Details: https://nvd.nist.gov/vuln/detail/CVE-2026-21710
The CVE is fixed in the current recipe version[1], but NVD tracks it
without verison info.
Mark it as patched in the recipe.
[1]: https://github.com/nodejs/node/blob/v22.x/doc/changelogs/CHANGELOG_V22.md
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit b483760dba76bb66bad820ea0246a38692c28c45)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-6409
The vulnerability impacts only the PHP library component, not the
cpp/python one. Ignore this CVE due to this.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit aef8bc34225cd0a56057749d0db1dfac773b17cb)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
In case $sbindir = $bindir we have to pass this setting to make.
Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit d09f50438f5d6bda37413e583776f177c3ccd343)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-39979
Backport the patch that is referenced by the NVD advisory.y
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 2b1e34f0f51b103fa37f163cdccdeebf821ac7c1)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-33948
Backport the patch that is referenced by the NVD advisory.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 8d399af3337b25d71f8cd4308b9788ac4e88b730)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-33947
Backport the patch that is referenced by the NVD report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 525e18ce214213193d9a280de3bfd2deb847110e)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-32316
Backport the patch that is referenced by the NVD advisory.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit e94ab85126f12d77253107084dc8463c79b3e776)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
There is a bug (see https://github.com/jqlang/jq/issues/434), which
results in an empty version being used if autoreconf is run on the jq
sources when using a release tar ball. The incorrect assumption is that
autoreconf is only used when fetching the code using Git.
The empty version results in an incorrect libjq.pc file being created
where the version is not set, which results in, e.g.,
`pkgconf --libs 'libjq > 1.6'` failing even if version 1.8.1 of jq is
actually installed.
Switch to fetching the code using Git to workaround the bug.
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit ed33569f822a3a8d41f82f6980a046d17aca37d5)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This is a bug fix release.
Changelog: https://www.php.net/ChangeLog-8.php#8.4.20
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-31344
Backport the commit that mentions this CVE ID explicitly
in its message.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
License Update: Add sorttable.js under the MIT license - https://github.com/nodejs/node/pull/61348/files
Update minimatch to the Blue Oak Model License - e72da8c754
Changelog: https://github.com/nodejs/node/releases/tag/v22.22.1
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit db05f827bb680d6e12e27ed55adf6b32688f7466)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-0994
The vulnerability impacts only the python bindings of protobuf, which
is in a separate recipe (python3-protobuf, where it is patched).
Ignore this CVE in this recipe due to this.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This is a bug fix release.
Changelog: https://www.php.net/ChangeLog-8.php#8.4.18
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This is the December 2025 security release that the nodejs team released
January 13, 2026.
3 high severity issues.
4 medium severity issues.
1 low severity issue.
High priority fixes:
CVE-2025-55131
CVE-2025-55130
CVE-2025-59465
Medium priority fixes:
CVE-2025-59466
CVE-2025-59464
CVE-2026-21636 *
CVE-2026-21637
Low priority fixes:
CVE-2025-55132
* note that this medium priority CVE only effects Nodejs v25.
https://nodejs.org/en/blog/vulnerability/december-2025-security-releases
Changelog: https://github.com/nodejs/node/releases/tag/v22.22.0
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0bb156371e433cf3e9fdc4291da2319d63a83575)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The related CVEs are tracked with "xerces-c\+\+" (sic).
See CVE db query:
sqlite> select vendor, product, count(*) from PRODUCTs where product like '%xerces%' group by 1, 2;
apache|xerces-c\+\+|29
apache|xerces-j|2
apache|xerces2_java|3
redhat|xerces|3
Set CVE_PRODUCT accordingly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 29a272744a314564035ec4a337704eb6d31e879e)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
CVE_PRODUCT is specified twice - the second instance only duplicates one
value from the first instance.
Remove this extra CVE_PRODUCT.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 6ff92524842233efb68eb92d4bf7637ef378900d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
==============
- Show the host name in the error message in case of name resolution error
- Fix Cursor.copy() and AsyncCursor.copy() to hold the connection lock for the
entire operation, preventing concurrent access issues
- Fix GSSAPI check with C extension built with libpq < v16
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 4b297312d7d256ddbca007f9fbdb1daa337fe431)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This is a bugfix release, containing fixes for CVE-2025-14177,
CVE-2025-14178 and CVE-2025-14180.
Changelog: https://www.php.net/ChangeLog-8.php#8.4.16
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
These CVEs were filed for "Fram's Fast File Exchange" application, which
has the same abbreviated name as fex. Currently this recipe has no historical
CVEs associated, so I couldn't set the correct CVE_PRODUCT. Rather ignore
these irrelevant CVEs explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b990486203b8eca688cfb6fc9bebf8b138e0b334)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upgrade to release 13.42:
- Added warning if tag arguments come before -csv= or -json= in
a command
- Added a new CanonModelID and RFLensType (thanks Norbert Wasser)
- Added ability to read XML as a block from Sony MP4 videos
- Added "EOS" to the R5 Mark II CanonModelID string
- Decode ReEditData in Samsung trailer
- Decode a couple more Sony rtmd tags from MP4 videos
- Tolerate some types of trailer corruption as caused by Samsung
Gallery
- Restrict decoding of MetaImageSize to HEIC files only
- Fixed issue writing Keys tags to Sony PMW-EX1R videos
- Fixed behaviour of CSV/JSON import when specifying tags to import
into an existing list, or when importing ValueConv values (ie.
"TAG#"), or when specifying a group name of "All"
This work was sponsored by GOVCERT.LU.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
According to [1][2], generate phar.php during cross-compile can't be
done, but upstream test res of $(TEST_PHP_EXECUTABLE) is not suitable
for Yocto.
Explicitly set TEST_PHP_EXECUTABLE_RES = "1" to not generate phar.php
for target recipe
Drop 0005-sapi-cli-config.m4-fix-build-directory.patch which is obsolete
for generating phar.php
After apply this commit
...log.do_compile...
Generating phar.php
Skipping phar.php generating during cross compilation
Generating phar.phar
Skipping phar.phar generating during cross compilation
...log.do_compile...
Then php supports reproducible build
[1] https://github.com/php/php-src/issues/11099
[2] 93fa9613e1
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
There are multiple vendors for yasm:
$ sqlite3 ./nvdcve_2-2.db "select distinct vendor, product from products where product = 'yasm';"
tortall|yasm
yasm_project|yasm
Both products refer to the same application
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Fex is a fast usermode x86 and x86-64 emulator for Arm64 Linux
It is used by 'valve' to run windows games on snapdragon
Compilation requires TOOLCHAIN = "clang"
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Add UPSTREAM_CHECK_URI and UPSTREAM_CHECK_REGEX to check the correct
latest stable verison.
Before the patch:
$ devtool latest-version php
INFO: Current version: 8.4.14
INFO: Latest version:
After the patch:
$ devtool latest-version php
INFO: Current version: 8.4.14
INFO: Latest version: 8.4.14
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Add UPSTREAM_CHECK_URI and UPSTREAM_CHECK_REGEX to check the correct
latest stable verison.
Before the patch:
$ devtool latest-version abseil-cpp
INFO: Current version: 20250814.1
INFO: Latest version:
After the patch:
$ devtool latest-version abseil-cpp
INFO: Current version: 20250814.1
INFO: Latest version: 20250814.1
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
===========
- Added CI job to publish GitHub release
- Maintenance to Fedora CI infrastructure
- Reference validation using contains() result rather than exception handling
- add support for $defs instead of definitions
- Apply clang-format / fix "test / Check pre-commit" failures
- Adding verbose error messages for logical combinations
- fix: issue-311
- Fix cmake install target on windows
- error-messages: Numeric limit errors should show maximum precision
- Add Fedora packaging
- Improve and fix bugs in Conanfile
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* It has cmake 4 fixes
* Drop all patches, they are no more needed
* Fix build with glibc-2.43/c23
* Enabled on riscv64, since libunwind now supports it
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The tk.tcl file was missing on the rootfs.
File "/usr/lib/python3.13/tkinter/__init__.py", line 2459, in __init__
self.tk = _tkinter.create(screenName, baseName, className, interactive, wantobjects, useTk, sync, use)
~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_tkinter.TclError: Can't find a usable tk.tcl in the following directories:
//zipfs:/app/tk_library //zipfs:/lib/tk/tk_library //zipfs:/lib/tk /usr/lib/tk9.0 /usr/lib/tcl9.0/tk9.0 /usr/lib/tk9.0 /usr/lib/tk9.0 /lib/tk9.0 /usr/library
By disabling the zipfs options the tk.tcl is in the rootfs.
Debian did also disable this option.
@see: https://sources.debian.org/src/tk9.0/9.0.2-1/debian/rules#L39
Tested on Walnascar. But master does have the same version of Tk.
Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Drop patch that is incorporated in this release.
Changelog:
0.29.2
* Request serde's std feature to avoid issues with newer toml versions.
0.29.1
* enum: Track dependencies properly in enumerations.
* constant: Handle cfg in associated constants.
* Remove "display" feature from the toml crate
* Fix incorrect detection of duplicated constants
* docs: Correct after_include type in example config (fix)
* cargo update
* Update toml to 0.9
0.29.0
* Support no-export annotation for statics and functions.
* Fixed conditional fields of constexpr literal structs
* Add rename rule for generated associated constant
* Upgrade heck to 0.5
* Add support for an optional nullable attribute
* docs.md: Fix deprecated_with_note and deprecated_variant_with_note being spelled as 'notes'
* Fix generic with "void" default
* Fixed error generation of structures using the keyword as inside arrays
* Added test for unsafe(no_mangle) attribute
* Fixed handling of trait methods containing the unsafe attribute
* Rename -Zparse-only
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Use gcc to compile failed for 32 bit arm target
$ echo 'MACHINE = "qemuarm"' >> conf/local.conf
$ bitbake nodejs
...
2645 | );
| ^
../deps/llhttp/src/llhttp.c:2643:11: error: incompatible type for argument 1 of 'vandq_u16'
2643 | vcgeq_u8(input, vdupq_n_u8(' ')),
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| uint8x16_t
...
Use '-flax-vector-conversions' to permit conversions between vectors
with differing element types or numbers of subparts
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
