Changelog:
==========
https://github.com/jqlang/jq/releases/tag/jq-1.8.0
Security fixes
* CVE-2024-23337: Fix signed integer overflow in jvp_array_write and jvp_object_rehash. @itchyny de21386
The fix for this issue now limits the maximum size of arrays and objects to 536870912 (2^29) elements.
* CVE-2024-53427: Reject NaN with payload while parsing JSON. @itchyny a09a4df
The fix for this issue now drops support for NaN with payload in JSON (like NaN123).
Other JSON extensions like NaN and Infinity are still supported.
* CVE-2025-48060: Fix heap buffer overflow in jv_string_vfmt. @itchyny c6e0416
* Fix use of uninitialized value in check_literal. @itchyny #3324
* Fix segmentation fault on strftime/1, strflocaltime/1. @itchyny #3271
* Fix unhandled overflow in @base64d. @emanuele6 #3080
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
According to release_notes.rst of 3.12.0 [1], it requires the `vfat-resize`
tool for FAT filesystem resize support. In Yocto, package libblockdev-bin
provides vfat-resize
[1] ce03a4869d (diff-b99febf52a7481dd33d7896edaaad85373851e76d8f01303491713e723b905ddR21-R25)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
In upstream (handcrafted) Makefile, .c and .h files are soft-linked
before being compiled. Under heavy load or a build with a high CPU
count, the compilation can start before header files are softlinked,
resulting in a build error:
| pcp-htop.c:13:10: fatal error: CommandLine.h: No such file or directory
| 13 | #include "CommandLine.h"
| | ^~~~~~~~~~~~~~~
Fix this by adding the make dependency between object files and the
headers.
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
https://github.com/redis/redis/releases/tag/6.2.17https://github.com/redis/redis/releases/tag/6.2.18
Security fixes
==============
* (CVE-2024-46981) Lua script commands may lead to remote code execution
* (CVE-2025-21605) An unauthenticated client can cause an unlimited growth of output buffers
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Add missing makefile rule depedency on compilation of cst_lexer.c, which
require header cst_parser.h generated at compilation with cst_parser.c
This issue has been detected during the Yocto autobuilder test CI,
probably during a high CPU load
(https://autobuilder.yoctoproject.org/valkyrie/#/builders/87/builds/46/steps/33/logs/stdio).
Signed-off-by: Kelefa Sane <kelefa.sane@smile.fr>
Reviewed-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 7.8.2:
- Wheels are provided for Windows ARM64 on Python 3.11, 3.12, and
3.13
- A number of EncodingWarnings were fixed that could appear if
you've enabled PYTHONWARNDEFAULTENCODING
- Fixed a race condition when using sys.monitoring with
free-threading Python
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 2.6.0:
- cmd2 2.6 supports Python 3.9+ (removed support for Python 3.8)
- Added support for Python 3.14
- Added new Cmd.ppretty() method for pretty printing arbitrary
Python data structures
- Clarified help text for -t/--transcript argument to the history
command
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 1.5.2:
- Remove support for Python 3.7
- Explicitly marks support for Python 3.13
- Improved project documentation
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 25.5.0:
- Add testing for Python 3.13
- Remove support for EOL Python 3.8
- Break after first hit with find_first_match
- Use cached_property for the prefix property
- Use cached_property for the major property
- Use cached_property for the minor property
- Use cached_property for the simple property
- Use cached_property for the strategy property
- Set full tag names in actions
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
ChangeLog:
- auditctl: update io_uring operations table
- update syscall table for 6.15
- auditd.cron.5: Describe time-based log rotation setup
- auditd: Broadcast a warning on startup if a system halt is possible
- Fix audisp-remote segfault on connection error
- Improve locating last event if ausearch is using checkpointing
- af_unix plugin: fix string mode support
- Remove const from audit_rule_fieldpair_data &
audit_rule_interfield_comp_data
- Add various updates to the experimental ids plugin
- Add glibc memory statistics to auditd state report
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
GCC 15 seems to be confused about when the <version> header was
introduced (C++20) and expects it to be used with C++17.
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
PipeWire 1.4.4 (2025-05-29)
This is a quick bugfix release that is API and ABI compatible with
previous 1.x releases.
Highlights
- Provide better compatibility with 1.2 for MIDI.
- Fix mpv buffer negotiation regression.
- Improve GStreamer compatibility with libcamera.
SPA
- Provide conversions to old style midi in the ALSA sequencer.
- Negotiate only to UMP when using a newer library.
- Fix negotiation direction for buffers, prefer the converter
suggestion instead of the application until we can be sure
applications make good suggestions.
GStreamer
- Allow a minimum of 1 buffers again instead of 8. libcamera will
allocate only 4 buffers so we need to support this.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrades
Add compatibility with Click 8.2. PR #1222 by @tiangolo.
When using the CliRunner with Click < 8.2,
to be able to access the stderr output, you needed to set the mix_stderr
parameter to True. Since Click 8.2 (and Typer 0.160 this release
supporting it) this is no longer necessary, so this parameter has been
removed.
Refactors
Refactor tests for compatibility with Click 8.2. PR #1230 by @tiangolo.
Internal
Remove Google Analytics. PR #1229 by @tiangolo.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 3.4.2:
- Addressed the DeprecationWarning in our CLI regarding
argparse.FileType by backporting the target class into the package.
- Improved the overall reliability of the detector with CJK Ideographs.
- Optional mypyc compilation upgraded to version 1.15 for Python >= 3.8
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 2.6.1:
- A __version__ attribute relying on importlib.metadata.
- A uv.lock lock-file for reproducible builds.
- Drop official support for Python 3.8.
- Switch from black to ruff for code style.
- Fully migrate to a pyproject.toml-based project.
- Ensure code style consistency (see selected rules in pyproject.toml).
- Extra dependencies are part of the dev dependency group (PEP 735).
- Switch from setuptools to hatchling for building portion.
- Switch from coverage to pytest-cov for test coverage.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This bbclass is intended to be used via "INHERIT". The qemu.bbclass
is in classes-recipe. So we can't inherit qemu. We need to copy
QEMU_OPTIONS settings from qemu.bbclass and use oe.qemu to make things
work.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This reverts commit 24ff52ba3b.
The original patch was my bad. The patches for oe-core were re-worked,
but I forgot the recall this patch.
In fact, inheriting qemu is needed because it sets a clear barriar
for people to use qemu user mode. And the QEMU_OPTIONS settings
are also in qemu.bbclass.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This reverts commit a8995fc3f3.
The patches for oe-core were re-worked. But I forgot to recall
this patch.
In fact, inheriting qemu is needed because it sets a clear barriar
for people to use qemu user mode. And the QEMU_OPTIONS settings
are also in qemu.bbclass.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Current implementation explicitly add rv64gcv to
-march, which means its not yet tested on rv32gcv
so disable RVV on 32bit RISCV for now.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
RACUT_FULL_VERSION is conditional assigned in Makefile as below:
DRACUT_FULL_VERSION ?= $(shell env GIT_CEILING_DIRECTORIES=$(CURDIR)/.. git describe --tags --always 2>/dev/null || :)
When build from git shallow tarball, since tag info is not included,
956c087 is returned. This will make dracut version in dracut.pc
different with build from git repo.
Set DRACUT_FULL_VERSION to PV, to improve reproducibility for this
recipe, and also fix the version mismatch warning
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Refer [1], dialog's tarballs released with date, for convenient, PV also
end with date. Change to check without date suffix.
[1] https://invisible-mirror.net/archives/dialog/
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
jemalloc set the version by pass --with-version=${PV_LONG}, PV_LONG :=
"${PV}-171-g${SRCREV}", set match pattern for jemalloc to mute the
version mismatch warning
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Refer [1], upstream set this version specially, so mute by skipp
checking
[1] 49057f6ce5
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The version get by the version check tool is wrong, the output
include version of grep. Skip checking to mute the warning
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
ld.libhugetlbfs --version return the ld version on the host, and cause
version mismatch warning, mute the warning by skip checking for this
package
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
bpftool is compiled from kernel source, we hope it has version
aligned with kernel version, but the sources will printout some
other versions, skip this checking.
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
ChangeLog:
https://github.com/redis/redis/releases/tag/7.2.8
Update urgency: SECURITY: There are security fixes in the release.
Security fixes
==================
* (CVE-2025-21605) An unauthenticated client can cause an unlimited growth of output buffers
Bug fixes
=================
* #12817, #12905 Fix race condition issues between the main thread and module threads
* #13863 RANDOMKEY - infinite loop during client pause
* #13877 ShardID inconsistency when both primary and replica support it
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Using a string search for Fail is not going to work always e.g.
when all tests are passing it still prints a summary string with string
"Fail" in it which points to 0, however the logic here catches that and
counts it as 1 failure and marks the return value as 1 and ptest runner
interprets that as failure
Pass the return value from unit.test which should be 0 on all passes
or non zero otherwise.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
- there is no tarball hosted at gnome anymore -> switch from
gnomebase class to meson + git
- add missing dependencies for uuid and nvme, add pkgconfig class
- dhcpcanon option was removed upstream
- gtkdoc is broken. Disable to unbreak builds if api-documentation
is enabled
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Extend and submit the existing patch fixing makefile parallelism:
> Some QA binaries include localconfig.h but there is no explicit dependencies
> between the binary build and the localconfig.h generation.
> On heavily loaded systems, this can result in the binary being built
> before localconf.h and a compilation error, e.g:
> | username.c:8:10: fatal error: localconfig.h: No such file or directory
> | 8 | #include "localconfig.h"
> | | ^~~~~~~~~~~~~~~
> | compilation terminated.
>
> Fix this by adding the missing Makefile rule dependency between the
> binary (or its pre-link .o) and localconfig.h.
AB frequenctly lost the race condition due to (I suppose) its high CPU
count and load[0].
[0]: https://autobuilder.yoctoproject.org/valkyrie/#/builders/87/builds/44/steps/32/logs/stdio
(line 131)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Reviewed-by: Kéléfa Sané <kelefa.sane@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Drop redundant limit declaration patch. Swap issetugid()/getenv() call for
secure_getenv() on Linux.
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Fix reproducibility issue by retrieving the compiler version from the CC
env variable, which define the compiler used in the build and not from
the native gcc compiler install in the host machine.
Signed-off-by: Kéléfa Sané <kelefa.sane@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
WirePlumber 0.5.10
Fixed a critical crash in linking-utils.haveAvailableRoutes that was
introduced accidentally in 0.5.9 and caused loss of audio output on affected
systems (#797, #799, #800, !713)
WirePlumber 0.5.9
Added a new audio node grouping functionality using an external command line
tool (!646)
The libcamera monitor now supports devices that are not associated with
device ids (!701)
The wireplumber user systemd service is now associated with dbus.service to
avoid strange warnings when dbus exits (!702)
Added "SYSLOG_IDENTIFIER", "SYSLOG_FACILITY", "SYSLOG_PID" and "TID" to log
messages that are sent to the journal (!709)
Fixes:
Fixed a crash of wpctl set-default on 32-bit architectures (#773)
Fixed a crash when a configuration component had no 'provides' field (#771)
Reduced the log level of some messages that didn't need to be as high (!695)
Fixed another nil reference issue in the alsa.lua monitor script (!704)
Fixed name deduplication of v4l2 and libcamera devices (!705)
Fixed an issue with wpctl not being able to save settings sometimes (!708, #749)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
PipeWire 1.4.3 (2025-05-22)
This is a bugfix release that is API and ABI compatible with
previous 1.x releases.
Highlights
- Many netjack2 improvements. The driver/manager roles were fixed,
MIDI is written correctly and errors are handled better.
- Improvements to UMP sysex handling.
- More small bug fixes and improvements.
PipeWire
- Let all commands go to the node. This makes it possible to send
custom commands.
Modules
- Many netjack2 improvements. The driver/manager roles were fixed,
MIDI is written correctly and errors are handled better.
- Improve the filter-graph state management in filter-chain.
SPA
- Use default value of filter. (#4619)
- Fix UMP program change conversion to MIDI 1.0. (#4664)
- Skip only the first buffer for raw formats in v4l2 to avoid
dropping important headers when dealing with encoded formats.
- Fix ebur128 port name. (#4667)
- Only convert UMP/MIDI, pass other controls. Fixes OSC and other
control types in the mixer. (#4692)
- Improve UMP sysex handling in alsa seq.
- Improve ALSA audio.channels support. Only use this when the value
is within the valid range.
Tools
- debug UMP SysRT messages correctly in pw-mididump.
JACK
- Handle sysex in UMP better by appending the converted midi1
sysex.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
See https://github.com/uutils/coreutils/releases/tag/0.1.0
- major performance gains
- SELinux support
- expanded GNU compatibility
- "features_os_unix" now also works for musl builds
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
In order to function, libglvnd requires vendor-provided Installable
Client Drivers for libEGL and libGLX. RRECOMMEND corresponding virtual
packages in order to pull default implementation for the target
platform.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Some packages (XWayland, X.org) add runtime dependency on libegl in
order to let it by open at runtime. Make libglvnd RPROVIDE that package
name too.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Add corresponding PROVIDES in order to let libglvnd declare that it
provides corresponding libraries.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
