mbox

[00/21] Scarthgap pull request

Message ID cover.1785461355.git.anuj.mittal@oss.qualcomm.com
State New
Headers show

Pull-request

https://git.openembedded.org/meta-openembedded-contrib anujm/scarthgap

Message

Anuj Mittal July 31, 2026, 4:21 a.m. UTC 
Please merge these changes in scarthgap. Tested locally and on autobuilder.

https://autobuilder.yoctoproject.org/valkyrie/#/builders/81/builds/1679

The following changes since commit 7eb94107580092f79ff1b639a87762fe6f96aa12:

  nginx: fix CVE-2026-42055 (2026-07-16 15:49:44 +0530)

are available in the Git repository at:

  https://git.openembedded.org/meta-openembedded-contrib anujm/scarthgap
  https://git.openembedded.org/meta-openembedded-contrib/log/?h=anujm/scarthgap

for you to fetch changes up to ef3df29f2cfca6a9513b51ebcdccf82b6c8a836f:

  libdbi-perl: Fix CVE-2026-14740 (2026-07-30 07:53:25 +0530)

----------------------------------------------------------------

Ankur Tyagi (2):
  postfix: upgrade 3.8.17 -> 3.8.19
  haveged: upgrade 1.9.22 -> 1.9.23

Benjamin Robin (Schneider Electric) (1):
  dnsmasq: fix CVE-2026-4890

Darsh Kelaiya (6):
  jq: Fix CVE-2026-43895
  jq: Fix CVE-2026-47770
  jq: Fix CVE-2026-49839
  jq: Fix CVE-2026-54679
  dnsmasq: Fix CVE-2026-12725
  dnsmasq: Fix CVE-2026-12969

Deepak Rathore (1):
  ldns: fix CVE-2026-10846

Hetvi Thakar (5):
  libdbi-perl: Fix CVE-2026-9698
  libdbi-perl: Fix CVE-2026-10879
  libdbi-perl: Fix CVE-2026-14380
  libdbi-perl: Fix CVE-2026-14739
  libdbi-perl: Fix CVE-2026-14740

Joao Marcos Costa (1):
  nginx: backport fixes for CVE-2026-42533

Khem Raj (1):
  apache2: upgrade 2.4.67 -> 2.4.68

Peter Marko (2):
  libwebsockets: patch CVE-2026-10650
  hostapd: set status for CVE-2026-58374

Qliangw (1):
  libuio: fix FILE descriptor leak

Wang Mingyu (1):
  monocypher: upgrade 4.0.2 -> 4.0.3

 .../{postfix_3.8.17.bb => postfix_3.8.19.bb}  |   2 +-
 .../recipes-support/dnsmasq/dnsmasq_2.90.bb   |   3 +
 .../dnsmasq/files/CVE-2026-12725.patch        | 111 +++
 .../dnsmasq/files/CVE-2026-12969.patch        |  54 ++
 .../dnsmasq/files/CVE-2026-4890.patch         |  75 ++
 .../hostapd/hostapd_2.10.bb                   |   2 +
 .../libwebsockets/CVE-2026-10650.patch        |  46 ++
 .../libwebsockets/libwebsockets_4.3.3.bb      |   1 +
 ...onocypher_4.0.2.bb => monocypher_4.0.3.bb} |   2 +-
 .../jq/jq/CVE-2026-43895.patch                | 206 +++++
 .../jq/jq/CVE-2026-47770.patch                | 449 +++++++++++
 .../jq/jq/CVE-2026-49839.patch                |  37 +
 .../jq/jq/CVE-2026-54679.patch                |  74 ++
 meta-oe/recipes-devtools/jq/jq_1.7.1.bb       |   4 +
 .../ldns/ldns/CVE-2026-10846_p1.patch         | 117 +++
 .../ldns/ldns/CVE-2026-10846_p2.patch         | 117 +++
 .../ldns/ldns/CVE-2026-10846_p3.patch         |  34 +
 meta-oe/recipes-devtools/ldns/ldns_1.8.3.bb   |   6 +-
 .../perl/libdbi-perl/CVE-2026-10879.patch     |  34 +
 .../perl/libdbi-perl/CVE-2026-14380_p1.patch  |  37 +
 .../perl/libdbi-perl/CVE-2026-14380_p2.patch  |  65 ++
 .../perl/libdbi-perl/CVE-2026-14380_p3.patch  |  27 +
 .../perl/libdbi-perl/CVE-2026-14380_p4.patch  |  56 ++
 .../perl/libdbi-perl/CVE-2026-14739.patch     | 170 +++++
 .../perl/libdbi-perl/CVE-2026-14740.patch     |  40 +
 .../perl/libdbi-perl/CVE-2026-9698.patch      |  43 ++
 .../perl/libdbi-perl_1.643.bb                 |   9 +
 .../{haveged_1.9.22.bb => haveged_1.9.23.bb}  |   2 +-
 ...ix-fclose-leak-in-uio_line_from_file.patch |  31 +
 .../recipes-extended/libuio/libuio_0.2.1.bb   |   1 +
 .../{apache2_2.4.67.bb => apache2_2.4.68.bb}  |   2 +-
 .../nginx/nginx-1.24.0/CVE-2026-42533-1.patch | 126 ++++
 .../nginx/nginx-1.24.0/CVE-2026-42533-2.patch | 381 ++++++++++
 .../nginx/nginx-1.24.0/CVE-2026-42533-3.patch | 704 ++++++++++++++++++
 .../nginx/nginx-1.24.0/CVE-2026-42533-4.patch | 587 +++++++++++++++
 .../nginx/nginx-1.24.0/CVE-2026-42533-5.patch |  55 ++
 .../recipes-httpd/nginx/nginx_1.24.0.bb       |   5 +
 37 files changed, 3710 insertions(+), 5 deletions(-)
 rename meta-networking/recipes-daemons/postfix/{postfix_3.8.17.bb => postfix_3.8.19.bb} (99%)
 create mode 100644 meta-networking/recipes-support/dnsmasq/files/CVE-2026-12725.patch
 create mode 100644 meta-networking/recipes-support/dnsmasq/files/CVE-2026-12969.patch
 create mode 100644 meta-networking/recipes-support/dnsmasq/files/CVE-2026-4890.patch
 create mode 100644 meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-10650.patch
 rename meta-oe/recipes-crypto/monocypher/{monocypher_4.0.2.bb => monocypher_4.0.3.bb} (85%)
 create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-43895.patch
 create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch
 create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-49839.patch
 create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch
 create mode 100644 meta-oe/recipes-devtools/ldns/ldns/CVE-2026-10846_p1.patch
 create mode 100644 meta-oe/recipes-devtools/ldns/ldns/CVE-2026-10846_p2.patch
 create mode 100644 meta-oe/recipes-devtools/ldns/ldns/CVE-2026-10846_p3.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-10879.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p1.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p2.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p3.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p4.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14739.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14740.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-9698.patch
 rename meta-oe/recipes-extended/haveged/{haveged_1.9.22.bb => haveged_1.9.23.bb} (94%)
 create mode 100644 meta-oe/recipes-extended/libuio/libuio/fix-fclose-leak-in-uio_line_from_file.patch
 rename meta-webserver/recipes-httpd/apache2/{apache2_2.4.67.bb => apache2_2.4.68.bb} (99%)
 create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-42533-1.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-42533-2.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-42533-3.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-42533-4.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-42533-5.patch

Comments

Khem Raj July 31, 2026, 5:56 p.m. UTC | #1 
LGTM. merged now thanks Anuj

On Thu, Jul 30, 2026 at 9:21 PM Anuj Mittal <anuj.mittal@oss.qualcomm.com>
wrote:

> Please merge these changes in scarthgap. Tested locally and on autobuilder.
>
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/81/builds/1679
>
> The following changes since commit
> 7eb94107580092f79ff1b639a87762fe6f96aa12:
>
>   nginx: fix CVE-2026-42055 (2026-07-16 15:49:44 +0530)
>
> are available in the Git repository at:
>
>   https://git.openembedded.org/meta-openembedded-contrib anujm/scarthgap
>
> https://git.openembedded.org/meta-openembedded-contrib/log/?h=anujm/scarthgap
>
> for you to fetch changes up to ef3df29f2cfca6a9513b51ebcdccf82b6c8a836f:
>
>   libdbi-perl: Fix CVE-2026-14740 (2026-07-30 07:53:25 +0530)
>
> ----------------------------------------------------------------
>
> Ankur Tyagi (2):
>   postfix: upgrade 3.8.17 -> 3.8.19
>   haveged: upgrade 1.9.22 -> 1.9.23
>
> Benjamin Robin (Schneider Electric) (1):
>   dnsmasq: fix CVE-2026-4890
>
> Darsh Kelaiya (6):
>   jq: Fix CVE-2026-43895
>   jq: Fix CVE-2026-47770
>   jq: Fix CVE-2026-49839
>   jq: Fix CVE-2026-54679
>   dnsmasq: Fix CVE-2026-12725
>   dnsmasq: Fix CVE-2026-12969
>
> Deepak Rathore (1):
>   ldns: fix CVE-2026-10846
>
> Hetvi Thakar (5):
>   libdbi-perl: Fix CVE-2026-9698
>   libdbi-perl: Fix CVE-2026-10879
>   libdbi-perl: Fix CVE-2026-14380
>   libdbi-perl: Fix CVE-2026-14739
>   libdbi-perl: Fix CVE-2026-14740
>
> Joao Marcos Costa (1):
>   nginx: backport fixes for CVE-2026-42533
>
> Khem Raj (1):
>   apache2: upgrade 2.4.67 -> 2.4.68
>
> Peter Marko (2):
>   libwebsockets: patch CVE-2026-10650
>   hostapd: set status for CVE-2026-58374
>
> Qliangw (1):
>   libuio: fix FILE descriptor leak
>
> Wang Mingyu (1):
>   monocypher: upgrade 4.0.2 -> 4.0.3
>
>  .../{postfix_3.8.17.bb => postfix_3.8.19.bb}  |   2 +-
>  .../recipes-support/dnsmasq/dnsmasq_2.90.bb   |   3 +
>  .../dnsmasq/files/CVE-2026-12725.patch        | 111 +++
>  .../dnsmasq/files/CVE-2026-12969.patch        |  54 ++
>  .../dnsmasq/files/CVE-2026-4890.patch         |  75 ++
>  .../hostapd/hostapd_2.10.bb                   |   2 +
>  .../libwebsockets/CVE-2026-10650.patch        |  46 ++
>  .../libwebsockets/libwebsockets_4.3.3.bb      |   1 +
>  ...onocypher_4.0.2.bb => monocypher_4.0.3.bb} |   2 +-
>  .../jq/jq/CVE-2026-43895.patch                | 206 +++++
>  .../jq/jq/CVE-2026-47770.patch                | 449 +++++++++++
>  .../jq/jq/CVE-2026-49839.patch                |  37 +
>  .../jq/jq/CVE-2026-54679.patch                |  74 ++
>  meta-oe/recipes-devtools/jq/jq_1.7.1.bb       |   4 +
>  .../ldns/ldns/CVE-2026-10846_p1.patch         | 117 +++
>  .../ldns/ldns/CVE-2026-10846_p2.patch         | 117 +++
>  .../ldns/ldns/CVE-2026-10846_p3.patch         |  34 +
>  meta-oe/recipes-devtools/ldns/ldns_1.8.3.bb   |   6 +-
>  .../perl/libdbi-perl/CVE-2026-10879.patch     |  34 +
>  .../perl/libdbi-perl/CVE-2026-14380_p1.patch  |  37 +
>  .../perl/libdbi-perl/CVE-2026-14380_p2.patch  |  65 ++
>  .../perl/libdbi-perl/CVE-2026-14380_p3.patch  |  27 +
>  .../perl/libdbi-perl/CVE-2026-14380_p4.patch  |  56 ++
>  .../perl/libdbi-perl/CVE-2026-14739.patch     | 170 +++++
>  .../perl/libdbi-perl/CVE-2026-14740.patch     |  40 +
>  .../perl/libdbi-perl/CVE-2026-9698.patch      |  43 ++
>  .../perl/libdbi-perl_1.643.bb                 |   9 +
>  .../{haveged_1.9.22.bb => haveged_1.9.23.bb}  |   2 +-
>  ...ix-fclose-leak-in-uio_line_from_file.patch |  31 +
>  .../recipes-extended/libuio/libuio_0.2.1.bb   |   1 +
>  .../{apache2_2.4.67.bb => apache2_2.4.68.bb}  |   2 +-
>  .../nginx/nginx-1.24.0/CVE-2026-42533-1.patch | 126 ++++
>  .../nginx/nginx-1.24.0/CVE-2026-42533-2.patch | 381 ++++++++++
>  .../nginx/nginx-1.24.0/CVE-2026-42533-3.patch | 704 ++++++++++++++++++
>  .../nginx/nginx-1.24.0/CVE-2026-42533-4.patch | 587 +++++++++++++++
>  .../nginx/nginx-1.24.0/CVE-2026-42533-5.patch |  55 ++
>  .../recipes-httpd/nginx/nginx_1.24.0.bb       |   5 +
>  37 files changed, 3710 insertions(+), 5 deletions(-)
>  rename meta-networking/recipes-daemons/postfix/{postfix_3.8.17.bb =>
> postfix_3.8.19.bb} (99%)
>  create mode 100644
> meta-networking/recipes-support/dnsmasq/files/CVE-2026-12725.patch
>  create mode 100644
> meta-networking/recipes-support/dnsmasq/files/CVE-2026-12969.patch
>  create mode 100644
> meta-networking/recipes-support/dnsmasq/files/CVE-2026-4890.patch
>  create mode 100644
> meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-10650.patch
>  rename meta-oe/recipes-crypto/monocypher/{monocypher_4.0.2.bb =>
> monocypher_4.0.3.bb} (85%)
>  create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-43895.patch
>  create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch
>  create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-49839.patch
>  create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch
>  create mode 100644
> meta-oe/recipes-devtools/ldns/ldns/CVE-2026-10846_p1.patch
>  create mode 100644
> meta-oe/recipes-devtools/ldns/ldns/CVE-2026-10846_p2.patch
>  create mode 100644
> meta-oe/recipes-devtools/ldns/ldns/CVE-2026-10846_p3.patch
>  create mode 100644
> meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-10879.patch
>  create mode 100644
> meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p1.patch
>  create mode 100644
> meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p2.patch
>  create mode 100644
> meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p3.patch
>  create mode 100644
> meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p4.patch
>  create mode 100644
> meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14739.patch
>  create mode 100644
> meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14740.patch
>  create mode 100644
> meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-9698.patch
>  rename meta-oe/recipes-extended/haveged/{haveged_1.9.22.bb =>
> haveged_1.9.23.bb} (94%)
>  create mode 100644
> meta-oe/recipes-extended/libuio/libuio/fix-fclose-leak-in-uio_line_from_file.patch
>  rename meta-webserver/recipes-httpd/apache2/{apache2_2.4.67.bb =>
> apache2_2.4.68.bb} (99%)
>  create mode 100644
> meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-42533-1.patch
>  create mode 100644
> meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-42533-2.patch
>  create mode 100644
> meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-42533-3.patch
>  create mode 100644
> meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-42533-4.patch
>  create mode 100644
> meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-42533-5.patch
>
> --
> 2.54.0
>
>