metadata module.

Signed-off-by: Bai, Haiqing <Haiqing.Bai@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 22:54:18 -07:00
Khem Raj 1bdc3c1c6d thunar-shares-plugin: Depend on X11 distro feature
it depends on thunar-> thunar-panel, which currently depends on libwnck3 which
only works on x11, thunar technically can replace it with libxfce4windowing
but its not done yet.

fixes

WARNING: Nothing PROVIDES 'thunar' (but /home/ubuntu/yoe/sources/meta-openembedded/meta-xfce/recipes-thunar-plugins/shares/thunar-shares-plugin_0.5.0.bb DEPENDS on or otherwise requires it)
thunar was skipped: using DISTRO 'yoe', which is missing required DISTRO_FEATURES: 'x11'
WARNING: Nothing RPROVIDES 'thunar-shares-plugin-dev' (but /home/ubuntu/yoe/sources/meta-openembedded/meta-xfce/recipes-thunar-plugins/shares/thunar-shares-plugin_0.5.0.bb RDEPENDS on or otherwise requires it)
No eligible RPROVIDERs exist for 'thunar-shares-plugin-dev'

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Cc: Changqing Li <changqing.li@windriver.com>
2026-04-06 18:51:59 -07:00
Zheng Ruoqin d3f9a64e7b multipath-tools: Add kernel-module as RRECOMMENDS
Service multipathd depends on kernel module dm_multipath,
so add it as RRECOMMENDS.

Signed-off-by: Zheng Ruoqin <zhengrq.fnst@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 18:51:59 -07:00
Zheng Ruoqin e39c811dc2 linux-atm: Add kernel-module as RRECOMMENDS
Runtime command line atmtcp depends on kernel module atmtcp,
so add it as RRECOMMENDS.

Signed-off-by: Zheng Ruoqin <zhengrq.fnst@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 18:51:59 -07:00
Gyorgy Sarvari c789281ecf tinyproxy: patch CVE-2026-3945
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-3945

Backport the patches which are references by the NVD avisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 10:03:48 -07:00
Gyorgy Sarvari d8c66c4428 tinyproxy: upgrade 1.11.2 -> 1.11.3
Drop patch that was merged upstream.

Shortlog: https://github.com/tinyproxy/tinyproxy/compare/1.11.2...1.11.3

Ptests passed successfully:

root@qemux86-64:~# ptest-runner
START: ptest-runner
2026-04-06T15:25
BEGIN: /usr/lib/tinyproxy/ptest
starting web server... done. listening on 127.0.0.3:32123
starting tinyproxy... done (listening on 127.0.0.2:12321)
waiting for 1 seconds. 1  done
checking direct connection to web server... ok
testing connection through tinyproxy... ok
requesting statspage via stathost url... ok
signaling tinyproxy to reload config...ok
checking direct connection to web server... ok
testing connection through tinyproxy... ok
requesting statspage via stathost url... ok
checking bogus request... ok, got expected error code 400
testing connection to filtered domain... ok, got expected error code 403
requesting connect method to denied port... ok, got expected error code 403
testing unavailable backend... ok, got expected error code 502
0 errors
killing tinyproxy... ok
killing webserver... ok
done
PASS: run_tests.sh
DURATION: 2
END: /usr/lib/tinyproxy/ptest
2026-04-06T15:25
STOP: ptest-runner
TOTAL: 1 FAIL: 0

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 10:03:48 -07:00
Gyorgy Sarvari 6a15ff3e9e wolfssl: ignore fixed CVEs
These CVEs are tracked without a version by NVD, but all of them
have been fixed in the current recipe version.

The relevant fixes (from the NVD reports):

CVE-2026-0819: https://github.com/wolfSSL/wolfssl/commit/2d3941056b6b961828947a2f159200df7f7d1cb2
CVE-2026-2646: https://github.com/wolfSSL/wolfssl/commit/7245ad02bb1a41235d923288fd640d40c1ecb2ea
  and https://github.com/wolfSSL/wolfssl/commit/67abcc6f2d0cc45f918325c4ae6fe2b8d5bc8f72
CVE-2026-3503: https://github.com/wolfSSL/wolfssl/commit/cc2fdda54cd6387e554b444eb2844fa840bd9d5d
CVE-2026-3548: https://github.com/wolfSSL/wolfssl/commit/84ca4a05fac9c6c055a514f05880c448ecbbed56
  and https://github.com/wolfSSL/wolfssl/commit/b3f08f33b845d2d6bb523f0f38d191ca25635e1c

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:32 -07:00
Gyorgy Sarvari e32b974754 strongswan: mark CVE-2026-25075 as patched
The CVE is fixed in the current version already, however
NVD tracks it without version - suppress the report explicitly.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:31 -07:00
Gyorgy Sarvari 4ee0103733 python3-aiohttp: mark fixed CVEs are patched
All these CVEs have been fixed already, the relevant NVD
reports mention it explicitly that 3.13.4 is fixed, along
with referencing the commit that fixes the respective
vulnerabilities. However each of these are tracked without
version info by NVD -.-

Due to this, mark them explicitly as patched.

Relevant reports:
https://nvd.nist.gov/vuln/detail/CVE-2026-22815
https://nvd.nist.gov/vuln/detail/CVE-2026-34513
https://nvd.nist.gov/vuln/detail/CVE-2026-34514
https://nvd.nist.gov/vuln/detail/CVE-2026-34515
https://nvd.nist.gov/vuln/detail/CVE-2026-34516
https://nvd.nist.gov/vuln/detail/CVE-2026-34517
https://nvd.nist.gov/vuln/detail/CVE-2026-34518
https://nvd.nist.gov/vuln/detail/CVE-2026-34519
https://nvd.nist.gov/vuln/detail/CVE-2026-34520
https://nvd.nist.gov/vuln/detail/CVE-2026-34525

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:31 -07:00
Gyorgy Sarvari 844f87dd10 python3-aiohttp: upgrade 3.13.4 -> 3.13.5
Changelog:
Skipped the duplicate singleton header check in lax mode (the default for response
parsing). In strict mode (request parsing, or -X dev), all RFC 9110 singletons
are still enforced.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:31 -07:00
Gyorgy Sarvari 22a31ea701 nodejs: ignore fixed CVEs
All these CVEs are fixed in v22.22.2[1], except for CVE-2026-21712,
which does not affect v22 series, because it was introduced in a
later version[2]. All these CVEs are tracked without version info
by NVD at the time of creating this patch.

[1]: https://github.com/nodejs/node/blob/v22.x/doc/changelogs/CHANGELOG_V22.md
[2]: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:31 -07:00
Gyorgy Sarvari fe1b038cd8 mbedtls: upgrade 3.6.5 -> 3.6.6
Contains fixes for CVE-2026-25833, CVE-2026-25834, CVE-2026-25835,
CVE-2026-34872, CVE-2026-34873, CVE-2026-34874 and CVE-2026-34875.

Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.6

Ptests passed successfully:
root@qemux86-64:~# ptest-runner
START: ptest-runner
2026-04-06T14:04
BEGIN: /usr/lib/mbedtls/ptest
PASS: test_suite_aes.cbc
PASS: test_suite_aes.cfb
PASS: test_suite_aes.ctr
...
PASS: test_suite_version
PASS: test_suite_x509parse
PASS: test_suite_x509write
DURATION: 24
END: /usr/lib/mbedtls/ptest
2026-04-06T14:04
STOP: ptest-runner

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:31 -07:00
Gyorgy Sarvari 05f47c9374 mbedtls: drop recipe for v2
It has been unmaintained/EOL for over a year - there is
a recipe for a newer, still supported version.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:31 -07:00
Gyorgy Sarvari 357f65dd13 libraw: upgrade 0.21.4 -> 0.22.1
Contains fixes for CVE-2026-5318[1] and CVE-2026-5318[2] (both are tracked without
a version by NVD, so they are explicitly marked as patched)

License-update: copyright year bump

Changelog: https://github.com/LibRaw/LibRaw/blob/0.22-stable/Changelog.txt

[1]: https://github.com/LibRaw/LibRaw/commit/5357bb5fc67ac616838fb84de67260d45987489b
[2]: https://github.com/LibRaw/LibRaw/commit/2468614a9cbcab6b75ca279ab60cac62156f7aeb

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:30 -07:00
Gyorgy Sarvari 082c108e6e leancrypto: upgrade 1.7.0 -> 1.7.1
Contains fix for CVE-2026-34610 (which is however tracked without
a version by NVD, so it is marked as patched explicitly)

Changelog:
- Offer a means to select the AES-C constant time / S-Box
  implementation via lc_init API
- use the AES-C constant time implementation by default - it is
  about 3 times slower than the AES-C S-Box implementation, but
  more secure. As the leancrypto library is about secure by default,
  the CT implementation is just right. Furthermore, if a caller
  wants to have the faster AES-C S-Box, he can call
  lc_init(LC_INIT_AES_SBOX) at the beginning.
- X.509: fix security issue (CVE-2026-34610)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:30 -07:00
Gyorgy Sarvari a0531bc55a giflib: mark CVE-2026-23868 patched
The fix[1] that is referenced by the NVD advisory is
already included in the current recipe version.

[1]: https://sourceforge.net/p/giflib/code/ci/f5b7267aed3665ef025c13823e454170d031c106/

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:30 -07:00
Gyorgy Sarvari 21f792ff63 freeipmi: mark CVE-2026-33554 patched
The CVE is tracked by NVD without version info. It's description
confirms that it is fixed in version 1.6.17.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:30 -07:00
Gyorgy Sarvari e99441755f dovecot: ignore already fixed CVEs
The following CVEs are fixed in the current version already,
however they are tracked without version info.

Upstream has confirmed[1] that these vulnerabilities are fixed,
and Debian has also identified the relevant commits:

CVE-2025-30189: https://security-tracker.debian.org/tracker/CVE-2025-30189
CVE-2026-0394: https://security-tracker.debian.org/tracker/CVE-2026-0394
CVE-2026-24031: https://security-tracker.debian.org/tracker/CVE-2026-24031
CVE-2026-27855: https://security-tracker.debian.org/tracker/CVE-2026-27855
CVE-2026-27860: https://security-tracker.debian.org/tracker/CVE-2026-27860

[1]: https://seclists.org/fulldisclosure/2026/Mar/13

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:30 -07:00
Gyorgy Sarvari 34628ad546 botan: mark CVE-2026-32877 and CVE-2026-32883 patched
Both CVEs were fixed in version 3.11.0, however NVD tracks them
without version/CPE info.

Relevant commits:
CVE-2026-32877: https://github.com/randombit/botan/commit/798a332e11949afa8b004564bb9031e66c1a4d13
CVE-2026-32883: https://github.com/randombit/botan/commit/6ecc62a4e36937d036df8c8eda6a85708abb8c37

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:30 -07:00
Gyorgy Sarvari e50cf01385 botan: upgrade 3.11.0 -> 3.11.1
Contains fixes for CVE-2026-35580 and CVE-2026-35582

Changelog: https://botan.randombit.net/news.html#version-3-11-1-2026-03-31

-CVE-2026-35580: Resolve certificate verification bypass bug introduced in 3.11.0
-CVE-2026-35582: Resolve TLS 1.3 client authentication bypass
-Add optimized Argon2 implementation using AVX512
-Add optimized and constant-time Twofish implementation using AVX512/GFNI
-Add optimized and constant-time SEED implementation using AVX512/GFNI
-Add optimized and constant-time Whirlpool implementations using AVX2 and AVX512
-Add SSSE3/NEON and AVX2 optimized codepaths for CTR
-Add constant time implementations of Camellia, ARIA, SEED and SM4 using
 AES-NI or ARMv8 AES instructions to implement sbox lookups
-Improve performance of the AVX512 implementation of SHA-512 especially for Clang
-Optimizations for the IDEA modular multiplication
-Fix various minor TLS conformance issues flagged by TLS-Anvil
-Fix bug in Ed25519 where an invalid signature checked with PK_Verifier
 might cause a later valid signature to be rejected.
-Fix a bug in handling of ECDSA DER-encode signatures where an invalid
 signature checked with PK_Verifier might cause a later valid signature to be rejected.
-Fix a problem introduced in 3.11.0 which could cause crashes on processors without
 SSSE3 support, particularly when compiled by GCC.
-Fix various new warnings from clang-tidy 22
-Fix a compilation error introduced in 3.11.0 which prevented using ffi
 unless bcrypt was also enabled.
-Avoid a macro collision with Microsoft headers that could cause a compilation
 problem in amalgamation mode.
-Enable explicit_bzero, getentropy, getrandom on Hurd

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:29 -07:00
Jason Schonberg 39adc57e17 webmin: upgrade 2.621 -> 2.630
Changelog: https://github.com/webmin/webmin/releases/tag/2.630

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-06 09:46:29 -07:00
Khem Raj f3da39cf75 libgphoto2: Fix c23 build errors
Fixes errors e.g.

error: assigning to 'char *' from 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
  131 |         dot = strrchr(filename, '.');
      |             ^ ~~~~~~~~~~~~~~~~~~~~~~
1 error generated.

They are latent and brought to fore with autoconf 2.73 which switches
defaults to use -std=gnu23

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-05 22:13:57 -07:00
Khem Raj 1d12cee712 ez-ipupdate: Update to 3.0.11b8
Drop upstreamed patches
Add a patch to fix C23 build break

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-05 07:48:16 +00:00
Jeroen Hofstee b7245e15b9 python3-pyroute2: add missing rdepend of python3-unittest
Without it, it will throw "ModuleNotFoundError: No module named
'unittest'" from pyroute2/netlink/rtnl/iprsocket.py" line 6.

Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-05 07:48:16 +00:00
Markus Volk 95eab24c06 libavif: use system libxml2 for building apps
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-04 08:44:08 -07:00
Markus Volk 659cdaf182 libavif: enable libyuv support
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-04 08:44:08 -07:00
Markus Volk 1d277a568d libavif: add PACKAGECONFIG for apps
- This allows to build avifdec,avifenc and avifgainmaputil

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-04-04 08:44:08 -07:00