From patchwork Thu Oct 29 20:30:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 102409 Received: from mta-65-227.siemens.flowmailer.net (mta-65-227.siemens.flowmailer.net [185.136.65.227]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.1722.1793305976197419351 for ; Thu, 29 Oct 2026 13:32:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=O2kpPre2; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.227, mailfrom: fm-256628-20261029203254d381c3ff3b000207e9-nwd4gy@rts-flowmailer.siemens.com) Received: by mta-65-227.siemens.flowmailer.net with ESMTPSA id 20261029203254d381c3ff3b000207e9 for ; Thu, 29 Oct 2026 21:32:54 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc; bh=to4kKSnfjecc4/E4gS9nL28EOUVD118tevqEoGJOl60=; b=O2kpPre22umrutgsZdTMfWvVkOl+xYB0KiKFTBATHLDC0iQLpn9AQT2sf6h0TBu2HIJyAA 5nOSULeNVL3xcpX+7d9pFh+5G9XyOuWNIPmpDWfSDWo1boH2fkXguinZyye0e72LasgJXT64 T8RbGzTTAZQS8bxf4VY8H+dCQOHRHIhHTF0/0slWt+zIv67r3D0Rakt6gC0c4gJlbwiINUes xIw4DdaWZXEMdZ4lOwZhW8+3xBLmOxEVdyh7r/gV7qrpqCyjqZ60XixKY+r1XK5LW0iuyvZB rCyYOfDSK54r8vsQeot5AhmD/4D9U6TWZQmFqNeI0Zw0Ykp7NiIkNsDg==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][wrynose][PATCH 1/2] zchunk: upgrade 1.5.3 -> 1.5.4 Date: Thu, 29 Oct 2026 21:30:41 +0100 Message-ID: <20261029203042.3210492-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 20:33:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131667 From: Wang Mingyu Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj Signed-off-by: Peter Marko --- .../recipes-support/zchunk/{zchunk_1.5.3.bb => zchunk_1.5.4.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-oe/recipes-support/zchunk/{zchunk_1.5.3.bb => zchunk_1.5.4.bb} (92%) diff --git a/meta-oe/recipes-support/zchunk/zchunk_1.5.3.bb b/meta-oe/recipes-support/zchunk/zchunk_1.5.4.bb similarity index 92% rename from meta-oe/recipes-support/zchunk/zchunk_1.5.3.bb rename to meta-oe/recipes-support/zchunk/zchunk_1.5.4.bb index fc5a55d192..9d587debfd 100644 --- a/meta-oe/recipes-support/zchunk/zchunk_1.5.3.bb +++ b/meta-oe/recipes-support/zchunk/zchunk_1.5.4.bb @@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=daf6e68539f564601a5a5869c31e5242" SRC_URI = "git://github.com/zchunk/zchunk.git;protocol=https;nobranch=1;tag=${PV}" -SRCREV = "366cf22e725fc273abe0e082c707753cce76c453" +SRCREV = "99e51afa38c723e7c25834c2c3b305d20ef55d04" DEPENDS = "zstd" DEPENDS:append:libc-musl = " argp-standalone" From patchwork Thu Oct 29 20:30:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 102410 Received: from mta-64-228.siemens.flowmailer.net (mta-64-228.siemens.flowmailer.net [185.136.64.228]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.1743.1793305996291422797 for ; Thu, 29 Oct 2026 13:33:16 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=IZUtex5G; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.228, mailfrom: fm-256628-2026102920331324252dc44d00020774-y8grqr@rts-flowmailer.siemens.com) Received: by mta-64-228.siemens.flowmailer.net with ESMTPSA id 2026102920331324252dc44d00020774 for ; Thu, 29 Oct 2026 21:33:14 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=b4SFnwTRw6uA7FQmbP6lwA1aHLn0+xVB2zPdrrrMWHw=; b=IZUtex5GlBp4XibQyJkpbIoXEHTeUsiwmp7X4FQArt9eLzo1K6fBPs7dcvShZEaSqaYbSb G8gifQWTb3v46AwvamlcfJcLlVIavYNV047h5l7eZCM+/zGrOwAo+MXTdB9o6wO7W9cNa84u ENPD39oAGdjnO59DdSTtUcJUlPfomnwrPlOG8tfqCPm317tRGJL2axjCARGtKXOewJp1ZG1M sWtmRk7vSOuLCI+U2FiGt0+OyesydspfKJytQSaQlJ/1XV+xGvAxDuEWiUUwIY2f8ZXVajSR qv5SGiXUlqnMM5ncgsJJiCyFgKNDzEqCQHZWgabVBHTF+9I7DJsyS9Ag==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][wrynose][PATCH 2/2] zchunk: upgrade 1.5.4 -> 1.5.5 Date: Thu, 29 Oct 2026 21:30:42 +0100 Message-ID: <20261029203042.3210492-2-peter.marko@siemens.com> In-Reply-To: <20261029203042.3210492-1-peter.marko@siemens.com> References: <20261029203042.3210492-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 20:33:23 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131668 From: Ankur Tyagi - Fix out-of-bounds read - Harden multipart download parsing against malicious servers - Harden chunk decompression and header parsing Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj Handle CVE-2026-117556. Signed-off-by: Peter Marko --- .../zchunk/{zchunk_1.5.4.bb => zchunk_1.5.5.bb} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename meta-oe/recipes-support/zchunk/{zchunk_1.5.4.bb => zchunk_1.5.5.bb} (81%) diff --git a/meta-oe/recipes-support/zchunk/zchunk_1.5.4.bb b/meta-oe/recipes-support/zchunk/zchunk_1.5.5.bb similarity index 81% rename from meta-oe/recipes-support/zchunk/zchunk_1.5.4.bb rename to meta-oe/recipes-support/zchunk/zchunk_1.5.5.bb index 9d587debfd..f84cd8d6fe 100644 --- a/meta-oe/recipes-support/zchunk/zchunk_1.5.4.bb +++ b/meta-oe/recipes-support/zchunk/zchunk_1.5.5.bb @@ -3,9 +3,9 @@ DESCRIPTION = "A file format designed for highly efficient deltas while maintain LICENSE = "BSD-2-Clause" LIC_FILES_CHKSUM = "file://LICENSE;md5=daf6e68539f564601a5a5869c31e5242" -SRC_URI = "git://github.com/zchunk/zchunk.git;protocol=https;nobranch=1;tag=${PV}" +SRC_URI = "git://github.com/zchunk/zchunk.git;protocol=https;branch=main;tag=${PV}" -SRCREV = "99e51afa38c723e7c25834c2c3b305d20ef55d04" +SRCREV = "ae8e9f5b1e820a906c39f7eaf231e71bef72a3a6" DEPENDS = "zstd" DEPENDS:append:libc-musl = " argp-standalone"