glib: Update to version 2.88.0

- Update from version 2.87.0 to 2.88.0
- Update of rootfile
- 3 CVE fixes in 2.87.3
- 3 CVE fixes in 2.87.1
- Changelog
    2.88.0
	* Bugs fixed:
	  - !5097 gslice: Factor out a size helper macro and stop using MAX in a public
	    header
    2.87.5
	* Brown paper bag release to attempt to fix the dist-job in CI; this caused it
	  to be impossible to build a release archive for 2.87.4
	* Bugs fixed:
	  - !5096 ci: Force a git clone and update the index when running dist-job
    2.87.4
	* Avoid installing broken symlinks as part of the test data for the gdatetime
	  tests (!5054, work by Alessandro Astone)
	* Fix `g_file_set_contents()` with non-ASCII filenames on Windows (#3873, work
	  by Lukas K.)
	* Bugs fixed:
	  - #3688 Documentation issue with g_slice_new and g_slice_new0 (Philip
	    Withnall)
	  - #3730 Unclear assertion failure message when `G_PARAM_CONSTRUCT` and
	    `G_PARAM_CONSTRUCT_ONLY` are both specified (depuc8)
	  - #3814 vs2019-arm64 CI fails with ninja error (Philip Withnall)
	  - #3873 g_file_set_contents broken on windows for non-ASCII filenames
	  - #3885 Documentation of g_file_info_get_is_backup() doesn’t define what a
	    backup file is (depuc8)
	  - #3897 GLocalFileInfo's set_symlink() is backwards (Philip Withnall)
	  - #3905 Memory leak in g_desktop_app_info_launch_uris_with_spawn (correctmost)
	  - !5030 gsocketconnection: Set an error when closed if no address is cached
	  - !5037 minor doc fixes
	  - !5047 i18n: Update and correction for Occitan
	  - !5048 ci: Install gi-docgen in the Fedora CI image
	  - !5049 Update Serbian translation
	  - !5050 Update Swedish translation
	  - !5051 Update French translation
	  - !5052 Update Bulgarian translation
	  - !5053 Update Romanian translation
	  - !5054 tests: Create unix_localtime root directory structure at runtime
	  - !5055 Update Chinese (China) translation
	  - !5056 Update Japanese translation
	  - !5057 Update Korean translation
	  - !5058 Update Georgian translation
	  - !5059 Update Ukrainian translation
	  - !5060 Update Lithuanian translation
	  - !5061 Update French translation
	  - !5062 Update Hungarian translation
	  - !5064 Update Portuguese translation
	  - !5065 Update Nepali translation
	  - !5066 i18n: Update for Occitan
	  - !5068 Update Turkish translation
	  - !5069 Update Brazilian Portuguese translation
	  - !5070 Update Galician translation
	  - !5071 Update Kazakh translation
	  - !5075 Update Polish translation
	  - !5076 Update Catalan translation
	  - !5077 Update Slovenian translation
	  - !5078 gio-tool-launch: Fix a filename leak
	  - !5080 Update Catalan translation
	  - !5081 Update Danish translation
	  - !5082 Update Polish translation
	  - !5084 Update British English translation
	  - !5085 Update Georgian translation
	  - !5087 Update Nepali translation
	  - !5088 tests: Fix a minor memory leak in the socket test
	  - !5089 ci: Drop workaround for GitLab submodule checkout bug
	  - !5090 Prevent iptosmessage test failures on FreeBSD and Hurd
	  - !5091 gobject: Disable new construct property check with G_DISABLE_CHECKS
	* Translation updates:
	  - Bulgarian (Alexander Alexandrov Shopov)
	  - Catalan (Victor Dargallo, Jordi Mas)
	  - Chinese (China) (luming zh)
	  - Danish (Ask Hjorth Larsen)
	  - English (United Kingdom) (Bruce Cowan)
	  - French (Guillaume Bernard)
	  - Galician (Francisco Diéguez Souto)
	  - Georgian (Ekaterine Papava)
	  - Hungarian (Balázs Úr)
	  - Japanese (Makoto Sakaguchi)
	  - Kazakh (Baurzhan Muftakhidinov)
	  - Korean (Changwoo Ryu)
	  - Lithuanian (Aurimas Aurimas Černius)
	  - Nepali (Pawan Chitrakar)
	  - Occitan (post 1500) (Mejans)
	  - Polish (Victoria)
	  - Portuguese (Hugo Carvalho)
	  - Portuguese (Brazil) (Rafael Fontenelle)
	  - Romanian (Antonio Marin)
	  - Serbian (Miloš Popović)
	  - Slovenian (Martin)
	  - Swedish (Anders Jonsson)
	  - Turkish (Emin Tufan Çetin)
	  - Ukrainian (Yuri Chornoivan)
    2.87.3
	* Improved support for `GNotification` on Windows (#3867, #3869, work by
	  Oscar Pernia Moreno)
	* Fix module lookups via `GModule` on Cygwin (#3741, work by Ailin Nemui)
	* Fix local timezone lookup with nested symlinks in `/etc/localtime` (#3816,
	  work by Alessandro Astone)
	* Fix ordering and sequential consistency of gatomic memory barriers on MSVC
	  and fallback GCC code paths (#3829, #3852, work by Luca Bacci)
	* Fix various integer overflow bugs (#3870, #3871, #3872, CVE-2026-1484,
	  CVE-2026-1485, CVE-2026-1489, work by Marco Trevisan)
	* Add `GSocketControlMessage` subclasses for receiving `IP_TOS` and
	  `IPV6_TCLASS` (!4846, work by Jakub Adam)
	* Support polling more than 1024 FDs on macOS (!4953, work by Ihar Hrachyshka)
	* Remove platform-specific backward compatibility from GLib-2.0 as it’s
	  impossible to support (#3839, !4881, work by Marco Trevisan)
	* Improve introspection annotations for delimiters on `g_strsplit_set()` (this
	  may require changes in introspection bindings)
	* Basic support for building and running some functionality on tvOS and watchOS
	  (!4992, work by Nirbheek Chauhan)
	* Add `g_get_monotonic_time()` variant with nanosecond precision (!5004, work
	  by Benjamin Otte)
	* Bugs fixed:
	  - #3628 Add test suite for gdbus tool (Philip Withnall)
	  - #3741 GModule incorrectly searches for cyg....so instead of cyg....dll on
	    Cygwin (Ailin Nemui)
	  - #3816 Local timezone wrongly considered to be UTC if timezone file in
	    /usr/share/zoneinfo is a symlink (Alessandro Astone)
	  - #3829 [RFC] gatomic: Memory barriers should be reversed (Luca Bacci)
	  - #3839 Broken Unix/Win32 specific GIRs
	  - #3852 MSVC and GCC-fallback atomics are not sequentially consistent (Luca
	    Bacci)
	  - #3863 Iterating over a short (preallocated) GVariant bytestring invalidly
	    refs a NULL GBytes (Christian Hergert)
	  - #3865 callable-info/native-address test fails on big endian (Alessandro
	    Astone)
	  - #3867 win32: Notifications without body won't show up
	  - #3869 gnotification-win32: Re-initialize tray icon if `explorer.exe` got
	    restarted
	  - #3870 (CVE-2026-1484) (YWH-PGM9867-168) Integer Overflow -> Buffer Underflow
	    on Glib through glib/gbase64.c via g_base64_encode_close() leads to OOB
	    Write (Marco Trevisan (Treviño))
	  - #3871 (CVE-2026-1485) (#YWH-PGM9867-169) Buffer underflow on Glib through
	    gio/gcontenttype-fdo.c via parse_header() lead to OOB Read/Write (Marco
	    Trevisan (Treviño))
	  - #3872 (CVE-2026-1489) (#YWH-PGM9867-171) Integer Overflow on Glib through
	    glib/guniprop.c via output_marks() lead to OOB Write in
	    glib/gutf8.c:g_unichar_to_utf8() (Marco Trevisan (Treviño))
	  - #3877 hash test failing randomly on MSYS2 (Luca Bacci)
	  - #3880 Integer overflow in gio-launch-desktop from over-long environment
	    variables (Philip Withnall)
	  - #3881 Integer overflow in g_resource_find_overlay() from over-long
	    environment variables (Philip Withnall)
	  - #3883 Integer overflow in `g_path_get_basename()` when passed an extremely
	    long path (length ≈SSIZE_MAX) (Philip Withnall)
	  - #3886 Crash in gdbus-tool on invalid --method argument format (Philip
	    Withnall)
	  - #3895 date_time_lookup_era unsafely caches `setlocale` pointer (Philip
	    Withnall)
	  - !4846 gio: Add GSocketControlMessage subclasses for receiving IP_TOS and
	    IPV6_TCLASS
	  - !4953 darwin: Support g_poll:maxfd >= FD_SETSIZE
	  - !4957 gstrfuncs: Annotate g_strsplit_set() as taking a byte array of
	    delimiters
	  - !4966 gio-tool-{copy,move}: Fix incorrect transfer rate calculation and
	    improve visualization
	  - !4968 markup: Better error reporting
	  - !4970 gutf8: Clarify docs about negative return values
	  - !4971 gutf8: Use size_t internally for some length calculations
	  - !4976 docs: Fix a typo and specify a codeblock is C
	  - !4977 gobject: Add nullable annotation to g_weak_ref_get return value
	  - !4982 markup: Initialize tag positions
	  - !4985 ci/fedora, glib/casemap: Add tests for the Azerbaijani cases
	  - !4987 giomodule: Simplify macro usage for getting the giomodule dir, don't
	    use it on iOS
	  - !4991 gio/gdatainputstream: Mark bytes as potentially unused
	  - !4992 Disable or stub out fork/execv* usage when targeting tvOS and watchOS
	  - !4993 Windows: Add test-profile
	  - !4996 Fix some small regressions in the iOS build
	  - !4997 meson: Add guesses for compute_int to speed up cross-compile setup
	  - !5002 Update Lithuanian translation
	  - !5004 Add g_get_monotonic_time() variant with nanosecond precision
	  - !5006 gfileutils: Fix a regression in `g_path_get_basename()` for plain
	    files
	  - !5008 Update Swedish translation
	  - !5009 Update Kazakh translation
	  - !5011 Update Romanian translation
	  - !5012 Compilation fixes for CLangCL and older MSVC
	  - !5013 Update Czech translation
	  - !5014 Update Russian translation
	  - !5015 GApplication: make send_notification / withdraw_notification thread-
	    safe
	  - !5018 Update Ukrainian translation
	  - !5020 Update Romanian translation
	  - !5021 Update Lithuanian translation
	  - !5023 Update Greek translation
	  - !5024 Update Chinese (China) translation
	  - !5025 Update Slovenian translation
	  - !5026 Update Brazilian Portuguese translation
	  - !5027 Update Basque translation
	  - !5028 gvalue: Update default terminology to initial
	  - !5029 Update Bulgarian translation
	  - !5031 Update Galician translation
	  - !5032 Update Hungarian translation
	  - !5034 Fix const qualifiers where discarded
	  - !5036 Address more size types issues
	  - !5038 Update Kazakh translation
	  - !5039 Update Catalan translation
	  - !5040 gsettings-tool: Fix leaks when running set commands
	  - !5041 gsettings-tool: Fix leaks when specifying invalid schemas
	  - !5042 Update Spanish translation
	* Translation updates:
	  - Basque (Asier Saratsua Garmendia)
	  - Bulgarian (Alexander Alexandrov Shopov)
	  - Catalan (Victor Dargallo)
	  - Chinese (China) (luming zh)
	  - Czech (Daniel Rusek)
	  - Galician (Fran Diéguez)
	  - Greek, Modern (1453-) (Efstathios Iosifidis)
	  - Hungarian (Balázs Úr)
	  - Kazakh (Baurzhan Muftakhidinov)
	  - Lithuanian (Aurimas Aurimas Černius)
	  - Portuguese (Brazil) (Juliano de Souza Camargo)
	  - Romanian (Antonio Marin)
	  - Russian (Artur S0)
	  - Slovenian (Martin)
	  - Spanish (Daniel Mustieles)
	  - Swedish (Anders Jonsson)
	  - Ukrainian (Yuri Chornoivan)
    2.87.2
	* Add initial support for `GNotification` on Windows (#3857, work by
	  Oscar Pernia Moreno)
	* Bugs fixed:
	  - #3850 g_strsplit_set docs are misleading (Matthias Clasen)
	  - #3857 win32: Add support for notifications using Shell_NotifyIcon API
	  - #3858 glib-compile-resources: Incorrect compiler detection on Windows when
	    building GTK causes a DoS (L. E. Segovia)
	  - #3863 Iterating over a short (preallocated) GVariant bytestring invalidly
	    refs a NULL GBytes (Christian Hergert)
	  - #3864 gir-tracker-bot posting diffs against too-recent-`main` (Marco
	    Trevisan (Treviño))
	  - #3867 win32: Notifications without body won't show up
	  - !4918 gio/unixmounts: use bsearch() to check for set inclusion
	  - !4949 gdesktopappinfo: Fix -Wsign-conversion warnings
	  - !4950 gobject: Fix -Wshorten-64-to-32 warnings and enable warning flag
	  - !4958 gtestutils: Avoid pointless logging string handling in gtestutils
	  - !4959 glib-unix: Implement g_unix_fd_query_path for Cygwin
	  - !4964 gio: Fix some -Wsign-conversion warnings
	  - !4965 gmodule: Enable -Wshorten-64-to-32 warnings for gmodule
	  - !4967 Fixup unicode 17
    2.87.1
	* Several low-risk CVE fixes (#3827, #3834, #3845)
	* Fix return type of `gi_callable_info_get_closure_native_address()` (#3859,
	  work by Philip Chimento)
	* Tweak thread pool handling for `GTask` threads to prevent stalls (#3840, work
	  by Ignazio Pillai)
	* Respect `NO_COLOR` environment variable in log output (!4898, work by
	  Aaron Andersen)
	* Update file system type lists to mark more file system types as system ones
	  and to recognise `ntfs3` file systems (!4916 and #3828, work by
	  Christian Hergert and Alexander Schwinn)
	* Add `G_GNUC_FLAG_ENUM` attribute to mark enums as flags (!4900, work by
	  Philip Chimento)
	* Add a static CRT constructor and fusion manifest XML for GLib utilities on
	  Windows so that `stderr` can be unbuffered and streams are flushed on exit
	  (#3733, work by Luca Bacci)
	* Fix `G_FILE_MONITOR_WATCH_HARD_LINKS` on Windows (#3819, work by Jehan)
	* Bugs fixed:
	  - #74 ignore case and '-' vs '_' differences when maching on enum/flag
	    nick/name (Emmanuel Fleury)
	  - #1181 Test failure: check_expected_events
	  - #3360 msys2-mingw32 CI failure: mingw-w64-i686-gcc and mingw-w64-i686-gcc-
	    objc are in conflict
	  - #3733 gi-compile-repository.py test intermittently fails on Windows with
	    empty stderr (Luca Bacci)
	  - #3818 g_main_context_check with a NULL context crashes (Michiel Jan Laurens
	    de Hoon)
	  - #3819 G_FILE_MONITOR_WATCH_HARD_LINKS flag does not monitor files on Windows
	  - #3827 (CVE-2025-13601) (#YWH-PGM9867-134) Incorrect calculation of buffer
	    size in g_escape_uri_string() (Philip Withnall)
	  - #3828 NTFS not detected by g_file_info_get_attribute_string
	  - #3834 (CVE-2025-14087) (#YWH-PGM9867-145) Buffer underflow on Glib through
	    glib/gvariant via bytestring_parse() or string_parse() leads to OOB Write
	    (Philip Withnall)
	  - #3840 GTask: g_task_run_in_thread never starts pending tasks (Ignazio
	    Pillai)
	  - #3843 glib: Integer overflow in `g_bytes_new_from_bytes()` leads to
	    corrupted `GBytes` object (Philip Withnall)
	  - #3845 (CVE-2025-14512) GIO: Integer overflow in file attribute escaping
	    (Philip Withnall)
	  - #3851 Integer overflow in `g_buffered_input_stream_peek()` leads to
	    segmentation fault (Philip Withnall)
	  - #3859 Return type of gi_callable_info_get_closure_native_address() should be
	    void* (Philip Chimento)
	  - !4883 ci: Do not use anymore only/except deprecated syntax
	  - !4885 ci: Track changes to gir files using artifacts and MRs comments
	  - !4898 glog: respect NO_COLOR environment variable
	  - !4899 genvironment: consider macOS behavior when testing g_getenv
	  - !4900 Add G_GNUC_FLAG_ENUM
	  - !4904 glog: guard NO_COLOR environment variable check with a GOnce for
	    performance reasons
	  - !4907 completion: fix error on nounset mode unknown completions
	  - !4908 glocalfile: Complain if `faccessat` sets an unusual error and use
	    AT_FDCWD
	  - !4909 glocalfile: Fix trash user cancellation not reported on Windows
	  - !4910 ci: Use issue bot native support for $ISSUE_BOT_API_TOKEN_FILE
	  - !4913 gdbusprivate: check length of path to GDBus binary
	  - !4916 gio/gunixmounts: mark some file-system types as system
	  - !4920 tests: Fix static-link test when running installed
	  - !4921 gutf8: Add tests and clarify documentation for g_unichar_to_utf8()
	  - !4922 ci: Enable the gobject-introspection build for the debian-stable-i386
	    job
	  - !4923 Added AIX implementation of g_unix_fd_query_path
	  - !4926 Fix g_strcompress docs (mod 256)
	  - !4928 Update of the Occitan translation
	  - !4930 gio/gunixmounts: Mark more file systems as system internal
	  - !4931 gio/gunixmounts: Replace /bin/efi with /boot/efi
	  - !4937 docs(GResource): Tweak overlays description
	  - !4939 gsocks4aproxy: Fix a buffer leak when finishing connecting
	  - !4941 gsignal: Cleanup handler disconnection avoiding unneeded operations
	  - !4942 gio: Fix a few -Wsign-conversion warnings
	  - !4943 ci: Some fixups on the gir checker
	* Translation updates:
	  - Occitan (post 1500) (Mejans)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/rootfiles/common/glib b/config/rootfiles/common/glib
index cd4ef61dab8d5abcbb4a689bc0a38b432b181cd2..cd96e6f7a0a109ff70f59d74a8eb6f3d1057fde5 100644 (file)
--- a/config/rootfiles/common/glib
+++ b/config/rootfiles/common/glib
@@ -106,6 +106,8 @@ usr/include/glib-2.0/gio/gdebugcontroller.h
 #usr/include/glib-2.0/gio/gioscheduler.h
 #usr/include/glib-2.0/gio/giostream.h
 #usr/include/glib-2.0/gio/giotypes.h
+#usr/include/glib-2.0/gio/giptosmessage.h
+#usr/include/glib-2.0/gio/gipv6tclassmessage.h
 #usr/include/glib-2.0/gio/glistmodel.h
 #usr/include/glib-2.0/gio/gliststore.h
 #usr/include/glib-2.0/gio/gloadableicon.h
@@ -337,22 +339,22 @@ usr/include/glib-2.0/gio/gdebugcontroller.h
 #usr/lib/glib-2.0/include/glibconfig.h
 #usr/lib/libgio-2.0.so
 usr/lib/libgio-2.0.so.0
-usr/lib/libgio-2.0.so.0.8700.0
+usr/lib/libgio-2.0.so.0.8800.0
 #usr/lib/libgirepository-2.0.so
 usr/lib/libgirepository-2.0.so.0
-usr/lib/libgirepository-2.0.so.0.8700.0
+usr/lib/libgirepository-2.0.so.0.8800.0
 #usr/lib/libglib-2.0.so
 usr/lib/libglib-2.0.so.0
-usr/lib/libglib-2.0.so.0.8700.0
+usr/lib/libglib-2.0.so.0.8800.0
 #usr/lib/libgmodule-2.0.so
 usr/lib/libgmodule-2.0.so.0
-usr/lib/libgmodule-2.0.so.0.8700.0
+usr/lib/libgmodule-2.0.so.0.8800.0
 #usr/lib/libgobject-2.0.so
 usr/lib/libgobject-2.0.so.0
-usr/lib/libgobject-2.0.so.0.8700.0
+usr/lib/libgobject-2.0.so.0.8800.0
 #usr/lib/libgthread-2.0.so
 usr/lib/libgthread-2.0.so.0
-usr/lib/libgthread-2.0.so.0.8700.0
+usr/lib/libgthread-2.0.so.0.8800.0
 #usr/lib/pkgconfig/gio-2.0.pc
 #usr/lib/pkgconfig/gio-unix-2.0.pc
 #usr/lib/pkgconfig/girepository-2.0.pc
@@ -375,8 +377,8 @@ usr/lib/libgthread-2.0.so.0.8700.0
 #usr/share/gdb/auto-load
 #usr/share/gdb/auto-load/usr
 #usr/share/gdb/auto-load/usr/lib
-#usr/share/gdb/auto-load/usr/lib/libglib-2.0.so.0.8700.0-gdb.py
-#usr/share/gdb/auto-load/usr/lib/libgobject-2.0.so.0.8700.0-gdb.py
+#usr/share/gdb/auto-load/usr/lib/libglib-2.0.so.0.8800.0-gdb.py
+#usr/share/gdb/auto-load/usr/lib/libgobject-2.0.so.0.8800.0-gdb.py
 #usr/share/gettext/its
 #usr/share/gettext/its/gschema.its
 #usr/share/gettext/its/gschema.loc

diff --git a/lfs/glib b/lfs/glib
index 7459d3bf4492c67135bcb7835919aeafcec8714d..1b6e2269ff7d6fb5795b40dfb2b119fc54262668 100644 (file)
--- a/lfs/glib
+++ b/lfs/glib
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2025  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.87.0
+VER        = 2.88.0
 #          https://download.gnome.org/sources/glib/
 
 THISAPP    = glib-$(VER)
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 799fc394e15c90c357687b681041530d9035af1c1d9ec16eaeb2453f3041e8c2a9d64b3e4e033e186975a3551edb95a4b1605300fa1384d7bf5f6600ce89ac18
+$(DL_FILE)_BLAKE2 = b540e0f5490f85b44cfad5d819f4a6fd911addc26fed8b8b49852bd6ec322d7d16136b691452030cf5f590374ea06cf8fdb8c9109d5cbe7b68625379bbd40615
 
 install : $(TARGET)