Major changes in 1.60.0
=======================
* CVE-2026-28296: ftp: Reject paths with CR/LF in g_vfs_ftp_file_new_from_ftp (Ondrej Holy)
* monitor: Do not load monitors when GIO_USE_VFS=local (Ondrej Holy)
Major changes in 1.59.90
========================
* client: Fix use-after-free when creating async proxy failed (Ondrej Holy)
* udisks2: Emit changed signals from update_all() (Ondrej Holy)
* daemon: Fix race on subscribers list when on thread (Ondrej Holy)
* ftp: Validate fe_size when parsing symlink target (Ondrej Holy)
* ftp: Check localtime() return value before use (Ondrej Holy)
* CVE-2026-28295: ftp: Use control connection address for PASV data (Ondrej Holy)
* CVE-2026-28296: ftp: Reject paths containing CR/LF characters (Ondrej Holy)
* gphoto2: Use g_try_realloc() instead of g_realloc() (Ondrej Holy)
* cdda: Reject path traversal in mount URI host (Ondrej Holy)
* client: Fail when URI has invalid UTF-8 chars (Ondrej Holy)
* udisks2: Fix memory corruption with duplicate mount paths (Alessandro Astone)
* build: Update GOA dependency to > 3.57.0 (Jan-Michael Brummer)
* Some other fixes (correctmost, Ondrej Holy)
Major changes in 1.59.1
=======================
* mtp: replace Android extension checks with capability checks (Raul Tambre)
* cdda: Fix duration of last track for some media (Bastien Nocera)
* dav: Add X-OC-Mtime header on push to preserve last modified time (Lawrence Murray)
* udisks2: Use hash tables in the volume monitor to improve performance (Milan Crha)
* onedrive: Check for identity instead of presentation identity (Jan-Michael Brummer)
* build: Disable google option and mark as deprecated (Jeremy Bícha, Ondrej Holy)
* Fix various memory leaks (Milan Crha)
* Some other fixes (wangrong, Jan-Michael Brummer, Simon Poirier)
* Translation updates (GNOME Translation Project contributors)
Major changes in 1.58.4
=======================
* Re-release of 1.58.3 due to incorrect release tag; no code changes.
Major changes in 1.58.3
=======================
* CVE-2026-28296: ftp: Reject paths with CR/LF in g_vfs_ftp_file_new_from_ftp (Ondrej Holy)
* monitor: Do not load monitors when GIO_USE_VFS=local (Ondrej Holy)
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Version 3.58.1
==============
- Use pkg-config to get systemd user unit dir.
- Updated translations.
Version 3.58.0
==============
- Add keybindings to move window between monitors. (!40)
- Updated translations.
Version 3.57.1
==============
- Drop zentiy dependency.
- Add systemd service.
- Updated translations.
drop 0001-drop-zenity-detection.patch
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
It fails to run `bitbake -p` for qemuppc64 with errors:
ERROR: /path_to/meta-oe/recipes-security/spdm-emu/spdm-emu_git.bb:
unsupported architecture 'powerpc64le'
ERROR: /path_to/meta-oe/recipes-support/libspdm/libspdm_3.8.2.bb:
unsupported architecture 'powerpc64le'
Add qemuppc64 default TARGET_ARCH to the arch map.
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
bpftrace-ptest requires bpftool which is not compatible with powerpc64.
So remove sub-package bpftrace-ptest for powerpc64 & powerpc64le.
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Ptests passed successfully:
Testsuite summary
TOTAL: 506
PASS: 506
SKIP: 0
XFAIL: 0
FAIL: 0
XPASS: 0
ERROR: 0
Changelog:
3.69:
Makefile: Drop coverage-report.log
Add Fedora 45 support
tests: Use pytest-cov to support coverage of parallel tests from pytest-xdist
workflows: Use latest released py3.14 and py3.12
test: Use pytest-xdist to run tests in parallel
tests: Use ThreadingHTTPServer and threads for load and include tests
tests: Mark helper classes as not tests
bootc: Add bootc command to the RHEL10 handler
rdp: Add rdp support to the RHEL10 handler
raid: Update RHEL10 handler to match rhel10-branch
Fix handling filesystem labels with spaces
3.68:
commands: bootc: remove 'experimental' warning
rhsm: Add Flatpak registry option for RHEL10
3.67:
drop python3-build dependency
Add Fedora 44 support
workflows: use py3.14rc1
tests: use pytest module instead of unittest
spec: Add python3-pytest to BuildRequires
3.66:
workflows: Use py3.14 beta.4
pylint: Ignore files in .git
pyproject: Bump setuptools to 77 or later
Makefile: Stop running setup.py directly
3.65:
workflows: Add python 3.14 to the test matrix
Add support for RDP
Deprecate VNC
docs: Fix chapter numbering after adding certificate
3.64:
workflow: Add python 3.13 testing
tests: Remove unused import of constants
realm: Clean up documentation
Add support for new bootc kickstart command
Update documentation for clearpart --initlabel option.
Update the %certificate section documentation
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This module depends on python3-six, otherwise it errors out:
>>> from txdbus.interface import DBusInterface, Method, Signal
Traceback (most recent call last):
File "<python-input-1>", line 1, in <module>
from txdbus.interface import DBusInterface, Method, Signal
File "/usr/lib/python3.14/site-packages/txdbus/interface.py", line 8, in <module>
import six
ModuleNotFoundError: No module named 'six'
Add the missing dependency.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Drop obsolete patch.
An important change is that this version supports Python 3.14.
License-Update: switch to license file instead of PKG-INFO file. The license
itself hasn't changed.
Changelog:
https://github.com/zopefoundation/zope.interface/blob/master/CHANGES.rst
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Bug- and security-fix release. Shortlog:
https://github.com/ImageMagick/ImageMagick/compare/7.1.2-17...7.1.2-18
Also remove the obsolete CVE_STATUS assignments - all of these have been corrected
at NVD, and they are tracked with a version/CPE that mirror the real vulnerability
state of the recipe.
While at it, also corrected the reason for the remaining CVE_STATUS assignments.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* refresh patches
* remove workaround for cppunit-dev needed only in 1.15.0
Release Notes [1]:
This is a bugfix and maintenance release that also introduces a few new
features.
Security Fixes:
* CVE-2026-32776 (NULL function pointer dereference)
* CVE-2026-32777 (infinite loop)
* CVE-2026-32778 (NULL dereference on OOM retry)
[1] https://github.com/pocoproject/poco/releases/tag/poco-1.15.1-release
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Inherit python3targetconfig so that cross python3-config is used instead
of native.
This fixes the below error when building on a 64 bit host for a 32 bit
target:
| In file included from /workspaces/yocto/build/tmp/work/core2-32-poky-linux/libgpiod/1.6.5/recipe-sysroot-native/usr/include/python3.14/Python.h:72,
| from ../../../sources/libgpiod-1.6.5/bindings/python/gpiodmodule.c:8:
| /workspaces/yocto/build/tmp/work/core2-32-poky-linux/libgpiod/1.6.5/recipe-sysroot-native/usr/include/python3.14/pyport.h:429:2: error: #error "LONG_BIT definition appears wrong for platform (bad gcc/glibc config?)."
| 429 | #error "LONG_BIT definition appears wrong for platform (bad gcc/glibc config?)."
| | ^~~~~
Signed-off-by: Ricardo Simoes <ricardo.simoes@pt.bosch.com>
Signed-off-by: Mark Jonas <mark.jonas@de.bosch.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
After libxfce4ui upgrade to 4.21.x, its pkgconfig moves gtk+-3.0
to Requires.private, so the linker no longer automatically pulls in
libgtk-3. This causes an undefined reference to 'gtk_combo_box_set_model'
when linking xfce-polkit.
Add patch for explicit PKG_CHECK_MODULES for gtk+-3.0 in configure.ac and wire
GTK3_CFLAGS/GTK3_LIBS into src/Makefile.am.
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
After libxfce4ui upgrade to 4.21.x, its pkgconfig sets
libxfce4util as Requires.private, so the linker no longer
automatically pulls in libxfce4util. This causes an undefined
reference to 'xfce_textdomain' when linking xfce4-datetime-settings.
Add patch for libxfce4util-1.0 and common_deps (gtk+-3.0 etc.) as explicit
dependencies in xfce/meson.build.
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
When libxfce4ui is upgrade to 4.21.x, pkgconfig sets private flags by
default and no longer exposes libxfce4util flags. This causes build
failures in xfwm4 settings-dialogs due to missing CFLAGS and LIBS.
Backport upstream fix to add LIBXFCE4UTIL_CFLAGS and
LIBXFCE4UTIL_LIBS to settings-dialogs/Makefile.am.
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
xfce4-panel 4.21.x added include guards to libxfce4panel sub-headers,
requiring consumers to include <libxfce4panel/libxfce4panel.h> instead
of individual headers like <libxfce4panel/xfce-panel-plugin.h>.
Since there is no new upstream release with this fix, add
-DLIBXFCE4PANEL_COMPILATION to CFLAGS as a workaround to bypass the
include guard check.
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Switch from autotools to meson build system. The upstream 4.20.1 source
already ships a meson.build.
libxfce4ui 4.21.7 moved libxfce4util-1.0 from Requires to
Requires.private in its pkg-config file, so pkg-config --libs
libxfce4ui-2 no longer emits -lxfce4util. This causes DSO missing
link errors for autotools consumers that use libxfce4util symbols
but rely on libxfce4ui to pull in the link dependency. The meson
build correctly declares libxfce4util in its own dependencies,
avoiding this issue.
Add PACKAGECONFIG[tests] (disabled by default)
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
4.21.2 (2026-03-16)
======
- Destroy GDBusProxy and GDBusConnection on library shutdown
- Make xfconf_init()/xfconf_shutdown() multithread-safe
- Emit signals on the thread that "owns" the channel or binding
- Revert "Make libxfconf multithread-safe"
4.21.1 (2026-03-13)
======
- Make libxfconf multithread-safe
- I18n: Update po/LINGUAS list
- build: Fix typo in optimization level
- README.md: Add uninstall info
- Update README after switchover to meson
- Update also .gitlab-ci.yml
- Remove autotools build
- common: Fix -Wlogical-op warning
- meson-build: Use configure_file() to generate GNU visibility files
- I18n: Update po/LINGUAS list
- Translation Updates:
Arabic, Estonian, Georgian, Occitan (post 1500), Polish, Slovenian,
Thai, Uyghur, Vietnamese
4.21.0 (2025-03-23)
======
- build: Automate copyright year management
- meson-build: Add missing function checks
- meson-build: Use SPDX license expression
- meson-build: Add tests option
- meson-build: Use 'pkgconfig_define' in dep.get_variable()
- meson-build: Use 'dependencies' in cc.alignment()
- meson-build: Update debug/optimization flag management
- meson-build: Add missing gir prefixes
- meson-build: Use path builder and fs instead of literal '/'
- Add meson build
- tests: Always cleanup xfconfd process
- tests: Enable t-list-channels test
- tests: Fix test failure because of xfconfd not running
- Migrate to xdt-gen-visibility and xdt-check-abi
- channel: Complete and harmonize docs of get_string_list()/get_arrayv()
- channel: Warn in case of failure in get_string_list()
- channel: Fix get_arrayv() return value
- Translation Updates:
Albanian, Slovak
https://gitlab.xfce.org/xfce/xfconf/-/blob/xfconf-4.21.2/NEWS?ref_type=tags
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Just remapping TMPDIR to TARGET_DBGSRC_DIR results in the files that
end up in the -src package containing lines such as
#line 196 "/usr/src/debug/fluentbit/4.0.1//work/cortexa76-oe-linux/fluentbit/4.0.1/sources/fluentbit-4.0.1/lib/cmetrics/src/cmt_decode_prometheus.l"
#line 1561 "/usr/src/debug/fluentbit/4.0.1//work/cortexa76-oe-linux/fluentbit/4.0.1/build/lib/cmetrics/cmt_decode_prometheus_parser.c"
By instead remapping both B and S, we strip more of the irrelevant
part of WORKDIR, and one ends up with line directives in the -src
package that actually match the source files' location in that
package:
#line 196 "/usr/src/debug/fluentbit/4.0.1/lib/cmetrics/src/cmt_decode_prometheus.l"
#line 1561 "/usr/src/debug/fluentbit/4.0.1/lib/cmetrics/cmt_decode_prometheus_parser.c"
$ find packages-split/fluentbit-src/ -name cmt_decode_prometheus*.[cl] | sort
packages-split/fluentbit-src/usr/src/debug/fluentbit/4.0.1/lib/cmetrics/cmt_decode_prometheus_lexer.c
packages-split/fluentbit-src/usr/src/debug/fluentbit/4.0.1/lib/cmetrics/cmt_decode_prometheus_parser.c
packages-split/fluentbit-src/usr/src/debug/fluentbit/4.0.1/lib/cmetrics/src/cmt_decode_prometheus.c
packages-split/fluentbit-src/usr/src/debug/fluentbit/4.0.1/lib/cmetrics/src/cmt_decode_prometheus.l
packages-split/fluentbit-src/usr/src/debug/fluentbit/4.0.1/lib/cmetrics/src/cmt_decode_prometheus_remote_write.c
and that also matches the remapping that the compiler is instructed to
do via the -ffile-prefix-map mechanism.
Signed-off-by: Rasmus Villemoes <ravi@prevas.dk>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Mbed OS has reached its ends of life in 2024 [1], the annoucement also
includes the change of the Mbed TLS homepage. This commit updates the
HOMEPAGE variable in the mbedtls recipe to reflect the new URL.
Additionally, the BUGTRACKER variable is added, as it is a required
field [2].
[1] https://os.mbed.com/blog/entry/Important-Update-on-Mbed/
[2] https://docs.yoctoproject.org/contributor-guide/recipe-style-guide.html#required-variables
Signed-off-by: Ricardo Simoes <ricardo.simoes@pt.bosch.com>
Signed-off-by: Mark Jonas <mark.jonas@de.bosch.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
oe-core just moved from pkgconfig to pkgconf, which has broken the
ptest buikd due to how fragile the compilation was.
This will be revisited to build the tests properly, but for now simply
disable the ptests.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
oe-core just moved from pkgconfig to pkgconf, which has broken the
ptest buikd due to how fragile the compilation was.
This will be revisited to build the tests properly, but for now simply
disable the ptests.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add ptest infrastructure to run the PostgreSQL standard regression test
suite (pg_regress) on the target system.
Test logs:
root@qemux86-64:~# ptest-runner postgresql
START: ptest-runner
2026-03-24T02:42
BEGIN: /usr/lib64/postgresql/ptest
.....
**if all pass **
PASS: - event_trigger_login 1901 ms
PASS: - fast_default 9459 ms
PASS: - tablespace 16542 ms
PASS: all tests passed
**if have fail**
FAIL: create_type 1763 ms
PASS: create_schema 2123 ms
PASS: - tablespace 23226 ms
FAIL: some tests failed
waiting for server to shut down.... done
server stopped
DURATION: 853
END: /usr/lib64/postgresql/ptest
2026-03-24T02:56
STOP: ptest-runner
TOTAL: 1 FAIL: 0
Signed-off-by: Guocai He <guocai.he.cn@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
opusfile comes from meta-multimedia and meta-oe does
not depend on it, for keeping layer compatible, it
must be kept disabled
Fixes YP Compatible checks
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Cc: Markus Volk <f_l_k@t-online.de>
The xml PACKAGECONFIG entry uses libxm2, which is a typo and not a
valid dependency in OE.
Replace it with libxml2 so enabling PACKAGECONFIG:xml pulls in the
correct provider.
Signed-off-by: Aviv Daum <aviv.daum@gmail.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Added tag to SRC_URI.
Release information [1]:
1.9.7: Bugfixes, build system cleanups
What's Changed
* Fixes PreventInSourceBuilds.cmake to work with add_subdirectory by @morbo84 in #1383
* json_value.cpp bug in the edges of uint/int by @YaalLek in #1519
* Release 1.9.6 and move versions to 1.9.7 by @baylesj in #1566
* Fixed work secure_allocator on old compiers by @TsynkPavel in #1478
* Fix flag -DJSONCPP_USE_SECURE_MEMORY:BOOL=TRUE by @tfc in #1567
* fix(build): remove check_required_components for meson build by @chenrui333 in #1570
* the cgi module was removed from Python3.13 by @a-detiste in #1578
* Fix name of static library when targeting MinGW. by @mmuetzel in #1579
* Fix comparison warnings caused by 54fc4e2 by @JensMertelmeyer in #1575
* Drop pre-C++11 alternatives by @BillyDonahue in #1593
* feat: support std::string_view in Value API by @evalon32 in #1584
* Added Value::findType with String key by @SwintonStreet in #1574
* Set up for Bazel module builds. by @bcsgh in #1597
* Add a BUILD.bazel file for //example. by @bcsgh in #1602
* Fix "include what you use" issue by @victorvianna in #1625
* Make the build configuration under Bazel more correct. by @bcsgh in #1600
* Add Bazel tests by @bcsgh in #1601
* Return false in Reader::readValue when stack limit is exceeded by @xuhdev in #1619
* Remove deprecated/removed clang-tidy key AnalyzeTemporaryDtors (#1614) by @bmagistro in #1615
* [docs] Consuming JSONCpp via Conan package manager by @uilianries in #1622
* Cleanup README.md, fix broken link. by @baylesj in #1633
* Add gcovr.cfg to fix CI coverage merge errors by @baylesj in #1635
* Remove build directory exclusion from gcovr config by @baylesj in #1640
* Add test for allowDroppedNullPlaceholders by @baylesj in #1648
* Prevent test colision when running in parallel via RESOURCE_LOCK by @marty1885 in #1637
* fixup project version updater by @baylesj in #1649
* Update README with project status and focus by @baylesj in #1639
* Adding a cmake option to exclude the jsoncpp files from install. by @nv-jdeligiannis in #1596
* Change stack depth limit to 256 by @baylesj in #1657
* Fix uninitialized CMake variable in version.in by @baylesj in #1658
* Fix CMake deprecation warning for compatibility with CMake < 3.10 by @baylesj in #1659
* Scope JSON_DLL_BUILD to shared lib target only by @baylesj in #1660
* Fix number parsing failing under non-C locales by @baylesj in #1662
* Reject unescaped control characters in JSON strings by @baylesj in #1663
* Fix MSAN issue in #1626 by @baylesj in #1654
* Fix string_view ABI mismatch between library and consumers by @baylesj in #1661
* Revert "Fix number parsing failing under non-C locales" by @baylesj in #1664
* Fix use-after-free in Reader::parse(std::istream&) by @baylesj in #1665
* Update bazel config for 9.x by @keith in #1655
[1] https://github.com/open-source-parsers/jsoncpp/releases/tag/1.9.7
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Release information [1] does not list python changes, but we should
match protobuf (C++) recipe version.
[1] https://github.com/protocolbuffers/protobuf/releases/tag/v33.6
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Added tag to SRC_URI.
Release notes [1]:
Add lvmlockd compare and write, index man pages, and a lot of fixes.
* Add atomic leases using Compare and Write (CAW) to lvmlockd.
* Add lvm-index(7), lvm-categories(7) and lvm-args(7) man pages.
* Use temporary activations for integrity, writecache, thin and VDO pool conv
preventing interference.
* Fix `vgreduce --removemissing --force` infinite loop for raid/mirror snapshot.
* Improve RAID LV health report to distinguish 'refresh needed' from 'repair needed'.
* Support `--interval +N` to delay first poll in pvmove and lvpoll.
* Show active cache mode in kernel table line with `lvs -o kernel_cache_mode`.
* Reject lvreduce of CoW snapshot COW store when it would truncate exception data.
* Skip filesystem resize handling for CoW snapshot COW store LVs in lvresize.
* Fix vgsplit to not fail on no active LV on a PV being split to an existing VG.
* Preserve file desciptors with CLOEXEC opened in library constructors.
* Add lvmpolld 'cmd' log keyword to enable verbose lvpoll output.
* Add `activate_lv_temporary()` to consolidate `LV_TEMPORARY` and sync handling.
* Add missing sync in `add_mirror_log()` and `activate_and_wipe_lv_list()`.
* Fix cachevol cmeta/cdata device offsets.
* Fix pofile generation to include SOURCES2 binaries and update xgettext options.
[1] https://github.com/lvmteam/lvm2/releases/tag/v2_03_39
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Newer gnulib use python implementation by default if it
finds py3 on the system. However, netcf is old package
and its not expecting python implementation, therefore
make the shell implementation be used.
REALLOC_N is gone in latest gnulib so house a local
macro
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
