new file mode 100644
@@ -0,0 +1,43 @@
+From 1159686379184a1c899eabb2174258aba5e0fd79 Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Mon, 20 Sep 2021 15:41:31 -0500
+Subject: [PATCH] Fix possibly uninitialized warnings
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/fb98e9a8c3062c75357b961543af091de2dd5459]
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-websocket-connection.c | 2 +-
+ tests/samesite-test.c | 3 +++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/libsoup/soup-websocket-connection.c b/libsoup/soup-websocket-connection.c
+index 65c1492..585d45c 100644
+--- a/libsoup/soup-websocket-connection.c
++++ b/libsoup/soup-websocket-connection.c
+@@ -471,7 +471,7 @@ send_message (SoupWebsocketConnection *self,
+ GByteArray *bytes;
+ gsize frame_len;
+ guint8 *outer;
+- guint8 mask_offset;
++ guint8 mask_offset = 0;
+ GBytes *filtered_bytes;
+ GList *l;
+ GError *error = NULL;
+diff --git a/tests/samesite-test.c b/tests/samesite-test.c
+index 0b081b2..60c9b8e 100644
+--- a/tests/samesite-test.c
++++ b/tests/samesite-test.c
+@@ -60,6 +60,9 @@ assert_highest_policy_visible (GSList *cookies, SoupSameSitePolicy policy)
+ case SOUP_SAME_SITE_POLICY_NONE:
+ expected_count = 1;
+ break;
++ default:
++ g_assert_not_reached ();
++ break;
+ }
+
+ g_assert_cmpuint (size, ==, expected_count);
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,145 @@
+From 0e3bfa22b23451531caf8cc30b1771ac6a41fcad Mon Sep 17 00:00:00 2001
+From: Carlos Garcia Campos <cgarcia@igalia.com>
+Date: Thu, 11 Feb 2021 10:47:09 +0100
+Subject: [PATCH] Remove http and https aliases support test
+
+Upstream has removed the whole function of http and https aliases
+support, this commit partially cherry pick it, only remove the test to
+mute the warning:
+| ../libsoup-2.74.3/tests/server-test.c: In function 'do_one_server_aliases_test':
+| ../libsoup-2.74.3/tests/server-test.c:180:17: warning: 'g_socket_client_set_tls_validation_flags' is deprecated [-Wdeprecated-declarations]
+| 180 | g_socket_client_set_tls_validation_flags (client, 0);
+| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/111ae4ebe7cc2e389573cff5b9ac76509d6cbac0]
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ tests/server-test.c | 104 --------------------------------------------
+ 1 file changed, 104 deletions(-)
+
+diff --git a/tests/server-test.c b/tests/server-test.c
+index 8976103..cb7e815 100644
+--- a/tests/server-test.c
++++ b/tests/server-test.c
+@@ -154,108 +154,6 @@ do_star_test (ServerData *sd, gconstpointer test_data)
+ soup_uri_free (star_uri);
+ }
+
+-static void
+-do_one_server_aliases_test (SoupURI *uri,
+- const char *alias,
+- gboolean succeed)
+-{
+- GSocketClient *client;
+- GSocketConnectable *addr;
+- GSocketConnection *conn;
+- GInputStream *in;
+- GOutputStream *out;
+- GError *error = NULL;
+- GString *req;
+- static char buf[1024];
+-
+- debug_printf (1, " %s via %s\n", alias, uri->scheme);
+-
+- /* There's no way to make libsoup's client side send an absolute
+- * URI (to a non-proxy server), so we have to fake this.
+- */
+-
+- client = g_socket_client_new ();
+- if (uri->scheme == SOUP_URI_SCHEME_HTTPS) {
+- g_socket_client_set_tls (client, TRUE);
+- g_socket_client_set_tls_validation_flags (client, 0);
+- }
+- addr = g_network_address_new (uri->host, uri->port);
+-
+- conn = g_socket_client_connect (client, addr, NULL, &error);
+- g_object_unref (addr);
+- g_object_unref (client);
+- if (!conn) {
+- g_assert_no_error (error);
+- g_error_free (error);
+- return;
+- }
+-
+- in = g_io_stream_get_input_stream (G_IO_STREAM (conn));
+- out = g_io_stream_get_output_stream (G_IO_STREAM (conn));
+-
+- req = g_string_new (NULL);
+- g_string_append_printf (req, "GET %s://%s:%d HTTP/1.1\r\n",
+- alias, uri->host, uri->port);
+- g_string_append_printf (req, "Host: %s:%d\r\n",
+- uri->host, uri->port);
+- g_string_append (req, "Connection: close\r\n\r\n");
+-
+- if (!g_output_stream_write_all (out, req->str, req->len, NULL, NULL, &error)) {
+- g_assert_no_error (error);
+- g_error_free (error);
+- g_object_unref (conn);
+- g_string_free (req, TRUE);
+- return;
+- }
+- g_string_free (req, TRUE);
+-
+- if (!g_input_stream_read_all (in, buf, sizeof (buf), NULL, NULL, &error)) {
+- g_assert_no_error (error);
+- g_error_free (error);
+- g_object_unref (conn);
+- return;
+- }
+-
+- if (succeed)
+- g_assert_true (g_str_has_prefix (buf, "HTTP/1.1 200 "));
+- else
+- g_assert_true (g_str_has_prefix (buf, "HTTP/1.1 400 "));
+-
+- g_io_stream_close (G_IO_STREAM (conn), NULL, NULL);
+- g_object_unref (conn);
+-}
+-
+-static void
+-do_server_aliases_test (ServerData *sd, gconstpointer test_data)
+-{
+- char *http_aliases[] = { "dav", NULL };
+- char *https_aliases[] = { "davs", NULL };
+- char *http_good[] = { "http", "dav", NULL };
+- char *http_bad[] = { "https", "davs", "fred", NULL };
+- char *https_good[] = { "https", "davs", NULL };
+- char *https_bad[] = { "http", "dav", "fred", NULL };
+- int i;
+-
+- g_test_bug ("703694");
+-
+- g_object_set (G_OBJECT (sd->server),
+- SOUP_SERVER_HTTP_ALIASES, http_aliases,
+- SOUP_SERVER_HTTPS_ALIASES, https_aliases,
+- NULL);
+-
+- for (i = 0; http_good[i]; i++)
+- do_one_server_aliases_test (sd->base_uri, http_good[i], TRUE);
+- for (i = 0; http_bad[i]; i++)
+- do_one_server_aliases_test (sd->base_uri, http_bad[i], FALSE);
+-
+- if (tls_available) {
+- for (i = 0; https_good[i]; i++)
+- do_one_server_aliases_test (sd->ssl_base_uri, https_good[i], TRUE);
+- for (i = 0; https_bad[i]; i++)
+- do_one_server_aliases_test (sd->ssl_base_uri, https_bad[i], FALSE);
+- }
+-}
+-
+ static void
+ do_dot_dot_test (ServerData *sd, gconstpointer test_data)
+ {
+@@ -1382,8 +1280,6 @@ main (int argc, char **argv)
+
+ g_test_add ("/server/OPTIONS *", ServerData, NULL,
+ server_setup, do_star_test, server_teardown);
+- g_test_add ("/server/aliases", ServerData, NULL,
+- server_setup, do_server_aliases_test, server_teardown);
+ g_test_add ("/server/..-in-path", ServerData, NULL,
+ server_setup, do_dot_dot_test, server_teardown);
+ g_test_add ("/server/ipv6", ServerData, NULL,
+--
+2.34.1
+
@@ -13,7 +13,10 @@ SHRT_VER = "${@d.getVar('PV').split('.')[0]}.${@d.getVar('PV').split('.')[1]}"
SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://0001-Fix-build-with-libxml2-2.12.0-and-clang-17.patch \
- file://0001-CVE-2025-32911.patch"
+ file://0001-CVE-2025-32911.patch \
+ file://0001-Fix-possibly-uninitialized-warnings.patch \
+ file://0001-Remove-http-and-https-aliases-support-test.patch"
+
SRC_URI[sha256sum] = "e4b77c41cfc4c8c5a035fcdc320c7bc6cfb75ef7c5a034153df1413fa1d92f13"
CVE_PRODUCT = "libsoup"