OpenSSL 3.5 (first shipped in wrynose) made HMAC_CTX a fully opaque
type by removing its struct definition from the public headers. It was
deprecated since OpenSSL 3.0 but the struct remained visible until 3.5.
libwebsockets uses HMAC_CTX_new() to detect which form to use in its
lws-genhash.h public header: if found it uses HMAC_CTX *ctx (pointer),
otherwise it falls back to HMAC_CTX ctx (embedded struct).
In cross-compilation the CMake CHECK_FUNCTION_EXISTS probe for
HMAC_CTX_new can fail due to native libraries being incorrectly pulled
into the aarch64 link test, causing the function to be reported as not
found. Before OpenSSL 3.5 this was a silent failure: the fallback
embedded struct still compiled fine. With OpenSSL 3.5 the fallback
now fails with "field has incomplete type".
Force LWS_HAVE_HMAC_CTX_new=ON so the pointer form is always used.
Signed-off-by: Kamlesh Gurudasani <kamlesh@ti.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
cca_settings is used without zero initialization, which may
introduce random values and result in invalid nl80211
attributes.
Without this fix, BSS color switch may fail completely and
the feature becomes non-functional. Initialize the structure
before use.
Signed-off-by: Wei Zhang <wei.zhang@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Doing wifi without the regulatory database is not good, so add a runtime
dependency to iwd to ensure that it gets pulled into the image for the
kernel drivers to use.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
============
- Fix off-by-one bug in SCgiTask::event_read
- Don't use std::scoped_lock in CurlStack as it doesn't support unlocking just one mutex
- Don't throw when DhtSearch is not found in DhtServer
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
License-Update: add attribution section for the third-party public-domain code[1]
Dropped patch which is now merged in the upstream version.
Changelog:
https://thrift.apache.org/changelog
[1]1e5fa4b9b3
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
It has one change over last release
84fa99d3ba
Fixes build errors e.g.
| CMake Error at cmake/VersionFromGit.cmake:59 (message):
| [VersionFromGit] Failed to execute Git: fatal: No names found, cannot
| describe anything.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
ttyd is a simple command-line tool for sharing terminal over the web.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
CVE-2026-23919: Has been fixed since version 7.0.19[1], mark it as patched
CVE-2026-23920: Has been fixed since version 7.0.22[2], mark it as patched
CVE-2026-23921: Has been fixed since version 7.0.22[3], mark it as patched
CVE-2026-23923: The vulnerable code isn't present in 7.0 yet, it is specific
to 7.4 versions. Compare the fix[4] in 7.4, which is changes code that doesn't
exist in the recipe version. Ignore this CVE due to this.
[1]: https://support.zabbix.com/browse/ZBX-27638
[2]: https://support.zabbix.com/browse/ZBX-27639
[3]: https://support.zabbix.com/browse/ZBX-27640
[4]: 043c28c208
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
- reverted the custom-on-fail discard value behavior so that it now correctly
discards the value instead of resetting the error state and recalculating dependent items
- added possibility to switch SSO user on internal login failures
- improved trigger-related postprocessing after configuration cache sync
- fixed graph rendering for items using throttling
- updated man page and help message for zabbix_js
- improved Device status mapping and added trigger for Meraki template
- updated maximum supported TimescaleDB version to 2.25
- fixed script macros expanding via Zabbix proxy during autoregistration
- fixed dependent item error message clearing in preprocessing
- fixed incorrect filter being applied when switching subfilters in multiple tabs
in Data collection->Hosts->Items, Monitoring->Hosts->Graphs
- fixed regexp runtime error when processing log* items with unspecified encoding
by sanitizing invalid UTF-8
- fixed inability to delete host, user, or template groups when accordingly hosts,
users, or templates belonging to them were previously deleted in parallel requests
- improved Teams Workflow webhook to use ALERT.SENDTO macro
- fixed redirect link when deleting host or template from item or item prototype list
- fixed snmp cache housekeeping not to interrupt scheduling
- fixed system.run not terminating commands correctly on Zabbix agent 2
- fixed showing some selected value by default for Map navigation tree
widget if listener does not exist
- fixed multiple event generation not to generate changelog entries on new events
- fixed compilation of Zabbix agent on HP-UX 11.23 (ia64)
- fixed "daylight saving time" error for scheduled reports
- fixed inability to return "not supported" via user parameters
- fixed discovery uniqueness criteria bug
- updated documentation links for Create template group and Create host group
- fixed checkboxes "SSL verify peer" and "SSL verify host" not being selected
when corresponding label is clicked in media type form
- fixed message box display bug in Monitoring problems page
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Fix following error when multilib is used.
configure: WARNING: using cross tools not prefixed with host triplet
checking pkg-config is at least version 0.9.0... yes
configure: error: cannot find pkg-config package for libpcre
Signed-off-by: Zheng Ruoqin <zhengrq.fnst@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The CVE is now tracked by NVD with a version that is earlier than
the recipe, the vulnerability doesn't show up in the CVE report
anymore.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
1.Changelog
https://github.com/arvidn/libtorrent/releases/tag/v2.0.12
2. Add 0001-Fix-Python3-site-packages-path-to-fix-package-QA-Iss.patch to fix package QA Issue:
libtorrent-rasterbar-2.0.12-r0 do_package: QA Issue: libtorrent-rasterbar: Files/directories were installed but not shipped in any package:
/lib/python3.14/site-packages/libtorrent.so
Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- Added dns cache
- Fix crash on double scrape request
- Use callback in DnsBuffer result and catch EINTR in Listen
- Fixed various SCGI issues
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- Fix issue with handling expiration of PMKSA.
- Fix issue with handling uninitialized buffer and PMKID.
- Fix issue with checking for PKCS#8 key parser in unit tests.
- Fix issue with using -std=c23 compiler setting.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Also disable running clang-tidy on the code. On one hand the cmake script is trying to run
the target version of it, and on the other hand it is not needed for compiling it,
it is intended for upstream developers.
Changelog: https://github.com/transmission/transmission/releases/tag/4.1.1
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The patches are required to build with detached build directory and
cross-compiling.
Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Building krb5 with glibc 2.43 fails due to ISO C23 changes to strchr() and
related search functions. Backport the upstream fix that updates code to
use correct pointer types and adjusts function signatures accordingly.
Signed-off-by: Viswanath Kraleti <viswanath.kraleti@oss.qualcomm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
============
- Added a buffer that limits/deduplicates active dns requests
- Properly handle libcurl reuse of sockets
- Added SocketManager to handle reuse of uninterested fd's by the kernel
- Removed old work-arounds in epoll and force stricter handling of errors
- Allow disabling of stream buffering for plaintext logs
- Fix some compile warnings
- Fix use after free in UdnsResolver::try_resolve_numeric
- Fix crash in DhtRouter::bootstrap
- Fix key/value pairs in Lua
- Expand '~/' to $HOME in session path.
- dht_add_peer_node is empty, use dht_add_bootstrap_node instead
- Re-send smkx on SIGWINCH to fix arrow keys after terminal reattach
- Allow dht bootstrap nodes to be added when dht is off.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Do not pass qrtr=false explicitly since recipe enables or disables it
based on the PACKAGECONFIG value. Also, use += with EXTRA_OEMESON.
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
https://github.com/eclipse-paho/paho.mqtt.cpp/releases/tag/v1.6.0
Changes:
- Bumped Paho C submodule to v1.3.16 and updated directory name to externals/paho.mqtt.c
- Some significant performance increases (lower latency) for connect and publish
- Fixed topic_matcher and topic_filter to properly match parent with multi-level ('#') wildcard.
- Slight optimization of topic_filter to do simple string comparison if the filter does not contain wildcards.
- Set a minimum version for Paho C in the CMake file. Report the version found.
- .deb version properly set, and add architecture name to .deb file
- remove const from connect_options_builder 'move' constructor
- fix potential deadlock in thread_queue on capacity increase.
- Incorrect default retain value in a will options constructor
- prevent undefined behaviour on empty topic matching
- Sync reconnect example crashes on first reconnect
Signed-off-by: Andrej Kozemcak <andrej.kozemcak@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
https://github.com/eclipse-paho/paho.mqtt.c/releases/tag/v1.3.16
Changes:
- Bumped minimum CMake to v3.12
- Consolidated "Event" thread signaling object.
- Reduce latency on connect #1430
- Fixed warning in Window build for TCP_NODELAY
- Added a .clang-format file and bash script to run it
Signed-off-by: Andrej Kozemcak <andrej.kozemcak@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-23925
The vulnerability has been fixed since 7.0.18[1], however NVD
tracks this CVE without version information.
[1]: 89dec866ec
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
libcppconnman is a C++ library to control ConnMan via D-Bus. It exposes
simple aync methods to perform all the controls that ConnMan allow via
D-Bus.
Signed-off-by: Andrea Ricchi <andrea.ricchi@amarulasolutions.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
=========
- Fix afskmdm shutdown issues
- Fix a crash if gensio_acc_disable() is called more than once.
- Allow the pcre2 package to be used.
- Fix a locking issue in cm108gpio.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
ver 3.11:
Fix issue with interface registration before acquiring name.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
1.ChangeLog
https://github.com/transmission/transmission/releases/tag/4.1.0
2. Remove following patches as they were merged upstream
0001-build-bump-CMake-version-to-3.10-4.patch
0001-miniupnpc-bump-CMake-version-to-3.14.patch
0001-build-set-minimum-required-CMake-to-3.5.patch
3. Change LICENSE Checksum as Copyright year has changed.
Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Drop the patches that are included in this release.
License-Update: copyright year bump
Changelog:
1.22.2:
Fix a SPNEGO packet parsing bug which could cause GSS mechanism negotiation failure.
1.22.1:
Fix a vulnerability in GSS MIC verification [CVE-2025-57736]
1.22.0:
User experience
- The libdefaults configuration variable "request_timeout" can be set to limit the
total timeout for KDC requests. When making a KDC request, the client will now
wait indefinitely (or until the request timeout has elapsed) on a KDC which
accepts a TCP connection, without contacting any additional KDCs. Clients will
make fewer DNS queries in some configurations.
- The realm configuration variable "sitename" can be set to cause the client to
query site-specific DNS records when making KDC requests.
Administrator experience
- Principal aliases are supported in the DB2 and LMDB KDB modules and in the
kadmin protocol. (The LDAP KDB module has supported aliases since release 1.7.)
- UNIX domain sockets are supported for the Kerberos and kpasswd protocols.
- systemd socket activation is supported for krb5kdc and kadmind.
Developer experience
- KDB modules can be be implemented in terms of other modules using the new
krb5_db_load_module() function.
- The profile library supports the modification of empty profiles and the copying
of modified profiles, making it possible to construct an in-memory profile and
pass it to krb5_init_context_profile().
- GSS-API applications can pass the GSS_C_CHANNEL_BOUND flag to gss_init_sec_context()
to request strict enforcement of channel bindings by the acceptor.
Protocol evolution
- The PKINIT preauth module supports elliptic curve client certificates, ECDH key
exchange, and the Microsoft paChecksum2 field.
- The IAKERB implementation has been changed to comply with the most recent draft
standard and to support realm discovery.
- Message-Authenticator is supported in the RADIUS implementation used by the OTP
kdcpreauth module.
Code quality
- Removed old-style function declarations, to accomodate compilers which have
removed support for them.
- Added OSS-Fuzz to the project's continuous integration infrastructure.
- Rewrote the GSS per-message token parsing code for improved safety.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Delete patch that's included in this release.
Changelog:
- Add support for MbedTLS
- Add Reverse Proxy implementation
- Add support for wireless pairing (AppleTV)
- Embed 3rd party libraries for ed25519 and SRP6a
- Fixes in idevicedebug
- idevicecrashreport: Allow filtering crash reports by filename
- Add idevicedevmodectl tool
- Fixes for idevicebackup2
- Add property_list_client_get_service_client() and service_get_connection() functions
- Add idevicebtlogger
- Add new idevice_events_subscribe/unsubscribe API
- Move LIBIMOBILEDEVICE_API to public headers
- Add afc_strerror function
- Add libimobiledevice_version() function
- Use libimobiledevice-glue's SHA1 implementation
- Add support for iOS 17+ Personalized Developer Disk image mounting
- Fix compilation on MSVC
- Add idevice_strerror() to interface
- Add new idevice_get_device_version() to interface
- Add os_trace_relay service implementation
- Fixes for idevicesyslog
- afc: Add afc_get_file_info_plist and afc_get_device_info_plist functions
... and several other internal changes
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Drop patch to fix gcc15 compatibility - the problem has been solved by upstream.
Changelog:
- Update getaddrinfo options to support IPv6 hostname resolution
- Removed unnecessary _WIN64 conditional checks
- Fixed condition variable timed wait
- Support tls:// prefix
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The CVEs are tracked with an underscore in the product name:
sqlite> select * from PRODUCTs where product like '%async%mq%';
CVE-2025-65503|redboltz|async_mqtt|10.2.5|=||
This patch sets the correct CVE_PRODUCT.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Features
---------
Added timestamp helper commands
Use separate thread for saving session data
Run multiple session save requests in parallel
Changed magnet metadata handling and added 'magnet.path.set'
Optimizations
-------------
Use map rather than vector for Poll tables
Bug Fixes
-----------
Convert IPv4in6 addresses to IPv4 in outgoing handshakes
Force clear bitfield ranges of downloads that get hashed
Use CURLOPT_CLOSESOCKETFUNCTION to properly handle libcurl closing sockets before CURL_POLL_REMOVE
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
* Build:
** New "-Dmbim_groupname=<name>" meson build option to restrict MBIM kernel
device access to a given Unix group and root. The access check works
in parallel to the "-Dmbim_username" option; passing either check allows
access to the kernel device (eg, logical OR).
* New Intel AT Tunnel service, including the following operations:
* MBIM_CID_INTEL_AT_TUNNEL_AT_COMMAND
* Extended the SMS service:
* MBIM_CID_SMS_CONFIGURATION now supports notifications
* mbimcli:
** New '--sms-query-configuration' and '--sms-query-message-store-status'
actions
** New '--atds-query-rat' and '--atds-query-operators' actions
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
