From patchwork Tue Oct 13 07:08:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 100555 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09423CC6B10 for ; Tue, 13 Oct 2026 07:08:23 +0000 (UTC) Received: from a27-29.smtp-out.us-west-2.amazonses.com (a27-29.smtp-out.us-west-2.amazonses.com [54.240.27.29]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.1675.1791875292582776159 for ; Tue, 13 Oct 2026 00:08:12 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=PmV5fa6Z; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=s9Yw8bNJ; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.29, mailfrom: 010101a134171945-fd0235bc-89c8-4f9c-9638-00b6e7be5f57-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1791875291; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date; bh=g7nvF7M7zXawFzS4tXWUm5xxTgnseD2N3MCWNuZ7IbI=; b=PmV5fa6ZB5EhBGKjsX97eu6o7cnJy18xFLzZxPY2bImBeKmnm3ALCFukC9XS6ddP zStNf0eJ3ymNA9gJkinHOHvrgTVyifFl/Y3jvmL7jLe0ND8jWcHwLXyA/5Ydu+FWsss eeDbeDKI6hJjaqdcSOJYNejgvDygmS/2Odyyq4zk= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1791875291; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date:Feedback-ID; bh=g7nvF7M7zXawFzS4tXWUm5xxTgnseD2N3MCWNuZ7IbI=; b=s9Yw8bNJh8+fod2peZZOmfJKUo51yzZl+/w0I3f2y54qEA7gT3tcb+36jgXZY2cx L6QTkTycZemJIgBBJNkrrPGkX2/Mu2tF1XWg/Rm9+4FLWxbob0OqHTvjxiley2UeiRt jS0lN8ckU7bAQK3NcBzuYOuX6vhB3T5O7GDD7KHM= MIME-Version: 1.0 From: auh@yoctoproject.org To: Ross Burton Cc: openembedded-core@lists.openembedded.org Subject: [AUH] freetype: upgrading to 2.15.0 SUCCEEDED Message-ID: <010101a134171945-fd0235bc-89c8-4f9c-9638-00b6e7be5f57-000000@us-west-2.amazonses.com> Date: Tue, 13 Oct 2026 07:08:11 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.10.13-54.240.27.29 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 07:08:23 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247702 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *freetype* to *2.15.0* has Succeeded. Next steps: - apply the patch: git am 0001-freetype-upgrade-2.14.3-2.15.0.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From 6f4ef4c01c8976cf2e00e58c1cf365865117dee8 Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Tue, 13 Oct 2026 06:27:35 +0000 Subject: [PATCH] freetype: upgrade 2.14.3 -> 2.15.0 Tag sources with `VER-2-15-0'. Whitespace. [truetype] Avoid overflow in VARC axis values. Reported as https://issues.oss-fuzz.com/issues/570754474 (tt_face_load_varc_glyph): Use `NEG_LONG` when rounding negative axis values, since the conversion can wrap to `INT32_MIN` and negating that value overflows on platforms with 32-bit longs. Assisted-by: OpenAI Codex `numBlends` comes from the charstring and is attacker-controlled. Check for overflow before multiplying: a wrapped `numOperands` would bypass the stack underflow check below and the loop that follows would then run up to 2^32 iterations (CPU exhaustion). [autofit] Limit default GSUB coverage to reachable glyphs. A lookup can be registered under several scripts while substituting inputs from only one of them. Collecting every output assigns those glyphs to the first processed script, regardless of the inputs' styles. In Google Sans this assigns the Latin rvrn alternates to Cyrillic; missing Cyrillic blue zones then disable their hinting and darkening. The full Meson test suite passes with linked, dynamic, and disabled HarfBuzz. The regression fails before the fix. Google Sans alternates retain Latin styles and stem darkening after the fix. Assisted-by: OpenAI Codex Fixes issue #1441. [truetype] Make tiny exception from v40 rules. [colr] Correctly handle B/W bitmaps in 'COLR' while blending. [sfnt] Fix standalone compilation of `ttcmap.c`. The single-object build inherited this include from `sfdriver.c` and `sfobjs.c`, masking the missing direct dependency. Assisted-by: OpenAI Codex 2026-10-04 Tomer Fichman <@tomer> Provide tests for issue #1469. [truetype] Update the VARC variation-store binary format. Spec: Offset-base erratum: Tests: full Meson regression suite (3 passed). Assisted-by: OpenAI Codex [truetype] Compare VARC condition values before rounding. Condition format 2 tests whether default plus interpolated delta is positive. Rounding the delta to an integer first loses small positive fractions and incorrectly hides components. (tt_varc_get_item_deltas, tt_varc_eval_condition): Allow the MultiItemVariationStore evaluator to initialize condition accumulators from their defaults and return the unrounded sign. Compare in the existing 64-bit representation, including the emulated path, so large int32 deltas need not fit in a signed 16.16 `FT_Long`. Use ULABS for unsigned magnitudes in emulated multiplication, avoiding MSVC's warning about unsigned unary negation (see https://gitlab.freedesktop.org/freetype/freetype/- /merge_requests/458#note_3692404). Cast to `FT_UInt32` after obtaining the magnitude; no additional absolute-value helper is needed. (tt_varc_apply_axis_deltas, tt_varc_apply_transform_deltas): Updated. All three Meson targets and the forced-emulated VARC tests pass. All 40 cross-library diagnostic cases and 115 native/emulated arithmetic comparisons agree. MSVC itself was not available locally. Assisted-by: OpenAI Codex [truetype] Repair VARC arithmetic without native 64-bit integers. Restrict the fast signed product to its safe range, preserve carries when adding negative products, and combine both accumulator words when converting fractional deltas. Explicitly sign-extend the result. The full Meson suite passes. An isolated build forcing the emulated VARC path compiles without an initializer bypass; 115 native/emulated condition and scaled/unscaled transform comparisons agree, including large signed deltas, cancellation, and carries. Assisted-by: OpenAI Codex [truetype] Treat null VARC conditions as true. The OpenType condition rules define an offset of zero as the true condition. Recognize that value both in the top-level ConditionList and in nested AND, OR, and NOT conditions. Add a VARC regression font covering all four cases. Assisted-by: OpenAI Codex docs/CHANGES: Updated. [cff] Load VARC-only glyphs beyond the CharStrings INDEX. OFF permits trailing glyphs to be provided entirely by VARC. Preserve the SFNT glyph count for CFF2 fonts with VARC, and dispatch those glyphs to VARC before checking the CFF2 fallback CharString range. Add a short-CharStrings fixture and verify its glyph count and outline. All three Meson tests pass. Assisted-by: OpenAI Codex [truetype] Apply VARC axis resets without explicit axis values. Tests: all three Meson targets pass. Generated reset, explicit-axis, and inheritance comparisons agree with HarfBuzz and FontTools. Assisted-by: OpenAI Codex [base] Preserve off-curve cubic pairs when reversing outlines. Assisted-by: OpenAI Codex [truetype] Support cubic outlines in 'GLYF' table. Preserve the cubic flag while loading extended simple glyphs, including on-curve points whose state can be changed by TrueType instructions. Teach outline decomposition, stroking, and rasterization to ha [Changelog truncated as it exceeds 5000 characters; the full changelog can be found in an attachment to the AUH email] --- .../freetype/{freetype_2.14.3.bb => freetype_2.15.0.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-graphics/freetype/{freetype_2.14.3.bb => freetype_2.15.0.bb} (94%) diff --git a/meta/recipes-graphics/freetype/freetype_2.14.3.bb b/meta/recipes-graphics/freetype/freetype_2.15.0.bb similarity index 94% rename from meta/recipes-graphics/freetype/freetype_2.14.3.bb rename to meta/recipes-graphics/freetype/freetype_2.15.0.bb index 924bcbfc4f..cb9c410b46 100644 --- a/meta/recipes-graphics/freetype/freetype_2.14.3.bb +++ b/meta/recipes-graphics/freetype/freetype_2.15.0.bb @@ -14,7 +14,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.TXT;md5=eeb073d5fb86d23c52bb9b84aa256307 \ " SRC_URI = "${SAVANNAH_NONGNU_MIRROR}/${BPN}/${BP}.tar.xz" -SRC_URI[sha256sum] = "36bc4f1cc413335368ee656c42afca65c5a3987e8768cc28cf11ba775e785a5f" +SRC_URI[sha256sum] = "93cd47eb719c325107f2d3cf087d06299e944c3b48a40b55537302304dea1dd5" UPSTREAM_CHECK_REGEX = "freetype-(?P\d+(\.\d+)+)"