Details: https://nvd.nist.gov/vuln/detail/CVE-2026-0994
The vulnerability impacts only the python bindings of protobuf, which
is in a separate recipe (python3-protobuf, where it is patched).
Ignore this CVE in this recipe due to this.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This is a bug fix release.
Changelog: https://www.php.net/ChangeLog-8.php#8.4.18
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This is the December 2025 security release that the nodejs team released
January 13, 2026.
3 high severity issues.
4 medium severity issues.
1 low severity issue.
High priority fixes:
CVE-2025-55131
CVE-2025-55130
CVE-2025-59465
Medium priority fixes:
CVE-2025-59466
CVE-2025-59464
CVE-2026-21636 *
CVE-2026-21637
Low priority fixes:
CVE-2025-55132
* note that this medium priority CVE only effects Nodejs v25.
https://nodejs.org/en/blog/vulnerability/december-2025-security-releases
Changelog: https://github.com/nodejs/node/releases/tag/v22.22.0
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0bb156371e433cf3e9fdc4291da2319d63a83575)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The related CVEs are tracked with "xerces-c\+\+" (sic).
See CVE db query:
sqlite> select vendor, product, count(*) from PRODUCTs where product like '%xerces%' group by 1, 2;
apache|xerces-c\+\+|29
apache|xerces-j|2
apache|xerces2_java|3
redhat|xerces|3
Set CVE_PRODUCT accordingly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 29a272744a314564035ec4a337704eb6d31e879e)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
CVE_PRODUCT is specified twice - the second instance only duplicates one
value from the first instance.
Remove this extra CVE_PRODUCT.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 6ff92524842233efb68eb92d4bf7637ef378900d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
==============
- Show the host name in the error message in case of name resolution error
- Fix Cursor.copy() and AsyncCursor.copy() to hold the connection lock for the
entire operation, preventing concurrent access issues
- Fix GSSAPI check with C extension built with libpq < v16
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 4b297312d7d256ddbca007f9fbdb1daa337fe431)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This is a bugfix release, containing fixes for CVE-2025-14177,
CVE-2025-14178 and CVE-2025-14180.
Changelog: https://www.php.net/ChangeLog-8.php#8.4.16
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
These CVEs were filed for "Fram's Fast File Exchange" application, which
has the same abbreviated name as fex. Currently this recipe has no historical
CVEs associated, so I couldn't set the correct CVE_PRODUCT. Rather ignore
these irrelevant CVEs explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b990486203b8eca688cfb6fc9bebf8b138e0b334)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upgrade to release 13.42:
- Added warning if tag arguments come before -csv= or -json= in
a command
- Added a new CanonModelID and RFLensType (thanks Norbert Wasser)
- Added ability to read XML as a block from Sony MP4 videos
- Added "EOS" to the R5 Mark II CanonModelID string
- Decode ReEditData in Samsung trailer
- Decode a couple more Sony rtmd tags from MP4 videos
- Tolerate some types of trailer corruption as caused by Samsung
Gallery
- Restrict decoding of MetaImageSize to HEIC files only
- Fixed issue writing Keys tags to Sony PMW-EX1R videos
- Fixed behaviour of CSV/JSON import when specifying tags to import
into an existing list, or when importing ValueConv values (ie.
"TAG#"), or when specifying a group name of "All"
This work was sponsored by GOVCERT.LU.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
According to [1][2], generate phar.php during cross-compile can't be
done, but upstream test res of $(TEST_PHP_EXECUTABLE) is not suitable
for Yocto.
Explicitly set TEST_PHP_EXECUTABLE_RES = "1" to not generate phar.php
for target recipe
Drop 0005-sapi-cli-config.m4-fix-build-directory.patch which is obsolete
for generating phar.php
After apply this commit
...log.do_compile...
Generating phar.php
Skipping phar.php generating during cross compilation
Generating phar.phar
Skipping phar.phar generating during cross compilation
...log.do_compile...
Then php supports reproducible build
[1] https://github.com/php/php-src/issues/11099
[2] 93fa9613e1
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
There are multiple vendors for yasm:
$ sqlite3 ./nvdcve_2-2.db "select distinct vendor, product from products where product = 'yasm';"
tortall|yasm
yasm_project|yasm
Both products refer to the same application
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Fex is a fast usermode x86 and x86-64 emulator for Arm64 Linux
It is used by 'valve' to run windows games on snapdragon
Compilation requires TOOLCHAIN = "clang"
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Add UPSTREAM_CHECK_URI and UPSTREAM_CHECK_REGEX to check the correct
latest stable verison.
Before the patch:
$ devtool latest-version php
INFO: Current version: 8.4.14
INFO: Latest version:
After the patch:
$ devtool latest-version php
INFO: Current version: 8.4.14
INFO: Latest version: 8.4.14
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Add UPSTREAM_CHECK_URI and UPSTREAM_CHECK_REGEX to check the correct
latest stable verison.
Before the patch:
$ devtool latest-version abseil-cpp
INFO: Current version: 20250814.1
INFO: Latest version:
After the patch:
$ devtool latest-version abseil-cpp
INFO: Current version: 20250814.1
INFO: Latest version: 20250814.1
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
===========
- Added CI job to publish GitHub release
- Maintenance to Fedora CI infrastructure
- Reference validation using contains() result rather than exception handling
- add support for $defs instead of definitions
- Apply clang-format / fix "test / Check pre-commit" failures
- Adding verbose error messages for logical combinations
- fix: issue-311
- Fix cmake install target on windows
- error-messages: Numeric limit errors should show maximum precision
- Add Fedora packaging
- Improve and fix bugs in Conanfile
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* It has cmake 4 fixes
* Drop all patches, they are no more needed
* Fix build with glibc-2.43/c23
* Enabled on riscv64, since libunwind now supports it
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The tk.tcl file was missing on the rootfs.
File "/usr/lib/python3.13/tkinter/__init__.py", line 2459, in __init__
self.tk = _tkinter.create(screenName, baseName, className, interactive, wantobjects, useTk, sync, use)
~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_tkinter.TclError: Can't find a usable tk.tcl in the following directories:
//zipfs:/app/tk_library //zipfs:/lib/tk/tk_library //zipfs:/lib/tk /usr/lib/tk9.0 /usr/lib/tcl9.0/tk9.0 /usr/lib/tk9.0 /usr/lib/tk9.0 /lib/tk9.0 /usr/library
By disabling the zipfs options the tk.tcl is in the rootfs.
Debian did also disable this option.
@see: https://sources.debian.org/src/tk9.0/9.0.2-1/debian/rules#L39
Tested on Walnascar. But master does have the same version of Tk.
Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Drop patch that is incorporated in this release.
Changelog:
0.29.2
* Request serde's std feature to avoid issues with newer toml versions.
0.29.1
* enum: Track dependencies properly in enumerations.
* constant: Handle cfg in associated constants.
* Remove "display" feature from the toml crate
* Fix incorrect detection of duplicated constants
* docs: Correct after_include type in example config (fix)
* cargo update
* Update toml to 0.9
0.29.0
* Support no-export annotation for statics and functions.
* Fixed conditional fields of constexpr literal structs
* Add rename rule for generated associated constant
* Upgrade heck to 0.5
* Add support for an optional nullable attribute
* docs.md: Fix deprecated_with_note and deprecated_variant_with_note being spelled as 'notes'
* Fix generic with "void" default
* Fixed error generation of structures using the keyword as inside arrays
* Added test for unsafe(no_mangle) attribute
* Fixed handling of trait methods containing the unsafe attribute
* Rename -Zparse-only
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Use gcc to compile failed for 32 bit arm target
$ echo 'MACHINE = "qemuarm"' >> conf/local.conf
$ bitbake nodejs
...
2645 | );
| ^
../deps/llhttp/src/llhttp.c:2643:11: error: incompatible type for argument 1 of 'vandq_u16'
2643 | vcgeq_u8(input, vdupq_n_u8(' ')),
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| uint8x16_t
...
Use '-flax-vector-conversions' to permit conversions between vectors
with differing element types or numbers of subparts
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
Allow copy to pass different types per column, as long as the database can convert them.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This is a bug fix release.
Changelog: https://www.php.net/ChangeLog-8.php#8.4.14
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
===========
- Fix spurious readiness flags in some of the wait functions
- Fix high CPU usage using the wait_c function on Windows
- Fix bad data on error in binary copy
- Respect Copy.set_types() in TEXT copy in C version, consistently with the Python version
- Don't raise warning, and don’t leak resources, if a builtin function is used as JSON dumper/loader function
- Improve performance of Python conversion on results loading
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
