Brings following fixes: a255c1ed36a1 [WebAssembly] Avoid crash in LateEHPrepare with empty cleanup pads (#200322) a2b779045093 [SystemZ] Fix off-by-one error in backend (#200141) 2615295c15ba [libc++] Fix multi{map,set}::extract not returning the first matching element (#199703) a760d7c07024 [LLD] [COFF] Fix handling of immediates in ARM64_SECREL_HIGH12A (#200060) 294ae8d1e62a [PowerPC] Drop invalid range metadata when lowering i64 load to fp in INT_TO_FP (#198705) 6db0725886bb [X86] lowerV64I8Shuffle - avoid lowerShuffleAsRepeatedMaskAndLanePermute call on VBMI targets (#183109) c43c9b426055 [X86] lowerV64I8Shuffle - prefer VPERMV3 byte shuffles to OR(PSHUFB,PSHUFB) on VBMI targets (#182852) 6ac68778a76e [X86] Add test coverage for #137422 (#182832) ad9524f38657 [PowerPC] Fix i128 vcmpequb optimization for loads with range metadata and small constants (#196801) 48967cc1a0d4 build: adjust LLDB and clang library naming on Windows (#185084) 8798085803f1 [libc] Demote compiler check error to a warning (#198033) 6e5effc4990b [LoongArch] Revert "Add patterns to support vector type average instructions generation" (#198306) 4d5dffb59420 [ELF] Initialize Symbol fields in the constructor instead of via memset (#198129) 823afe046164 Reland [C++20] [Modules] Don't profiling the callee of CXXFoldExpr (#190732) (#195983) e624f1204282 [CoroSplit] Never collect allocas used by catchpad into frame (#186728) 81c69e140401 Bump version to 22.1.7
Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
rust-target-config:
limit llvm-floatabi to ARM targets
Generate `llvm-floatabi` only for ARM/ARMv7 targets and set the
corresponding Rust target ABI (`eabi` or `eabihf`) according to
`TARGET_FPU`.
`llvm-floatabi` is an ARM-specific LLVM setting (Rust currently
uses it only for ARM targets) and should not be emitted for
other architectures.
https://github.com/rust-lang/rust/blob/main/compiler/rustc_target/src/spec/mod.rs#L2619
Following upstream Rust changes that tightened validation of
target ABI fields, ARM targets must provide an explicit ABI in
addition to the float ABI configuration. Match the ABI settings
used by Rust's built-in ARM target specifications when
generating target JSON files.
Upstream-Reference:
https://github.com/rust-lang/rust/commit/40ebcc031da647d6a76deaf05c471b7a1d4aa228
("Rename target.abi to target.cfg_abi and enum-ify llvm_abiname")
Drop merged patches:
0001-Update-call-llvm-intrinsics-test.patch
0001-Fix-multiple-option-or-permutations-test-for-big-end.patch
Updated patch:
rust-oe-selftest.patch
New patch:
0003-explicit-tail-calls-disable-two-tests.patch
Backport two commits that disable two failing tests on LoongArch.
Selftest Changes:
Ignore one failing test for arm
tests/ui/c-variadic/same-program-multiple-abis-arm.rs
The test is marked ignore-thumb and contains ARM-mode assembly (stmib sp, {r2, r3}).
Our target enables +thumb-mode by default, causing LLVM to assemble the naked_asm!
block in Thumb state, where the instruction is invalid. The resulting failure is due
to ARM-vs-Thumb assembly mode, not the c-variadic ABI behavior being tested. Therefore
the test is not applicable to our target configuration.
Ignore one failing test for riscv64
tests/assembly-llvm/riscv-redundant-memory-stores.rs
https://github.com/rust-lang/rust/issues/157074
Excluded tests:
+--------+----------+---------+
| Before | After | Skipped |
+---------+---------+---------+
| 39 | 41 | +2 |
+--------+----------+---------+
Ross Burton [Thu, 14 May 2026 13:37:47 +0000 (14:37 +0100)]
avahi: upgrade 0.8 -> 0.9-rc4
As per upstream[1], 0.9-rc4 is pretty much what is going to be in the
0.9 release, and upgrading to this now will make upgrading to the final
release a lot simplier.
As there are no tarballs for the release candidates, switch to git. This
means we need to disable the manpages as they need xmltoman to build.
Delete all of the backported CVE patches as they're included in this
release. The cvelistv5 database has version information on all of these
CVEs, so they don't reappear in reports.
Delete invalid-service.patch, fixed upstream differently in [2].
Upstream has deleted the in-tree init scripts, so copy them from before
deletion and add alongside the recipe.
Consolidate the systemd options, and depend on libsystemd as avahi links
to that instead of duplicating the code.
Pass --runstatedir so that /run is used as expected.
[1] https://github.com/avahi/avahi/issues/503#issuecomment-4443016376
[2] avahi 93b1436 ("core: no longer supply bogus services to callbacks")
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Wed, 3 Jun 2026 17:27:34 +0000 (18:27 +0100)]
ppp: Remove PD license
The code referred to as having a "public domain" license (chat) has a
MIT SPDX license indentifier and matching license text. We can therefore
drop the PD license field entry.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Joshua Watt [Mon, 1 Jun 2026 18:11:38 +0000 (12:11 -0600)]
glib-2.0: Change from Public Domain to Gnome GCR Documentation License
The file docs/reference/COPYING is an exact match for the text of the
Gnome GCR Documentation License (SPDX ID GCR-docs), so use that license
instead of Public Domain. This licenses actually requires that the
copyright notice be preserved, unlike Public Domain, so its likely that
using Public Domain is actually an error due to a misreading of the
license text.
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Joshua Watt [Mon, 1 Jun 2026 18:11:36 +0000 (12:11 -0600)]
mobile-broadband-provider-info: Fix license to be CC-PDDC
Careful reading of the license text reveals that it is actually the
exact wording of the Creative Commons Public Domain Dedication and
Certification license, which has the SPDX identifier CC-PDDC
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Pratik Farkase [Thu, 21 May 2026 07:49:10 +0000 (09:49 +0200)]
libxslt: add ptest support
Add ptest support for libxslt, running the upstream runtest binary which
validates XSLT transformations across REC conformance, general, encoding,
documents, numbers, keys, namespaces, extensions, reports, and EXSLT
function tests.
Tested on qemux86-64 with ptest-runner: 748 tests, 0 errors (9s).
Pratik Farkase [Thu, 21 May 2026 08:15:05 +0000 (10:15 +0200)]
libatomic-ops: add ptest support
Add ptest support for libatomic-ops, running the upstream test suite
which validates atomic operations, generalized emulation, pthread-based
fallbacks, lock-free stack, and memory allocation.
Tested on qemux86-64 with ptest-runner: 5 PASS, 0 FAIL.
Chen Qi [Mon, 18 May 2026 05:55:52 +0000 (13:55 +0800)]
recipeutils: add optional stable_upgrade parameter to get_recipe_upgrade_status
We want the ability to do stable version upgrades for recipes.
To this end, add an optional stable_upgrade parameter to the
get_recipe_upgrade_status function, which defaults to False and
when enabled will try to get the latest stable version of the recipe.
The UPSTREAM_STABLE_RELEASE_REGEX is respected. If a recipe sets
it, it will be used as the filter_regex. If it's not set explicitly,
it means that there's no stable updates or the recipe hasn't been
checked yet.
Daniel Turull [Mon, 25 May 2026 08:01:05 +0000 (10:01 +0200)]
devtool: upgrade: extract changelog between versions
Automatically extract changelog information when upgrading a recipe.
Uses the devtool-base tags created during upgrade to diff known
changelog files (NEWS, ChangeLog, CHANGES, etc.) between the old and
new versions. For git-based sources, falls back to git log --oneline
if no changelog file changed.
Prioritize per-version release notes files containing the new version
number (e.g. v2.42.1-ReleaseNotes, changelog-9.20.23.rst) over generic
changelog files. When multiple per-version files match, all are included.
For standard changelog files, picks the one with the most new content.
Resolve RST .. include:: directives by searching the source tree for
the included file by basename. Strip RST comment blocks (copyright
headers) from .rst files.
Collapse runs of multiple blank lines and strip leading/trailing
whitespace for cleaner output suitable for commit messages.
Output is written to workspace/changelogs/<pn>.txt and cleaned up on
devtool reset. This allows AUH and other tools to pick up the changelog
without implementing their own extraction logic.
Add test cases for existing test recipes.
Tested with AUH with changelog support (See yocto-patches)
master 2026-05-22:
commits in https://git.openembedded.org/openembedded-core-contrib/log/?h=dturull/devtool-changelog-test-master
- Total recipes attempted: 239
- With meaningful changelog: 191 (80%)
- Without changelog: 48 (20%)
Recipes without changelogs:
- acpica: devtool upgrade failed
- autoconf: devtool upgrade failed
- busybox: devtool upgrade failed
- cargo-c: devtool upgrade failed
- debugedit: devtool upgrade failed
- diffoscope: only PKG-INFO changed
- gcc-source-15.2.0: devtool upgrade failed
- gdb, gdb-cross-x86_64, gdb-cross-canadian-x86-64: devtool upgrade failed
- go-cross-x86-64-v3: devtool upgrade failed
- groff: devtool upgrade failed
- gtk-doc: devtool upgrade failed
- icu: no changelog files in source
- iproute2: no changelog files in source
- libcap: no changelog files in source
- libdrm: no changelog files in source
- libmpc: devtool upgrade failed
- libpciaccess: no changelog files in source
- librsvg: devtool upgrade failed
- linux-firmware: binary blobs, no changelog in tarball
- llvm-project-source: devtool upgrade failed
- nfs-utils: no changelog file changed
- python3-certifi: only CA bundle + PKG-INFO changed
- python3-dtschema: no changelog in PyPI sdist
- python3-editables: no changelog in PyPI sdist
- python3-hypothesis: no changelog in PyPI sdist
- python3-jsonpointer: no changelog in PyPI sdist
- python3-maturin: devtool upgrade failed
- python3-pdm-backend: no changelog in PyPI sdist
- python3-poetry-core: no changelog in PyPI sdist
- python3-pytz: only timezone data changed
- python3-shacl2code: no changelog in PyPI sdist
- python3-spdx-python-model: devtool upgrade failed
- python3-sphinxcontrib-svg2pdfconverter: no changelog in PyPI sdist
- python3-trove-classifiers: only classifiers list changed
- python3-uv-build: devtool upgrade failed
- python3-wcwidth: only unicode tables changed
- python3-xmltodict: no changelog in PyPI sdist
- rpm-sequoia: devtool upgrade failed
- spirv-llvm-translator: devtool upgrade failed
- sqlite3: amalgamation tarball, no changelog
- time: devtool upgrade failed
- vte: devtool upgrade failed
- wayland: devtool upgrade failed
- wayland-protocols: no changelog files in source
- wireless-regdb: no changelog files in source
- xwayland: no changelog in tarball
AI-generated: kiro with claude-opus-4.6 model Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Mingli Yu [Mon, 1 Jun 2026 01:58:45 +0000 (09:58 +0800)]
valgrind: Upgrade 3.27.0 -> 3.27.1
This release contains only bug fixes and thhe following bugs have
been fixed or resolved in this release.
519574 valgrind 3.27 "--fair-sched=yes" does not work
519613 Valgrind incorrectly unpacks the result of sys_port (port_getn)
on error, leading to a ~60s wallclock time delay on every call
n-i-bz Update vg-lifespan (copyright) years
n-i-bz Use SSizeT for VG_(readlink) result in VG_(realpath)
To see details of a given bug, visit
https://bugs.kde.org/show_bug.cgi?id=XXXXXX
where XXXXXX is the bug number as listed above.
Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tim Orling [Sun, 31 May 2026 20:09:44 +0000 (13:09 -0700)]
python3-packaging: upgrade 26.0 -> 26.2
* Add python3-hypothesis to ptest REDEPENDS
26.2 - 2026-04-24
Fixes:
* Fix incorrect sysconfig var name for pyemscripten in (PR #1160)
* Make Version, Specifier, SpecifierSet, Tag, Marker, and Requirement
pickle-safe and backward-compatible with pickles created in 25.0-26.1
(including references to the removed packaging._structures module)
(PR #1163, PR #1168, PR #1170, PR #1171)
* Re-export ExceptionGroup in metatadata for now in (PR #1164)
26.1 - 2026-04-14
Fixes:
* Fix > comparison for versions with dev+local segments in (PR #1097)
* Fix incorrect self-comparison for InfinityType and NegativeInfinityType
in (PR #1093)
* Canonicalize when deduplicating specifiers in SpecifierSet in
(PR #1109)
* Fix charset error message formatting in (PR #1121)
* Handle the key parameter in SpecifierSet.filter when specifiers are
empty and prerelease is False in (PR #1096)
* Standardize inner components of repr output in (PR #1090)
* Specifier’s === uses original string, not normalized, when available
in (PR #1124)
* Propagate int-max-str-digits ValueError in (PR #1155)
For additional changes, see [1].
For full comparison, see [2].
Tan Siewert [Wed, 27 May 2026 11:06:20 +0000 (13:06 +0200)]
tune-cortexa9: add tunes without VFP enabled
VFP is optional on armv7a and almost always included, however the HPE
GXP SoC omits it. This SoC is used on HPE ProLiant server motherboards
as the out-of-band management controller (iLO).
Signed-off-by: Tan Siewert <tan.siewert@9elements.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Jesse Van Gavere [Wed, 27 May 2026 08:31:30 +0000 (10:31 +0200)]
rust: export CARGO_BUILD_TARGET
To cross compile a rust project with the SDK one currently has to know
the associated target sys and run cargo build with it, by setting
CARGO_BUILD_TARGET to the rust target sys, running cargo build after
sourcing the SDK will immediately have the correct target.
See https://doc.rust-lang.org/cargo/reference/config.html#buildtarget
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com> Signed-off-by: Jesse Van Gavere <jesse.vangavere@teledyne.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Trevor Gamblin [Fri, 29 May 2026 14:46:52 +0000 (10:46 -0400)]
python3: use SKIPPED_TESTS instead of test skip patches
Drop all 13 patches carried for skipping various known ptest failures
and replace them with usage of the SKIPPED_TESTS variable, which we have
started doing in recent commits (e.g. 40b0815dc9). Most but not all of
the test skips are due to load variability, distinguish between them by
using multiple SKIPPED_TESTS:append blocks with comments taken from the
patch files indicating their purpose. This adds 62 lines to the Python 3
recipe, but it also means that we no longer have to maintain the patch
files across version upgrades, where they often break due to changes in
the test modules upstream.
Results look the same as those from my last upgrade run:
Jörg Sommer [Sun, 31 May 2026 16:04:59 +0000 (18:04 +0200)]
python3-idna: Upgrade 3.13 -> 3.17
* 3.17 (2026-05-28)
- Substantial 75% reduction in memory usage through new data
structures and some optimization in processing speed.
- Added a general 1024-character input length cap to the public
validation, conversion, and codec entry points. This is well above
any legitimate domain or label and guards against pathological
inputs.
* 3.16 (2026-05-22)
- Add a command-line interface (`python -m idna`, also available as
the `idna` script). Encodes or decodes one or more domains supplied
as arguments or on standard input, with options to select A-label
or U-label output and control error handling.
- Raise the minimum supported Python version to 3.9
- Various code quality improvements
* 3.15 (2026-05-12)
- Enforce DNS-length cap on individual labels early in `check_label`,
short-circuiting contextual-rule processing for oversized input
while staying compatible with UTS 46 usage.
- Tidy core helpers: hoist bidi category sets to module-level
frozensets (avoiding per-codepoint list construction), simplify
length checks, and reuse the shared `_unicode_dots_re` from
`idna.core` in the codec module.
- Use `raise ... from err` for proper exception chaining and
switch internal string formatting to f-strings.
- Allow `flit_core` 4.x in the build backend.
- Expand the ruff lint set (flake8-bugbear, flake8-simplify,
pyupgrade, perflint) and apply the surfaced fixes; pin lint CI
to Python 3.14.
- Add Dependabot configuration for GitHub Actions.
- Convert README and HISTORY from reStructuredText to Markdown.
- Reference CVE-2026-45409 for the 3.14 advisory in place of the
initial GHSA identifier.
Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for
contributions to this release.
* 3.14 (2026-05-10)
- Removed opportunity to process long inputs into quadratic
time by rejecting oversize inputs up-front. Closes a bypass
of the CVE-2024-3651 mitigation. [CVE-2026-45409]
Thanks to Stan Ulbrych for reporting the issue.
Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tim Orling [Sun, 31 May 2026 00:17:55 +0000 (17:17 -0700)]
python3-wcwidth: upgrade 0.6.0 -> 0.7.0
Changes [1]:
* New support for kitty text sizing protocol (OSC 66) in width() and
clip().
* New clip() parameter control_codes='parse', 'ignore', and 'strict'.
clip() is now able to clip OSC 8 hyperlinks and OSC 66 text sizing
sequences.
* Improved clip() and width() to support horizontal cursor sequences
(cub, cuf, hpa). Cursor-left (cub) or backspace (\b) now overwrites
text. column_address (hpa) and carriage return (\r) are now parsed,
and more values conditionally raise ValueError when
control_codes='strict'.
PR's:
* Remove docs, add utils by @jquast in #209
* Bump requests from 2.32.5 to 2.33.0 in /docs by @dependabot[bot] in
#210
* Bump pygments from 2.19.2 to 2.20.0 in /docs by @dependabot[bot] in
#212
* dependabot nonsense by @jquast in #215
* Expand terminal escape sequence for three more ECMA-48 "families" by
@jquast in #214
* Improve clip() and width() with hyperlinks and overtyping by @jquast
in #216
* Improve width() and clip() with kitty Text Sizing Protocol by @jquast
in #213
Tim Orling [Sun, 31 May 2026 00:17:54 +0000 (17:17 -0700)]
python3-snowballstemmer: upgrade 3.0.1 -> 3.1.0
git shortlog:
Dmitry Shachnev (5):
python: Drop Python 2 support, require Python ≥ 3.3
python: Simplify code after dropping Python 2 support
python: Add a minimal pyproject.toml file
Stop excluding classifiers for Armenian and Yiddish
stemwords.py: Replace deprecated codecs.open() with built-in open()
Henry Schreiner (1):
Protect empty languages dict
Olly Betts (11):
python: Fix algorithms() when wrapping PyStemmer
python: Reduce overhead of forwarding to PyStemmer
stemwords.py: Make -i and -o optional
Python: Optimise string test
Avoid unnecessary cursor update in among helpers
Python: Change slice_check() to assert conditions
Python: Remove parentheses from assert
Update slice end after `delete` and `<-`
Python: Remove deprecated licence classifier
stemwords.py: Remove now-unused `import codecs`
Update for 3.1.0
Tim Orling [Sun, 31 May 2026 00:17:53 +0000 (17:17 -0700)]
python3-rpds-py: upgrade 0.30.0 -> 2026.5.1
git shortlog (ignoring merge, dependabot and pre-commit-ci commits):
Edgar RamÃrez Mondragón (1):
Update to PyO3 0.28.0
Julian Berman (10):
Update pre-commit hooks.
Use regular gh CLI for release notes.
Run zizmor in pedantic mode and address findings.
Drop support for 3.10. Add 3.15.
Use cargo-release for releases, without the chore: prefix on commit messages.
Run each nox session in its own job with a single Python installed.
Reserve Mach-O header padding on macOS so install_name_tool can relocate.
Bump url-py to a version that supports Python 3.15.
Regenerate uv.lock without user-config artifacts.
Release rpds-py version 2026.5.1
Tim Orling [Sun, 31 May 2026 00:17:52 +0000 (17:17 -0700)]
python3-pytz: upgrade 2026.1 -> 2026.2
git shortlog:
Fullchee Zhang (1):
fix typo
Shaun Walbridge (1):
try to access resource using `importlib.resources`
Stuart Bishop (6):
Bump version number to 2026.1.post1
Update test runners for new Pythons and github actions
Squashed 'tz/' changes from dd6be6d155..8be0d5483d
IANA 2026b
Bump version numbers to 2026.2 (IANA 2026b)
Bump github actions/checkout to @v6
Stub (2):
Try to access resource using `importlib.resources`
Fix typo in README
Tim Orling [Sun, 31 May 2026 00:17:48 +0000 (17:17 -0700)]
at-spi2-core: upgrade 2.60.3 -> 2.60.4
What's new in at-spi2-core 2.60.4 [1]:
* AtspiDeviceA11yManager: Make use of pid when returned by queryPointer
* Fix deregistering application-specific event listeners
* Drop 0001-bump-uv_build-to-0.11.0.patch; change is included in upgrade.
* Refresh python3-crytpography-crates.inc
48.0.0 - 2026-05-04 [1]
* BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been removed.
cryptography now requires Python 3.9 or later.
* BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
TBSCertList.signature algorithm does not match the outer
signatureAlgorithm now raises ValueError. Previously, such CRLs
were parsed successfully and only rejected during signature validation.
* Added support for ML-KEM key encapsulation and ML-DSA signing when
using OpenSSL 3.5.0 or later, in addition to the existing AWS-LC and
BoringSSL support. This means post-quantum algorithms are now available
to users of our wheels.
- Note: Going forward, we do not guarantee that all functionality in
cryptography will be available when building against OpenSSL. See
The State of OpenSSL for pyca/cryptography for more information.
47.0.0 - 2026-04-24 [2]
* Support for Python 3.8 is deprecated and will be removed in the next
cryptography release.
* BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
(SECT* classes) has been removed. These curves are rarely used and
have additional security considerations that make them undesirable.
* BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been removed.
OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and
AWS-LC continue to be supported.
* BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL < 4.1.
* BACKWARDS INCOMPATIBLE: Loading keys with unsupported algorithms or
keys with unsupported explicit curve encodings now raises
UnsupportedAlgorithm instead of ValueError. This change affects
load_pem_private_key(), load_der_private_key(), load_pem_public_key(),
load_der_public_key(), and public_key() when called on certificates
with unsupported public key algorithms.
* BACKWARDS INCOMPATIBLE: When parsing elliptic curve private keys, we
now reject keys that incorrectly encode a private key of the wrong
length because such keys are impossible to process in a constant-time
manner. We do not believe keys with this problem are in wide use,
however we may revert this change based on the feedback we receive.
* Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys to
TripleDES. In a future release, only 192-bit (24-byte) keys will be
accepted. Users should expand shorter keys themselves (e.g., for
single DES: key + key + key, for two-key: key + key[:8]).
Tim Orling [Sat, 30 May 2026 22:42:32 +0000 (15:42 -0700)]
python3-uv-build: upgrade 0.11.14 -> 0.11.17
0.11.17 [1]
Released on 2026-05-28.
Bug fixes
---------
* Improve the performance of large entries in tool.uv.conflicts
(#19538)
* Avoid modifying the parent process' env with --env-file in uv
run (#19567)
* Fix script environment creation for scripts with long filenames
(#19539)
* Fix transitive Git archive dependencies in lockfiles (#19589)
* Preserve Git repository URLs in direct URL metadata (#19590)
* Support redirects in --check-url (#19594)
* Accept case-insensitive HTML tags in --find-links parsing (#19537)
* Reject duplicate script metadata blocks (#19544)
* Ban names like "python3" as script entry points (#19535, #19536)
* Validate Git LFS artifacts for Git archives (#19592)
* Use a relative path when creating symlinks in cache to improve
relocatability (#19033)
See [1] for the rest of 0.11.17 changes.
0.11.16 [2]
Released on 2026-05-21.
Bug fixes
---------
* Allow environment variables that take a list to be empty (#19503)
* Ensure that incompatible wheel hints do not leak secrets (#19504)
* Reject unsafe entry points in uv-build (#19495)
* Restrict delimiters in entry point parsing (#19471)
* uv-netrc: fix multi-word no-space comment lines causing parse errors
(#19494)
See [2] for the rest of 0.11.16 changes.
0.11.15 [3]
Released on 2026-05-18.
Security
--------
* Fix a TAR parser differential, see GHSA-3cv2-h65g-fgmm (#19463)
* Enforce that entry points cannot escape in the scripts directory, see
GHSA-4gg8-gxpx-9rph (#19464)
Bug fixes
---------
* Apply workspace-member [tool.uv.sources] credentials under uv sync
--frozen (#19423)
* Skip empty directories in uv build outputs (#19437)
* Fix Git submodule handling when using relative paths (#12156)
* Fix line number reporting in netrc parsing (#19452)
Tim Orling [Sat, 30 May 2026 22:42:31 +0000 (15:42 -0700)]
python_uv_build: add PEP-517 backend class
uv_build is a slimmed down version of uv containing only the build
backend. See https://pypi.org/project/uv/ and https://docs.astral.sh/uv/
for the main project package and documentation.
python3-cryptography-vectors uses the 'uv_build' backend.
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Peter Tatrai [Fri, 29 May 2026 17:01:17 +0000 (19:01 +0200)]
time64: enable 64-bit time/file-offset flags for 32-bit nativesdk
When SDKMACHINE is set to i686 or i586, nativesdk binaries are compiled
as 32-bit. Without -D_TIME_BITS=64 and -D_FILE_OFFSET_BITS=64, stat()
and time-related syscalls use 32-bit types, causing EOVERFLOW on
filesystems with large inode numbers (e.g. container overlay filesystems)
and Y2038 issues.
Add SDK_CC_ARCH appends for class-nativesdk:i686 and class-nativesdk:i586
using GLIBC_64BIT_TIME_FLAGS, mirroring how target architectures are
handled.
Signed-off-by: Peter Tatrai <peter.tatrai.ext@siemens.com>" Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Mon, 17 Jun 2024 13:42:40 +0000 (13:42 +0000)]
oeqa/core/runner: stub addDuration in OETestResult
We have a custom TestResult implementation, and Python 3.12 added a new
method addDuration() to the TestResult interface. This would be useful
to implement correctly, but for now stub it out to silence the warning
when running under Python 3.12:
/usr/lib64/python3.12/unittest/case.py:580: RuntimeWarning: TestResult has no addDuration method
warnings.warn("TestResult has no addDuration method",
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[NOTE]: 'CONFIG_CRYPTO_CTS' last val (m) and .config val (y) do not match
[INFO]: CONFIG_CRYPTO_CTS : y ## .config: 8103 :configs/v6.18/ktypes/base/base.cfg (y) configs/v6.18/standard/features/qat/qat.cfg (m)
[INFO]: raw config text:
config CRYPTO_CTS
tristate "CTS (Cipher Text Stealing)"
select CRYPTO_SKCIPHER
select CRYPTO_MANAGER
depends on CRYPTO
help
CBC-CS3 variant of CTS (Cipher Text Stealing) (NIST
Addendum to SP800-38A (October 2010))
This mode is required for Kerberos gss mechanism support
for AES encryption.
Config 'CRYPTO_CTS' has the following Direct dependencies (CRYPTO_CTS=y):
CRYPTO(=y)
Parent dependencies are:
CRYPTO [y]
[INFO]: selection details for 'CONFIG_CRYPTO_CTS':
Symbols currently y-selecting this symbol:
- FS_ENCRYPTION_ALGS
Symbols currently n-selecting this symbol (no effect):
- RXGK
- CRYPTO_KRB5
base.cfg pins CRYPTO_CTS=y while features/qat/qat.cfg requests =m.
FS_ENCRYPTION_ALGS=y forces the symbol to =y at .config time, which is
the correct outcome -- QAT consumes CRYPTO_CTS via the in-kernel
crypto API and works against either built-in or modular CTS. Add the
symbol to the y_or_m_enabled.cfg whitelist so the audit no longer
flags this mismatch, matching the existing handling of CRYPTO_CCM
and CRYPTO_GCM.
Signed-off-by: Yogesh Tyagi <yogesh.tyagi@intel.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]
2/2 [
Author: Yogesh Tyagi
Email: yogesh.tyagi@intel.com
Subject: bsp/intel-{x86,common}: drop CONFIG_HIGHMEM64G
Date: Mon, 18 May 2026 22:21:03 +0530
CONFIG_HIGHMEM64G was removed from the kernel in v6.18-rc1 by:
The two intel 32-bit BSP fragments still carry CONFIG_HIGHMEM64G=y,
which against a v6.18 kernel produces:
[INFO]: the following symbols were not found in the active configuration:
- CONFIG_HIGHMEM64G
emitted by do_kernel_configcheck whenever MACHINE selects one of these
BSPs (e.g. MACHINE=intel-core2-32).
The replacement on x86-PAE kernels is the unconditional 64GiB ceiling
that landed alongside the removal commit; no fragment-level opt-in is
required. Drop the obsolete symbol from both fragments. This mirrors
the recent "x86: drop CONFIG_BIG_SMP" cleanup (3260f662) for symbols
upstream removed in the same series.
Signed-off-by: Yogesh Tyagi <yogesh.tyagi@intel.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Niko Mauno [Tue, 26 May 2026 05:59:59 +0000 (05:59 +0000)]
sbom-cve-check-common: Fatalize command failure
Change the bb.error to bb.fatal in order to avoid marking the
'sbom_cve_check' task successful, even when it encounters an error,
like:
sbom-cve-check: error: [Errno 2] No such file or directory: '/build/layers/openembedded-core/build/tmp/deploy/images/qemuarm/.spdx.json'
-NOTE: Tasks Summary: Attempted 5946 tasks of which 5283 didn't need to be rerun and all succeeded.
+NOTE: Tasks Summary: Attempted 5945 tasks of which 5944 didn't need to be rerun and 1 failed.
Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Richard Purdie [Thu, 28 May 2026 10:39:53 +0000 (11:39 +0100)]
xserver-xorg/xwayland: Drop X11-swapped from LICENSE
The licenses are all X11, not X11-swapped so this can be dropped, was a mistake
on my part with the original analysis from some tooling that got confused.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Wei Zhang [Tue, 26 May 2026 08:30:48 +0000 (01:30 -0700)]
wpa_supplicant: Handle invalid op_class 255 in BSS Transition candidates
Some APs provide invalid operating class (e.g. 255) in BSS Transition
Management Requests. Fall back to deriving the band from the channel
number.
Without this workaround, invalid op_class values may trigger unnecessary
full scans and degrade roaming behavior with non-compliant APs.
Standard-compliant cases remain unchanged.
Mark Jonas [Mon, 25 May 2026 13:42:28 +0000 (15:42 +0200)]
libsdl2: Fix compilation error with DirectFB
Compiling libsdl2 with DirectFB as renderer results in a compilation
error. Patch libsdl2 so DirectFB_CreateRenderer() uses the current
SDL_RenderDriver API.
Signed-off-by: Mark Jonas <toertel@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Each time a mock is called, Python reads the call_count, adds 1,
and writes it back. When multiple threads do this simultaneously,
some increments get lost because two threads can read the same
value before either writes back.
The fix adds a lock around this operation in ThreadingMock so
only one thread can update call_count at a time.
Reproduction and testing:
- x86 stress test (50 threads x 10000 calls x 30 runs):
Before fix: 23/30 failures, missing up to 42095 calls
After fix: 0/30 failures
- qemuarm64 (10 threads x 100 calls x 20 runs):
Before fix: 3/20 failures, missing up to 49 calls
After fix: 0/20 failures
- All 19 existing ThreadingMock tests pass
Upstream fix merged into CPython main:
https://github.com/python/cpython/pull/150176
Fixes [YOCTO #16213]
Signed-off-by: Sai Sneha <saisneha196@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Fri, 22 May 2026 16:04:51 +0000 (17:04 +0100)]
classes/gtk-icon-cache: fix libdir passed to the postrm intercept
Back in 2015[1] I fixed the libdir passed to the postinst intercept, but
I forgot to also update the postrm intercept. This should also be
libdir_native, not libdir.
[ YOCTO #13896 ]
[1] oe-core 0fe8400717 ("gtk-icon-cache: pass the native libdir to the intercept")
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Jate Sujjavanich [Fri, 22 May 2026 01:37:14 +0000 (21:37 -0400)]
udev-extraconf: use -H for unmount tmpfile find
Add -H option to find of automount files in /tmp to allow find to
follow /tmp if it is a symlink to a volatile file system. This option
also avoids following any links within /tmp.
Otherwise the find for the automount tmp file does not work which
prevents the removal of the automount directory. Then subsequent
auto-mounts fail.
Robert Yang [Thu, 21 May 2026 07:46:46 +0000 (00:46 -0700)]
nfs-utils: 2.8.7 -> 2.9.1
* Add libnl to DEPENDS to fix:
configure: error: Package requirements (libnl-3.0 >= 3.1) were not met:
* Add 0001-fh_key_file.c-Fix-build-error-for-musl.patch to fix build with musl:
error: implicit declaration of function 'strerror'
Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Sunil Dora [Wed, 20 May 2026 17:30:02 +0000 (10:30 -0700)]
gdb: Upgrade 17.1 -> 17.2
GDB 17.2 brings the following fixes and enhancements over GDB 17.1:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=blob_plain;f=gdb/NEWS;hb=gdb-17.2-release
* PR dap/33228 ([gdb/dap] error while listing register children)
* PR gdb/33737 (gdb --help says 'For more information, type "stream"
from within GDB', but "stream" is not a defined command)
* PR build/33747 (Incompatible with MUSL libc: no member named 'c_ospeed'
in 'termios')
* PR gdb/33748 (gdb17 regression with displaying ANSI colors)
* PR gdb/33753 (Out-of-bounds writes in string_{v}printf -- threads
and static data don't mix)
* PR cli/33761 (Setting style colors is broken on MS-Windows)
* PR gdb/33768 (Loading compressed GDB scripts from .debug_gdb_scripts fails)
* PR symtab/33775 ([gdb/symtab] data race in
dwarf2_per_cu::{set_addr_size,set_offset_size,set_ref_addr_size})
* PR symtab/33777 ([gdb/symtab] dw2_get_file_names doesn't cache result
for dummy CU)
* PR symtab/33825 ([dwz] Extremely slow symbol lookup with DWZ-compressed
debug info (thousands of partial units))
* PR testsuite/33845 (gdb: There are 4 unexpected failures in
breakpoint-in-ro-region.exp)
* PR gdb/33872 (`skip -gfile` has inverted logic)
* PR gdb/33926 (GDB 17.1 AArch64: redefinition of user_gcs struct on musl)
* PR breakpoints/34112 (rbreak `file:regex` sets breakpoints for matches
outside of `file` [reproducer attached])
Drop patches merged upstream:
* 0009-PR-gdb-33747-gdb-ser-unix-modernize-Linux-custom-bau.patch
* 0010-GDB-aarch64-linux-Fix-build-failure-on-musl-systems.patch
Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Wed, 20 May 2026 11:41:10 +0000 (12:41 +0100)]
linux-yocto: remove CVE exclusion list, sbom-cve-check does this itself
This generate-cve-exclusions.py script parses the kernel CVE metadata
in the vulns repository and generates CVE_STATUS statements to mark CVEs
that are fixed in that kernel release.
However, this is no longer needed as sbom-cve-check uses the MITRE
cvelistV5 repository as a data source which in turn is fed by vulns.git,
and the NVD database has prioritised the kernel for enrichment so also
has the same metadata attached.
Initially one CVE had incorrect data in the NVD, but this was resolved
on the same day when contacting NIST.
I've verified that at the time of writing (2026-05-20) the generated
SPDX is smaller by almost 20MB, but the reported CVE list is unchanged.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Harish Sadineni [Wed, 20 May 2026 10:01:37 +0000 (03:01 -0700)]
perf: disable BUILD_BPF_SKEL by default
Enabling the Rust in-kernel feature pulls in clang-native as a
dependency for the kernel build. During the perf build, the presence of clang
causes all BUILD_BPF_SKEL dependency checks to succeed, which makes perf attempt
to build bpftool as part of its build process and make build to fail.
Previously, When Rust support was not enabled, BUILD_BPF_SKEL is set 0 due to missing
clang dependency.
The perf recipe does not currently provide/support the required
bpftool build environment, resulting in build failures such as:
Error:
| make[3]: *** ../bpf/bpftool: No such file or directory. Stop.
As a workaround currently disabling BUILD_BPF_SKEL by default to make perf to build.
libc-test: limit libatomic-staticdev ptest dependency to GCC
clang does not require libatomic-staticdev for the libc-test
static tests. Restrict the dependency addition to GCC toolchain
using the toolchain-gcc override.
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
GCC 16 introduced -flink-libatomic which automatically injects
-latomic_asneeded into link commands via LINK_LIBATOMIC_SPEC.
When glibc is built with a GCC 16 cross-compiler, the compiler
would attempt to link against libatomic which does not exist yet
at this stage.(libatomic is built later as part of gcc-runtime)
gcc: i386: fix ICE with -ffloat-store and SSE [PR125308]
Backport upstream commit c96589414eeb0e46d9fe9cc1d562e048230b5f67
to fix an ICE on i386 seen while building piglit with GCC 16.
The failure happens during the IRA pass in extract_insn() when
handling UNSPEC_IEEE_MAX patterns generated with -ffloat-store
and SSE enabled.
gcc-runtime: avoid passing MULTIBUILDTOP to libatomic
libatomic constructs gcc_objdir using `pwd` and assumes
MULTIBUILDTOP is relative. Passing an absolute MULTIBUILDTOP
from OE results in malformed paths during libtool install
operations in both compile and install stages.
Avoid passing MULTIBUILDTOP for libatomic and use the upstream
default handling instead.
GCC 16 generates libatomic_asneeded.so and libatomic_asneeded.a
during the build as part of the fix for unnecessary DT_NEEDED
entries on libatomic in GCC runtime libraries (PR libstdc++/123396).
Add them to avoid unpackaged files QA errors.
gcc-runtime: disable automatic libatomic linking during build
GCC 16 introduced -flink-libatomic which automatically injects
-latomic_asneeded into link commands via LINK_LIBATOMIC_SPEC.
During gcc-runtime do_compile, OE uses a pre-built GCC 16
cross-compiler to build target runtime libraries before libatomic
itself is ready.
extrauser.bbclass: Switch from using --root to --prefix
This corresponds to commit a7b846ba7d6d63a5e59939d75d9c5fe3e4cbb0e9,
which updated useradd.bbclass to use the --prefix option instead of the
--root option when specifying the destination directory.
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
useradd_base.bbclass: Emulate the groupmems command using usermod
The groupmems command does to support the --prefix option, which is
being used since commit a7b846ba7d6d63a5e59939d75d9c5fe3e4cbb0e9.
However, the groupmems command can easily be emulated using the usermod
command.
[YOCTO#16277]
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The groupmems command will be removed in shadow 4.20. The same
functionality as provided by groupmems can be achieved with the usermod
command. Add support for USERMOD_PARAM variables to specify the options
to use.
The following GROUPMEMS_PARAM:
GROUPMEMS_PARAM:${PN} = "--add user --group group1; \
--add user --group group2"
would be directly converted to the following USERMOD_PARAM:
Add USERMOD_PARAM to PACKAGEVARS similarly to the USERADD_PARAM and
GROUPADD_PARAM variables.
[YOCTO#16277]
Co-authored-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
useradd.bbclass: Some clean-ups and simplifications
* Improve some odd function names, e.g., groupmemsadd_sysroot and
user_group_groupmems_add_sysroot. These were introduced in commit 322ef726132a47d977d2c6ee41de5358f1e85994 (useradd.bbclass: Fix order
of postinst-useradd-*).
* Make common_useradd_sysroot() look for the actually used command
instead of always looking for useradd.
* Simplification of common_useradd_sysroot() by using case/esac.
* A bit of whitespace clean-up.
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ricardo Salveti [Wed, 20 May 2026 00:21:52 +0000 (21:21 -0300)]
u-boot: move DT validation yaml removal patch to SRC_URI
Commit 5e97f3c1e2cf ("u-boot-tools: drop yaml in DT validation") added the
backport through SRC_URI_RISCV, so only RISC-V u-boot builds picked it up.
This issue is because the v1 of the patch was merged instead the v2 (which
is also not fully correct as it is not patching u-boot-tools). Drop the
patch from SRC_URI_RISCV and add it directly to both u-boot_2026.04.bb and
u-boot-tools_2026.04.bb, so it is applied to both recipes without
affecting external recipes including u-boot-common.inc.
Fixes: 5e97f3c1e2cf ("u-boot-tools: drop yaml in DT validation") Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Thu, 21 May 2026 13:50:39 +0000 (14:50 +0100)]
xserver-xorg/xwayland: 'Clarify' xserver license
The Xserver license, https://gitlab.freedesktop.org/xorg/xserver/-/blob/main/COPYING
is a bit of a challenge to decode. Whilst overall thought to be MIT, there
are many other simlar/related licences included in there.
The make our license data more accurate, update to include all the license
variants present.
I have submitted a patch upstream to add identifiers to the COPYING file to
make it clearer where these come from and save others from repeating this painful
exercise:
Upgrade the firmware package to latest release. Add compute package
for shikra. Add packages ${PN}-ath12k-{ipq5424, qcc2072} for ath12k
based chips. Add Texas Instruments PCM6240 firmware, firmware for
tas2783A projects, firmware for Lontium LT7911EXC and LT9611C. Move
lt*_fw.bin firmware to Lontium subdir. Add HP ISH firmware for Intel
Panther Lake systems. Add RDEPENDS on ${PN}-qcom-license for Dell
XPS13 packages as qcom/NOTICE.txt is applicable to those firmwares.
Ross Burton [Tue, 19 May 2026 14:15:07 +0000 (15:15 +0100)]
groff: build less in groff-native
When building groff-native we only really need enough of groff to build
manpages, and don't need documentation or extra tools.
Patch the Makefile to stop building the doc and contrib directories,
which both take time and have incomplete build dependencies that cause
intermittent failures[1][2].
And some tools are removed, which I don't believe are needed by anything
we build:
/usr/bin/chem was removed
/usr/bin/eqn2graph was removed
/usr/bin/gdiffmk was removed
/usr/bin/gperl was removed
/usr/bin/gpinyin was removed
/usr/bin/mmroff was removed
/usr/bin/pic2graph was removed
/usr/share/groff/1.24.1/tmac/chem.pic was removed
/usr/share/groff/1.24.1/tmac/hdmisc.tmac was removed
/usr/share/groff/1.24.1/tmac/hdtbl.tmac was removed
/usr/share/groff/1.24.1/tmac/mm was removed
/usr/share/groff/1.24.1/tmac/mm/0.MT was removed
/usr/share/groff/1.24.1/tmac/mm/4.MT was removed
/usr/share/groff/1.24.1/tmac/mm/5.MT was removed
/usr/share/groff/1.24.1/tmac/mm/ms.cov was removed
/usr/share/groff/1.24.1/tmac/mm/se_ms.cov was removed
/usr/share/groff/1.24.1/tmac/mmse.tmac was removed
/usr/share/groff/1.24.1/tmac/mm.tmac was removed
/usr/share/groff/1.24.1/tmac/mom.tmac was removed
/usr/share/groff/1.24.1/tmac/mse.tmac was removed
/usr/share/groff/1.24.1/tmac/m.tmac was removed
/usr/share/groff/1.24.1/tmac/om.tmac was removed
/usr/share/groff/1.24.1/tmac/refer-mm.tmac was removed
/usr/share/groff/1.24.1/tmac/rfc1345.tmac was removed
/usr/share/groff/1.24.1/tmac/sboxes.tmac was removed
Package libcaf static libraries installed by GCC 16 to
avoid installed-vs-shipped QA errors.
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libc-test: add libatomic-staticdev to ptest RDEPENDS
GCC 16 adds libatomic_asneeded.a which is required when statically
linking. The libc-test static tests fail on musl without it. Add
libatomic-staticdev alongside musl-staticdev for the same reason.
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>