useradd.bbclass: drop groupmems from sysroot setup
groupmems was removed from shadow 4.20.0 [1]. The useradd class never
actually called the binary - perform_groupmems already uses usermod.
Drop it from the sysroot loop to silence the warnings.
Notable upstream changes:
- expiry(1): removed (deprecated in 4.19)
- groupmems(8): removed, use usermod(8) instead (deprecated in 4.19)
- logoutd(8): removed (deprecated in 4.19)
- PAM configs for setuid account tools removed (08f27babeb2c)
- login.defs(5): ENCRYPT_METHOD now defaults to SHA512
- Removed unused dependency on libattr
- New --disable-syslog configure option
Patches removed:
- prototypes.patch: patched src/expiry.c and src/logoutd.c which were
removed upstream in commits 2bb1b984 and eec97ce4.
- disable_syslog.patch: shadow now supports --disable-syslog configure
option natively. Added to EXTRA_OECONF for class-native instead.
- shadow-update-pam-conf.patch: the files it patched (chgpasswd,
groupadd, groupdel, groupmod, useradd, userdel, usermod) were removed
upstream in commit 08f27babeb2c. The remaining pam.d files in the
tarball are all overridden by the recipe's own PAM files.
Patches added:
- 0001-subid-Add-stdint.h-for-uintmax_t.patch: backport of upstream
commit ba4419c57b22 fixing missing <stdint.h> include causing build
failure in find_new_sub_uids.c and find_new_sub_gids.c.
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sun, 2 Aug 2026 07:36:57 +0000 (08:36 +0100)]
lib/oe/lsb: Merge distro_identifier functions
In order to access LSB_DISTRO_ADJUST fuctions, a portion of the lsb
distro_indetifier code was left in base.bbclass. There is a way to handle
this so merge the code into one function and use it from all call
sites.
This makes the code slightly less of a maze.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sat, 1 Aug 2026 18:00:30 +0000 (19:00 +0100)]
kernel-devicetree: Add missing function prefixes
There is an implicit ordering problem with this class and kernel.bbclass,
since kernel.bbclass uses EXPORT_FUNCTIONS on these function and if the
inherit ordering is wrong, the functions get broken.
The class is always included and always wants to append them. Therefore
target the real functions we want to change.
This makes the inherit order less fragile.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sat, 1 Aug 2026 12:51:16 +0000 (13:51 +0100)]
kernel-arch: Move ARCH usage into target classes
Since ARCH is just a function now we can move it into the target class usages
and drop it from the default environment. We still have to export in some
cases where the usage is unknown but this does significatly reduce the
scope and number of places exported to.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Fri, 31 Jul 2026 10:39:21 +0000 (11:39 +0100)]
barebox: Separate out from kernel-arch.bbclass
Move the ARCH usage into barebox.bbclass and stop using kernel-arch.bbclass
since there are things in there which barebox might not want.
This does mean the variables ARCH and UBOOT_ARCH are no longer in the environment
but I hopefully covered the main usages of the variables with alternatives.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Fri, 31 Jul 2026 10:34:58 +0000 (11:34 +0100)]
u-boot: Separate out from kernel-arch.bbclass
Move the UBOOT_ARCH usage into u-boot.inc and stop using kernel-arch.bbclass
since there are things in there which u-boot might not want.
This does mean the ARCH and UBOOT_ARCH variables are no longer in the environment
but I hopefully covered the main uboot usages of the variables.
Also document where these values are from and what they're supposed to mean
explictly, including the difference between UBOOT_ARCH and UBOOT_ARCH_DIR.
UBOOT_ARCH_DIR has issues which will need discussion with newer platforms
which use dts/upstream.
You might think we need to set ARCH in EXTRA_OEMAKE for u-boot but it turns
out it was ignoring the value and setting it breaks builds. This patch
therefore doesn't do that after confirmation from the u-boot devs:
Richard Purdie [Wed, 29 Jul 2026 22:32:52 +0000 (23:32 +0100)]
kernel-arch: Move kernel and uboot arch functions to lib/oe/kernel.py
Move the ARCH and UBOOT_ARCH python functions to the python library code.
The ability to alter valid_archs is removed as:
- the values should be long since established by now
- non-linux targets have an escape in the code
- the lower case variable name is not normal convention and should be
replaced if we were to retain it
By removing it we'll find out if anyone does actually need that (and we
can probably fix the entries in the file if there is anything missing).
The code itself is full of redundant codepaths but that is for another
patch if we try and improve it.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Wed, 29 Jul 2026 21:39:29 +0000 (22:39 +0100)]
lib/oe/kernel: Move python functions from linux-kernel-base to library code
This means get_kernelXXX needs to become oe.kernel.get_XXX and means we can
clear linux-kernel-base to allow it to be removed, starting to simplify the
file structure.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Wed, 29 Jul 2026 22:46:53 +0000 (23:46 +0100)]
sstatesig: Use kernel.bbclass instead of linux-kernel-base.bbclass
linux-kernel-base is nearly empty and about to be removed, switch to
kernel.bbclass which should be similar. The main risk is other layers
using that class name, but hopefully they'd still be kernels!
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Fri, 31 Jul 2026 12:25:22 +0000 (14:25 +0200)]
perl: inherit upstream-stable-release-point
perlpolicy documents a strict maintenance-branch policy: new releases of
a maint branch may only contain security/CVE fixes, crashing bugs,
regressions, build and install blockers, portability fixes and factual
documentation corrections, and must not contain patches that "add or
remove features", "break binary compatibility", or "add new warnings or
errors or deprecate features". New dual-life module versions are
explicitly deferred to the next stable series. So upgrades within a
major.minor are stable point upgrades per the OE-Core stable release
policy (ref-manual, "Stable Point Release Upgrades"). Long-lived
per-even-minor maint branches back this up, maint-5.6 through maint-5.42,
with a documented back-porting vote process.
Checked the last two point releases for feature creep. perldelta makes
this easy to see, as maint releases carry no "Core Enhancements" section
at all:
5.42.2 (Mar 29 2026): one CVE in a vendored dependency, CVE-2026-4176
in Compress::Raw::Zlib, plus module version bumps. States "There are no
changes intentionally incompatible with 5.42.1".
5.42.1 (Mar 08 2026): four fixes -- a Configure fix so POSIX locale
values can be passed in for cross-compilation, an AIX thread-safe
locale workaround, a Win32 build fix, and module version bumps. States
"There are no changes intentionally incompatible with Perl 5.42.0".
5.42.0 (Jul 02 2025) is the series-opening release, not a point
release: it adds seven language-level features, confirming X.Y.0 bumps
are feature bumps that must stay outside the regex.
Cross-checked the previous series the same way: 5.40.1, 5.40.2 and 5.40.3
all show the same profile, with security, module, documentation, test and
bug-fix sections only and no Core Enhancements.
The policy forbidding binary-compatibility breaks in maint releases also
covers the ABI concern directly.
Already tracked this way on the OE stable branches, counting only bumps
made since each branch forked from master: kirkstone 5.34.1 -> 5.34.3 and
scarthgap 5.38.2 -> 5.38.4 are both in-series point bumps. wrynose is
still at 5.42.0 while master is at 5.42.2, so it is missing the
CVE-2026-4176 fix -- exactly the tracking gap --stable is meant to close.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Fri, 31 Jul 2026 12:25:21 +0000 (14:25 +0200)]
git: inherit upstream-stable-release-point
Git's maintainer documentation defines the version scheme explicitly:
vX.Y.0 are feature releases carrying bugfixes and enhancements in any
area, while vX.Y.Z (Z>0) maintenance releases "contain only bugfixes for
the corresponding vX.Y.0 feature release and earlier maintenance
releases". So upgrades within a major.minor are stable point upgrades per
the OE-Core stable release policy (ref-manual, "Stable Point Release
Upgrades").
Checked recent maintenance releases for feature creep:
2.44.4 (May 28 2025): CVE fixes only, seven of them, merged up from the
fixes that appeared in v2.43.7. The release notes contain nothing else.
2.35.7 (Feb 06 2023): four fixes -- two libcurl portability fixes, and
two symlink-escape fixes in apply and clone back-merged from older
maintenance lines.
No 2.55.x point release exists yet, 2.55.0 being the current tip, so this
relies on the documented policy plus the historical pattern above rather
than a same-series point release. The ref-manual admits that basis: a
recipe may qualify on clear historical evidence that a class of bump is
bugfix-only (ref-manual, "Criteria for Qualifying Upstreams").
Already tracked this way on the OE stable branches, counting only bumps
made since each branch forked from master: kirkstone 2.35.2 -> 2.35.7,
five point bumps, and scarthgap 2.44.0 -> 2.44.4, three point bumps.
wrynose ships 2.53.0 as its initial version with no bump yet.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Fri, 31 Jul 2026 12:25:20 +0000 (14:25 +0200)]
xz: inherit upstream-stable-release-point
XZ Utils's README documents that an even minor (Y) is a stable series
where the revision (Z) "is incremented when bugs get fixed without adding
any new features". So upgrades within a major.minor are stable point
upgrades per the OE-Core stable release policy (ref-manual, "Stable Point
Release Upgrades").
Checked the last two point releases for feature creep:
5.8.3 (Mar 31 2026): one CVE (CVE-2026-34743, a buffer overflow in
lzma_index_append), one invalid-memory-access fix, build portability
fixes for Windows ARM64EC and Hurd, and man page translations. No new
options or API.
5.8.2 (Dec 17 2025): build portability fixes for four toolchains, a
RHEL 9 kernel-bug workaround, and a resource-aware memory-limit default
tweak that is a bugfix rather than a new feature. No new options or
API.
Already tracked this way on the OE stable branches, counting only bumps
made since each branch forked from master: kirkstone picked up 5.2.6 and
scarthgap 5.4.7, one bump each.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Fri, 31 Jul 2026 12:25:19 +0000 (14:25 +0200)]
dbus: inherit upstream-stable-release-point
D-Bus's CONTRIBUTING.md documents even-minor stable branches, currently
dbus-1.16.x, that receive only cherry-picked bug fixes, so upgrades
within a major.minor are stable point upgrades per the OE-Core stable
release policy (ref-manual, "Stable Point Release Upgrades"). It also
states that odd-minor development branches such as 1.17.x are not
supported at all and receive no bug fixes, not even for security
vulnerabilities, so only the even-minor stable series should be tracked.
Checked the only point release in the series so far for feature creep,
the 1.16.x series having just one non-.0 release to date:
1.16.2 (Feb 27 2025): two items -- one build-regression fix for
verbose-mode builds against libselinux >= 3.8, and a documentation
update. No API or behaviour changes.
Already tracked this way on the OE stable branches, counting only bumps
made since each branch forked from master: kirkstone 1.14.0 -> 1.14.8.
scarthgap has had zero point-release bumps since its fork and remains at
1.14.10; wrynose ships 1.16.2 as its initial version with no bump yet.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Fri, 31 Jul 2026 12:25:18 +0000 (14:25 +0200)]
glib-2.0: inherit upstream-stable-release-point
GLib's docs/backports.md states that only bug and documentation fixes are
backported to the current stable branch, that new features and API/ABI
changes must not be, and that micro stable releases are intended as
drop-in replacements. So upgrades within a major.minor are stable point
upgrades per the OE-Core stable release policy (ref-manual, "Stable Point
Release Upgrades").
Checked the last two point releases for feature creep:
2.88.2 (Jun 25 2026): entirely "Bugs fixed" backports plus translation
updates.
2.88.1 (May 02 2026): seven fixes -- a GCC 16 miscompilation, a GRegex
out-of-bounds read with security impact, and five further out-of-bounds
reads. No API or behaviour changes.
The series opened with 2.88.0 (Mar 16 2026), which must stay outside the
regex as the feature-level release.
Already tracked this way on the OE stable branches, counting only bumps
made since each branch forked from master: kirkstone 2.72.0 -> 2.72.3,
scarthgap 2.78.4 -> 2.78.6, and wrynose 2.88.0 -> 2.88.2.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Fri, 31 Jul 2026 12:25:17 +0000 (14:25 +0200)]
systemd: inherit upstream-stable-release-point
systemd's README ("STABLE BRANCHES AND BACKPORTS") documents per-release
stable branches carrying backported patches. The current one, v261-stable,
is branched in the main repository; the README still points at the
systemd-stable repository, which holds the branches up to v255. The major
is a single version part (261 -> 261.1), so upgrades within a major
are stable point upgrades per the OE-Core stable release policy
(ref-manual, "Stable Point Release Upgrades"). STABLE_VERSION_PARTS is
set to 1 accordingly.
261.2 (Jul 23 2026), against 261.1 (Jun 26 2026): 277 commits, mostly
fixes. NEWS files both releases under "CHANGES WITH 261" and gives
neither its own entry. Four items are feature-shaped: refcounting,
argument handling and JSON output additions, plus one new internal
string-util flag.
Those are small internal additions on a real, diverged stable branch
rather than mainline drift, and none introduce a new subsystem: closer in
scope to a security-hardening batch than a feature release, though
broader than a pure bugfix release.
These bumps are not free: the scarthgap 255.4 -> 255.13 bump was held for a
v2 because TCLIBC=musl broke, and was merged once fixed. A point release
being fixes-only upstream does not remove the need to build and test it.
Already tracked this way on the OE stable branches, counting only bumps
made since each branch forked from master: kirkstone 250.4 -> 250.14 and
scarthgap 255.4 -> 255.21. wrynose has had no point-release bump yet.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Trevor Woerner [Sun, 2 Aug 2026 02:10:00 +0000 (22:10 -0400)]
image_types_wic: gate syslinux-native on the target, not the build host
A .wks needs the syslinux installer only when the target is x86.
image_types_wic.bbclass selects syslinux-native on the build host
architecture instead, so the dependency lands like this:
| x86 target | non-x86 target
-------------+------------+----------------
x86 host | yes | yes
non-x86 host | no | no
Two of those cells are wrong. An x86 image cross-built on a non-x86 host
gets the target bootloader without the installer that writes it, and an
x86 host building a non-x86 image builds an installer nothing uses.
Gate on the target, as wic-tools does [1]:
| x86 target | non-x86 target
-------------+------------+----------------
x86 host | yes | no
non-x86 host | yes | no
Bug 13276 [2] was an aarch64 host failing to build syslinux-native for
an ARM target, at a time when syslinux was x86-only in every variant. It
was closed in 2019 by gating on BUILD_ARCH [3]. Since 7273e131bfc7 [4]
only syslinux's target code is x86-specific, so a host gate is no longer
needed, and gating on the target keeps 13276's case fixed.
Trevor Woerner [Sun, 2 Aug 2026 02:09:57 +0000 (22:09 -0400)]
wic: add runtime dependencies on the tools it invokes
wic shells out to a range of host tools (parted, mkfs.*, mcopy, sfdisk,
and more) but, since the recipe was created, has declared none of them,
so an installed wic works only by chance depending on what the host
provides. Declare them as RDEPENDS so they are installed with wic.
The wic image type and wic-tools each carried a copy of that same list,
and the copies had drifted: only wic-tools staged tar-native and
util-linux-native. Neither needs a list of its own now. native.bbclass
makes a native recipe's do_populate_sysroot depend on its RDEPENDS, so
depending on wic-native stages the lot.
Three entries stay written out. cdrtools has only a native recipe, so
there is no package a target or nativesdk wic could name, even though
wic does run mkisofs. grub is bootloader territory and belongs to
whatever drives wic. pseudo is wic-tools staging what the oe-selftest
needs.
Trevor Woerner [Sun, 2 Aug 2026 02:09:56 +0000 (22:09 -0400)]
image_types_wic, wic-tools: drop the obsolete cross-binutils dependency
wic depends on virtual/cross-binutils because its EFI boot image plugin
once assembled unified kernel images and needed cross-objcopy for it.
That plugin no longer builds them: it refuses and points at
uki.bbclass, which declares virtual/cross-binutils itself.
No code wic runs invokes objcopy any more, so drop the dependency from
the two places still carrying it.
Trevor Woerner [Sun, 2 Aug 2026 02:09:55 +0000 (22:09 -0400)]
wic-tools: drop the target bootloader firmware
wic-tools should stage only wic's host tools, but its arch-specific
appends also depended on target bootloader firmware (syslinux, grub-efi,
systemd-boot) solely for the wic oe-selftest. Which firmware is needed
depends on the plugins a .wks uses, so that firmware is the
responsibility of whoever supplies the .wks, not of wic-tools. Have the
oe-selftest bitbake those recipes itself instead.
Images already work that way through WKS_FILE_DEPENDS in
image_types_wic.bbclass, and the oe-selftest now does the equivalent,
adding syslinux to core-image-minimal's DEPENDS where the tests expect
it in the recipe sysroot.
WXbet [Sat, 1 Aug 2026 16:16:06 +0000 (09:16 -0700)]
rust-target-config: set MIPS ABI in the target JSON
rustc 1.96 (rust-lang/rust#153769) started rejecting MIPS target JSON
files that do not carry both an "abi" field and a matching "llvm-
abiname" field, aborting libstd-rs's do_compile with
error: error loading target specification:
invalid MIPS ABI name and `cfg(target_abi)` combination:
ABI name: <empty>
cfg(target_abi): <empty>
rust_gen_target() populates the target JSON from the DATA_LAYOUT /
TARGET_ENDIAN / ... varflags plus an arch-specific "abi" branch that
today only covers arm/armv7. On mips*/mipsel* neither "abi" nor
"llvm-abiname" is written, so rustc's stricter check fails.
Cover every MIPS tune shipped in meta/conf/machine/include/mips/
arch-mips.inc's AVAILTUNES:
Note that the mips64-o32 / mips64el-o32 tunes (o32 ABI on a 64-bit
MIPS CPU) get MIPSPKGSFX_BYTE="" from arch-mips.inc and therefore
TUNE_ARCH="mips[el]"; they fall into the 32-bit branch above.
Signed-off-by: WXbet <57314510+WXbet@users.noreply.github.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Thu, 30 Jul 2026 14:01:57 +0000 (15:01 +0100)]
qemu: allow building for mingw targets
The recent upgrade to qemu 11[1] introduced overly-tight COMPATIBLE_HOST
statements that don't allow mingw builds. Remove the -linux from the
nativesdk-qemu and nativesdk-qemu-helper recipes so that 64-bit mingw
builds of qemu are possible.
opkg: enable sha256 checksum verification by default
WITH_SHA256=ON adds no external dependency: sha256.c is a self-contained
528-line pure C implementation already present in the source tree.
oe-core already generates SHA256Sum fields in the Packages index
(via --checksum sha256 in OpkgIndexer.write_index), but opkg silently
ignores them unless compiled with WITH_SHA256=ON. Enabling sha256 by
default makes those checksums actually verified at install time,
improving package integrity checking at zero dependency cost.
Once SHA256 is universally available, --checksum md5 can also be
dropped from OpkgIndexer.write_index() -- MD5 is collision-prone and
should not be relied upon for integrity checking -- completing the
deprecation noted in https://git.openembedded.org/openembedded-core/commit/?id=e462f47489f35902b6972f9837d9adfa542fc796
(2019).
AI-Generated: Claude Sonnet 4.6 Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
package_manager/ipk: skip checksums for unsigned local feeds
Computing checksums in the opkg Packages index requires reading every
.ipk file in full. For a large image with 7000+ packages (including
multi-gigabyte debug packages), this adds 150-300s to every do_rootfs run.
Checksums in the Packages index are only meaningful for signed feeds
(PACKAGE_FEED_SIGN=1): the GPG signature covers the Packages index
which contains the SHA256Sum of each .ipk, forming a chain of trust
that prevents tampered packages being swapped on a remote feed.
For unsigned local file:// feeds the packages are installed directly
from the build host filesystem where there is no tampering risk. Skip
all checksum generation in that case by passing no --checksum flags to
opkg-make-index (the tool's default behaviour when given no flags).
Pass --force-checksum to opkg so it does not error on the absent
checksum fields.
On a test image with 7000+ packages (including a 2.3 GB debug
package): write_index time reduced from ~180s to ~22s (8x speedup)
when opkg-make-index is configured to produce no checksums by default.
See https://git.openembedded.org/openembedded-core/commit/?id=e462f47489f35902b6972f9837d9adfa542fc796
("Enable sha256 checksums in opkg indexer", 2019) for the original rationale.
AI-Generated: Claude Sonnet 4.6 Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Wang Mingyu [Fri, 31 Jul 2026 04:36:28 +0000 (12:36 +0800)]
kernel-devsrc: Install sources required for BPF host tools
When CONFIG_DEBUG_INFO_BTF is enabled in the kernel, building external
modules that use BPF requires the 'resolve_btfids' host tool. This tool
and its dependencies were not included in the kernel-devsrc package.
This can cause a build failure in an SDK environment when 'make scripts'
is run, for example:
make[4]: *** No rule to make target '.../tools/bpf/resolve_btfids/main.o'
To fix this, unconditionally install the minimal set of source files
required to build the 'resolve_btfids' tool and its library dependencies.
This avoids coupling the recipe to specific kernel CONFIG symbols while
also ensuring only necessary files are included in the package.
The copy operations ignore errors to prevent build failures on older
kernel versions where these files may not exist.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
ncurses: stop moving terminfo files from /usr/share to /etc
Why it is done that way is mostly lost in history. The gentoo
reference leads one to [1] and then to [2]. But the small set of
terminfo files needed for "recovery" or an initramfs or similar is
exactly what we're putting in the terminfo-base package, there is no
need for those files to not just stay under /usr/share.
This also drops the xterm -> xterm-color symlink. I don't think that
symlink is appropriate nowadays either, as running
infocmp -L -d xterm xterm-color
shows that "xterm" (aka xterm-new, aka xterm-p370) has far more
capabilities than "xterm-color". So instead, just add plain 'xterm' to
the TERMINFO_BASE variable. Incidentally, gentoo had xterm in their
"basic" list as of their initial git commit 10 years ago [3].
Moreover, as the xterm -> xterm-color symlink only existed under /etc,
people who install the full ncurses-terminfo would have a
/usr/share/terminfo/x/xterm which did not match /etc/terminfo/x/xterm,
and which one an application would pick up is not obvious.
The cargo recipe has exports to stop the libssh2-sys (and git2-sys, but
disabled) crate from vendoring the C code into the built binary and
instead link to the shared libraries that we already have built.
This is desirable because it means that we have a single copy of say
libssh2 on the system that can be updated easily, instead of potentially
multiple different versions embedded in rust binaries.
This isn't specific to cargo, so move it into cargo_common so that all
recipes that build crates don't vendor C code.
The git2-sys linking was disabled due to incompatibilities with older
versions, but this appears to be historical now and git2-sys will link
dynamically if the library can be found. Force this by exporting the
variable so it refuses to build if it can't link.
Add anti-vendoring exports for libsqlite3-sys, openssl-sys, and
zstd-sys. Also explicitly tell pkg-config-sys that we'd prefer to never
build vendorered code, and link dynamically not statically.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add a check for the changelog-truncation notice that auto-upgrade-helper
appends to the commit message when the devtool changelog exceeds
changelog_max_len. This text is meant to be replaced by the submitter
with their own summary of the changes before sending the patch, so flag
it if left in place.
AI-Generated: Kiro with Claude Sonnet 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
oeqa/selftest/wic: drop redundant per-test PATH overrides
setUpLocal() already puts wic and its tools on PATH for every test, so
the per-test "os.environ['PATH'] = get_bb_var('PATH', 'wic-tools')"
overrides and their try/finally wrappers add nothing. Drop them; the
resulting dedent makes the diff large, so review with git show -w.
oeqa/selftest/wic: drop dead COREBASE/scripts wic lookup
wic moved to a standalone repository and is no longer shipped in
scripts/, so that search path can never match. Look for wic only in the
wic-tools native sysroot.
Richard Purdie [Mon, 3 Aug 2026 05:10:34 +0000 (05:10 +0000)]
mpg123: upgrade 1.33.6 -> 1.33.7
1.33.7
------
- mpg123:
-- Fix heap buffer overflows in unicode path conversion on Windows (bug 388,
thanks to Alejandro Ramos).
-- Fix information disclosure of uninitialied memory for --auth-file without
line endings. (bug 390, thanks to Alejandro Ramos)
-- Fix out-of-bounds read/write when combining --continue --random --listentry <n>
where n is larger than the playlist size. (bug 391, thanks to Alejandro Ramos)
-- Fix a harmless valgrind memory leak report by not nulling playlist name.
-- Fix error handling of win32_net_writestring() (Windows only) by actually using
a signed type, also preventing a OOB read on failure.
(bug 392 by Alejandro Ramos)
-- Fix a mostly harmless OOB read of 1 byte when printing USLT lyrics.
(bug 392)
-- Fix leaking file descriptor on read error from --equalizer file. (bug 392)
-- Hardening of loading HTTP(S) via curl or wget against funky URLs by including
the -- separator. No actual vulnerability, tough, just extra care. (bug 392)
- out123:
-- Fix heap overrun on --endian conversion with differing input and output
channel counts. (bug 391)
-- Fix parsing of filter specs with whitespace before commas, which resulted
in out-of-bounds writes before. (bug 391)
- libmpg123, mpg123: Harden memory realloc calls against multiplication overflow
of size_t in arguments. Specifically, this addresses part of bug 389 with possible
application abuse of mpg123_set_index64(). (bug 389 by Alejandro Ramos)
- libmpg123:
-- Fix possible use of uninitialized values in layer III dequantization.
III_dequantize_sample() for consistent output also for strange input. The new
code seems to be slightly faster after some rearrangements.
(thanks to He Huang, Swinburne University of Technology (discovered using
NexusSan))
-- Fix a double free when deleting a handle after failed mpg123_decoder() call
(possibly among others). (bug 389)
-- More strong wording in API that ID3 text convenience links are short-lived,
but safeguard against ignorant use by nulling them early.
(bug 389)
-- Prevent double free in mpg123_set_index() 32 bit wrapper being called with
index size 0. (bug 392)
-- Harden against an application wielding a foot gun by handing in an undersized
decoding buffer betwee seek and read (return error before trying to decode
and discard frames in that case). (bug 392)
-- Do properly terminate ID3v2 texts coming in UTF16 encoding when they overwrite
previous frames, like with other encodings. The symptom was a shorter second
frame resulting in a combined text with the earlier longer frame.
(bug 392)
-- Check and properly handle null source buffer and zero size in mpg123_store_utf8()
instead of reading past (before) buffers. (bug 392)
-- Ensure clients get ID3v1 data with (unmotivated) mpg123_id3_raw()
only if the parser decided that it is there, not possibly the last 128 bytes of
a seekable stream without ID3v1 tag. (bug 392)
-- Prevent impossible NtoM resampling with too low target rate (like 1 Hz) which
would trgger endless looping. (bug 392)
- libout123:
-- Fix deadlock in buffer mode when combined with (stereo) 24 bit output. Now
also mpg123 --buffer 4096 -e s24 shall actuallly work. Sorry. (bug 392)
-- Abort early on zero/negative rate and channel count in out123_start().
(bug 392)
-- Fix divide by zero in WAV writing by catching channel counts that go zero in the
16 bit WAV header field. (bug 392)
- libsyn123:
-- Explictly reject mismatched format for appending filters with
syn123_setup_filter(), preventing memory errors from that API-violating use.
(bug 392)
-- Harden the dirty resampling interpolator against extreme rates (around 1e18 Hz)
by fixing a sample offset check to not do the exact overflowing addition
that it is supposed to guard against. The fine resampler was … fine. (bug 392)
-- Error out on trying to create a filter of order 0 instead of dividing by zero
later. (bug 392)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sun, 2 Aug 2026 05:22:20 +0000 (05:22 +0000)]
pkgconf: upgrade 3.0.4 -> 3.0.5
Changes from 3.0.4 to 3.0.5:
----------------------------
* Correctness fixes:
- Shell quoting and backslash escapes in pc(5) properties are now consumed
once, after variable substitution, instead of while splitting the property
beforehand. Quoting arriving from a variable is therefore treated like
quoting written inline, --variable reports a value as the .pc file spells
it, and fragments are escaped exactly once when rendered. This supersedes
the 3.0.4 fix, which unescaped whitespace at parse time and so hid the
escaping from consumers such as cmake's FindPkgConfig.
See https://github.com/pkgconf/pkgconf/issues/575 and
https://github.com/pkgconf/pkgconf/issues/579.
- Metadata queries no longer consult Conflicts rules between the modules named
on the command line, as reporting metadata does not combine them into a
build. This covers --license, --license-file, --modversion, --path,
--print-provides, --print-requires, --print-requires-private,
--print-variables, --source and --variable. --cflags, --libs and --exists
are unaffected.
See https://github.com/pkgconf/pkgconf/issues/580.
- ${pc_sysrootdir} is now injected into the path taken by every -isystem and
-idirafter flag in a fragment list, rather than only the first.
- -isystem and -idirafter written joined to their path, as in `-isystem/opt`,
are split into the flag and the path it takes, so that the path is subject
to the same sysroot injection and deduplication as the separated spelling.
- Sysroot injection is decided by reading the fragment's path instead of
remembering whether ${pc_sysrootdir} was expanded, so a path which already
lies under the sysroot never acquires a doubled prefix.
* Performance:
- The package cache and the fragment deduplication index are kept sorted and
searched with bsearch() rather than re-sorted or scanned linearly.
- Variable keys and fragment text are stored with the structures they belong
to, and buffers are rewound and reused rather than reallocated.
- Escaping, fragment rendering and path relocation write into their
destination buffer directly.
Resolving a graph of roughly forty modules is about six times faster than
3.0.4, and a small graph such as gio-2.0 about twice as fast.
* Build and portability fixes:
- Fix the pkgconf-lite build, which failed to link because the dependency list
renderer had come to depend on tracing machinery that pkgconf-lite omits.
- Fix the test runner failing to build on MinGW, where the mkdtemp(3) fallback
was compiled only for MSVC builds.
See https://github.com/pkgconf/pkgconf/issues/582.
- The meson build now defines HAVE_DECL_READLINKAT, so readlinkat(2) is used
where it is available instead of always falling back to readlink(2).
The MinGW and readlinkat fixes are by moi15moi.
* New libpkgconf API additions:
- pkgconf_argv_split_raw: splits a string into an argument vector
* New libpkgconf API additions:
- pkgconf_argv_split_raw: splits a string into an argument vector like
pkgconf_argv_split, but leaves the quoting it reads in place.
- pkgconf_fragment_filter_splice: like pkgconf_fragment_filter, but moves the
matching fragments to the destination list instead of copying them.
- pkgconf_charset_from_spans: compiles a span list into a byte set.
- pkgconf_buffer_escape_charset: escapes a buffer against such a byte set.
- pkgconf_buffer_rewind: empties a buffer while keeping its allocation.
- pkgconf_list_splice: moves the contents of one list onto the end of another.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sun, 2 Aug 2026 05:52:45 +0000 (05:52 +0000)]
libpsl: upgrade 0.23.0 -> 0.23.1
Source: NEWS
01.08.2026 Release V0.23.1
* configure: Allow explicitly disabling fuzzing
* configure/meson: Fix reproducible builds (regression introduced in V0.23.0)
* psl-make-dafsa: embed only the basename of the input file
* meson: also rename cdata to _cdata in docs/libpsl/meson.build
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sun, 2 Aug 2026 05:49:27 +0000 (05:49 +0000)]
libmicrohttpd: upgrade 1.0.8 -> 1.0.9
Source: ChangeLog
Thu Jul 30 05:32:00 PM CEST 2026
Enfocing a minimal size on the PSK.
Fix support for red zones in memorypool.
Fix rare over-writing of HTTP version string with network data
after parsing header.
Fix rare crash from adding connection manually followed by
immediate daemon shutdown.
Releasing GNU libmicrohttpd 1.0.9. -CG
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sat, 1 Aug 2026 05:28:57 +0000 (05:28 +0000)]
ttyrun: upgrade 2.43.0 -> 2.44.0
Source: CHANGELOG.md
* __v2.44.0 (2026-07-31)__
For Linux kernel version: 7.2
Changes of existing tools / libraries:
- create-sehdr: Enable quantum safe keys usage
- dbginfo.sh: Let zpcimon log both optical module and SMART data
- libutil/util_fmt: Add util_fmt_type_to_name()
- nvmemon: Skip SCLP on NVMes with non-IBM subsystem vendor ID
- opticsmon: zpcimon: Rename opticsmon to zpcimon
- pvattest: Enable quantum safe keys usage
- pvimg: Add '--flags <...>' and '--disable-flags <...>' option
- pvimg: Enable quantum safe keys usage
- pvsecret: Enable quantum safe keys usage
- pvverify: Enable quantum safe keys usage
- zmemtopo: Add CLI option to filter partitions by name
- zpcimon: Allow setting output format using --format CLI option
- zpcimon: Monitor for hotplug of NVMes to trigger SMART collection
Bug Fixes:
- opticsmon: Fix wrong size check for OPTICS_QSFP28_LOS_IMPLEMENTED_OFFSET
- opticsmon: Handle error return of ethtool_nl_connect()
- opticsmon: Fix error path free of struct optics in ethtool_nl_get_optics()
- opticsmon: Close epoll fd in monitor_wait_loop()
- opticsmon: Fix wrong JSON print for tx_fault
* __v2.43.1 (2026-07-22)__
For Linux kernel version: 7.1
Changes of existing tools:
- dasdfmt: Check disk type before prompting for blocksize
- iucvterm/ts-shell: Introduce config parameter to specify iucvconn binary
- iucvterm/ts-shell: Introduce pager config to replace env variable
- pv: Add root CA organization pinning to certificate verification
- zdump/ngdump: Use OpenSSL's SHA256 to compute digest of dump image
Bug Fixes:
- 95sel-ebc: Add udev-settle dependency
- 95sel-ebc: Add umount to boot service
- 95sel-ebc: Harden boot mount service
- fdasd: Fix memory leak in yes_no() function
- iucvterm/iucvtty: Ensure PTY and server fd's are closed at exec
- iucvterm/iucvtty: Prevent connection stalls when receiving TERM env
- iucvterm/iucvtty: Validate TERM environment name
- libkmipclient: Protect from symlink-following attacks
- libkmipclient: Various bugfixes
- libseckey: Protect from symlink-following attacks
- libseckey: Various bugfixes
- mon_procd: Fix possible static buffer overflow
- osasnmpd: Fix SNMP non-compliance
- zdev: Harden against invalid udev, import, firmware, or hypervisor data
- zipl-editenv: Check in-bootmap environment block validity
- zipl/boot: Check in-bootmap environment block syntax
- zipl: Check keyword duplications in BLS entries
- zipl: Fix bugs in mirror support
- zkey: Protect from symlink-following attacks
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sat, 1 Aug 2026 06:02:39 +0000 (06:02 +0000)]
spirv-llvm-translator: upgrade 22.1.2 -> 22.1.5
27afcfe3 [Backport to 22] Read old SPV_INTEL_float4 type for StochasticRound*ToE2M1INTEL (#3926) 699789f4 [Backport to 22] Fix OpGroupNonUniformRotateKHR mangling (#3863) (#3905) f167fe94 [Backport to 22] Add missing coverage for SPV_EXT_long_vector (#3889) f172a708 [Backport to 22] Add 2 opcodes back from old SPV_INTEL_fp_conversions spec (#3880) 08310a8e [Backport to 22] Represent FP4 E2M1 with SPV_EXT_ocp_microscaling_types (#3867) 64fa6b0a [Backport to 22] Keep VectorAnyINTEL for VectorCompute modules with SPV_EXT_long_vector (#3829) 36e45764 [Backport to 22] Use SPV_EXT_long_vector extension for non-standard vector size (#3777) e123849a [Backport to 22] Implement SPV_INTEL_subgroup_scaled_matrix_multiply_accumulate (#3831) c88a2e4a [Backport to 22] Support SPV_INTEL_rounded_div_sqrt extension (#3770) 6c3fc37e [Backport to 22] Preventing generating FPRoundingMode for arithmetic constrained intrinsics (#3771) 9c688012 [Backport to 22] Update SPV_INTEL_fp_conversions to the latest spec revision (#3782) 521e409d [Backport to 22] Support `SaturatedToLargestFloat8NormalConversionEXT` decoration (#3767) 1d5546f5 [Backport to 22] [SPIRV->LLVM] Fix missing spir_func CC on builtin FP4/i4 conversion calls (#3746) e10ca9b4 [LLVM 22] Add workaround to translate casts from target ext types to int (Originally: #3476) (#3684) beefc64b [Backport to llvm_release_220] Remove internal values for SPV_INTEL_predicated_io (#3723)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sat, 1 Aug 2026 05:43:24 +0000 (05:43 +0000)]
msmtp: upgrade 1.8.32 -> 1.8.34
* Bump version to 1.8.34
* Update translations
* Update NEWS
* Update gettext.h from current gettext
* msmtpq: fix loop condition in make_id()
* msmtpq: fix compatibility with older bash
* Fix: msmtpd can leak zombie session children and eventually stop accepting connections
* Fix base64 build on FreeBSD
* Bump version to 1.8.33
* Bump year in --version output
* Add curl-based connection test to use when ping-style prohibited
* Update gettext files
* Fix heap buffer overflow in RCPT TO command buffer growth
* Add curl-based connection test to use when ping-style prohibited
* msmtpd: fix infinite loop in smtp_pipe on premature client disconnect
* msmtpd: fix read_smtp_cmd out-of-bounds access when len=0
* Protect against overflow in string_replace()
* Fix a potential overflow or NULL pointer dereference on systems lacking strndup()
* Update base64 from current gnulib
* Protect against buffer overflow with very large input strings
* Fix a potential error-mishandling on systems lacking vasprintf()
* Fix typo in man page
* Fix typo in msmtp.texi
* msmtpd: allow NOOP and RSET commands at certain points in the session
* Fix minor type
* Update notification checks for DBUS session address
* Adds connection test option q to force msmtpq to queue
* msmtpq: Add uuid, simplify anti-collision logic
* msmtpq: explicitly enumerate globs
* msmtpq: move up err() defn (SC complained)
* msmtpq: Add config knobs (esp rc location)
* express failed sending attempt more clearly
* msmtpq: robust notify, stderr, nc timeout, path/typo fix
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sat, 1 Aug 2026 05:48:53 +0000 (05:48 +0000)]
harfbuzz: upgrade 14.2.1 -> 14.3.0
Source: NEWS
Overview of changes leading to 14.3.0
Friday, July 31, 2026
=====================================
- Changes affecting shaping output:
* Lookup order is now respected for mark positioning in the cross-direction
(y in horizontal text, x in vertical text): marks no longer follow a
cross-direction shift that a later lookup applies to the base. This
improves compatibility with DirectWrite and Core Text.
* Fix mark attachment to ligatures formed from decomposed glyphs.
* The `calt` feature in Hangul text is now disabled only for the Jamos,
not the whole buffer.
- Support for partially instancing version of `avar` table, as well as `CFF2`
table.
- New fill-glyph paint operation and APIs for the common case of filling a
glyph with a solid color.
- New API to fetch assorted raw values from the `OS/2`, `head`, and `post`
tables.
- New experimental API to extract a font’s glyph dependency graph, that
applications can use to compute glyph closures themselves without running the
subsetter.
- New subset flag to convert the charset of a subsetted CID-keyed `CFF` fonts
into identity charset, and a matching `hb-subset` option. Useful for
embedding fonts in PDF.
- Command-line utilities now handle non-ASCII arguments correctly on Windows.
- Various instancing and subsetting fixes.
- Various fixes to the experimental `harfbuzz-vector`, `harfbuzz-raster` and
`harfbuzz-gpu` libraries.
- Various improvements to the HarfRust integration shaper.
- Various build, CI, portability, and fuzzing fixes.
This version made no changes to documented features or interfaces. Some implementation
updates were made to support ecosystem changes and/or fix regressions.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Overview of changes in GLib 2.88.3, 2026-07-29
==============================================
* Fix potential miscompilation with GCC 17 with G_GNUC_CONST on get_type()
functions (#3984, work by Sam James)
* Bugs fixed:
- #3984 G_GNUC_CONST vs get_type comes home to roost (Sam James)
- #3985 (CVE-2026-15588) Security report: GDBusServer pre-authentication DoS
via unbounded SASL line buffering (Philip Withnall)
- !5225 Backport !5223 "Drop G_GNUC_CONST for *_get_type" to glib-2-88
- !5241 Backport !5240 "gdbusauth: Limit length of lines read from client" to
glib-2-88
- !5242 Backport !5238 "gpoll: Correctly zero-out heap-allocated fd_sets on
macOS" to glib-2-88
- !5243 gdbusauth: Unmark a new string as translatable
- !5259 Backport !5248, !5249: several Meson/gcc fixes to glib-2-88
CVE-2026-58016 patches refreshed due to context changes in the new
version. The patch content is unchanged, only line offsets updated.
Backport fix for buildpaths QA error from upstream !5259: use the .in
template as input for the installed service file.
[https://gitlab.gnome.org/GNOME/glib/-/commit/ed5956d]
Richard Purdie [Thu, 30 Jul 2026 05:44:55 +0000 (05:44 +0000)]
nghttp2: upgrade 1.69.0 -> 1.70.0
Pulls in:
Require C++23 in #2688
Adopt Designated initializers part1 in #2689
Adopt Designated initializers part2 in #2690
Adopt Designated initializers part3 in #2691
tests: Make const values static const in #2692
src: Rewrite util::split_str and its variants in #2693
src: Adopt std::string::resize_and_overwrite in #2694
src: Pass std::chrono::{time_point,duration} by value in #2695
Bump mruby to 4.0.0 in #2696
src: Fix warning "space between quotes and suffix is deprecated in C++23" in #2697
lib, tests: Use C-style comment in #2698
src: Avoid std::chrono::high_resolution_clock in #2699
src: Add noexcept to user-defined literals in #2700
src: Replace std::optional with std::expected in #2701
src/util: Adopt std::expected for error handling in #2702
get_socket_error: Return errno of getsockopt if it fails in #2703
src: Use util::stream_error in #2704
src: Get rid of std::stringstream in #2705
src: Modernize Header and HeaderRef in #2707
src/http2: Adopt std::expected in #2708
src/tls: Adopt std::expected in #2709
nghttpx: Adopt std::expected for Connection read/write in #2710
Nghttpx dconn expected in #2711
Nghttpx downstream expected in #2712
Nghttpx http2session expected in #2713
Nghttpx upstream expected in #2714
Nghttpx clienthandler expected in #2715
Nghttpx httpdownstreamconnection expected in #2716
Nghttpx expected in #2717
Nghttpx http2upstream expected in #2718
Nghttpx http3upstream expected in #2719
Nghttpx mruby expected in #2720
Nghttpx quic expected in #2721
nghttpx: Adopt std::expected for QUICConnectionHandler in #2722
Nghttpx tls expected in #2723
nghttpx: Rewrite time_t_from_asn1_time with ASN1_TIME_diff for boringssl in #2724
Nghttpx livecheck expected in #2725
Nghttpx dns expected in #2726
Nghttpx memcached expected in #2727
Nghttpx misc expected in #2728
Nghttpx worker expected in #2729
Nghttpx connhandler expected in #2730
nghttpx: Pass WorkerEvent without explicit std::move in #2731
nghttpx: Adopt std::expected for worker_process_event_loop in #2732
nghttpx: Adopt std::expected for parse_config in #2733
Nghttpx config expected in #2734
Src fixup in #2735
nghttpx: Adopt std::expected for main routines in #2736
H2load expected in #2737
nghttp: Adopt std::expected in #2738
nghttpd: Adopt std::expected in #2739
HtmlParser: Adopt std::expected in #2740
src: Adopt size_t literal suffix in #2742
nghttp: put pseudo headers before normal headers in #2741
h2load: Replace std::cerr with std::print in #2744
h2load: Replace std::cout with std::print in #2745
nghttpx: Migrate to std::print in #2746
Nghttp print in #2747
Nghttpd print in #2748
src: Migrate std::cout to std::print in #2749
src: Simplify as_string_view usage in #2750
src: Migrate fprintf to C++ counterparts in #2751
src: Use std::println without argument to print just line separator in #2752
nghttpx: Create CID encryption ctx per worker in #2753
nghttpx: Use std::unique_ptr for quic_keying_materials_ in #2754
Src optimize in #2755
src: Provide faster hash functions for OpenSSL forks in #2756
src: Adopt std::expected for http2::make_websocket_accept_token in #2757
src: NSDMI part1 in #2758
src: Add noexcept to move ctor and assignment operator in #2759
build(deps): bump github.com/quic-go/quic-go from 0.59.0 to 0.59.1 in #2760
build(deps): bump golang.org/x/net from 0.53.0 to 0.54.0 in #2761
src: MSDMI part2 in #2762
Avoid azure ubuntu mirror in #2763
src: MSDMI part3 in #2764
src/allocator: Rewrite concat_string_ref with fold expression in #2765
src: Fix build failure on macos26 in #2766
cmake: Remove CMAKE_CXX_STANDARD 23 that is not needed there in #2767
Fix base64 oob in #2768
Nghttpx upgrade in #2769
Make NGHTTP2_HTTP_FLAG_* macros and make them unsigned in #2770
Define flags as macros in #2771
Make NGHTTP2_EXTPRI_INC_MASK unsigned in #2772
src: Avoid zero-argument std::println in #2773
build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 in #2774
GHA: Add Cygwin build in #2775
Fix docker build in #2776
lib: Rewrite integer decoder in http in #2777
Bump ngtcp2 and its dependencies in #2778
Avoid deprecated ngtcp2 and nghttp3 apis in #2779
net: Use macros for win32 hton*/ntoh* fallbacks in #2780
lib: Add nghttp2_downcase_byte in #2781
Rework HTTP header validation in #2782
Bump sfparse in #2783
helper: Initialize array with designated initializers in #2784
Reformat downcase table in #2785
http: Initialize array with designated initializers in #2786
Upper case hex integer literals in huffman data table in #2787
Upcase hex in #2788
Nghttpx h2 stream write timeout in #2789
bpf, examples, tests: Upper case hex integer literals in #2790
Reformat huffman data table in #2791
nghttpx: Provide frontend and backend stream timeouts in #2794
build(deps): bump github.com/quic-go/quic-go from 0.59.1 to 0.60.0 in #2792
nghttpx: Reformat help message to make it editor friendly in #2796
nghttpx: Drop connection when frontend write rate is too low in #2797
build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 in #2799
build(deps): bump actions/checkout from 6 to 7 in #2800
Bump ngtcp2 and its dependencies in #2802
nghttpx: Drop h3 connection when frontend write rate is too low in #2803
build(deps): bump actions/cache from 5 to 6 in #2804
Gcc 16 in #2805
nghttpx: NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE is not allowed in on_frame_recv_callback in #2806
nghttpx: Rename completeCb_ to complete_cb_ in #2807
nghttpx: Remove unused unordered_set include in #2808
Require nghttp3 >= 1.17.0 in #2810
Add the missing header value check for priority header field in #2813
build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 in #2814
build(deps): bump actions/setup-go from 6 to 7 in #2815
Count CONTINUATIONS per its frame header in #2818
build(deps): bump github.com/quic-go/quic-go from 0.60.0 to 0.61.0 in #2819
Bump ngtcp2 and its dependencies in #2820
Bump neverbleed in #2821
Bump llhttp to v9.4.2 in #2822
nghttpx: Reset quic upstream addr fd to the current path in #2823
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Fri, 31 Jul 2026 05:27:52 +0000 (05:27 +0000)]
python3-markdown: upgrade 3.10.2 -> 3.10.3
* Fix `SetextHeaderProcessor` regex to prevent mixed `=` and `-` chars in setext-style headers (#1606).
* Add AI Policy to Contributing Guide.
* Officially document all included extensions as being in maintenance mode.
* Link the Extension API documentation to the API Reference (#1612).
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Fri, 31 Jul 2026 06:26:43 +0000 (07:26 +0100)]
oeqa/selftest/sstatetests: Work around the removal of i686 uninative
Uninative 5.2 is the first version with no i686 support. The tests comparing different
kinds of sstate are still useful and we really want uninative in those tests too, so
work around the issue by having i686 refer to the last release for the test.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
selftest: uboot: remove duplicated KVM presence test
test_boot_uboot_kvm_to_full_target test, needs a working KVM.
It checked it with the kvm-ok tool but that tool is not documented as a
requirement. Also, the check is also done by runqemu called later in the
test.
Remove it from the test and let runqemu have the responsibility of
checking for KVM.
Note that the KVM check now happens *after* the image build instead of
before it.
Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Thu, 30 Jul 2026 07:12:46 +0000 (08:12 +0100)]
spirv-tools: Upgrade 1.4.350.1 -> 1.4.357.0
v2026.3 2026-07-08
- General
- Support SPV_QCOM_multiple_wait_queues, SPV_KHR_opacity_micromap, and SPV_EXT_ocp_microscaling_types (#6671, #6670, #6772)
- Add ArmExperimentalMLOperations and NonSemantic.Graph.DebugInfo instruction sets (#6692, #6666)
- Fix unbounded memory usage in FriendlyNameMapper (#6763)
- Improved hex-float compilation and float equality testing (#6778, #6783)
- Various build system and dependency updates (Bazel, GN, Protobuf, Abseil)
- Optimizer
- Stability fixes for DeadBranchElimPass, CodeSinkingPass, and OrderBlocks (#6764, #6703, #6676)
- Improved handling of tensor constants, non-semantic instructions, and loop decorations (#6684, #6721, #6719, #6690)
- Add folding rule for extract from copy logical and prevent word limit overflows (#6725, #6722)
- Validator
- Support SPV_EXT_ocp_microscaling_types, SPV_EXT_split_barrier, and SPV_ARM_graph (#6779, #6732, #6694)
- Support for SPV_NV_cooperative_matrix_decode_vector and Intel extensions (#6693, #6717, #6665)
- Enhanced error reporting with source line printing and Shader Debug Info (#6648, #6698, #6691, #6686, #6685, #6681)
- Correctness fixes for ray queries, descriptors, OpSpecConstantOp, and array validation (#6710, #6729, #6731, #6777, #6709)
- Disallow duplicate targets for OpGroupDecorate and multiple graph entry points (#6720, #6754)
- Assembler/Disassembler
- Support for SPV_QCOM_image_processing3 (#6776)
- Performance and correctness improvements in the disassembler and tools (#6757, #6650)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Wed, 29 Jul 2026 06:21:51 +0000 (06:21 +0000)]
vulkan-headers: upgrade 1.4.350.1 -> 1.4.357.0
e3b1eec Update for Vulkan-Docs 1.4.357 8d6039a Update for Vulkan-Docs 1.4.356 8c26833 Change to dual license on static Vulkan headers d2d8ded Add new C header 6433e5c Update for Vulkan-Docs 1.4.355 0307c70 build(deps): bump actions/checkout from 6 to 7 01393c3 Update for Vulkan-Docs 1.4.354 45834b7 Update for Vulkan-Docs 1.4.353 015e25c Update for Vulkan-Docs 1.4.352 8cfaaa1 chore: Upgrade reuse to 3.3 0e9de56 Update for Vulkan-Docs 1.4.351 7f233bc Fix incorrect header on AI-Assisted Contributions bc927f3 Add AI-Assisted Contributions and CLA section
License-Update: Some headers are now dual license, one is still MIT
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Wed, 29 Jul 2026 06:43:28 +0000 (06:43 +0000)]
vulkan-volk: upgrade 1.4.350.1 -> 1.4.357.0
7768933 Merge pull request #303 from zeux/update/357 11f5a1b Update generated source with the new exclusion rules 1bb1f65 Update extension version filtering mechanism to be more generic 94d905c Update to 1.4.357 3b00554 Merge pull request #302 from zeux/update/356 f5e6b44 Update to 1.4.356 91e0d29 Merge pull request #301 from zeux/update/355 2ad9fb2 Update to 1.4.355 477a354 Merge pull request #300 from zeux/update/354 e2e6d51 Update to 1.4.354 9aa85bf Merge pull request #299 from zeux/update/353 6a8a2d5 Update to 1.4.353 47cddf7 Merge pull request #298 from zeux/update/352 40a3321 Update to 1.4.352 916c68b Merge pull request #297 from zeux/update/351 44a84ca Update to 1.4.351
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Wed, 29 Jul 2026 06:14:19 +0000 (06:14 +0000)]
glslang: upgrade 1.4.350.1 -> 1.4.357.0
* Add support for GL_EXT_opacity_micromap_ray_query_mode
* Implement `GLSL_EXT_structured_descriptor_heap` with SPIR-V layout generation, heap offset access, buffer references, matrix layout decorations, and correct `readonly`/`writeonly` qualifier propagation for buffer and image descriptors
* Fix descriptor heap-bound buffer access to use typed pointers
* Omit `NonUniform` decoration when using descriptor heaps, as the SPIR-V spec does not require it
* Add `--relax-set-binding-limits` option to allow large `layout(set)` and `layout(binding)` values for descriptor heap-style workflows with sparse set spaces
* Reject combined image samplers with `descriptor_heap`
* Fix `GL_KHR_compute_shader_derivatives` regressions on shaders using the `GL_NV` variant
* Update compute shader derivative rules to allow texture operations with implicit derivatives without extensions, falling back to LoD 0
* Implement `GL_EXT_ocp_microscaling_types`
* Implement `GL_NV_cooperative_matrix_decode_vector`
* Add basic support for `GL_NV_desktop_lowp_mediump`
* Implement `GL_EXT_opacity_micromap_ray_query_mode`
* Fix generated decoration string from `UTF8EncodingKHR` to `UTFEncodingKHR`
* Fix missing SPIR-V extension emission for `float16` derivative functions with `SPV_AMD_gpu_shader_half_float`
* Apply `NoContraction` decoration to `dot()` when `noContraction` is set
* Fix `OpStore` of buffer device address pointer to use 8-byte alignment, consistent with loads
* Fix `RayTracingOpacityMicromapKHR` capability emission to only occur when `gl_RayFlagsForceOpacityMicromap2StateEXT` is actually used, fixing SPIR-V validation failures in ray query shaders outside ray-tracing pipeline stages
* Fix `setInvertY()` to apply Y-inversion to GLSL vertex, geometry, and tessellation-evaluation shaders (previously only affected HLSL)
* Fix `.length()` on arrays of long/cooperative vectors to use `OpArrayLength` instead of a constant component count
* Fix unnecessary cooperative matrix conversions when creating arrays of KHR cooperative matrices
* Add error for cooperative matrix `*=` with bf16/fp8 scalar operands
* Fix out-of-bounds access in `elseSeen` at maximum `#if`/`#ifdef` nesting depth
* Fix out-of-bounds read on empty struct texture template types
* Fix crash in `layoutObjectCheck` when accessing members of an empty block
* Emit an error when HLSL [numthreads] is given more than three arguments instead of crashing the compiler.
* Emit error when attempting to convert a literal string to an incompatible type
* Fix `abortKHR` to preserve the original user-defined string without modification
* Fix out-of-bounds indexing in `TDefaultIoResolverBase::addStage` when a negative `EShLanguage` value is passed
* Add `--discard-is-terminate` option to emit `OpTerminateInvocation` instead of `OpDemoteToHelperInvocation` for GLSL `discard` when tar
[Changelog truncated]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
oeqa/selftest/devtool: cover srcrev update mode guessing for gitsm://
Add test_devtool_update_recipe_gitsm: devtool modify the
git-submodule-test recipe, move the source tree to the parent of the
pinned revision (an upstream commit, no local changes) while staying on
the devtool branch, sync the submodules to it with 'git submodule
update', run 'devtool update-recipe' in the default auto mode, and
assert the recipe's SRCREV is updated to the checked-out revision.
Without the preceding fix the mode guesser cannot see gitsm:// URIs,
falls into patch mode, reports "No patches or files need updating" and
leaves the recipe untouched, and this test fails with:
The 'git submodule update' step matters: the pinned revision of
git-submodule-test happens to bump a gitlink, so after checking out its
parent the submodule no longer matches the revision the parent records,
and the guesser deliberately stays in patch mode for such trees.
The other direction of the guess — local commits inside a submodule
must keep patch mode, because they leave the parent HEAD on the
upstream branch while a srcrev update would silently drop them — is
already covered by the vulkan-samples based test_devtool_git_submodules,
which is what caught exactly that regression in v1 of this series on
the autobuilder, so no test is added for it.
No existing test exercises the auto->srcrev guess for any URI scheme:
the auto-mode arm of test_devtool_update_recipe_git covers the
local-commits->patch direction only.
AI-Generated: Uses Claude (claude-sonnet-5) Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
devtool: standard: guess srcrev update mode for gitsm:// recipes too
'devtool update-recipe' and 'devtool finish' default to guessing the
recipe update mode: 'srcrev' when the source tree HEAD sits on the
upstream branch (the "checked out another upstream revision" workflow),
'patch' otherwise. The guesser matches SRC_URI entries against a
literal 'git://' prefix, so a gitsm:// recipe never has any git URIs
from its point of view and always falls into patch mode.
In that case there are no local commits to export either, so checking
out a different upstream revision and running update-recipe reports
"No patches or files need updating" and silently leaves the recipe's
SRCREV untouched, while the same operation on a git:// recipe updates
SRCREV. Forcing -m srcrev works, since _update_recipe_srcrev() is
scheme-agnostic; only the guess is broken.
Accept gitsm:// URIs the same way e7076f1742 ("devtool: gitsm://
should be handled same as git:// in upgrades") did for the upgrade
path, where the same omission was fixed; the guesser itself dates from 9b9733b7d7 (2015), before gitsm handling was a consideration.
Unlike git://, a gitsm:// tree can carry exportable changes that do
not move the parent HEAD off the upstream branch: local commits in a
submodule only show up as an out-of-sync gitlink in the parent.
Guessing srcrev there would silently drop them, because
_update_recipe_srcrev() only rewrites the parent SRCREV — this is
exactly the scenario test_devtool_git_submodules exercises (commit
inside a submodule, then devtool finish), which caught v1 of this
patch on the autobuilder. So only guess srcrev when every submodule
checkout matches the revision its parent records: any '+' (checkout
differs) or 'U' (merge conflicts) entry in 'git submodule status
--recursive' output keeps the current patch mode. This also covers a
tree where another parent revision was checked out without a
following 'git submodule update': srcrev must never be guessed when
it could lose submodule content, and a fully synced tree is the only
state where it provably cannot.
Note this changes the guessed mode for existing gitsm:// recipes from
'patch' to 'srcrev' when HEAD is on the upstream branch and the
submodules are in sync — the behavior git:// recipes have had since
2015. Trees carrying local commits still guess 'patch', because their
HEAD is not reachable from the upstream branch.
AI-Generated: Uses Claude (claude-sonnet-5) Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Igor Opaniuk [Fri, 24 Jul 2026 13:15:37 +0000 (15:15 +0200)]
libzip: import recipe from meta-oe
Recent versions of the qdl tool [1], used for flashing and provisioning
Qualcomm-based boards, depend on libzip in order to flash images
directly from zip-compressed flat builds without unpacking them: the
device requests individual images on demand (in Sahara/Firehose
device-driven order), which requires random access to archive members
by name. Neither zlib (byte-stream compression only, no container
format support) nor libarchive (streaming, sequential access only)
covers this use case.
qdl recipes are provided by the Qualcomm BSP layer (e.g. meta-qcom [2])
and board flashing is core BSP functionality. Recipes from other layers
also depend on libzip (libsigrok, idevicerestore and php in meta-oe,
localsearch in meta-gnome), so it makes sense to move libzip to
OE-Core in order to reduce inter-layer dependencies, following the
example of commit 1a0196a794 ("libconfig: import recipe from meta-oe").
Changes between meta-oe and this recipe:
- Added SUMMARY, BUGTRACKER and SECTION
- Fixed the tools and examples PACKAGECONFIGs to use the actual
BUILD_TOOLS and BUILD_EXAMPLES CMake options (ENABLE_TOOLS and
ENABLE_EXAMPLES do not exist and were silently ignored)
- Fixed the tests PACKAGECONFIG to use BUILD_REGRESS consistently
- Dropped the mbedtls PACKAGECONFIG, as mbedtls is not in OE-Core
- Extended BBCLASSEXTEND with nativesdk
Richard Purdie [Wed, 29 Jul 2026 05:59:09 +0000 (05:59 +0000)]
python3-vcs-versioning: upgrade 2.2.2 -> 2.2.3
- Fix `ValueError` when parsing `.git_archival.txt` of a tagged commit whose tag
contains more than one dash (e.g. `llvmorg-23.1.0-rc2`) - the `git describe`
suffix is now matched precisely instead of splitting on the last two dashes.
([#1481](https://github.com/pypa/setuptools-scm/issues/1481))
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Wed, 29 Jul 2026 07:24:20 +0000 (07:24 +0000)]
libmicrohttpd: upgrade 1.0.6 -> 1.0.8
Source: ChangeLog
Tue Jul 28 06:12:03 PM CEST 2026
Fixing additional vulnerabilities inspired by reviewing the
code for similar issues like the ones reported by A. Ramos;
expand the test suite to cover these and other issues.
Releasing GNU libmicrohttpd 1.0.8. -CG
Mon Jul 27 06:12:03 PM CEST 2026
Fixing various vulnerabilities reported by A. Ramos resulting
in possible crashes or out-of-bounds stack writes for certain
requests in specific configurations.
Releasing GNU libmicrohttpd 1.0.7. -CG
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Markus Volk [Sat, 25 Jul 2026 08:46:07 +0000 (10:46 +0200)]
appstream: update 1.1.3 -> 1.1.5
- add wayland dependency to fix:
| Run-time dependency wayland-client found: NO (tried pkg-config and cmake)
|
| ../sources/AppStream-1.1.5/meson.build:210:25: ERROR: Dependency "wayland-client" not found (tried pkg-config and cmake)
- add it conditionally to allow builds without wayland
Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
projects / thirdparty / openembedded / openembedded-core.git / log
