From patchwork Thu Oct 29 17:16:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 102394 Received: from mta-64-225.siemens.flowmailer.net (mta-64-225.siemens.flowmailer.net [185.136.64.225]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.17220.1793294270044661793 for ; Thu, 29 Oct 2026 10:17:52 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=EWE5pot7; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.225, mailfrom: fm-256628-20261029171746689d5e48d100020778-8__mnp@rts-flowmailer.siemens.com) Received: by mta-64-225.siemens.flowmailer.net with ESMTPSA id 20261029171746689d5e48d100020778 for ; Thu, 29 Oct 2026 18:17:46 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc; bh=2Qn8DVZERaQFjt2pmD11nayK9dHNIYVag7BXR53O1DA=; b=EWE5pot7BCXUw8sei17mIDRc/FBPugyPcm4STyMxGo7PD/opRNoXy9HkB0chmWaDlUmIDy ZuLSQBiMcmE4luPc6fyuBzcUs4hFMYH1YccUgLR0Q5vcQ8x0q6/UK9tXvLGYu1ANMVYWHu7a 8xIz7p4mCH8rgzAsHvRch7ltNlgMyQMygZ1SAMOpA+oqizRJFhxTpTcB5ZuDwOO3cJNaap8+ +I/OlOrCERFGreJL060NfNtqFQLigz0NH5s1Ho4qr+V5IhY3sWqvysgvqsaSq7DmZGtbkhAp OPMG4P/j/Fs2rib/Regpgv0dN8Jcd1Q4YIhsTl3e2e6vldZp40vOw9Rw==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [blacksail][PATCH 1/8] python3: upgrade 3.14.7 -> 3.14.9 Date: Thu, 29 Oct 2026 18:16:59 +0100 Message-ID: <20261029171709.2842512-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 17:18:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248957 From: Ross Burton The release notes are long[1] but the highlight is upgrading the bundled pip wheel to 26.2.2, as pip bundles certifi which needed upgrading due to the eMudhra intermediate CA compromise. [1] https://docs.python.org/release/3.14.9/whatsnew/changelog.html [2] https://emudhra.we-have-a-problem.com Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (From OE-Core rev: 526baf80188308bc1e65b09ccb41186772cd6336) Signed-off-by: Peter Marko --- ...shebang-overflow-on-python-config.py.patch | 2 +- ...-use-prefix-value-from-build-configu.patch | 2 +- ...-qemu-wrapper-when-gathering-profile.patch | 2 +- ...146207-Add-support-for-OpenSSL-4.0.0.patch | 29 +++++++++---------- ...Update-_ssl._SSLSocket-for-OpenSSL-4.patch | 18 ++++++------ ...utdown-test-in-test_ssl.test_got_eof.patch | 2 +- .../python/python3/makerace.patch | 2 +- .../{python3_3.14.7.bb => python3_3.14.9.bb} | 2 +- 8 files changed, 28 insertions(+), 31 deletions(-) rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.9.bb} (99%) diff --git a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch index 7a60538364..7cacaf0ff3 100644 --- a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch +++ b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch @@ -19,7 +19,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index e946018..345ed29 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2835,6 +2835,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh +@@ -2839,6 +2839,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh @ # Substitution happens here, as the completely-expanded BINDIR @ # is not available in configure sed -e "s,@EXENAME@,$(EXENAME)," < $(srcdir)/Misc/python-config.in >python-config.py diff --git a/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch b/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch index 60391e726b..580d38a403 100644 --- a/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch +++ b/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch @@ -21,7 +21,7 @@ diff --git a/Lib/sysconfig/__init__.py b/Lib/sysconfig/__init__.py index 0a8bcc0..a2341f2 100644 --- a/Lib/sysconfig/__init__.py +++ b/Lib/sysconfig/__init__.py -@@ -538,12 +538,12 @@ def _init_config_vars(): +@@ -539,12 +539,12 @@ def _init_config_vars(): _CONFIG_VARS['py_version'] = _PY_VERSION _CONFIG_VARS['py_version_short'] = _PY_VERSION_SHORT _CONFIG_VARS['py_version_nodot'] = _PY_VERSION_SHORT_NO_DOT diff --git a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch index c7f14cad1e..4e41b04a3b 100644 --- a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch +++ b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch @@ -18,7 +18,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index 526d500..a7e536d 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -861,8 +861,7 @@ profile-run-stamp: +@@ -863,8 +863,7 @@ profile-run-stamp: # enabled. $(MAKE) profile-gen-stamp # Next, run the profile task to generate the profile information. diff --git a/meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch b/meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch index bef6044358..8bb4a4c905 100644 --- a/meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch +++ b/meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch @@ -32,7 +32,7 @@ diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index dc795c6bd8a..61355927296 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py -@@ -395,7 +395,7 @@ def test_constants(self): +@@ -424,7 +424,7 @@ class BasicSocketTests(unittest.TestCase): ssl.OP_NO_COMPRESSION self.assertEqual(ssl.HAS_SNI, True) self.assertEqual(ssl.HAS_ECDH, True) @@ -41,7 +41,7 @@ index dc795c6bd8a..61355927296 100644 self.assertEqual(ssl.HAS_TLSv1_3, True) ssl.OP_NO_SSLv2 ssl.OP_NO_SSLv3 -@@ -586,11 +586,11 @@ def test_openssl_version(self): +@@ -615,11 +615,11 @@ class BasicSocketTests(unittest.TestCase): # Some sanity checks follow # >= 1.1.1 self.assertGreaterEqual(n, 0x10101000) @@ -56,7 +56,7 @@ index dc795c6bd8a..61355927296 100644 self.assertGreaterEqual(minor, 0) self.assertLess(minor, 256) self.assertGreaterEqual(fix, 0) -@@ -656,12 +656,14 @@ def test_openssl111_deprecations(self): +@@ -685,12 +685,14 @@ class BasicSocketTests(unittest.TestCase): ssl.OP_NO_TLSv1_2, ssl.OP_NO_TLSv1_3 ] @@ -77,7 +77,7 @@ index dc795c6bd8a..61355927296 100644 versions = [ ssl.TLSVersion.SSLv3, ssl.TLSVersion.TLSv1, -@@ -1205,6 +1207,7 @@ def test_min_max_version(self): +@@ -1184,6 +1186,7 @@ class ContextTests(unittest.TestCase): ssl.TLSVersion.TLSv1, ssl.TLSVersion.TLSv1_1, ssl.TLSVersion.TLSv1_2, @@ -85,7 +85,7 @@ index dc795c6bd8a..61355927296 100644 ssl.TLSVersion.SSLv3, } ) -@@ -1218,7 +1221,7 @@ def test_min_max_version(self): +@@ -1197,7 +1200,7 @@ class ContextTests(unittest.TestCase): with self.assertRaises(ValueError): ctx.minimum_version = 42 @@ -94,7 +94,7 @@ index dc795c6bd8a..61355927296 100644 ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_1) self.assertIn( -@@ -1675,23 +1678,24 @@ def test__create_stdlib_context(self): +@@ -1749,23 +1752,24 @@ class ContextTests(unittest.TestCase): self.assertFalse(ctx.check_hostname) self._assert_context_options(ctx) @@ -130,7 +130,7 @@ index dc795c6bd8a..61355927296 100644 ctx = ssl._create_stdlib_context(purpose=ssl.Purpose.CLIENT_AUTH) self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLS_SERVER) -@@ -3654,10 +3658,10 @@ def test_protocol_tlsv1_2(self): +@@ -3863,10 +3867,10 @@ class ThreadedTests(unittest.TestCase): client_options=ssl.OP_NO_TLSv1_2) try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_TLSv1_2, 'TLSv1.2') @@ -147,7 +147,7 @@ diff --git a/Modules/_ssl.c b/Modules/_ssl.c index b45295b4c0c..6f75af86113 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c -@@ -164,6 +164,17 @@ static void _PySSLFixErrno(void) { +@@ -135,6 +135,17 @@ static void _PySSLFixErrno(void) { #error Unsupported OpenSSL version #endif @@ -165,7 +165,7 @@ index b45295b4c0c..6f75af86113 100644 /* OpenSSL API 1.1.0+ does not include version methods */ #ifndef OPENSSL_NO_SSL3_METHOD extern const SSL_METHOD *SSLv3_method(void); -@@ -1151,7 +1162,7 @@ _asn1obj2py(_sslmodulestate *state, const ASN1_OBJECT *name, int no_name) +@@ -1134,7 +1145,7 @@ _asn1obj2py(_sslmodulestate *state, const ASN1_OBJECT *name, int no_name) static PyObject * _create_tuple_for_attribute(_sslmodulestate *state, @@ -174,7 +174,7 @@ index b45295b4c0c..6f75af86113 100644 { Py_ssize_t buflen; PyObject *pyattr; -@@ -1180,16 +1191,16 @@ _create_tuple_for_attribute(_sslmodulestate *state, +@@ -1163,16 +1174,16 @@ _create_tuple_for_attribute(_sslmodulestate *state, } static PyObject * @@ -195,7 +195,7 @@ index b45295b4c0c..6f75af86113 100644 int index_counter; int rdn_level = -1; int retcode; -@@ -6967,9 +6978,15 @@ sslmodule_init_constants(PyObject *m) +@@ -6530,9 +6541,15 @@ sslmodule_init_constants(PyObject *m) ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS); ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT); ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER); @@ -229,7 +229,7 @@ diff --git a/Tools/ssl/multissltests.py b/Tools/ssl/multissltests.py index 3b4507c6771..48207e5330f 100755 --- a/Tools/ssl/multissltests.py +++ b/Tools/ssl/multissltests.py -@@ -429,9 +429,11 @@ def _post_install(self): +@@ -422,9 +422,11 @@ class BuildOpenSSL(AbstractBuilder): def _post_install(self): if self.version.startswith("3."): self._post_install_3xx() @@ -242,7 +242,7 @@ index 3b4507c6771..48207e5330f 100755 config_args += ("enable-fips",) super()._build_src(config_args) -@@ -447,6 +449,9 @@ def _post_install_3xx(self): +@@ -440,6 +442,9 @@ class BuildOpenSSL(AbstractBuilder): lib64 = self.lib_dir + "64" os.symlink(lib64, self.lib_dir) @@ -252,6 +252,3 @@ index 3b4507c6771..48207e5330f 100755 @property def short_version(self): """Short version for OpenSSL download URL""" --- -2.25.1 - diff --git a/meta/recipes-devtools/python/python3/0002-gh-148292-Update-_ssl._SSLSocket-for-OpenSSL-4.patch b/meta/recipes-devtools/python/python3/0002-gh-148292-Update-_ssl._SSLSocket-for-OpenSSL-4.patch index 587f141dd4..1005fcf3ec 100644 --- a/meta/recipes-devtools/python/python3/0002-gh-148292-Update-_ssl._SSLSocket-for-OpenSSL-4.patch +++ b/meta/recipes-devtools/python/python3/0002-gh-148292-Update-_ssl._SSLSocket-for-OpenSSL-4.patch @@ -28,7 +28,7 @@ diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index 965dbc36f096499..03d9e3f9e5e96b5 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py -@@ -2711,6 +2711,36 @@ def close(self): +@@ -2994,6 +2994,36 @@ class ThreadedEchoServer(threading.Thread): def stop(self): self.active = False @@ -65,7 +65,7 @@ index 965dbc36f096499..03d9e3f9e5e96b5 100644 class AsyncoreEchoServer(threading.Thread): # this one's based on asyncore.dispatcher -@@ -4747,6 +4777,58 @@ def background(sock): +@@ -5035,6 +5065,58 @@ class ThreadedTests(unittest.TestCase): if cm.exc_value is not None: raise cm.exc_value @@ -141,7 +141,7 @@ diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 1603d0ffd559559..376df32b7cb4bd6 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c -@@ -352,6 +352,16 @@ typedef struct { +@@ -351,6 +351,16 @@ typedef struct { * and shutdown methods check for chained exceptions. */ PyObject *exc; @@ -158,7 +158,7 @@ index 1603d0ffd559559..376df32b7cb4bd6 100644 } PySSLSocket; #define PySSLSocket_CAST(op) ((PySSLSocket *)(op)) -@@ -499,6 +509,10 @@ fill_and_set_sslerror(_sslmodulestate *state, +@@ -498,6 +508,10 @@ fill_and_set_sslerror(_sslmodulestate *state, PyObject *init_value, *msg, *key; PyUnicodeWriter *writer = NULL; @@ -169,7 +169,7 @@ index 1603d0ffd559559..376df32b7cb4bd6 100644 if (errcode != 0) { int lib, reason; -@@ -654,6 +668,18 @@ PySSL_ChainExceptions(PySSLSocket *sslsock) { +@@ -653,6 +667,18 @@ PySSL_ChainExceptions(PySSLSocket *sslsock) { return -1; } @@ -188,7 +188,7 @@ index 1603d0ffd559559..376df32b7cb4bd6 100644 static PyObject * PySSL_SetError(PySSLSocket *sslsock, const char *filename, int lineno) { -@@ -901,6 +927,7 @@ newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock, +@@ -900,6 +926,7 @@ newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock, self->server_hostname = NULL; self->err = err; self->exc = NULL; @@ -196,7 +196,7 @@ index 1603d0ffd559559..376df32b7cb4bd6 100644 /* Make sure the SSL error state is initialized */ ERR_clear_error(); -@@ -1041,6 +1068,11 @@ _ssl__SSLSocket_do_handshake_impl(PySSLSocket *self) +@@ -1040,6 +1067,11 @@ _ssl__SSLSocket_do_handshake_impl(PySSLSocket *self) BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking); } @@ -208,7 +208,7 @@ index 1603d0ffd559559..376df32b7cb4bd6 100644 timeout = GET_SOCKET_TIMEOUT(sock); has_timeout = (timeout > 0); if (has_timeout) { -@@ -2504,6 +2536,11 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b) +@@ -2505,6 +2537,11 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b) BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking); } @@ -220,7 +220,7 @@ index 1603d0ffd559559..376df32b7cb4bd6 100644 timeout = GET_SOCKET_TIMEOUT(sock); has_timeout = (timeout > 0); if (has_timeout) { -@@ -2644,6 +2681,11 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len, +@@ -2645,6 +2682,11 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len, Py_INCREF(sock); } diff --git a/meta/recipes-devtools/python/python3/0003-gh-148292-Remove-shutdown-test-in-test_ssl.test_got_eof.patch b/meta/recipes-devtools/python/python3/0003-gh-148292-Remove-shutdown-test-in-test_ssl.test_got_eof.patch index af067f549c..c42b336798 100644 --- a/meta/recipes-devtools/python/python3/0003-gh-148292-Remove-shutdown-test-in-test_ssl.test_got_eof.patch +++ b/meta/recipes-devtools/python/python3/0003-gh-148292-Remove-shutdown-test-in-test_ssl.test_got_eof.patch @@ -24,7 +24,7 @@ diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index 03d9e3f9e5e96b5..6445f122b4272be 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py -@@ -4820,14 +4820,6 @@ def test_got_eof(self): +@@ -5108,14 +5108,6 @@ class ThreadedTests(unittest.TestCase): sslsock.do_handshake() self.assertEqual(sslsock.pending(), 0) diff --git a/meta/recipes-devtools/python/python3/makerace.patch b/meta/recipes-devtools/python/python3/makerace.patch index 248a521118..b589dfb346 100644 --- a/meta/recipes-devtools/python/python3/makerace.patch +++ b/meta/recipes-devtools/python/python3/makerace.patch @@ -20,7 +20,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index a7e536d..e946018 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2741,7 +2741,7 @@ COMPILEALL_OPTS=-j0 +@@ -2745,7 +2745,7 @@ COMPILEALL_OPTS=-j0 TEST_MODULES=@TEST_MODULES@ .PHONY: libinstall diff --git a/meta/recipes-devtools/python/python3_3.14.7.bb b/meta/recipes-devtools/python/python3_3.14.9.bb similarity index 99% rename from meta/recipes-devtools/python/python3_3.14.7.bb rename to meta/recipes-devtools/python/python3_3.14.9.bb index f917edebd8..e6fa2bd111 100644 --- a/meta/recipes-devtools/python/python3_3.14.7.bb +++ b/meta/recipes-devtools/python/python3_3.14.9.bb @@ -30,7 +30,7 @@ SRC_URI:append:class-native = " \ file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \ " -SRC_URI[sha256sum] = "3b48dac8fb59f62eaa67ac83c1eb12bda1b7a08406dd286e252c11a66be27f81" +SRC_URI[sha256sum] = "e02d9ac21cebda6e46435369744a92c65cc7cd8669697694122cf97ffacd1e53" # exclude pre-releases for both python 2.x and 3.x UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P\d+(\.\d+)+).tar" From patchwork Thu Oct 29 17:17:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 102395 Received: from mta-64-225.siemens.flowmailer.net (mta-64-225.siemens.flowmailer.net [185.136.64.225]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.17223.1793294284221985917 for ; Thu, 29 Oct 2026 10:18:04 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=fiShPkOJ; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.225, mailfrom: fm-256628-20261029171802a97afc59b900020793-lo9gcl@rts-flowmailer.siemens.com) Received: by mta-64-225.siemens.flowmailer.net with ESMTPSA id 20261029171802a97afc59b900020793 for ; Thu, 29 Oct 2026 18:18:02 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=Sux8UJSP3ZnfWywvC2xl7mmFfMVmsR32Ywcao8UAKkE=; b=fiShPkOJdW5VtYbLDpEz6wjTX1QL8ckDHTv9pBg0yPlPU/r2UGIGogYhhlC8bZYvW31gWP BbUVT+OSpCXvyCrkgV3gqsJuA44Tea12jHzm20C09gE9qP2WTc+L5EBkOsFsIj231BP73rg+ kkpOeFoaYvbKMvH0Fk8oq0PmobfQ0hOd7TTruHhfwC1+Pi1GRTcteKqD+dnbV6cRl5Koqv9o IMNeFAdOhuNwkX7nlxPDe9/LmK0aboWVsjiFEDeTDoE0p4vqbbiHlL1q9gHTRIimQSA4hUlG /p53PV0UC0uALgPi0rfLSMBgkj/oHsYsb+IXLBERVtmvT0X1/Q2hgb1Q==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [blacksail][PATCH 2/8] python3: upgrade 3.14.9 -> 3.14.10 Date: Thu, 29 Oct 2026 18:17:00 +0100 Message-ID: <20261029171709.2842512-2-peter.marko@siemens.com> In-Reply-To: <20261029171709.2842512-1-peter.marko@siemens.com> References: <20261029171709.2842512-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 17:18:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248958 From: Peter Marko This is an expedited security release to address the compromised eMudhra intermediate CA keys. These keys are now blocked by the ssl module as a last resort against their use. Normal uses of pip, including to upgrade pip itself, are now safe from attacks based on those compromised keys, even if pip hasn't been updated yet. Release information: [1] Security content in this release * CVE-2026-115557 gh-160040: Distrust compromised eMudhra intermediate CA keys * CVE-2026-114583 gh-160097: Reject links replacing the destination in tarfile.tar_filter * gh-160300: Reject cookies with a negative version in http.cookiejar [1] https://www.python.org/downloads/release/python-31410/ Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (From OE-Core rev: 4041f4a2e031f76e5a90207e855c735fd14259b1) Signed-off-by: Peter Marko --- ...shebang-overflow-on-python-config.py.patch | 2 +- ...-qemu-wrapper-when-gathering-profile.patch | 2 +- ...est_sysconfig-for-posix_user-purelib.patch | 2 +- ...146207-Add-support-for-OpenSSL-4.0.0.patch | 22 +++++++++---------- ...Update-_ssl._SSLSocket-for-OpenSSL-4.patch | 18 +++++++-------- ...utdown-test-in-test_ssl.test_got_eof.patch | 2 +- .../python/python3/makerace.patch | 2 +- .../{python3_3.14.9.bb => python3_3.14.10.bb} | 2 +- 8 files changed, 26 insertions(+), 26 deletions(-) rename meta/recipes-devtools/python/{python3_3.14.9.bb => python3_3.14.10.bb} (99%) diff --git a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch index 7cacaf0ff3..79fee9803f 100644 --- a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch +++ b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch @@ -19,7 +19,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index e946018..345ed29 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2839,6 +2839,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh +@@ -2844,6 +2844,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh @ # Substitution happens here, as the completely-expanded BINDIR @ # is not available in configure sed -e "s,@EXENAME@,$(EXENAME)," < $(srcdir)/Misc/python-config.in >python-config.py diff --git a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch index 4e41b04a3b..d3f46c372a 100644 --- a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch +++ b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch @@ -18,7 +18,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index 526d500..a7e536d 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -863,8 +863,7 @@ profile-run-stamp: +@@ -864,8 +864,7 @@ profile-run-stamp: # enabled. $(MAKE) profile-gen-stamp # Next, run the profile task to generate the profile information. diff --git a/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch b/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch index 5509b7475a..0864f23926 100644 --- a/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch +++ b/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch @@ -25,7 +25,7 @@ diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py index 1fe4b68..383142a 100644 --- a/Lib/test/test_sysconfig.py +++ b/Lib/test/test_sysconfig.py -@@ -434,7 +434,7 @@ class TestSysConfig(unittest.TestCase, VirtualEnvironmentMixin): +@@ -435,7 +435,7 @@ class TestSysConfig(unittest.TestCase, VirtualEnvironmentMixin): expected = os.path.normpath(global_path.replace(base, user, 1)) # bpo-44860: platlib of posix_user doesn't use sys.platlibdir, # whereas posix_prefix does. diff --git a/meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch b/meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch index 8bb4a4c905..37f55de65c 100644 --- a/meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch +++ b/meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch @@ -32,7 +32,7 @@ diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index dc795c6bd8a..61355927296 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py -@@ -424,7 +424,7 @@ class BasicSocketTests(unittest.TestCase): +@@ -439,7 +439,7 @@ class BasicSocketTests(unittest.TestCase): ssl.OP_NO_COMPRESSION self.assertEqual(ssl.HAS_SNI, True) self.assertEqual(ssl.HAS_ECDH, True) @@ -41,7 +41,7 @@ index dc795c6bd8a..61355927296 100644 self.assertEqual(ssl.HAS_TLSv1_3, True) ssl.OP_NO_SSLv2 ssl.OP_NO_SSLv3 -@@ -615,11 +615,11 @@ class BasicSocketTests(unittest.TestCase): +@@ -630,11 +630,11 @@ class BasicSocketTests(unittest.TestCase): # Some sanity checks follow # >= 1.1.1 self.assertGreaterEqual(n, 0x10101000) @@ -56,7 +56,7 @@ index dc795c6bd8a..61355927296 100644 self.assertGreaterEqual(minor, 0) self.assertLess(minor, 256) self.assertGreaterEqual(fix, 0) -@@ -685,12 +685,14 @@ class BasicSocketTests(unittest.TestCase): +@@ -700,12 +700,14 @@ class BasicSocketTests(unittest.TestCase): ssl.OP_NO_TLSv1_2, ssl.OP_NO_TLSv1_3 ] @@ -77,7 +77,7 @@ index dc795c6bd8a..61355927296 100644 versions = [ ssl.TLSVersion.SSLv3, ssl.TLSVersion.TLSv1, -@@ -1184,6 +1186,7 @@ class ContextTests(unittest.TestCase): +@@ -1199,6 +1201,7 @@ class ContextTests(unittest.TestCase): ssl.TLSVersion.TLSv1, ssl.TLSVersion.TLSv1_1, ssl.TLSVersion.TLSv1_2, @@ -85,7 +85,7 @@ index dc795c6bd8a..61355927296 100644 ssl.TLSVersion.SSLv3, } ) -@@ -1197,7 +1200,7 @@ class ContextTests(unittest.TestCase): +@@ -1212,7 +1215,7 @@ class ContextTests(unittest.TestCase): with self.assertRaises(ValueError): ctx.minimum_version = 42 @@ -94,7 +94,7 @@ index dc795c6bd8a..61355927296 100644 ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_1) self.assertIn( -@@ -1749,23 +1752,24 @@ class ContextTests(unittest.TestCase): +@@ -1764,23 +1767,24 @@ class ContextTests(unittest.TestCase): self.assertFalse(ctx.check_hostname) self._assert_context_options(ctx) @@ -130,7 +130,7 @@ index dc795c6bd8a..61355927296 100644 ctx = ssl._create_stdlib_context(purpose=ssl.Purpose.CLIENT_AUTH) self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLS_SERVER) -@@ -3863,10 +3867,10 @@ class ThreadedTests(unittest.TestCase): +@@ -3908,10 +3912,10 @@ class ThreadedTests(unittest.TestCase): client_options=ssl.OP_NO_TLSv1_2) try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_TLSv1_2, 'TLSv1.2') @@ -147,7 +147,7 @@ diff --git a/Modules/_ssl.c b/Modules/_ssl.c index b45295b4c0c..6f75af86113 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c -@@ -135,6 +135,17 @@ static void _PySSLFixErrno(void) { +@@ -136,6 +136,17 @@ static void _PySSLFixErrno(void) { #error Unsupported OpenSSL version #endif @@ -165,7 +165,7 @@ index b45295b4c0c..6f75af86113 100644 /* OpenSSL API 1.1.0+ does not include version methods */ #ifndef OPENSSL_NO_SSL3_METHOD extern const SSL_METHOD *SSLv3_method(void); -@@ -1134,7 +1145,7 @@ _asn1obj2py(_sslmodulestate *state, const ASN1_OBJECT *name, int no_name) +@@ -1137,7 +1148,7 @@ _asn1obj2py(_sslmodulestate *state, const ASN1_OBJECT *name, int no_name) static PyObject * _create_tuple_for_attribute(_sslmodulestate *state, @@ -174,7 +174,7 @@ index b45295b4c0c..6f75af86113 100644 { Py_ssize_t buflen; PyObject *pyattr; -@@ -1163,16 +1174,16 @@ _create_tuple_for_attribute(_sslmodulestate *state, +@@ -1166,16 +1177,16 @@ _create_tuple_for_attribute(_sslmodulestate *state, } static PyObject * @@ -195,7 +195,7 @@ index b45295b4c0c..6f75af86113 100644 int index_counter; int rdn_level = -1; int retcode; -@@ -6530,9 +6541,15 @@ sslmodule_init_constants(PyObject *m) +@@ -6599,9 +6610,15 @@ sslmodule_init_constants(PyObject *m) ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS); ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT); ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER); diff --git a/meta/recipes-devtools/python/python3/0002-gh-148292-Update-_ssl._SSLSocket-for-OpenSSL-4.patch b/meta/recipes-devtools/python/python3/0002-gh-148292-Update-_ssl._SSLSocket-for-OpenSSL-4.patch index 1005fcf3ec..1b9a7fc942 100644 --- a/meta/recipes-devtools/python/python3/0002-gh-148292-Update-_ssl._SSLSocket-for-OpenSSL-4.patch +++ b/meta/recipes-devtools/python/python3/0002-gh-148292-Update-_ssl._SSLSocket-for-OpenSSL-4.patch @@ -28,7 +28,7 @@ diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index 965dbc36f096499..03d9e3f9e5e96b5 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py -@@ -2994,6 +2994,36 @@ class ThreadedEchoServer(threading.Thread): +@@ -3039,6 +3039,36 @@ class ThreadedEchoServer(threading.Thread): def stop(self): self.active = False @@ -65,7 +65,7 @@ index 965dbc36f096499..03d9e3f9e5e96b5 100644 class AsyncoreEchoServer(threading.Thread): # this one's based on asyncore.dispatcher -@@ -5035,6 +5065,58 @@ class ThreadedTests(unittest.TestCase): +@@ -5079,6 +5109,58 @@ class ThreadedTests(unittest.TestCase): if cm.exc_value is not None: raise cm.exc_value @@ -141,7 +141,7 @@ diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 1603d0ffd559559..376df32b7cb4bd6 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c -@@ -351,6 +351,16 @@ typedef struct { +@@ -352,6 +352,16 @@ typedef struct { * and shutdown methods check for chained exceptions. */ PyObject *exc; @@ -158,7 +158,7 @@ index 1603d0ffd559559..376df32b7cb4bd6 100644 } PySSLSocket; #define PySSLSocket_CAST(op) ((PySSLSocket *)(op)) -@@ -498,6 +508,10 @@ fill_and_set_sslerror(_sslmodulestate *state, +@@ -499,6 +509,10 @@ fill_and_set_sslerror(_sslmodulestate *state, PyObject *init_value, *msg, *key; PyUnicodeWriter *writer = NULL; @@ -169,7 +169,7 @@ index 1603d0ffd559559..376df32b7cb4bd6 100644 if (errcode != 0) { int lib, reason; -@@ -653,6 +667,18 @@ PySSL_ChainExceptions(PySSLSocket *sslsock) { +@@ -654,6 +668,18 @@ PySSL_ChainExceptions(PySSLSocket *sslsock) { return -1; } @@ -188,7 +188,7 @@ index 1603d0ffd559559..376df32b7cb4bd6 100644 static PyObject * PySSL_SetError(PySSLSocket *sslsock, const char *filename, int lineno) { -@@ -900,6 +926,7 @@ newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock, +@@ -901,6 +927,7 @@ newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock, self->server_hostname = NULL; self->err = err; self->exc = NULL; @@ -196,7 +196,7 @@ index 1603d0ffd559559..376df32b7cb4bd6 100644 /* Make sure the SSL error state is initialized */ ERR_clear_error(); -@@ -1040,6 +1067,11 @@ _ssl__SSLSocket_do_handshake_impl(PySSLSocket *self) +@@ -1043,6 +1070,11 @@ _ssl__SSLSocket_do_handshake_impl(PySSLSocket *self) BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking); } @@ -208,7 +208,7 @@ index 1603d0ffd559559..376df32b7cb4bd6 100644 timeout = GET_SOCKET_TIMEOUT(sock); has_timeout = (timeout > 0); if (has_timeout) { -@@ -2505,6 +2537,11 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b) +@@ -2514,6 +2546,11 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b) BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking); } @@ -220,7 +220,7 @@ index 1603d0ffd559559..376df32b7cb4bd6 100644 timeout = GET_SOCKET_TIMEOUT(sock); has_timeout = (timeout > 0); if (has_timeout) { -@@ -2645,6 +2682,11 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len, +@@ -2654,6 +2691,11 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len, Py_INCREF(sock); } diff --git a/meta/recipes-devtools/python/python3/0003-gh-148292-Remove-shutdown-test-in-test_ssl.test_got_eof.patch b/meta/recipes-devtools/python/python3/0003-gh-148292-Remove-shutdown-test-in-test_ssl.test_got_eof.patch index c42b336798..59742290e8 100644 --- a/meta/recipes-devtools/python/python3/0003-gh-148292-Remove-shutdown-test-in-test_ssl.test_got_eof.patch +++ b/meta/recipes-devtools/python/python3/0003-gh-148292-Remove-shutdown-test-in-test_ssl.test_got_eof.patch @@ -24,7 +24,7 @@ diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index 03d9e3f9e5e96b5..6445f122b4272be 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py -@@ -5108,14 +5108,6 @@ class ThreadedTests(unittest.TestCase): +@@ -5152,14 +5152,6 @@ class ThreadedTests(unittest.TestCase): sslsock.do_handshake() self.assertEqual(sslsock.pending(), 0) diff --git a/meta/recipes-devtools/python/python3/makerace.patch b/meta/recipes-devtools/python/python3/makerace.patch index b589dfb346..7167d5b4e8 100644 --- a/meta/recipes-devtools/python/python3/makerace.patch +++ b/meta/recipes-devtools/python/python3/makerace.patch @@ -20,7 +20,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index a7e536d..e946018 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2745,7 +2745,7 @@ COMPILEALL_OPTS=-j0 +@@ -2750,7 +2750,7 @@ COMPILEALL_OPTS=-j0 TEST_MODULES=@TEST_MODULES@ .PHONY: libinstall diff --git a/meta/recipes-devtools/python/python3_3.14.9.bb b/meta/recipes-devtools/python/python3_3.14.10.bb similarity index 99% rename from meta/recipes-devtools/python/python3_3.14.9.bb rename to meta/recipes-devtools/python/python3_3.14.10.bb index e6fa2bd111..3dd0962ad9 100644 --- a/meta/recipes-devtools/python/python3_3.14.9.bb +++ b/meta/recipes-devtools/python/python3_3.14.10.bb @@ -30,7 +30,7 @@ SRC_URI:append:class-native = " \ file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \ " -SRC_URI[sha256sum] = "e02d9ac21cebda6e46435369744a92c65cc7cd8669697694122cf97ffacd1e53" +SRC_URI[sha256sum] = "de414a57119abef52784d8993e341d53aed635fc2b05c2607d9f98a2c5b72032" # exclude pre-releases for both python 2.x and 3.x UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P\d+(\.\d+)+).tar" From patchwork Thu Oct 29 17:17:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 102396 Received: from mta-65-228.siemens.flowmailer.net (mta-65-228.siemens.flowmailer.net [185.136.65.228]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.17320.1793294289527536559 for ; Thu, 29 Oct 2026 10:18:10 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=kKiHe4SN; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.228, mailfrom: fm-256628-20261029171807a8e9707ebd00020702-uqyf1g@rts-flowmailer.siemens.com) Received: by mta-65-228.siemens.flowmailer.net with ESMTPSA id 20261029171807a8e9707ebd00020702 for ; Thu, 29 Oct 2026 18:18:07 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=x/Xuvf6unqg6EitbgF8kpbug3vn1ccWAjEl2ou96soM=; b=kKiHe4SNhqA7iZlrCoxCjR9yjt/AmRvnK06CyzomU0IEP77obHwaaGiQ7phuAoabq9mKUr 5TFotR0zGu2+oyhrJHlFPIyqs1RavHZvNURs8EQwjMb1uKND3Me4UBPVIkMTwyMzvpCZyDf/ DhZAkZOYBwvjwm88LtxJkGuW0rjMtQjyhw0BP+8AguadHurbaNUUDc7QilT0SjiTDRB7fX+h YiDsNmaahL/v4DIbYR+0Yfsa9a0QLaoanqwwfDSiZKTxjrxF7eeGK5kp2W14bFGGYCqP6bKd OsnXfsnxr84EE2Xl/UasLEUx1gbEl9k2De4xFTepa8cEZXO9x2dGL8zg==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [blacksail][PATCH 3/8] systemd: add iproute2-devlink runtime dependency to udev Date: Thu, 29 Oct 2026 18:17:01 +0100 Message-ID: <20261029171709.2842512-3-peter.marko@siemens.com> In-Reply-To: <20261029171709.2842512-1-peter.marko@siemens.com> References: <20261029171709.2842512-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 17:18:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248959 From: Peter Marko Service file ${nonarch_libdir}/udev/rules.d/81-net-bridge.rules executes /usr/sbin/devlink which causes errors seen in journal on systems which don't install this package explicitly. Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (From OE-Core rev: 69bf564780353d34cfd87bf73960cfadd8b2c6ac) Signed-off-by: Peter Marko --- meta/recipes-core/systemd/systemd_261.3.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-core/systemd/systemd_261.3.bb b/meta/recipes-core/systemd/systemd_261.3.bb index 0901736e7c..1f482d988e 100644 --- a/meta/recipes-core/systemd/systemd_261.3.bb +++ b/meta/recipes-core/systemd/systemd_261.3.bb @@ -764,6 +764,7 @@ FILES:libsystemd-shared = "${libdir}/systemd/libsystemd-shared*.so" RPROVIDES:udev = "hotplug" +RDEPENDS:udev += "iproute2-devlink" RDEPENDS:udev-bash-completion += "bash-completion" RDEPENDS:udev-hwdb += "udev" From patchwork Thu Oct 29 17:17:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 102397 Received: from mta-65-228.siemens.flowmailer.net (mta-65-228.siemens.flowmailer.net [185.136.65.228]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.17320.1793294289527536559 for ; Thu, 29 Oct 2026 10:18:13 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=hizfZ0kB; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.228, mailfrom: fm-256628-20261029171812a7383e878900020796-_wktuq@rts-flowmailer.siemens.com) Received: by mta-65-228.siemens.flowmailer.net with ESMTPSA id 20261029171812a7383e878900020796 for ; Thu, 29 Oct 2026 18:18:12 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=d9i3mDrPF0UYuW/RcGaFodfHMzIcEIdkT0srAuJlzMU=; b=hizfZ0kB7XYCa3JXWzqu28AlGyAl71MD3kHUkQ6WbHKoF7Q9ifPGhnoSEDdcMEmJJueetb q+z1b/W5oVTat/7H91mGYiyrsroUYXOpBZ/dT7Td0NSGIg0HN74aJKyuTKUOZHRqCdIPJ66m ZFzUf2yone8dlvx2De36dttlyHPLO5iT4Xko1uwI80TJNo1MNRhCBl9VtN7S4ZdcmEVSqhQi Naop8I3Zsc2pk6M27WYBn3bjUVLrbjeJAhtBIhjB9B3+z3aeyXxaC/3r71KxoVfllMrhHZyr F+OaTzg3lHcP0EHEqkOi4Lr+FxWZoWBynquh2poPEvQrBDln7peA++Gg==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [blacksail][PATCH 4/8] bind: upgrade 9.20.29 -> 9.20.30 Date: Thu, 29 Oct 2026 18:17:02 +0100 Message-ID: <20261029171709.2842512-4-peter.marko@siemens.com> In-Reply-To: <20261029171709.2842512-1-peter.marko@siemens.com> References: <20261029171709.2842512-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 17:18:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248960 From: Jaipaul Cheernam ReleaseNotes: https://bind9.readthedocs.io/en/v9.20.30/notes.html#notes-for-bind-9-20-30 CVE fixes: CVE-2026-19630, CVE-2026-96888, CVE-2026-97313, CVE-2026-94300 - Other bug fixes are mentioned in ReleaseNotes. - Refresh existing patches Signed-off-by: Jaipaul Cheernam Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (From OE-Core rev: 3d52bad81bb24f84af630b9bbd3cadd7048ceec5) Signed-off-by: Peter Marko --- .../bind/bind/0001-avoid-start-failure-with-bind-user.patch | 2 +- .../0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch | 2 +- ...0001-named-lwresd-V-and-start-log-hide-build-options.patch | 4 ++-- ...bind-ensure-searching-for-json-headers-searches-sysr.patch | 4 ++-- meta/recipes-connectivity/bind/bind/conf.patch | 2 +- .../bind/bind/init.d-add-support-for-read-only-rootfs.patch | 2 +- .../bind/bind/make-etc-initd-bind-stop-work.patch | 2 +- .../bind/{bind_9.20.29.bb => bind_9.20.30.bb} | 2 +- 8 files changed, 10 insertions(+), 10 deletions(-) rename meta/recipes-connectivity/bind/{bind_9.20.29.bb => bind_9.20.30.bb} (97%) diff --git a/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch b/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch index 15796a15fb..d302bc1481 100644 --- a/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch +++ b/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch @@ -1,4 +1,4 @@ -From 95141cf9494292fc5645165ef3d5e9e2ed2208c6 Mon Sep 17 00:00:00 2001 +From 1c087c24e8162c7a042cf1f19ad313e0f3a21196 Mon Sep 17 00:00:00 2001 From: Chen Qi Date: Mon, 15 Oct 2018 16:55:09 +0800 Subject: [PATCH] avoid start failure with bind user diff --git a/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch b/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch index 99e781799d..eb0adcfabe 100644 --- a/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch +++ b/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch @@ -1,4 +1,4 @@ -From 06e9624eb7e474a08ed7e1a456bfe9759ba211da Mon Sep 17 00:00:00 2001 +From aa978a473328123575af0270dc1dd274050bdfc0 Mon Sep 17 00:00:00 2001 From: Khem Raj Date: Fri, 10 Apr 2026 23:33:49 +0000 Subject: [PATCH] m4: Backport ax_prog_cc_for_build.m4 macros diff --git a/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch b/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch index 80a4f2abde..5871fb433c 100644 --- a/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch +++ b/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch @@ -1,4 +1,4 @@ -From f28920a59b658fcda24efde1c45322f785a0b0fe Mon Sep 17 00:00:00 2001 +From 525570781b873c3434df49ac753afca7c1bd9613 Mon Sep 17 00:00:00 2001 From: Hongxu Jia Date: Mon, 27 Aug 2018 21:24:20 +0800 Subject: [PATCH] `named/lwresd -V' and start log hide build options @@ -20,7 +20,7 @@ Signed-off-by: Armin Kuster 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac -index 0bc3965..e1c2b12 100644 +index 4d02c6e..225f59c 100644 --- a/configure.ac +++ b/configure.ac @@ -35,7 +35,7 @@ AC_DEFINE([PACKAGE_VERSION_EXTRA], ["][bind_VERSION_EXTRA]["], [BIND 9 Extra par diff --git a/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch b/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch index 323985a402..73300b46e8 100644 --- a/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch +++ b/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch @@ -1,4 +1,4 @@ -From f003f396067e6cc1e2ec609b296bb642b8ddf47b Mon Sep 17 00:00:00 2001 +From 4388bec9a8ebd7d9dded4b1942a5670cdaec064f Mon Sep 17 00:00:00 2001 From: Paul Gortmaker Date: Tue, 9 Jun 2015 11:22:00 -0400 Subject: [PATCH] bind: ensure searching for json headers searches sysroot @@ -32,7 +32,7 @@ Signed-off-by: Paul Gortmaker 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac -index 26c442a..0bc3965 100644 +index 75088e5..4d02c6e 100644 --- a/configure.ac +++ b/configure.ac @@ -872,7 +872,7 @@ AS_CASE([$with_lmdb], diff --git a/meta/recipes-connectivity/bind/bind/conf.patch b/meta/recipes-connectivity/bind/bind/conf.patch index 28ee4ae74d..f88f93951f 100644 --- a/meta/recipes-connectivity/bind/bind/conf.patch +++ b/meta/recipes-connectivity/bind/bind/conf.patch @@ -1,4 +1,4 @@ -From 5fc3dfd3f994b5fd97e97837eee2ad808cd8af93 Mon Sep 17 00:00:00 2001 +From 65c90b60cc9f30c383b8e30b900abd04bc977bd1 Mon Sep 17 00:00:00 2001 From: Qing He Date: Tue, 30 Nov 2010 13:35:42 +0800 Subject: [PATCH] bind: add new recipe diff --git a/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch b/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch index b373251c47..388335b271 100644 --- a/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch +++ b/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch @@ -1,4 +1,4 @@ -From 42c109317070d19fda70635b7043cbc6f9ec36ef Mon Sep 17 00:00:00 2001 +From c58e1309e80449ecc1fa1fa793630b53c08f958e Mon Sep 17 00:00:00 2001 From: Chen Qi Date: Thu, 27 Mar 2014 02:34:41 +0000 Subject: [PATCH] init.d: add support for read-only rootfs diff --git a/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch b/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch index 74cf947787..bd6ada8822 100644 --- a/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch +++ b/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch @@ -1,4 +1,4 @@ -From 2e1314f2e71be15704ba18756250185b36a5c0da Mon Sep 17 00:00:00 2001 +From ad9cb821a119f441f6131e01715d5e0eab368fc0 Mon Sep 17 00:00:00 2001 From: Roy Li Date: Thu, 15 Nov 2012 02:27:54 +0000 Subject: [PATCH] bind: make "/etc/init.d/bind stop" work diff --git a/meta/recipes-connectivity/bind/bind_9.20.29.bb b/meta/recipes-connectivity/bind/bind_9.20.30.bb similarity index 97% rename from meta/recipes-connectivity/bind/bind_9.20.29.bb rename to meta/recipes-connectivity/bind/bind_9.20.30.bb index c280d5b98d..44f09ceaa8 100644 --- a/meta/recipes-connectivity/bind/bind_9.20.29.bb +++ b/meta/recipes-connectivity/bind/bind_9.20.30.bb @@ -21,7 +21,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \ file://0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch \ " -SRC_URI[sha256sum] = "587029508b3b1b43229fae416c97e5543aba45809cefaca98a5004a02a5736c1" +SRC_URI[sha256sum] = "9e1443a40a72a30272cbc3196d020a6b2e26937111c83e59e101e82e1e3b4fef" UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/" # follow the ESV versions divisible by 2 From patchwork Thu Oct 29 17:17:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 102398 Received: from mta-64-227.siemens.flowmailer.net (mta-64-227.siemens.flowmailer.net [185.136.64.227]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.17324.1793294298892712538 for ; Thu, 29 Oct 2026 10:18:19 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=mx88WsRM; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.227, mailfrom: fm-256628-202610291718179e78cfb52d000207a2-rd0gqu@rts-flowmailer.siemens.com) Received: by mta-64-227.siemens.flowmailer.net with ESMTPSA id 202610291718179e78cfb52d000207a2 for ; Thu, 29 Oct 2026 18:18:17 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=CYS3KfeQoERb3PM/Tmu6ZiLqidHC3E/CfQFUPNalbGQ=; b=mx88WsRM1mMAjuUM2mPwme8TD6CeDpouXSjpLh0vkGXk6UzW27U8Lk2irC2CDvdltQT6lw FQvogZ1lqzSKYXDfLbydm49GdKo3O3FQkSZ3iZTByDmj/bNQBBTyIqOQafZD2o9/pfAbClQr JjikdZhcEjEuUTqWiQxkYcZC9cDkDwGDtRe5R1z4PoOujBhA+akzXUpt8Xnitv/AWCwWnL9O 5a4QDjNIHGBMhx9Be0nQN9lkrILZUo5ktlTNKieei+ix2sNHcGnyELooznQGeYgP8vozrEub STvsL3qdjtAF8b5oWMUeNssiuLp13da0MppJq5TedOzzf4ZkPc+FIanQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [blacksail][PATCH 5/8] bison: Fix CVE-2026-56390 Date: Thu, 29 Oct 2026 18:17:03 +0100 Message-ID: <20261029171709.2842512-5-peter.marko@siemens.com> In-Reply-To: <20261029171709.2842512-1-peter.marko@siemens.com> References: <20261029171709.2842512-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 17:18:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248961 From: Yogita Urade This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://cgit.git.savannah.gnu.org/cgit/bison.git/commit/?id=8d101c19d4d9aaedf83a448c925513742d4efcf0 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-56390 Signed-off-by: Yogita Urade Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (From OE-Core rev: eefec9cde464081f5943f4ad5c3cb688a87eff1f) Signed-off-by: Peter Marko --- .../bison/bison/CVE-2026-56390.patch | 236 ++++++++++++++++++ meta/recipes-devtools/bison/bison_3.8.2.bb | 1 + 2 files changed, 237 insertions(+) create mode 100644 meta/recipes-devtools/bison/bison/CVE-2026-56390.patch diff --git a/meta/recipes-devtools/bison/bison/CVE-2026-56390.patch b/meta/recipes-devtools/bison/bison/CVE-2026-56390.patch new file mode 100644 index 0000000000..a63f3952e3 --- /dev/null +++ b/meta/recipes-devtools/bison/bison/CVE-2026-56390.patch @@ -0,0 +1,236 @@ +From 8d101c19d4d9aaedf83a448c925513742d4efcf0 Mon Sep 17 00:00:00 2001 +From: Paul Eggert +Date: Thu, 23 Apr 2026 12:41:25 -0700 +Subject: [PATCH] bison: tighten up output file names +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Problem reported by Michał Majchrowicz. +* src/parse-gram.y: Do not allow '/' in %header and %output directives. + +CVE: CVE-2026-56390 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/bison.git/commit/?id=8d101c19d4d9aaedf83a448c925513742d4efcf0] + +Backport Changes: +- Adapted generated src/parse-gram.c to the Bison 3.8.2 source tree. +- omitted upstream generator-version/copyright metadata and + src/parse-gram.h-only metadata changes while retaining the + security-relevant parser changes. + +(cherry picked from commit 8d101c19d4d9aaedf83a448c925513742d4efcf0) +Signed-off-by: Yogita Urade +--- + THANKS | 1 + + doc/bison.texi | 2 ++ + src/parse-gram.y | 31 ++++++++++++++++++++++----- + src/parse-gram.c | 56 ++++++++++++++++++++++++++++++++---------------- + 4 files changed, 67 insertions(+), 23 deletions(-) + +diff --git a/THANKS b/THANKS +index be743a23..0e481561 100644 +--- a/THANKS ++++ b/THANKS +@@ -128,6 +128,7 @@ Michael Catanzaro mcatanzaro@gnome.org + Michael Felt mamfelt@gmail.com + Michael Hayes m.hayes@elec.canterbury.ac.nz + Michael Raskin 7c6f434c@mail.ru ++Michał Majchrowicz mmajchrowicz@afine.com + Michel d'Hooge michel.dhooge@gmail.com + Michiel De Wilde mdewilde.agilent@gmail.com + Mickael Labau labau_m@epita.fr +diff --git a/doc/bison.texi b/doc/bison.texi +index a559649c..44a4e159 100644 +--- a/doc/bison.texi ++++ b/doc/bison.texi +@@ -5973,6 +5973,7 @@ Introduced in Bison 3.8. + + @deffn {Directive} %header @var{header-file} + Same as above, but save in the file @file{@var{header-file}}. ++The @var{header-file} name should not contain slashes. + @end deffn + + @deffn {Directive} %language "@var{language}" +@@ -6026,6 +6027,7 @@ file, treating it as an independent source file in its own right. + + @deffn {Directive} %output "@var{file}" + Generate the parser implementation in @file{@var{file}}. ++The @var{file} name should not contain slashes. + @end deffn + + @deffn {Directive} %pure-parser +diff --git a/src/parse-gram.y b/src/parse-gram.y +index 15180cb5..114c5c44 100644 +--- a/src/parse-gram.y ++++ b/src/parse-gram.y +@@ -95,8 +95,11 @@ + string from the scanner (should be CODE). */ + static char const *translate_code_braceless (char *code, location loc); + ++ /* Is FILE a valid output file name? */ ++ static bool valid_output_file_name (char const *file); ++ + /* Handle a %header directive. */ +- static void handle_header (char const *value); ++ static void handle_header (location const *loc, char const *value); + + /* Handle a %error-verbose directive. */ + static void handle_error_verbose (location const *loc, char const *directive); +@@ -337,7 +340,7 @@ prologue_declaration: + muscle_percent_define_insert ($2, @$, $3.kind, $3.chars, + MUSCLE_PERCENT_DEFINE_GRAMMAR_FILE); + } +-| "%header" string.opt { handle_header ($2); } ++| "%header" string.opt { handle_header (&@2, $2); } + | "%error-verbose" { handle_error_verbose (&@$, $1); } + | "%expect" INT_LITERAL { expected_sr_conflicts = $2; } + | "%expect-rr" INT_LITERAL { expected_rr_conflicts = $2; } +@@ -356,7 +359,15 @@ prologue_declaration: + | "%name-prefix" STRING { handle_name_prefix (&@$, $1, $2); } + | "%no-lines" { no_lines_flag = true; } + | "%nondeterministic-parser" { nondeterministic_parser = true; } +-| "%output" STRING { spec_outfile = unquote ($2); gram_scanner_last_string_free (); } ++| "%output" STRING ++ { ++ char *file = unquote ($2); ++ if (valid_output_file_name (file)) ++ spec_outfile = file; ++ else ++ complain (&@2, complaint, _("invalid %%output file name ignored")); ++ gram_scanner_last_string_free (); ++ } + | "%param" { current_param = $1; } params { current_param = param_none; } + | "%pure-parser" { handle_pure_parser (&@$, $1); } + | "%require" STRING { handle_require (&@2, $2); } +@@ -952,14 +963,24 @@ add_param (param_type type, char *decl, location loc) + } + + ++static bool ++valid_output_file_name (char const *file) ++{ ++ return !strchr (file, '/'); ++} ++ ++ + static void +-handle_header (char const *value) ++handle_header (location const *loc, char const *value) + { + header_flag = true; + if (value) + { + char *file = unquote (value); +- spec_header_file = xstrdup (file); ++ if (valid_output_file_name (file)) ++ spec_header_file = xstrdup (file); ++ else ++ complain (loc, complaint, _("invalid %%header file name ignored")); + gram_scanner_last_string_free (); + unquote_free (file); + } +diff --git a/src/parse-gram.c b/src/parse-gram.c +index 3c1d8229..7f6deb33 100644 +--- a/src/parse-gram.c ++++ b/src/parse-gram.c +@@ -276,8 +276,11 @@ typedef enum yysymbol_kind_t yysymbol_kind_t; + string from the scanner (should be CODE). */ + static char const *translate_code_braceless (char *code, location loc); + ++ /* Is FILE a valid output file name? */ ++ static bool valid_output_file_name (char const *file); ++ + /* Handle a %header directive. */ +- static void handle_header (char const *value); ++ static void handle_header (location const *loc, char const *value); + + /* Handle a %error-verbose directive. */ + static void handle_error_verbose (location const *loc, char const *directive); +@@ -663,19 +666,19 @@ union yyalloc + /* YYRLINE[YYN] -- Source line where rule number YYN was defined. */ + static const yytype_int16 yyrline[] = + { +- 0, 310, 310, 319, 320, 324, 325, 331, 335, 340, +- 341, 342, 343, 344, 345, 350, 355, 356, 357, 358, +- 359, 360, 360, 361, 362, 363, 364, 365, 366, 367, +- 368, 372, 373, 382, 383, 387, 398, 402, 406, 414, +- 424, 425, 435, 436, 442, 455, 455, 460, 460, 465, +- 465, 470, 480, 481, 482, 483, 488, 489, 493, 494, +- 499, 500, 504, 505, 509, 510, 511, 524, 533, 537, +- 541, 549, 550, 554, 567, 568, 573, 574, 575, 593, +- 597, 601, 609, 611, 616, 623, 633, 637, 641, 649, +- 655, 668, 669, 675, 676, 677, 684, 684, 692, 693, +- 694, 699, 702, 704, 706, 708, 710, 712, 714, 716, +- 718, 723, 724, 733, 757, 758, 759, 760, 772, 774, +- 798, 803, 804, 809, 817, 818 ++ 0, 314, 314, 323, 324, 328, 329, 335, 339, 344, ++ 345, 346, 347, 348, 349, 354, 359, 360, 361, 362, ++ 363, 372, 372, 373, 374, 375, 376, 377, 378, 379, ++ 380, 384, 385, 394, 395, 399, 410, 414, 418, 426, ++ 436, 437, 447, 448, 454, 467, 467, 472, 472, 477, ++ 477, 482, 492, 493, 494, 495, 500, 501, 505, 506, ++ 511, 512, 516, 517, 521, 522, 523, 536, 545, 549, ++ 553, 561, 562, 566, 579, 580, 585, 586, 587, 605, ++ 609, 613, 621, 623, 628, 635, 645, 649, 653, 661, ++ 667, 680, 681, 687, 688, 689, 696, 696, 704, 705, ++ 706, 711, 714, 716, 718, 720, 722, 724, 726, 728, ++ 730, 735, 736, 745, 769, 770, 771, 772, 784, 786, ++ 810, 815, 816, 821, 829, 830 + }; + #endif + +@@ -2217,7 +2220,7 @@ yyreduce: + + case 9: /* prologue_declaration: "%header" string.opt */ + #line 340 "src/parse-gram.y" +- { handle_header ((yyvsp[0].yykind_75)); } ++ { handle_header (&(yylsp[0]), (yyvsp[0].yykind_75)); } + #line 2222 "src/parse-gram.c" + break; + +@@ -2289,7 +2292,14 @@ yyreduce: + + case 20: /* prologue_declaration: "%output" "string" */ + #line 359 "src/parse-gram.y" +- { spec_outfile = unquote ((yyvsp[0].STRING)); gram_scanner_last_string_free (); } ++ { ++ char *file = unquote ((yyvsp[0].STRING)); ++ if (valid_output_file_name (file)) ++ spec_outfile = file; ++ else ++ complain (&(yylsp[0]), complaint, _("invalid %%output file name ignored")); ++ gram_scanner_last_string_free (); ++ } + #line 2294 "src/parse-gram.c" + break; + +@@ -3290,14 +3300,24 @@ add_param (param_type type, char *decl, location loc) + } + + ++static bool ++valid_output_file_name (char const *file) ++{ ++ return !strchr (file, '/'); ++} ++ ++ + static void +-handle_header (char const *value) ++handle_header (location const *loc, char const *value) + { + header_flag = true; + if (value) + { + char *file = unquote (value); +- spec_header_file = xstrdup (file); ++ if (valid_output_file_name (file)) ++ spec_header_file = xstrdup (file); ++ else ++ complain (loc, complaint, _("invalid %%header file name ignored")); + gram_scanner_last_string_free (); + unquote_free (file); + } +-- +2.44.4 + diff --git a/meta/recipes-devtools/bison/bison_3.8.2.bb b/meta/recipes-devtools/bison/bison_3.8.2.bb index 03d3cffe2a..339a9d1336 100644 --- a/meta/recipes-devtools/bison/bison_3.8.2.bb +++ b/meta/recipes-devtools/bison/bison_3.8.2.bb @@ -13,6 +13,7 @@ SRC_URI = "${GNU_MIRROR}/bison/bison-${PV}.tar.xz \ file://autoconf-2.73.patch \ file://add-with-bisonlocaledir.patch \ file://CVE-2026-56389.patch \ + file://CVE-2026-56390.patch \ " SRC_URI[sha256sum] = "9bba0214ccf7f1079c5d59210045227bcf619519840ebfa80cd3849cff5a5bf2" From patchwork Thu Oct 29 17:17:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 102399 Received: from mta-64-225.siemens.flowmailer.net (mta-64-225.siemens.flowmailer.net [185.136.64.225]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.17325.1793294303889171220 for ; Thu, 29 Oct 2026 10:18:24 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=XJfw31ZG; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.225, mailfrom: fm-256628-202610291718227fedb83d7200020799-prj8vy@rts-flowmailer.siemens.com) Received: by mta-64-225.siemens.flowmailer.net with ESMTPSA id 202610291718227fedb83d7200020799 for ; Thu, 29 Oct 2026 18:18:22 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=SXDsQEmQE2cwBuCIw2boltJtGHCbJQoHjTDruXLVKy4=; b=XJfw31ZGVKef27a9DClw6jJh4kqia8cewhkArRtVWnEBTUfZSkzhF/KvygWX4MArOdDfR1 z1BbGAFqyqVVVTDuKAkiaJrb5zpTuGIyKsF/XguS8xFYh4Ap4cLRPKrjqFykwFJ2vWpulp/s cz1BheC2Mrsb+XzvWYvtppvJHtDiHlFQ7qxo6TCQvKfllSE2mjp7GITqwEfS3ItC9rZZDHQf qGE/Dx1G9bzUrF941nHsNKpcFfm6GSLvv+NgU10Ed9vwUp/HASK1uBJNG6WQvef7f5Kkcddn Jj/I4ioKeW3EVo1PQDr06I+yBYYfEQczMIAqL4jOlsAQ+2dSgsLHB4Bg==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [blacksail][PATCH 6/8] cups: upgrade 2.4.19 -> 2.4.20 Date: Thu, 29 Oct 2026 18:17:04 +0100 Message-ID: <20261029171709.2842512-6-peter.marko@siemens.com> In-Reply-To: <20261029171709.2842512-1-peter.marko@siemens.com> References: <20261029171709.2842512-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 17:18:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248962 From: Jaipaul Cheernam Release Notes: https://github.com/OpenPrinting/cups/releases/tag/v2.4.20 Changes: https://github.com/OpenPrinting/cups/blob/v2.4.20/CHANGES.md#v2420---2026-10-05 Assigned CVE ids: CVE-2025-55480, CVE-2026-61702, CVE-2026-87875, CVE-2026-87876, CVE-2026-55453, CVE-2026-55467, CVE-2026-105326 Signed-off-by: Jaipaul Cheernam Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (From OE-Core rev: ffad0699a46b2e34b8a986c7d94b758f09a07535) Signed-off-by: Peter Marko --- .../recipes-extended/cups/cups/0001-use-echo-only-in-init.patch | 2 +- .../cups/cups/0002-don-t-try-to-run-generated-binaries.patch | 2 +- .../cups/0004-cups-fix-multilib-install-file-conflicts.patch | 2 +- meta/recipes-extended/cups/cups/libexecdir.patch | 2 +- meta/recipes-extended/cups/{cups_2.4.19.bb => cups_2.4.20.bb} | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) rename meta/recipes-extended/cups/{cups_2.4.19.bb => cups_2.4.20.bb} (51%) diff --git a/meta/recipes-extended/cups/cups/0001-use-echo-only-in-init.patch b/meta/recipes-extended/cups/cups/0001-use-echo-only-in-init.patch index e4b473aaf3..ca92548cbe 100644 --- a/meta/recipes-extended/cups/cups/0001-use-echo-only-in-init.patch +++ b/meta/recipes-extended/cups/cups/0001-use-echo-only-in-init.patch @@ -1,4 +1,4 @@ -From 575a890a818e8ddc95d22838480b62988ffcd639 Mon Sep 17 00:00:00 2001 +From 4b7e48fb41dce9c10a4c4f91dc9fabfb14b9f1d7 Mon Sep 17 00:00:00 2001 From: Saul Wold Date: Thu, 13 Dec 2012 19:03:52 -0800 Subject: [PATCH] use echo only in init diff --git a/meta/recipes-extended/cups/cups/0002-don-t-try-to-run-generated-binaries.patch b/meta/recipes-extended/cups/cups/0002-don-t-try-to-run-generated-binaries.patch index 378ef677a5..b79b8be307 100644 --- a/meta/recipes-extended/cups/cups/0002-don-t-try-to-run-generated-binaries.patch +++ b/meta/recipes-extended/cups/cups/0002-don-t-try-to-run-generated-binaries.patch @@ -1,4 +1,4 @@ -From 36fa890e4b30bf42318065fe3172ef92b2d3e313 Mon Sep 17 00:00:00 2001 +From 9818e95ed747752e37d792693d3bf971af765084 Mon Sep 17 00:00:00 2001 From: Koen Kooi Date: Sun, 30 Jan 2011 16:37:27 +0100 Subject: [PATCH] don't try to run generated binaries diff --git a/meta/recipes-extended/cups/cups/0004-cups-fix-multilib-install-file-conflicts.patch b/meta/recipes-extended/cups/cups/0004-cups-fix-multilib-install-file-conflicts.patch index 2728fc7e3c..7dd5920338 100644 --- a/meta/recipes-extended/cups/cups/0004-cups-fix-multilib-install-file-conflicts.patch +++ b/meta/recipes-extended/cups/cups/0004-cups-fix-multilib-install-file-conflicts.patch @@ -1,4 +1,4 @@ -From 53aeff85692ce3fd0ac325ec7dcdff31748ccee6 Mon Sep 17 00:00:00 2001 +From c9c54505f5c1f77d598e8e1baea09a3794a4f5d9 Mon Sep 17 00:00:00 2001 From: Kai Kang Date: Wed, 3 Oct 2018 00:27:11 +0800 Subject: [PATCH] cups: fix multilib install file conflicts diff --git a/meta/recipes-extended/cups/cups/libexecdir.patch b/meta/recipes-extended/cups/cups/libexecdir.patch index 4acff27e54..4fdc2d7da4 100644 --- a/meta/recipes-extended/cups/cups/libexecdir.patch +++ b/meta/recipes-extended/cups/cups/libexecdir.patch @@ -1,4 +1,4 @@ -From fab57dbafccee851b22b757f08fc3273ad78b8ae Mon Sep 17 00:00:00 2001 +From 97f71812d2553661ccac15eaf7fd354824339ef8 Mon Sep 17 00:00:00 2001 From: Ross Burton Date: Tue, 13 Jul 2021 12:56:30 +0100 Subject: [PATCH] Use $libexecdir instead of hardcoding $prefix/lib as this diff --git a/meta/recipes-extended/cups/cups_2.4.19.bb b/meta/recipes-extended/cups/cups_2.4.20.bb similarity index 51% rename from meta/recipes-extended/cups/cups_2.4.19.bb rename to meta/recipes-extended/cups/cups_2.4.20.bb index c4885b60bc..18ab74c783 100644 --- a/meta/recipes-extended/cups/cups_2.4.19.bb +++ b/meta/recipes-extended/cups/cups_2.4.20.bb @@ -2,4 +2,4 @@ require cups.inc LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" -SRC_URI[sha256sum] = "820984b12a67f98705785aae2dd1347fe0ac097828001d4583ff64574aed6389" +SRC_URI[sha256sum] = "ab4d9cd7f3e58060091d2b24972223d6401675f11c49b65abf4f6ef31dea22ff" From patchwork Thu Oct 29 17:17:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 102400 Received: from mta-65-227.siemens.flowmailer.net (mta-65-227.siemens.flowmailer.net [185.136.65.227]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.17231.1793294309264531329 for ; Thu, 29 Oct 2026 10:18:29 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=PJJFfOvY; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.227, mailfrom: fm-256628-20261029171827a2d95e1f0400020706-f34tay@rts-flowmailer.siemens.com) Received: by mta-65-227.siemens.flowmailer.net with ESMTPSA id 20261029171827a2d95e1f0400020706 for ; Thu, 29 Oct 2026 18:18:27 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=tNHllWYp3t9KOerlTl2jmum22d/GK0vLQCA12omFtHk=; b=PJJFfOvYQTZJ38xhq8H7zxxS9dEZnxcQ5CSWQqq9+lDjnXzelk0rE4SMIV+Cusf3t9hm+V Tr9k+NCCZThThOLIYivn7GExR+ELkNfEvG86YsOjgya0HyRhFqKH+Fjzp9gC1mfkY1gDVS3c 0XTvZRFtDsW/zNpHV2ua6rqwKN4rVAUlb/YZr2HRY9isYo0kVG74iNTenHWAAfUqS/MNEyv5 k697KDDAKPaUHaxe0+2pKSbD4fkPwU1q/UvYvYf7M7UQ8d+vOT+/2BSp5nuwHdWXckylaDrr 9AWPEWX+O3dNlIBfX4upTT9LtIFZCqiCjktrIj3FNYDZVZxayhVQ/XcQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [blacksail][PATCH 7/8] libical: uprade 4.0.5 -> 4.0.6 Date: Thu, 29 Oct 2026 18:17:05 +0100 Message-ID: <20261029171709.2842512-7-peter.marko@siemens.com> In-Reply-To: <20261029171709.2842512-1-peter.marko@siemens.com> References: <20261029171709.2842512-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 17:18:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248963 From: Ross Burton Drop upstreamed patch. - CVE: Fix UBSAN issue "bsearch comparator through an incompatible function pointer" - RFC5545 section 3.3.5 Date-Time fixes: - Resolve local times in a fall-back overlap to the first occurrence - Fix explicit local time in a DST gap resolves using the post-transition offset - RFC5545 section 3.3.10 Recurrence Rule fixes: - FREQ=WEEKLY with BYMONTH and BYSETPOS loses occurrences in the week straddling month boundary - libicalvcard: the typed vcardvalue getters now check that the value type of the property uses the same union member as the expected value type of the getter. If the type mismatches, then they return the zero value for the expected value type. The typed setters error with ICAL_BADARG_ERROR instead of overwriting a value held in another union member. - libicalvcal: Fixed a memory leak in vobject.c - Buildsystem changes: - Fix build paths in installed cmake files (esp. for cross-compiling) - Install the libicalversion.h header - Fix building libical as a submodule in a larger CMake project - Fix "now" linker support check in the hardening compiler options - Fix the DESTINATION path for libical.jar - Use private linkage for 3rdparty libraries (icu, glib, ..) - Built-in timezones updated to tzdata2026e. - Remove ancient hack (since 2012) to support malformed TZID parameters Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (From OE-Core rev: 3c04485f3effa61811fabadb52473ee29bc95f1e) Signed-off-by: Peter Marko --- ...001-Mark-ICU-as-private-linkage-1366.patch | 76 ------------------- .../{libical_4.0.5.bb => libical_4.0.6.bb} | 6 +- 2 files changed, 2 insertions(+), 80 deletions(-) delete mode 100644 meta/recipes-support/libical/libical/0001-Mark-ICU-as-private-linkage-1366.patch rename meta/recipes-support/libical/{libical_4.0.5.bb => libical_4.0.6.bb} (91%) diff --git a/meta/recipes-support/libical/libical/0001-Mark-ICU-as-private-linkage-1366.patch b/meta/recipes-support/libical/libical/0001-Mark-ICU-as-private-linkage-1366.patch deleted file mode 100644 index 53bd1683af..0000000000 --- a/meta/recipes-support/libical/libical/0001-Mark-ICU-as-private-linkage-1366.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 13642054f650795446f6020d9d2e14d147b8da51 Mon Sep 17 00:00:00 2001 -From: Ross Burton -Date: Wed, 2 Sep 2026 16:14:44 +0100 -Subject: [PATCH] Mark ICU as private linkage (#1366) - -* libical-glib: Hide some target options in the installed CMake files - -The build paths could be shown in the installed .cmake files, thus -hide them from there, because they are not needed. - -Closes https://github.com/libical/libical/issues/532 - -* libical: mark ICU linkage as private - -There's no need to expose the ICU linkage publically as the .so will -pull this in itself. - -This has a side-effect of removing build/sysroot paths from the installed -.cmake files. - -Closes #532. - ---------- - -Co-authored-by: Milan Crha -(cherry picked from commit 38c7e6d31a3a1a4bd67479f402c323fb0679271e) - -Upstream-Status: Backport [libical 13642054f650795446f6020d9d2e14d147b8da51] -Signed-off-by: Ross Burton ---- - src/libical-glib/CMakeLists.txt | 9 +++++---- - src/libical/CMakeLists.txt | 2 +- - 2 files changed, 6 insertions(+), 5 deletions(-) - -diff --git a/src/libical-glib/CMakeLists.txt b/src/libical-glib/CMakeLists.txt -index d63bbf3c..470a4d22 100644 ---- a/src/libical-glib/CMakeLists.txt -+++ b/src/libical-glib/CMakeLists.txt -@@ -24,16 +24,17 @@ if(NOT DEFINED LIBXML2_DEFINITIONS) - endif() - target_compile_options( - ical-glib-src-generator -- PUBLIC -+ PRIVATE - ${GLIB_CFLAGS} - ${LIBXML2_DEFINITIONS} - -DG_LOG_DOMAIN=\"src-generator\" - ) - target_link_libraries( - ical-glib-src-generator -- ${GLIB_LDFLAGS} -- ${GOBJECT_LDFLAGS} -- ${LIBXML2_LIBRARIES} -+ PRIVATE -+ ${GLIB_LDFLAGS} -+ ${GOBJECT_LDFLAGS} -+ ${LIBXML2_LIBRARIES} - ) - - install( -diff --git a/src/libical/CMakeLists.txt b/src/libical/CMakeLists.txt -index 6fc2e953..583f2eeb 100644 ---- a/src/libical/CMakeLists.txt -+++ b/src/libical/CMakeLists.txt -@@ -294,7 +294,7 @@ if(DEFINED CMAKE_THREAD_LIBS_INIT) - target_link_libraries(ical ${CMAKE_THREAD_LIBS_INIT}) - endif() - if(ICU_FOUND) -- target_link_libraries(ical ${ICU_LIBRARIES}) -+ target_link_libraries(ical PRIVATE ${ICU_LIBRARIES}) - if(VCPKG_MANIFEST_MODE) - if(NOT APPLE AND NOT WIN32) - target_link_libraries(ical "m;stdc++") --- -2.43.0 - diff --git a/meta/recipes-support/libical/libical_4.0.5.bb b/meta/recipes-support/libical/libical_4.0.6.bb similarity index 91% rename from meta/recipes-support/libical/libical_4.0.5.bb rename to meta/recipes-support/libical/libical_4.0.6.bb index e9b093544f..7b9185c374 100644 --- a/meta/recipes-support/libical/libical_4.0.5.bb +++ b/meta/recipes-support/libical/libical_4.0.6.bb @@ -10,10 +10,8 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=6d9294493d031c817783b0400a126c89 \ " SECTION = "libs" -SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BP}.tar.gz \ - file://0001-Mark-ICU-as-private-linkage-1366.patch \ - " -SRC_URI[sha256sum] = "cc09a3ac41d60e6144e644bd3fcf97d47106d659c4a0b8965102581401e67c9c" +SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BP}.tar.gz" +SRC_URI[sha256sum] = "2e3729cb69c282d3bb17a8d2b198af6e4bc7502fd3621c9adf573921fe9dceb0" inherit cmake pkgconfig gobject-introspection vala github-releases From patchwork Thu Oct 29 17:17:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 102401 Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.17331.1793294314338368236 for ; Thu, 29 Oct 2026 10:18:34 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=Tc6zGxd2; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-256628-202610291718328a4e1b7b900002078f-uwsmnt@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 202610291718328a4e1b7b900002078f for ; Thu, 29 Oct 2026 18:18:32 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=n/q4++jztABydhSzHObSRTDN+BH9URleRN0wiVlEwis=; b=Tc6zGxd2hxLohT+IFhCD7NUY1httAkT80W4+0JK8YYfRs05zeTgikpnA83qb9DfPY+8XwF 6zKpDR0wXxgmHgRoQoxEPOtDdPOhjdF+sQqgPPaNNUL+dFBsTaa/6/flpJ2JEkZbXKARXYYn MwgRY4Me0eE0eUiZjLeQRNLCXOIOsJXF09/gV4CEeMSMiWWeETwSdnON0CRv7BMECFkpi7xW StfVIolw04qRuEdLY6gcdlHNua51Zin6iDg4vipuewlKk2+DSpeYovZPq43jSMy2ze9K7FFM PF3MD0gZoiO51TIJ3CPINpBk3qd2FMRKPXQe7dHowj+43Qu+6ZKLINxw==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [blacksail][PATCH 8/8] libical: upgrade 4.0.6 -> 4.0.7 Date: Thu, 29 Oct 2026 18:17:06 +0100 Message-ID: <20261029171709.2842512-8-peter.marko@siemens.com> In-Reply-To: <20261029171709.2842512-1-peter.marko@siemens.com> References: <20261029171709.2842512-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 17:18:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248964 From: Ross Burton - libicalvcard: - `vcardcomponent_clone()` and friends now deep-copy TEXTLIST values (e.g. NICKNAME, CATEGORIES) and structured parameters (JSCOMPS), and keep the property group. - Fixed a use-after-free and a memory leak when converting a vCalendar procedure alarm (PALARM) whose attachment is a plain path name. - libical: - Fix busy status of recurring events in `icalcomponent_foreach_recurrence()`. - Fix `icalvalue_decode_ical_string()` and `icallangbind_property_eval_string()` reading past the end of a string that ends in a backslash or a newline. - `icaltimezone_truncate_vtimezone()` no longer reads the RRULE after freeing it when the new DTSTART is within a year of UNTIL (RSCALE rules), and no longer uses an uninitialized onset when no RRULE occurrence falls before the window close. - Fix IMAGE and STRUCTURED-DATA given by URI (with or without VALUE=URI) parsing to a URI value, whose string `icalproperty_get_image()` and `icalproperty_get_structureddata()` then read as an icalattach pointer. - Fix use-after-free and double free in `icalcomponent_merge_component()` when both calendars have a VTIMEZONE with the same TZID. Every VTIMEZONE of the merged calendar is now merged, and a conflicting VTIMEZONE is added under a renamed TZID (e.g. "Zone1") that its events use. - Fix out-of-bounds access to the year days bitmask in the recurrence iterator when an RSCALE date falls outside the year (e.g. BYWEEKNO with a DTSTART before the calendar's epoch). - Fix `icalrecur_iterator_set_range()` for a reverse range on a rule without UNTIL, which started the iteration at year 0 instead of at 'from'. - Fix `icalparser_clean()` for proper reuse by resetting internal structure values and clearing the root component to avoid a use-after-free. - Behavior change: The typed icalvalue getters now check that the value type of the icalvalue uses the same union member as the expected value type of the getter, as the vcardvalue getters have done since version 4.0.6. If the type mismatches, then they return the zero value for the expected value type. The typed setters error with ICAL_BADARG_ERROR instead of overwriting a value held in another union member. - libicalss: - Fix heap-buffer-overflow in `icalspanlist_as_freebusy_matrix()` for busy spans that start before or end after the spanlist. `icalspanlist_from_vfreebusy()` now sets the spanlist start/end from DTSTART/DTEND and marks FBTYPE=FREE periods as free (all others as busy). - Buildsystem changes: - Fix CMake command target_link_libraries() to use all-keywords as required since CMake v4.4.4. - When cross-compiling, don't build/install ical-glib-src-generator w/o existing binary Signed-off-by: Ross Burton Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (From OE-Core rev: 0646b1d8b6ad5a4c49afd72487e2f28b7fa7b6c3) Signed-off-by: Peter Marko --- .../libical/{libical_4.0.6.bb => libical_4.0.7.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-support/libical/{libical_4.0.6.bb => libical_4.0.7.bb} (96%) diff --git a/meta/recipes-support/libical/libical_4.0.6.bb b/meta/recipes-support/libical/libical_4.0.7.bb similarity index 96% rename from meta/recipes-support/libical/libical_4.0.6.bb rename to meta/recipes-support/libical/libical_4.0.7.bb index 7b9185c374..cbfcb0675e 100644 --- a/meta/recipes-support/libical/libical_4.0.6.bb +++ b/meta/recipes-support/libical/libical_4.0.7.bb @@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=6d9294493d031c817783b0400a126c89 \ SECTION = "libs" SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BP}.tar.gz" -SRC_URI[sha256sum] = "2e3729cb69c282d3bb17a8d2b198af6e4bc7502fd3621c9adf573921fe9dceb0" +SRC_URI[sha256sum] = "47c05bc96e41416578cf1803bb2ba3f8d292cb17d5ac2fca539dee922bae8a94" inherit cmake pkgconfig gobject-introspection vala github-releases