There is an additional patch for CVE-2026-0797, which is not mentioned
in the CVE advisory, nor in the related issue nor in the related PR, however
both the change, and the commit message shows that this is a continuation
of the original fix, which was incomplete.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-2047
The vulnerability exists in ICNS importer, which was first introduced in
version 3.0 [1], and the code is not present in the recipe version.
Due to this, ignore this CVE.
[1]: 00232e1787
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-2760
Use the fixes from Debian.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15059
Backport the patch that is referenced by the NVD advisory.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-14424
The vulnerbaility was introduced in version 3.0.0, with commit[1].
The recipe version isn't vulnerable - ignore this CVE.
[1]: a0fc5a025a
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-14423
The vulnerability is about parsing LBM files, however this feature
was introduced in verison 3.0[1], and the current recipe version
is not vulnerable.
[1]: 222bef78c7
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-14425
Patch referenced by the nvd report is for the file "file-jp2.c" which was
renamed from "file-jp2-load.c" by commit[1] in the later versions.
[1] 19c57a9765
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
NVD still tracks this CVE as version-less, so explicit ignore is needed.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Feature backport for Windows otherwise it is mostly a bug-fix release
https://gitlab.gnome.org/GNOME/gimp/-/blob/GIMP_2_10_38/NEWS
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
-GeglColor extended with GBytes API, and space aware accesors for RGB
and CMYK. Better runtime handling of mismatched GEGL ops in graphs.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
"double" and "half" support in cli-tool, build fixes.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
=============
New simpler API for connecting pads, gegl_node_connect which can be used instead
of either gegl_node_connect_from or gegl_node_connect_to by autosensing the
neccesary direction of the connection.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The issue reported in [1] works fine with clang 15+
This effectively reverts b12e87f84c4af258e8ea8cc78ed075989cbf9dcb
and ff19c7c5694f79271ae26543562e5563d4250559
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
This release fixes a crashing bug what is umasked by GLib 2.75.3 and
newer. Never-allocated data were being passed to g_slice_free, in
GeglBuffer's handling of copy-on-write tiles.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
Brown paper bag release - LUT code-paths now disabled by default.
Stop double processing with LUT+normal fishes.
Support for non-ASCII characters in file paths on windows. Improved wrap build
support.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
Operations:
-----------
*newsprint: do not drop alpha channel in RGB modes.
Core
----------
*fixes for legacy build, still supporting building latest GEGL for
stable GIMP with old babl (not recommended if distros can have
recent enough meson.).
*avoiding possible multi thread race in babl garbage collection
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
0001-meson-Do-not-run-git-rev-parse-during-configure.patch
removed since it's not available in 0.1.96
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
0001-meson-fix-misspelled-kwarg-name.patch
0002-meson-Various-fixes.patch
removed since they're included in 0.1.94
Changelog:
==========
Fix of crash on non-aligned data for SIMD, add commandline tool, improve vala
compatibility of introspection info.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This uses qemu during build and qemu-user segfaults on all 32bit
architectures, until that is fixed disable building vector icons on
32bit architectures
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Automatic LUT creation for conversions from <24bpp of colorant componants,
SIMD builds for x86_64 micro-architecture levels and ARM neon, pre-defined
CIE Lab u8 and CIE Lab u16 formats. Fix bug of an unlocked non-locked mutex,
which started failing on some platforms.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
