No CVEs specified, but NEWS states:
!5394 Backport various security fixes to glib-2-88
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5394
And a number of other bugfixes:
* Bugs fixed:
- #4011 gio/tests/services: Installed service file contains build path after
!5259 (Jaipaul Cheernam)
- #4020 ‘TLS callback not invoked’ error on msys2-clang64 CI job (Luca Bacci)
- !5262 Backport !5261 “gio/tests/services: Fix installed service file
containing build path” to glib-2-88
- !5273 Backport !5266 “docs: Fix gio gi-docgen docs_url” to glib-2-88
- !5285 Backport !5283 “gconstructor: Reference _tls_used also on GCC, CLang”
to glib-2-88
- !5323 Backport !5311 “fix: handle long filenames in trash by truncating from
front” to glib-2-88
- !5379 Update Norwegian Nynorsk translation
- !5394 Backport various security fixes to glib-2-88
* Translation updates:
- Norwegian Nynorsk (Roy-Magne Mo)
https://gitlab.gnome.org/GNOME/glib/-/blob/2.88.4/NEWS?ref_type=tags
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Fiona: fix typo in upstream NEWS link]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
This fixes the following vulnerability:
- CVE-2026-85091:
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow
vulnerability in the gz_vacate() function when processing non-blocking
gzwrite() operations with stale external buffer pointers. Attackers
can trigger the overflow by calling gzprintf() or gzvprintf() after a
write stall, causing an unchecked memmove() to write beyond the
internal input buffer boundary.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-85091
- https://security-tracker.debian.org/tracker/CVE-2026-85091
- df84af25dc.patch
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Switch to hatchling with hatch-vcs and use the PyPI source distribution,
which includes the version metadata needed by hatch-vcs.
Drop the obsolete six dependency and keep the remaining Python
dependencies as runtime selections.
Update the license hash for the removal of a trailing blank line:
f9d97a8bde
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Switch to hatchling with hatch-vcs and use the PyPI source distribution,
which includes the version metadata needed by hatch-vcs.
Restore the compatibility symlink omitted from the PyPI archive so the
wheel continues to provide the rtslib_fb module.
Replace the six runtime dependency with pyudev and propagate its
libudev requirement to targetcli-fb.
Update the license hash for the removal of a trailing blank line:
c44657500a
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Switch to hatchling with hatch-vcs and use the PyPI source distribution,
which includes the version metadata needed by hatch-vcs.
Restore the compatibility symlink omitted from the PyPI archive so the
wheel continues to provide the configshell_fb module.
Drop the obsolete six and urwid runtime dependencies. Select curses
explicitly, since it was previously pulled in by urwid.
Update the license hash for the removal of a trailing blank line:
36306fd6f8
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Since kernel v7.0, perf uses `rustc --version` to know whether or not
rust is available. If rust is installed on the host, this `rustc
--version` works fine but then the perf build fails with following error
(on aarch64) if host-rust isn't selected:
rustc /home/bastien/embedded-linux-imx93-frdm-labs/integration/buildroot/output/build/linux-7.1.3/tools/perf/tests/workloads/code_with_type.a
error[E0463]: can't find crate for `std`
|
= note: the `aarch64-unknown-linux-gnu` target may not be installed
= help: consider downloading the target with `rustup target add aarch64-unknown-linux-gnu`
error: aborting due to 1 previous error
In perf, rust is only used by one file of the test suite
(tools/perf/tests/workloads/code_with_type.rs) so we can safely disable
it.
Always use the NO_RUST flag to build perf.
Signed-off-by: Bastien Curutchet <bastien.curutchet@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
nettest depends, through rustls, quinn and rcgen, on the ring crate,
which refuses to build for 32-bit x86 targets without SSE and SSE2:
error[E0080]: evaluation panicked: assertion failed: cfg!(target_feature = "sse") && cfg!(target_feature = "sse2")
--> .../VENDOR/ring/src/cpu/intel.rs:26:9
This affects i586 and i686-class CPUs that lack SSE2
Make nettest depend on SSE2 support when building for i386.
Fixes: https://autobuild.buildroot.org/results/d04f770538412bee77851142ee007f2ff107e0ec
Fixes: 36fa003547 ("package/nettest: new package")
Signed-off-by: Bogdan Radulescu <bogdan@nimblex.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Drop --skip-dependency-check now that upstream restricts the
setuptools-rust build requirement to Windows and macOS.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Refresh the libudev loading workaround for the removal of an upstream
import-sorting comment.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Add the mypy-extensions runtime dependency for both target and host
packages. The vecs module now imports mypy_extensions unconditionally,
rather than only when the experimental vector support is enabled.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
