This CVE is fixed in current libsass recipe version.
So wrapper around it will also not show this problem.
It's usual usecase is to be statically linked with libsass which is
probably the reason why this is listed as vulnerable component.
[1] links [2] as issue tracker which points to [3] as fix.
[4] as base repository for the recipe is not involved and files from [3]
are not present in this repository.
[1] https://nvd.nist.gov/vuln/detail/CVE-2022-43357
[2] https://github.com/sass/libsass/issues/3177
[3] https://github.com/sass/libsass/pull/3184
[4] https://github.com/sass/sassc/
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 576b84263bac4dda26d84d116a9e7628a126f866)
Scarthgap has also the fixed libsass version (3.6.6), the CVE can
be considered fixed.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This patch updates SRC_URIs using git to include branch=master if no branch is set
and also to use protocol=https for github urls as generated by the conversion script
in OE-Core.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog
Fix extend edge case going endlessly (@mgreter #3081)
Fix source-maps and how we count unicode characters (@mgreter #3096)
Fix seed generator if std::random_device fails (@benbucksch #3151)
Fix url() containing exclamation mark causing an error (#2880)
Fix Offset initialization when end was not given (@ihsinme #3131)
Fix obvious backporting error in pseudo extend (@mgreter #3136)
Fix obvious identical subexpressions in op_color_number (@ariccio #3148)
Fix edge case regarding unit-less number equality as object keys (@mgreter #3095)
Revert compound re-ordering for non extended selectors (@mgreter #3100)
Prevent compiler warning about unnecessary copy (@acocuzzo #3129)
Replace Travis CI with GitHub Actions (@mgreter #3150)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* kde plasma's breeze-gtk needs native since 5.15
* there were attempts to land similar for gnome3-desktop [1]. So just in case
somebody comes back to it...
[1] http://lists.openembedded.org/pipermail/openembedded-devel/2018-October/197228.html
Signed-off-by: Andreas Müller <schnitzeltony@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
