From patchwork Mon Sep 21 05:40:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 98763 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9781BC982F8 for ; Mon, 21 Sep 2026 05:40:17 +0000 (UTC) Received: from a27-191.smtp-out.us-west-2.amazonses.com (a27-191.smtp-out.us-west-2.amazonses.com [54.240.27.191]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43179.1789969210958134432 for ; Sun, 20 Sep 2026 22:40:11 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=tybsarHl; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=0crCCAZf; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.191, mailfrom: 010101a0c27a9abb-24a72e7b-d6bb-46d3-8796-5c1b6ad19efd-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1789969210; h=Content-Type:MIME-Version:From:To:Subject:Message-Id:Date; bh=ApXJRJevI2W0l8yzzXrLhH/WIlpSZuXcIJAI4RuOp7M=; b=tybsarHlx3yYDMgcA+B8P39Kcvo8rytTuwkYIlTj3I1Lv+o6aeaNzSWLWyjTpj9d 5xNt2aIvJ8Au0K4clYltM8V8Q62awo0pVFQor6L/0LOSgQGIlhCGdn2OKOK+XFkZxOR NNirfxXb6p5lyBtQVlYgX7YaCpF19JToWwaiPYqY= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1789969210; h=Content-Type:MIME-Version:From:To:Subject:Message-Id:Date:Feedback-ID; bh=ApXJRJevI2W0l8yzzXrLhH/WIlpSZuXcIJAI4RuOp7M=; b=0crCCAZfJTeRT1YKqlND2vO+26CG1MF96Tc5zpTgie/0SzmvRrEzggdXGeNdOXlJ wAoViVe5vOPa3ckLCoWUGk7X/DXa7f16dlTMn3V5SEBAsAPcScejgrkFkTCmTDuqjoH AMnGkbZp5qzQLmE/eigDY9mm48IJ6/iOM2Ps8Ujc= MIME-Version: 1.0 From: auh@yoctoproject.org To: openembedded-core@lists.openembedded.org Subject: [AUH] cairo: upgrading to 1.18.6 SUCCEEDED Message-ID: <010101a0c27a9abb-24a72e7b-d6bb-46d3-8796-5c1b6ad19efd-000000@us-west-2.amazonses.com> Date: Mon, 21 Sep 2026 05:40:10 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.09.21-54.240.27.191 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 21 Sep 2026 05:40:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246279 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *cairo* to *1.18.6* has Succeeded. Next steps: - apply the patch: git am 0001-cairo-upgrade-1.18.4-1.18.6.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From c8b000d3a12d989c24e12bade74a1c644e241e75 Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Mon, 21 Sep 2026 05:30:06 +0000 Subject: [PATCH] cairo: upgrade 1.18.4 -> 1.18.6 Source: NEWS Release 1.18.6 (2026-09-20 Emmanuele Bassi ) ============================================================== A new stable release. The XCB surface triggered an UAF warning when building with GCC. [#898] The clipping code was accessing various fields in a guard value, and causing a crash inside Inkscape. See: https://gitlab.com/inkscape/inkscape/-/issues/5631 Multiple fixes for the Windows backends, including improvements in the thread safety of the DirectWrite code. [#897] The DirectWrite backend now supports COLRv1 fonts. [#903] Multiple fixes for building with MSVC and ClangCL. A leak in the PDF surfaces has been fixed. [!644] Various gaps between abutting rectangles when drawing with ANTIALIAS_NONE were removed by using absolute coordinates and avoiding rounding errors. [#976] Remove an overflow when computing the buffer size in the XRender code. [#950] --- .../cairo-get_bitmap_surface-bsc1036789-CVE-2017-7475.diff | 6 +++--- .../cairo/{cairo_1.18.4.bb => cairo_1.18.6.bb} | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) rename meta/recipes-graphics/cairo/{cairo_1.18.4.bb => cairo_1.18.6.bb} (97%) diff --git a/meta/recipes-graphics/cairo/cairo/cairo-get_bitmap_surface-bsc1036789-CVE-2017-7475.diff b/meta/recipes-graphics/cairo/cairo/cairo-get_bitmap_surface-bsc1036789-CVE-2017-7475.diff index 79ef16dfb9..c6c5ba09c6 100644 --- a/meta/recipes-graphics/cairo/cairo/cairo-get_bitmap_surface-bsc1036789-CVE-2017-7475.diff +++ b/meta/recipes-graphics/cairo/cairo/cairo-get_bitmap_surface-bsc1036789-CVE-2017-7475.diff @@ -1,4 +1,4 @@ -From 054ad9b65e074899c82e75cfc6623cfe29ab1fea Mon Sep 17 00:00:00 2001 +From e21fd76dc2572061d078a41fd5faa76592483e88 Mon Sep 17 00:00:00 2001 From: Fan Xin Date: Tue, 6 Jun 2017 15:57:52 +0900 Subject: [PATCH] Cairo: Fix Denial-of-Service Attack due to Logical Problem in @@ -15,10 +15,10 @@ Signed-off-by: Fan Xin 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/cairo-ft-font.c b/src/cairo-ft-font.c -index b5d08ee..5e20ae1 100644 +index b9bdf81..fa9c05d 100644 --- a/src/cairo-ft-font.c +++ b/src/cairo-ft-font.c -@@ -1220,7 +1220,7 @@ _get_bitmap_surface (FT_Bitmap *bitmap, +@@ -1231,7 +1231,7 @@ _get_bitmap_surface (FT_Bitmap *bitmap, width = bitmap->width; height = bitmap->rows; diff --git a/meta/recipes-graphics/cairo/cairo_1.18.4.bb b/meta/recipes-graphics/cairo/cairo_1.18.6.bb similarity index 97% rename from meta/recipes-graphics/cairo/cairo_1.18.4.bb rename to meta/recipes-graphics/cairo/cairo_1.18.6.bb index ae448101d9..138ad7492b 100644 --- a/meta/recipes-graphics/cairo/cairo_1.18.4.bb +++ b/meta/recipes-graphics/cairo/cairo_1.18.6.bb @@ -31,7 +31,7 @@ SRC_URI = "http://cairographics.org/releases/cairo-${PV}.tar.xz \ file://cairo-get_bitmap_surface-bsc1036789-CVE-2017-7475.diff \ " -SRC_URI[sha256sum] = "445ed8208a6e4823de1226a74ca319d3600e83f6369f99b14265006599c32ccb" +SRC_URI[sha256sum] = "1c767308174337a74694da0f3ec069c271452163a1ef4540964c50c301f157d4" inherit meson pkgconfig upstream-version-is-even gtk-doc multilib_script