The backport dropped the "j++" body of the delpaths_sorted() grouping
loop while adding the "== 1" guard, turning "while (...) j++;" into an
empty-bodied "while (...);". The index never advances, so any update
that produces "empty" (which reaches _modify() -> delpaths()) hangs,
e.g. "map_values(. // empty)" and ".a |= empty". This also hangs the jq
ptest suite.
Restore the "j++" body while keeping the "== 1" guard.
Assisted-by: kiro:claude-opus-4.8
Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
csysdig fails to link when stock Lua is also present in the sysroot:
ld.lld: error: undefined symbol: luaL_openselectedlibs
>>> referenced by chisel.cpp:1190
ld.lld: error: undefined symbol: lua_pcallk
ld.lld: error: undefined symbol: lua_setglobal
sysdig's chisel code does #include "lua.h" and links against LuaJIT
(lua${JIT}), but the recipe-sysroot also carries stock Lua headers
(openembedded-core lua installs lua.h into ${includedir}). Those headers
win the include search over ${includedir}/luajit-2.1, so the chisel
objects are compiled against stock Lua while the binary links
libluajit-5.1.so. In Lua >= 5.4.4 luaL_openlibs is a macro for
luaL_openselectedlibs and lua_setglobal/lua_pcallk are real symbols,
none of which LuaJIT (a Lua 5.1 ABI) provides, hence the undefined
references. -DLUA_INCLUDE_DIR does not help: sysdig's luajit.cmake only
consults it in its stock-Lua fallback, not when it finds LuaJIT.
Prepend ${STAGING_INCDIR}/luajit-2.1 to CFLAGS/CXXFLAGS. These land in
CMAKE_CXX_FLAGS, which precede CMake's generated -I includes, so LuaJIT's
lua.h is found first and matches the linked library.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 00e7a91180)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The pypi class default python:h11 doesn't match how h11 is tracked
in the CVE databases. NVD has no CPE for it yet; the only existing
record (CVE-2025-43859) carries python-hyper:h11 in its CNA affected
entry [1], so set that pair.
CVE-2025-43859 (request smuggling) is fixed in 0.16.0, the version
we ship, so it resolves as not affected.
[1] https://www.cve.org/CVERecord?id=CVE-2025-43859
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a9bfe001bd)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
lens_default.c defines PRIb64 through a fallback that hardcodes
__PRI64_PREFIX as "ll". That is only correct where uint64_t is unsigned
long long (ILP32). On LP64 musl targets uint64_t is unsigned long, so the
resulting "%llb" conversion does not match the argument and do_compile
aborts under -Werror=format:
lens_default.c:90:48: error: format '%llb' expects argument of type
'long long unsigned int', but argument 3 has type 'uint64_t'
{aka 'long unsigned int'}
glibc never reaches the fallback: it defines __PRI64_PREFIX itself,
wordsize aware, in <inttypes.h>. musl provides the same modifier there
under the name __PRI64 but not __PRI64_PREFIX, so the hardcoded "ll" is
used and is wrong on 64-bit. Reuse musl's __PRI64 when __PRI64_PREFIX is
absent, keeping "ll" as a last resort. glibc builds are unaffected: the
block is skipped entirely.
Signed-off-by: Alejandro Mery <amery@apptly.co>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 09a7b15072)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
===========
* Fix to set VERSION_INFO to create .so.3 instead of .so.11 which will
be reserved for a future 1.10.0 release
* Bugfix: Insufficient verification that responses belong to a
query (CVE-2026-10846). Thanks Pablo Ruiz from 'codecome.ai'
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a5a18fe23f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
===========
- Fixed timing leak vulnerability in EdDSA/Ed25519 signatures.
- Various minor documentation fixes.
- Various minor build system fixes.
- Various minor compiler warning fixes.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 25cfd0324c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
PipeWire 1.6.8 (2026-07-09)
This is a bugfix release that is API and ABI compatible with the previous
1.6.x releases.
Highlights
- Fix a data race in JACK that could cause lost MIDI events in ardour.
- Fix some unbounded memory allocations.
- Various small fixes.
PipeWire
- Avoid some graph recalcs, which fixes a bug when suspending a node
while it is active.
Modules
- Do Content-Length and allocation check in RAOP to avoid OOM errors.
- Fix a potential memory leak in the error path of client-node. (#5348)
SPA
- Fix filter-graph dynamic graph updates.
- Avoid 100% when unplugging a card.
- Fix filter-graph volumes when the filter is loaded inside a node with
hardware volume. (#5344)
- Add normalize and latency options to the SOFA filter. (#5322)
Bluetooth
- Fix a potential leak when transport fails to start.
Pulse-server
- Avoid stack exhaustion via unbounded alloca.
JACK
- Fix a data race in jack_port_get_buffer() when called from concurrent
threads, like in ardour. (#5324)
GStreamer
- Skip invalid crop metadata.
- Avoid crash because metadata listener was registered twice.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6dbf718454)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
PipeWire 1.6.7 (2026-06-18)
This is a bugfix release that is API and ABI compatible with the previous
1.6.x releases.
Highlights
- Fix a race issue where some ports would stay silent after a rate change.
- Fix sync regressions between ALSA cards in some cases.
- Small fixes and improvements.
PipeWire
- Fix a scheduler regression where some driver nodes would not run
correctly and cause sync issues. (#5210)
- Fix a race issue with suspend on samplerate changes. It can cause ports
to be silent. (#3547)
Modules
- There are some locking issues in the RT portal, for now reduce the
DBus timeout to something more sane. Also disable portal RT for
pipewire and the pulse server. These are not usually run in a sandbox
and can go directly to RTKit.
- Fix potential incorrect delay in combine-stream.
SPA
- Fix a regression in ALSA period_size calculations. For non-power-of-2
periods, it would in some cases round down a a power-of-2, causing a
mismatch between requested and configured period_size. (#5302)
- Fix a potential segfault when removing a card because of bad ALSA api
usage. (#5255)
- Emit a route param update when card properties change. Otherwise, jack
port updates are not always reflected correctly.
Misc
- Make sure we don't deal with uninitialized spa_dict.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit ce604315bc)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upgrade to release 6.5.7:
- CurlAsyncHTTPClient now fully resets the curl object before reusing
it. This prevents incorrectly reusing options from a previous request,
specifically including client SSL and credentials used for accessing
proxies.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 7c11942641)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Hetvi Thakar
Tugrul Kukul
Khem Raj
mark.yang
He Zhe
Alejandro Mery
Wang Mingyu
Jason Schonberg
Ankur Tyagi
Markus Volk
Leon Anavi
Peter Marko
Darsh Kelaiya