[AUH] libical: upgrading to 4.0.8 SUCCEEDED

Hello,

this email is a notification from the Auto Upgrade Helper
that the automatic attempt to upgrade the recipe(s) *libical* to *4.0.8* has Succeeded.

Next steps:
    - apply the patch: git am 0001-libical-upgrade-4.0.7-4.0.8.patch
    - check the changes to upstream patches and summarize them in the commit message,
    - compile an image that contains the package
    - perform some basic sanity tests
    - amend the patch and sign it off: git commit -s --reset-author --amend
    - send it to the appropriate mailing list

Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.

Please review the attached files for further information and build/update failures.
Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler

Regards,
The Upgrade Helper

-- >8 --
From 76e9425e16f39b6d5df4a397ae252ac707cc0344 Mon Sep 17 00:00:00 2001
From: Upgrade Helper <auh@yoctoproject.org>
Date: Sun, 15 Nov 2026 05:48:08 +0000
Subject: [PATCH] libical: upgrade 4.0.7 -> 4.0.8

# Libical v4.0.7
## Overview

This is a patch release and is fully source and binary compatible with version
4.0.0.

[Note: the libicalvcard is a released as a *Technical Preview*. As such,
its API is not finalized and no source or binary compatibility is guaranteed
with that library in the 4.0.x series.]

## ReleaseNotes

- libicalvcard:
  - `vcardcomponent_clone()` and friends now deep-copy TEXTLIST values (e.g.
    NICKNAME, CATEGORIES)
    and structured parameters (JSCOMPS), and keep the property group. Previously
    the clone shared
    them with the original, so freeing both freed the same memory twice.
  - Fixed a use-after-free and a memory leak when converting a vCalendar
    procedure alarm (PALARM)
    whose attachment is a plain path name.
- libical:
  - Fix busy status of recurring events in `icalcomponent_foreach_recurrence()`.
  - Fix `icalvalue_decode_ical_string()` and
    `icallangbind_property_eval_string()` reading past
    the end of a string that ends in a backslash or a newline.
  - `icaltimezone_truncate_vtimezone()` no longer reads the RRULE after freeing
    it when the new
     DTSTART is within a year of UNTIL (RSCALE rules), and no longer uses an
     uninitialized onset
     when no RRULE occurrence falls before the window close.
  - Fix IMAGE and STRUCTURED-DATA given by URI (with or without VALUE=URI)
    parsing to a URI value,
    whose string `icalproperty_get_image()` and
    `icalproperty_get_structureddata()` then read as
    an icalattach pointer.
  - Fix use-after-free and double free in `icalcomponent_merge_component()` when
    both calendars
    have a VTIMEZONE with the same TZID. Every VTIMEZONE of the merged calendar
    is now merged,
    and a conflicting VTIMEZONE is added under a renamed TZID (e.g. "Zone1")
    that its events use.
  - Fix out-of-bounds access to the year days bitmask in the recurrence iterator
    when an RSCALE
    date falls outside the year (e.g. BYWEEKNO with a DTSTART before the
    calendar's epoch).
  - Fix `icalrecur_iterator_set_range()` for a reverse range on a rule without
    UNTIL, which
    started the iteration at year 0 instead of at 'from'.
  - Fix `icalparser_clean()` for proper reuse by resetting internal structure
    values and clearing
    the root component to avoid a use-after-free.
  - Behavior change: The typed icalvalue getters now check that the value type
    of the icalvalue
    uses the same union member as the expected value type of the getter, as the
    vcardvalue getters
    have done since version 4.0.6. If the type mismatches, then they return the
    zero value for the
    expected value type. The typed setters error with ICAL_BADARG_ERROR instead
    of overwriting a
    value held in another union member.
- libicalss:
  - Fix heap-buffer-overflow in `icalspanlist_as_freebusy_matrix()` for busy
    spans that start
    before or end after the spanlist. `icalspanlist_from_vfreebusy()` now sets
    the spanlist
    start/end from DTSTART/DTEND and marks FBTYPE=FREE periods as free (all
    others as busy).
- Buildsystem changes:
  - Fix CMake command target_link_libraries() to use all-keywords as required
    since CMake v4.4.4.
  - When cross-compiling, don't build/install ical-glib-src-generator w/o
    existing binary

Please see the
[CHANGELOG](https://github.com/libical/libical/blob/4.0/CHANGELOG.md) for more.

# Libical v4.0.8
## Overview

This is a patch release and is fully source and binary compatible with version
4.0.0.

Version 4.0.8 will likely be the last release in the 4.0.x series.
Version 4.1.0 is on our planning board for the next release.

[Note: the libicalvcard is a released as a *Technical Preview*. As such,
its API is not finalized and no source or binary compatibility is guaranteed
with that library in the 4.0.x series.]

## ReleaseNotes
- Built-in timezones updated to tzdata2026f.

- libicalvcard:
  - BDAY, ANNIVERSARY and DEATHDATE with a timestamp value, such as
    `19531015T231000Z`, were written
    with `VALUE=TIMESTAMP`. RFC 6350 does not allow TIMESTAMP for these
    properties, but a TIMESTAMP
    is a valid DATE-TIME value. The VALUE parameter is now omitted.
  - Various fixes for fuzzer issues (OOM and cpu time).

- libicalvcal:
  - Fix an out-of-bounds write when decoding a BASE64 value whose padding
    contains more than
    two `=` characters. The decoder computed the output length as `3 - pad`,
    which wrapped
    to a huge value when `pad` exceeded 3 and was then used as the size of a
    `memcpy`.
  - Reject a vCalendar RRULE/EXRULE interval of 0 or one that does not fit in a
    short.
    Such an interval was converted into an iCalendar RRULE that never advances,
    so expanding it
    (e.g. with `icalcomponent_foreach_recurrence()`) looped forever.
  - Fix an out-of-bounds read in the lexer. When a value folded across lines put
    a newline at the
    last slot of the lookahead ring buffer, `lexLookahead()` peeked at the next
    character with
    `lexB

[Changelog truncated as it exceeds 5000 characters;
the full changelog can be found in an attachment to the AUH email]
---
 .../libical/{libical_4.0.7.bb => libical_4.0.8.bb}              | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-support/libical/{libical_4.0.7.bb => libical_4.0.8.bb} (96%)