Skip to content

merge: Currency merge with upstream wrynose branch#200

Draft
erickshepherdNI wants to merge 817 commits into
ni:nilrt/master/nextfrom
erickshepherdNI:dev/upstream_merge
Draft

merge: Currency merge with upstream wrynose branch#200
erickshepherdNI wants to merge 817 commits into
ni:nilrt/master/nextfrom
erickshepherdNI:dev/upstream_merge

Conversation

@erickshepherdNI
Copy link
Copy Markdown

merge: Currency merge with upstream wrynose branch

Resolved the following conflicts:

  • meta/classes/create-spdx-2.2.bbclass
    • Deleted upstream as a part of deprecating spdx 2.2. I kept the file in the merge and then reverted the commit that had removed it since there were other files affected. We currently rely on spdx 2.2 and upgrading to 3.0 will require additional work on our end. Spdx 2.2 should be removed again before the dist-next merge.
  • meta/lib/oe/spdx30_tasks.py
    • The code we modified in 007b492 was removed upstream in 96a4b4b. Kept upstream changes.
  • meta/recipes-bsp/u-boot/u-boot.inc
    • A nearly change to our f816c65 was implemented by upstream in 6f58513. Kept upstream change.

AB#3738531

Arctize and others added 30 commits April 9, 2026 10:30
See systemd/systemd#41231 or the patch commit
message for details. The regression affects v259.1 to 259.5 as well as
v260.1. Requested a backport to v259 but for now a patch is needed.

Signed-off-by: Patrick Wicki <patrick.wicki@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fix several issues with double quotes in kernel command line

- Kernel options like 'opt="value"' were breaking the parser,
  causing the whole reminder of the command line to be ignored.
  The code only supported 'opt="word1 word2..."

- Setting variables without removing quotes in the value

- Setting variables to values with spaces without enclosing
  the value with quotes. This caused execution errors evaluating
  expressions like:
  bootparam_opt=word1 word2

The first fix is particularly needed for people using the kernel
"bootconfig" configuration parameters to add options to the kernel
command line:

CONFIG_BOOT_CONFIG=y
CONFIG_BOOT_CONFIG_EMBED=y
CONFIG_BOOT_CONFIG_EMBED_FILE="additional-bootargs.bootconfig"

This mechanism systematically adds quotes around options
with values, for example:
init="/sbin/preinit"

Without the fix, the wrong init program can be started from the
initramfs and debug messages are ignored when "debug" is
present after "init" in the kernel command line.

For readability and performance sake, also use shell variable operators
instead of "sed" to remove leading and trailing quotes.

Tested both on host and target machines.
With the below kernel command line:
rootwait init="/sbin/preinit" debug root=/dev/mmcblk0p2 console=ttymxc0 dyndbg="file drivers/usb/core/hub.c +pltf" quiet

The following variables are set:
bootparam_rootwait="true"
bootparam_init="/sbin/preinit"
bootparam_root="/dev/mmcblk0p2"
bootparam_debug="true"
bootparam_console="ttymxc0"
bootparam_dyndbg="file drivers/usb/core/hub.c +pltf"
bootparam_quiet="true"

Signed-off-by: Michael Opdenacker <michael.opdenacker@rootcommit.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The file udatatst.c really contains the string /build/tmp. When building
with kas-container the build directory is /build and hence the TMPDIR
becomes /build/tmp. This triggers the QA check *buildpaths*. To work around
this, slightly modify the string in the source code.

% grep -n -C2 /build/tmp source/test/cintltst/udatatst.c
136-    char* path=(char*)malloc(sizeof(char) * (strlen(ctest_dataOutDir())
137-                                           + strlen(U_ICUDATA_NAME)
138:                                           + strlen("/build/tmp/..")+1 ) );
139-
140-    char        *icuDataFilePath = 0;

Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Missing space before --uname ukify option mangles the command line
string when KERNEL_VERSION is set.

Signed-off-by: Pavel Löbl <pavel@loebl.cz>
Reviewed-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
  git://gitlab.gnome.org/GNOME/blueprint-compiler

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Full list of changes in this release is available at [0].

[0]: https://github.com/rpm-software-management/createrepo_c/releases/tag/1.2.3

Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
================
WebKitGTK 2.50.6
================

What's new in WebKitGTK 2.50.6?

  - Fix sample code included in the documentation of the
    webkit_user_content_manager_register_script_message_handler()
    function.
  - Fix MP4 muxing when using GStreamer 1.28.
  - Fix WebAudio not resuming correctly after using window.alert()
  - Fix WebAudio producing incorrect output in some cases due to
    incorrect sample buffer management.
  - Fix several crashes and rendering issues.

Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upgrade to latest revision of 1.24.0.
- Drop patches included in this release.
- Add patch to fix test-groff not found in cross-compilation.
- Add patch to use SOURCE_DATE_EPOCH in gropdf for reproducible PDF generation.
- COPYING, LICENSES: Refresh GPLv3 text.

Release Note:[https://lists.gnu.org/r/groff/2026-02/msg00149.html]

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
CVE-2026-33243 has been fixed in v2026.03.0[0] but introduced
a regression. v2026.03.1 contains a single commit to fix it[1].

Changelog : barebox/barebox@v2026.03.0...v2026.03.1
* FIT: handle hashed-nodes property not being in hashed nodes order

Release: https://github.com/barebox/barebox/releases/tag/v2026.03.1

[0]: barebox/barebox@55f25be
[1]: https://lore.kernel.org/barebox/abljJRMecNdejSD0@pengutronix.de/

Signed-off-by: Yanis BINARD <yanis.binard@smile.fr>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If the merge of all config snippets leads to a SUID binary without any
applets, do not build and install it to reduce the SUID binaries in the
system.

Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Enable busybox’s mkfs.vfat (mkdosfs) implementation using a dedicated
mkdosfs.cfg config fragment.

While dosfstools provides mkfs.vfat and is available through
update-alternatives, it is licensed under GPLv3. Busybox also includes a
lightweight mkfs.vfat implementation that is suitable for minimal images
and systems relying primarily on busybox utilities.

Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Grub would report an error message in boot stage as below:

   "error: no such device: ((hd0,gpt1)/EFI/BOOT)/EFI/BOOT/grub.cfg"

Consequently, the root variable is not set, and the intended protection
against cross-device configuration loading (the purpose of the original 2014 commit)
is lost.

The most robust fix is to use the --hint parameter.
This separates the search target from the device hint, avoiding
fragile string concatenation and supporting both prefixed and
non-prefixed $cmdpath formats.

Fixes: 5ce73b6 ("grub: add cmdpath to grub configuration file")
Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* The closedcaption plugin no longer depends on cairo and pango.
* Explicitly disable new plugins that require external dependencies:
  * hip
  * mpeghdec
  * tflite
  * tflite-edgetpu
  * tflite-vsi
  * vmaf
  * wpe2

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
0002-tests-add-support-for-install-the-tests.patch
refreshed for 1.28.0

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes since 1.28.0
* b2a3b2e: Back to development after 1.28.0
* f8b4f2a: input-selector: fix race condition selecting next active pad
* 193b858: input-selector: gracefully handle active pad disappearance
* 52f8be4: input-selector: don't consider pad being released checking
  for eos
* c711f7c: input-selector: fix regression receiving eos event
* 3d48df2: input-selector: don't wait for active pad when eos
  (active-segment mode)
* 583ae1a: typefindhelper: EOS case explained in more details
* 305fb65: gst: Fix a couple of new const-ness warnings around strstr()
  usage
* 88cdc0d: ptpclock: Fix potential out-of-bounds read when parsing
  ANNOUNCE messages
* 443fb64: ptpclock: Fix copy-paste mistake in error messages
* c520284: ptpclock: Initialize PTP message to avoid invalid
  uninitialized variable warning
* f8f0df1: caps: gst_caps_append_structure should not allow NULL
  structure
* d08ede5: aggregator: Various introspection annotations / docs fixes
  for vfuncs
* 1a98767: filesink: Add debug category to file write helper
* 1f415d1: filesink: Report write error correctly on Windows
* 1aa6b48: multiqueue: reverse playback: use segment stop position as
  start time
* c7e0e43: aggregator: Handle gap event before segment
* 816e87b: bitwriter: Steal owned data in reset_and_get_data()
* 7c2da22: tests: bitwriter: Fix leak in test
* 835da19: modules: Remove NEWS from git which is generated from full
  release notes
* 201b14e: modules: remove RELEASE from git, will be generated from
  template on dist
* 7694a7d: modules: remove subproject README.md from git
* 6376a84: modules: dist common files from monorepo root
* 291e479: meson: Deprecate `system = 'ios'` in cross files, use
  subsystem
* d609133: gstcheck: Disable fork on tvOS and watchOS
* 55bea0a: gstreamer: Stop using deprecated G_MODULE_SUFFIX
* 020a8fd: registry: Skip .dSYM bundles when loading plugins, try 2
* d8b40e3: gst-stats: Also allow ANSI colored logs without 0x in front
  of the thread id
* c21305a: gst: Add explanatory comment to call_async implementation
* dcb37e2: Release 1.28.1
* 32113a6: Back to development after 1.28.1
* 216d38a: all: GThreadFunc return type fixes
* e76eebd: registry: Skip recursion into and from .dSYM bundles
* 9a94133: filesink: Fix wrong open() in overwrite mode
* 749cbe0: baseparse: Preserve upstream buffer duration if possible
* f71eb59: bin: iterator is not nullable
* 1b3939b: baseparse: Fix out_buffer leak in frame_free and missing ref
  in frame_copy
* 1afd273: gstreamer: update translations
* cf7231d: queue: Fix potential use-after-free in log function
* 43421c2: Release 1.28.2

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes since 1.28.0
* b2a3b2e: Back to development after 1.28.0
* e2c7b85: input-selector: add pad release stress test
* 6cb0626: input-selector: add test eos for remaining non active pad
* c4f4ad2: typefindfunctions: Promote y4m_typefind
* 62629e5: decodebin3: Ensure input->collection is always coherent
* cad6787: decodebin3: Improve handling collection change on existing
  pad
* 7365663: rtp: Add mappings for H266 and AV1 encoding-names
* 3d82e94: base: Fix a couple of new const-ness warnings around
  strstr() usage
* 848766d: gl: Fix explicit enabling of EAGL support on iOS
* 47576c7: eagl: Auto-resize when the UIView window is resized
* 4faeb36: audiorate: Handle SEGMENT_DONE the same way as EOS
* 2a7e50c: videodecoder: Handle recovery from temporary reordered
  output
* d6fb546: playsink: unref color balance channels with g_object_unref()
* efc09c7: decodebin3: Fix switch to smaller collections
* acbe1ed: rtsp: Validate transport parameter parsing in RFC 2326
* 746553b: glsrcbin: adapt klass "Src" to "Source"
* a02c813: audiodecoder: Only forward gap events immediately if no
  frames are pending
* 045b7a0: videodecoder: Move gap event handling into a helper function
* ff28f77: videodecoder: Don't directly forward gap events if the
  decoder is not drained
* b1c6307: videofilter: Add VIDEO_ALIGNMENT to downstream pool
* 835da19: modules: Remove NEWS from git which is generated from full
  release notes
* 201b14e: modules: remove RELEASE from git, will be generated from
  template on dist
* 7694a7d: modules: remove subproject README.md from git
* 6376a84: modules: dist common files from monorepo root
* c6ea1f1: compositor: Do copy_metas also for background frame
* 291e479: meson: Deprecate `system = 'ios'` in cross files, use
  subsystem
* d765ba7: eagl: Add support for tvOS
* 507fa0a: gstgl: Fix incorrect usage of G_MODULE_SUFFIX on macOS
* e14eecd: video-converter: Do not transform_metas with 0 width or
  height
* 133c200: meson: Fix building of examples/gl/qt/qglwtextureshare
* 377a41d: riff: Correctly check that enough RGB palette data is
  available
* dcb37e2: Release 1.28.1
* 32113a6: Back to development after 1.28.1
* de557ba: glcolorconvert: Fix NULL pointer dereference on buffers
  without video meta
* 216d38a: all: GThreadFunc return type fixes
* ecbaac1: rtpbuffer: Add validation for CSRC list length
* 8b1dec6: rtcp: Fix buffer overread in SDES packet parsing
* 3e5ac12: opusenc: Use correct memcpy() size when copying Vorbis
  channel positions
* 8b4ea49: video-converter: fix I420/A420/AYUV BGRA/ARGB output on
  big-endian
* cad4597: videorate: Fix unrestored caps on backward PTS
* ae535bd: video: fix too small default stride for UYVP with odd widths
* 6c2d5bd: gl: upload: Optimize EGL format check when there is no
  context
* 8112ede: gl: upload: Fix linking glupload with restrictive caps
  filter
* 5daccd1: gst-plugins-base: update translations
* 69d7aed: compositor: move gst_compositor_init_blend() to element
  class_init
* 2f35652: rtsp: gstrtspurl: Parse URL having user without password
* ae8c618: videodecoder: Fix different seqnum error
* 9e4e4a3: audiodecoder: Fix different seqnum error
* 13f2638: base: audioencoder: Remove fixed caps from srcpad
* 9379c4a: exiftag: Unmap buffer if parsing a rational number gives a
  zero denominator
* 87c7096: playback: Make sure to check for empty/any caps before
  getting the first structure
* add1c1f: parsebin: Remove pointless casts
* 2a437f9: exiftag: Ignore invalid fractions with numerator/denominator
  G_MININT
* 9949c53: audio-resampler-neon: read array operand by hand
* d33fc55: subparse: Replace a `g_strv_length()` in a loop header with
  more efficient code
* a41cbb4: subparse: Replace regex string matching / replacing with
  plain C string parsing
* 3a81eb4: subparse: Fix handling of closing of multi-byte tags
* 12fc1ed: subparse: Avoid NULL-pointer dereferences in mdvdsub parsing
  code
* 7617d9e: typefind: Avoid signed 32 bit integer overflow when parsing
  AV1 LEB128 values
* b86af52: typefind: Use a byte reader for parsing AV1 bitstreams
* d9c7e28: typefind: Allow G_MAXUINT32 as LEB128 encoded value when
  parsing AV1 bitstreams
* 1f78c53: typefind: Remove dead code in AV1 LEB128 parser
* 66044db: exiftag: Use g_malloc() instead of malloc()
* aeef929: exiftag: Add missing bounds check and integer overflow
  protections in various places
* e47f697: exiftag: Parse sensitivity value with the correct number of
  bits and endianness
* 7f6db3d: subparse: Fix integer overflow when calculating qttext
  timestamp
* 5e78c44: audio-resampler-neon: read array operand by hand, part 2
* 43421c2: Release 1.28.2

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes since 1.28.0
* b2a3b2e: Back to development after 1.28.0
* 99c68cb: meson: Fix libxml2 not building due to wrong option type
* 8388e74: qtdemux: Improve debug output around seek event handling
* db3c0c6: qtdemux: Rename last mention of last_stop to position
* 19e3c57: qtdemux: Set the segment position to the start on EOS in
  reverse playback mode
* 5c681d2: v4l2: Add v4l2av1dec stateful decoder support
* 6438539: v4l2: update gst plugins cache
* d3c0283: vpxdec: Support downstream pools with alignment requirements
* 0edccca: qtdemux: Don't ignore flow return when pushing queued
  buffers downstream
* ff3edfc: qtdemux: Make sure to not output the same samples multiple
  times in reverse playback mode
* d415a2b: qtdemux: Push raw audio/video buffers downstream in reverse
  order if rate < 0
* e1c1979: wavpackparse: Parse 32 bit sample rate and channel masks
* 74d8469: wavpackparse: Print hexadecimal numbers with leading zeroes
  for easier reading
* d296187: wavpackparse: Sync flags with latest wavpack
* 4ad4418: wavpackparse: Include sample type (int / float / dsd) in the
  caps
* 6631df5: wavpackparse: Correctly parse and advertise depth vs. width
* f4d6909: wavpackdec: Set OPEN_NORMALIZE flag to normalize floating
  point samples into the [-1,1] range
* 7005bb5: wavpackdec: Allow up to 4096 channels and up to maximum
  sample rate
* 7514ac2: wavpackdec: Re-create wavpack decoder on caps changes
* 2cda74a: wavpackdec: Output 24 bit samples as actual 24 bit samples
* 69e76ae: wavpackdec: Allocate output buffer via the base class
* 293e350: wavpackdec: Output 18 and 20 bit as their corresponding
  formats
* 4d3bdcb: wavpackenc: Extend caps a bit
* c5143e8: wavpackenc: Map buffer readwrite for channel reordering
* 3db67a3: wavpackenc: Add support for S8/S16/S18/S20/S24/S32 and F32
  samples
* 4704dfe: wavpack: Update plugin docs cache
* d333aeb: qml6glsrc: Fix rendering of scene with clipped items
* ee8e500: qml6glsrc: Fix scraping of QQuickWindow content
* 2b09aec: rtpsource: Add locking for receive reports table
* eaadb4d: gst-plugins-good: fix author name: Kentaro Fukuchi
* 0f77771: gst: fix author name: add missing closing angle bracket
* e92f814: rtph263pay: fix author name: where not separated by ','
* 4506913: gst-plugins: fix author name: correct incomplete or wrong
  emails
* d125725: gst: also adapt author names in the gst_plugins_cache.json
  files
* f68c471: rtpptdemux/rtpssrcdemux: adapt klass "Demux" to "Demuxer"
* 75ae4d7: gstrtspsrc: Set new mki in the encoder upon crypto update
* 09635fe: rtspsrc: Memory leak in gst_rtspsrc_close() when
  GST_RTSP_EEOF error occurs
* 835da19: modules: Remove NEWS from git which is generated from full
  release notes
* 201b14e: modules: remove RELEASE from git, will be generated from
  template on dist
* 7694a7d: modules: remove subproject README.md from git
* 6376a84: modules: dist common files from monorepo root
* 291e479: meson: Deprecate `system = 'ios'` in cross files, use
  subsystem
* 88febbc: osxaudio: Stop using HAVE_IOS, use TARGET_OS_* macros
  instead
* c3b73e9: qtdemux: Fix out-of-bounds read when parsing PlayReady DRM
  UUIDs
* b4558a4: rtpqdm2depay: error out if anyone tries to use this element
* 1171ae8: wavparse: Remove pointless duplicated GST_ROUND_UP_2()
* 3564405: wavparse: Use unsigned integers for data sizes
* c73a1f4: wavparse: Use GST_ROUND_UP_2() in two more places instead of
  a manual implementation
* 8822ee3: wavparse: Define maximum chunk size in a single place
* 081484e: wavparse: Avoid integer overflow and out-of-bounds read when
  parsing adtl chunks
* dcb37e2: Release 1.28.1
* 32113a6: Back to development after 1.28.1
* 5ee8c64: rtptwcc: fix feedback packet count wrapping at 255
* 216d38a: all: GThreadFunc return type fixes
* 180a877: rtph264depay: fix invalid memory access in
  gst_rtp_h264_finish_fragmentation_unit
* d824117: Qt6GLVideoItem: caps update fixed
* d6ed0a0: qtdemux: fix invalid WebVTT timestamps
* b8436bf: wavparse: Avoid overflow in length when setting
  ignore-length=true
* 586ff9c: wavparse: Fix parsing of RF64 wave files
* b08a64e: rgvolume: don't apply dBSPL reference level compensation for
  LUFS values
* 9ca0bd6: hlsdemux2: fix seekable range for live HLS streams
* 100a0e6: qtdemux: Don't immediately push segment after moov in push
  mode for fmp4
* 95919fa: wavenc: Skip writing empty LIST INFO chunk
* e717c43: gst-plugins-good: update translations
* 1ac03ff: qtdemux: fix handling of in-between fragments without tfdt
* 457b197: qtdemux: Preserve Metas and Flags when doing row alignment
* 27a9cc0: qtdemux: Avoid integer overflows when handling transform
  matrices
* 1279ec9: qtdemux: Don't store 64 bit integers in 32 bit integers to
  avoid overflows
* 0871bb2: qtdemux: Check that big enough stco/stsz are available when
  parsing sample tables
* 160bba0: qtdemux: Error out instead of trying to handle a truncated
  stts box
* b73c493: audioinvert: fix float truncation in transform_float
* bcc8c6e: qmlglsink: Fix for caps tracking on multiple setCaps calls
* 5ebb94c: qt6: Avoid parsing caps on every buffer
* 49bab9c: qt5: Avoid parsing caps on every buffer
* c4f56c0: rtspsrc: Discard early data in ONVIF mode
* 86e640a: rtspsrc: Fix const-correctness issue around strchr() usage
* 48cefc4: flvmux: fix race condition on caps get and check
* dbd4cb4: qtdemux: Avoid division by zero if 0 audio channels are
  signalled
* 10fd1ab: qtdemux: Validate chnl defined layout before using it to
  index the layouts array
* 3441881: qtdemux: Avoid out-of-bounds reads and writes of 64 item
  audio channel positions array
* dc7ab66: qtdemux: Fix bit pattern check for omitted audio channels
  map
* bad6721: qtdemux: Add various integer overflow and bounds checks to
  uncompressed video handling
* 8aed48f: flvdemux: Avoid assertions on corrupted streams
* 35a905a: wavparse: Fix integer overflow when checking available
  buffer size for reading cues
* 0d819ce: wavparse: Use prepend+reverse instead of append when
  building the cues list
* 6db6dd0: matroskademux: Add missing parenthesis when calculating bz2
  buffer sizes
* 43421c2: Release 1.28.2

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes since 1.28.0
* b2a3b2e: Back to development after 1.28.0
* 99c68cb: meson: Fix libxml2 not building due to wrong option type
* e973899: cudaupload, cudadownload: Fix CUDA/GL interop copy path
* 83b8417: webrtc: sink floating refs of ICE transports
* 887f2bf: ajasink: Only allow 6 / 8 / 16 audio channels
* a74bd95: mpegtspacketizer: Handle clock change/resets without skew
  correction
* 956e714: mxfdemux: fix gst_mxf_demux_pad_get_stream_time ()
* 73bc4b8: tsdemux: Fix Continuity Counter handling
* 3795ca5: tsdemux: Simplify initial packet handling
* 150a7e4: mxfdemux: always send a segment before sending eos or
  segment-done
* 3fdc449: codectimestamper: Fix latency query handling
* 530a52f: vtdec: Always reset flushing flag in flush()
* 4dfe11e: vtdec: Fix a very slight race in handle_frame() when
  flushing
* 0a5e48c: vtdec: Make sure to reset last flow return when flushing
* ae04185: vtdec: Implement drain() to allow reverse playback
* 9e0e66f: webrtcbin: Check the presence of encoding-name fields in
  answer caps
* fe28caa: vadisplay: Fix a couple of new const-ness warnings around
  strstr() usage
* b88511e: classifiertensordecoder: Fix uninitialized variable compiler
  warning
* 9924971: gstplay: fix reference counting
* f721368: v4l2: Add support for AV1 V4l2 decoder
* 0fd06de: vulkan/ios: Fix scaling and resizing with UIView
* 0708627: audiobuffersplit: Correctly calculate adapter start/end
  running time for negative rates
* 9ae3903: audiobuffersplit: Use the output segment for output related
  calculations
* 1a9c31f: audiobuffersplit: Don't use floating point divisions
  unnecessarily
* 5e9ff8c: audiobuffersplit: Log if an input buffer has the discont
  flag set or not
* 2ded76c: audiobuffersplit: Send any pending segment before
  EOS/SEGMENT_DONE
* 72b9964: audiobuffersplit: Handle SEGMENT_DONE the same way as EOS
* 1f43861: audiobuffersplit: Convert gap events to silence buffers
* 16a2fef: audiobuffersplit: Implement negative rates correctly
* 6c6aba2: mpeghdec: memory leak fix in MPEG-H Audio decoder plugin
* 63e8a3b: vtdec: Don't re-create session if only the framerate changed
* 9e17a28: audiobuffersplit: fix reverse playback
* 59a7e80: vtdec: Add more debug logging
* 321c742: vtdec: Fix race condition when negotiating during playback
* 030cfc1: wayland: Fix CLAMP operation of maxFALL and maxCLL
* 705376e: objectdetectionoverlay: add support for rotated bounding
  boxes
* d2aae83: cea608mux: fix overflow when calculating output PTS
* 05d821e: siren: remove trailing space from klass
* 24d4d91: openni2src: remove trailing space from desc
* 2700371: smoothstreaming: remove trailing space from desc
* d5e0ba7: gst-plugins-bad: remove trailing spaces: update
  gst_plugins_cache.json
* f7f24fc: zebrastripe: adapt klass to recommendation
* d032f3c: fieldanalysis: adapt klass to recommendation
* 3c06dee: dtls: fix author name: add missing angle brackets
* 0f77771: gst: fix author name: add missing closing angle bracket
* 4506913: gst-plugins: fix author name: correct incomplete or wrong
  emails
* d125725: gst: also adapt author names in the gst_plugins_cache.json
  files
* c20ae61: videocodectestsink: fix typo in klass
* b463b8f: unixfdsrc: adapt klass "Src" to "Source"
* 8aa4eff: avtpsrc: adapt klass "Src" to "Source"
* e6348c3: rtpsrc: adapt klass "Src" to "Source"
* d21129f: frei0r-src: adapt klass "Src" to "Source"
* 78ce4b2: tsmux: reduce noise for DEBUG log level
* 5b40409: openh264enc: skip drain for baseline profile
* 53a95b2: openh264enc: remove broken drain and simplify handle_frame
* fafeaef: ajasinkcombiner: Only forward the segment events from the
  video sinkpad
* 988666b: meson: Add a subproject for providing the LunarG MoltenVK
  SDK
* 5084c9b: vulkan: load video function pointers conditionally based on
  codec operation
* 011a06b: waylandsink: make gst_wl_window_commit_buffer handle NULL
  buffers
* f201683: vtdec: Fix CM memory leak due to incorrect unref
* 930b4aa: zxing: Minimal support for compiling with zxing-cpp 3.x
* 51f45dc: vabasetransform: copy buffer's metadata at copy when import
  buffer
* dbefb70: zxing: Fix version check for zxing-cpp 3.0.1
* 835da19: modules: Remove NEWS from git which is generated from full
  release notes
* 201b14e: modules: remove RELEASE from git, will be generated from
  template on dist
* 7694a7d: modules: remove subproject README.md from git
* 6376a84: modules: dist common files from monorepo root
* 2601491: vtdec: Avoid busy looping when queue length is smaller than
  DPB size
* b76fe59: ladspa: Fix macOS detection
* 291e479: meson: Deprecate `system = 'ios'` in cross files, use
  subsystem
* 4aa405d: applemedia: Stop using HAVE_IOS, use TARGET_OS_* macros
  instead
* b4eaad5: avfdeviceprovider: AVCaptureDevice manufacturer is more
  widely available
* 38655e0: applemedia: Enable EAGL support on tvOS too
* 25fbfd3: vtdec: VTRegisterSupplementalVideoDecoderIfAvailable is
  widely available
* e833ae2: vtdec: Software decoders are now more widely available
* 082bc62: avfvideosrc: Add support for newer iOS 17+ APIs
* 190153c: vtenc: Fix build with tvOS
* 1c213de: applemedia: Disable avfvideosrc and avfdeviceprovider on
  tvOS/watchOS
* 7807e72: vtdec: Check for AV1 and VP9 support once
* 9d8e01f: macos: Stop using HAVE_OSX, use built-in macros instead
* 86b0957: frie0r, ladspa: Stop using G_MODULE_SUFFIX
* 149cc0e: vtdec: Fix GstVideoCodecState leak
* 2f5b70e: asiosink: Fill silence when paused
* ad31d52: applemedia: elements can now be individually registered with
  gst-full
* 8074134: h264,h265ccextractor: Fix framerate in initial caps
* 2efd57c: ccconverter: Reset counters on flush-stop
* af04ec5: vkav1dec: fix to set SavedOrderHints properly
* a10695e: v4l2codecs: Add short and long term controls in linux
  headers
* 1721252: h265parser: Store raw short/long term RPS sets
* 8788a6c: codecs: h265dec: Parse extended SPS information
* 54994bb: v4l2codecs: Set long and short term RPS controls
* c22cdd5: build: codecs: Add AV1 decoder to the GIR includes
* 81b283e: build: codecs: Small style improvement
* d795915: build: codecparsers: Install some newly introduce API
  headers
* 0fd74d0: build: codecparsers: Create a GIR file needed for since
  marking
* 3686103: codec: h265decoder: Fix annotation and constify return value
* 1768b12: build: codecs: Add gir dependency to the new GstCodecParsers
  gir
* 282fd81: codecparsers: h265/vc1: Add missing namespace to some
  defines
* 9579389: codecparsers: Fix annotation warnings reported at GIR
  constructions
* 947d59f: doc: codecparsers: Switch to gi-index
* 13b57d5: meson: Explicitly use cpp_std=c++11 for decklink
* 1ff173e: vavp8enc: set color format chroma
* c1ee041: tensordecoders: fix wrong dims_order check
* cbd357d: onnx: set dims_order on GstTensor
* 94c24fe: vtdec: Fix return value in flush()
* e5f8ddf: vtdec: Make sure VT thread won't get stuck after a
  downstream error
* a1c2bb8: vtenc: Make sure draining actually drains all frames, port
  fixes from vtdec, unify naming
* 3313eab: vtdec: Fix wrong DPB size check in the output loop
* ab5cead: vtdec: Calculate DTS offset correctly
* 673922a: applemedia: Sort sources list, fix indentation
* 1205741: applemedia: Fix broken HAVE_VIDEOTOOLBOX_10_9_6 define
* c1772be: applemedia: Remove outdated HAVE_VIDEOTOOLBOX define
* 8bcac75: applemedia: Get rid of AVFoundation-related defines
* 68c0b40: avfvideosrc: Small fixes to the plugin header
* 1758e23: applemedia: Small simplifications to the vulkan checks
* 561bfde: dvbsuboverlay: Mark parsed byte array as const
* 69a2c1c: dvbsuboverlay: Add missing bounds checks to the parser
  everywhere
* cfb98fe: dvbsuboverlay: Avoid integer overflows and unreasonably
  large displays/regions
* fcd957d: libs: jpegparser: boundary checks before copying it
* 8a26fa7: h266parser: Validate tile index bounds in picture partition
  parsing
* 080ac76: h266parser: Fix APS ID bounds check in APS parsing
* 00a086a: h266parser: Fix out of bounds write when parsing pic_timing
  SEI
* 5285725: h265parser: Validate num_decoding_units_minus1 in pic_timing
  SEI
* dcb37e2: Release 1.28.1
* 32113a6: Back to development after 1.28.1
* 6a3b3b6: av1parse: Add the GstAV1ParseStreamFormat enum and helper
  functions
* 5b115b5: av1parse: Split the stream format and alignment logic
* 3b7e321: svtav1: fix "Level of parallelism" property type
  discrepencies
* 74e26cf: dashsink: test: use playbin3 for DASH playback verification
* b99ef73: dashsink: guard splitmuxsink removal in release_pad during
  dispose
* 31a80ef: vulkan: Fix libMoltenVK.dylib not found when installed
* 216d38a: all: GThreadFunc return type fixes
* 9bd09cc: srtpenc: preserve ROC when master key is updated for an
  ongoing session
* 7e5161c: av1dec: Enable VIDEO_META and VIDEO_ALIGNMENT for pool
* b72d4cd: av1parse: Fix the consumed typo in _read_leb128
* 47002f8: av1parse: Fix a latent wrong setting of cll in
  update_src_caps
* 0426e58: decklinkvideosink: fix element leak in decklink callback
* 16b556c: soundtouch: Only allow up to 192kHz and 16 channels
* 4520fe5: gdppay: Fix null pointer dereference on duplicated caps
  event
* cf7ec94: h264parse: Do not update valid DTS and duration
* d850e77: h265parse: Update buffer duration only when it's invalid
* eb67339: vtdec: Store supplemental codec support in a global variable
* fb821c3: onnx: set default pixel-aspect-ratio
* 8e2db48: tflite: set PAR to 1:1 by default
* b5fa0db: vulkan: Clear mutex when GstVulkanImageMemory is freed
* be3a040: h264parser: Fix memory leak in gst_h264_parser_parse_nal()
* 18dd8d6: tsmux: Fix integer overflow in SCTE35 NULL interval
* 95b4388: gst-plugins-bad: update translations
* 07c0ecc: dtls: unregister signal handlers from connection
* e8b7cc0: vp9parse, av1parse: Remove segment clipping to let
  downstream handle frame boundaries
* 259d5e7: vtdec: Do not hold the stream lock when pushing out frames
* 72afb2c: nice: Fix leak of nice thread
* 391d843: vulkanvp9dec: Fix case in device-specific factory name
* 09872a7: wasapi2sink: Ignore device errors from default device
* 5d165e6: mxfdemux: reject corrupted index entry
* a277cb4: mxfdemux: add reversed temporal offset bound check
* 384e65b: waylandsink: fix waylandsink crash when call window flush
* 9552c85: wlwindow: fix viewport source outside buffer when play
  resolution change stream
* 8320b8d: vtdec: Supplemental VideoToolbox decoders now registered via
  vtutil helper
* dea92e8: vkswapper/vksink: Don't advertise unsupported formats
* c8a404b: shm: fix shmsink exit code 1 on clean shutdown
* 5dfb388: wayland: display: Add protection when replacing wl_output
* 0882b60: gst: Fix a couple of const correctness bugs around strchr()
  usage
* 5ed6a6d: wasapi2: Log target device information
* b05db6e: sctp: Set number of outgoing & incoming streams to the same
  value
* 6e69d47: applemedia/vtdec: handle decoder error status for iOS
* cf067cc: applemedia/vtenc: make sure to NULL terminate the level
  string
* 299ffee: vtenc: restart even if VTCompressionSessionCompleteFrames
  fails
* a8d3ce8: vtdec: Also reset session when output_callback gets a
  kVTVideoDecoderMalfunctionErr
* 63efa3c: waylandsink: Properly reset the tag orientation
* 701194a: nvcodec: Add capability caching to speed up plugin
  initialization
* 18851f9: vtdec: Don't leak RGBA64_LE caps during class init
* 327188d: vtdec: Fix incorrect setting of bitfield / flag
* b5af409: vtdec: Invert order of output caps to match our preference
* e265144: macos: Set activation policy in vulkansink (MoltenVK)
* f9cc731: jp2kdecimator: Fix some possible integer overflows in size
  checks
* e900fe1: jp2kdecimator: Avoid integer overflows and divisions by zero
  on invalid tile configurations
* ad02aae: h264parse: Remove pointless allocation failure handling
* 43a89cd: h264parse: Avoid NULL pointer dereferences when freeing
  partially parsed SPS/MVC data
* c2690af: h266parser: Avoid integer overflow when parsing profile /
  tier / level
* 845e9cf: av1parse: Avoid signed 32 bit integer overflow when parsing
  LEB128 values
* f9d57db: av1parse: Be more explicit about available data when parsing
  LEB128 values
* 6e84260: av1parse: Allow G_MAXUINT32 as LEB128 encoded value
* 00d6368: av1parse: Correctly reject LEB128 values where the 8th byte
  has the high bit set
* 871ac21: vmncdec: Set cursormask to NULL to prevent double free
* 43421c2: Release 1.28.2

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes since 1.28.0
* b2a3b2e: Back to development after 1.28.0
* 835da19: modules: Remove NEWS from git which is generated from full
  release notes
* 201b14e: modules: remove RELEASE from git, will be generated from
  template on dist
* 7694a7d: modules: remove subproject README.md from git
* 6376a84: modules: dist common files from monorepo root
* 8f9c0ad: asfdemux: Error out on files with more than 32 streams
* cb184da: rmdemux: Check if new video fragment overflows the fragment
  storage before storing it
* 3bcbda6: rmdemux: Avoid integer overflow when checking if enough data
  is available for video fragment
* dcb37e2: Release 1.28.1
* 32113a6: Back to development after 1.28.1
* 37274be: gst-plugins-ugly: update translations
* 43421c2: Release 1.28.2

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes since 1.28.0
* b2a3b2e: Back to development after 1.28.0
* be2f846: avviddec: Allow stride changes for some decoders
* f0bfd0c: avviddec: Handle field/order changes in mixed interlace mode
* f717c6e: avviddec: Simplify picture_changed helper function
* 0f77771: gst: fix author name: add missing closing angle bracket
* d125725: gst: also adapt author names in the gst_plugins_cache.json
  files
* 92ba6c2: avviddec: Don't increment the AVCodecContext frame counter
* 529e7a6: avauddec: Don't increment the AVCodecContext frame counter
* aa02005: avviddec: Forward any ready video frames on gap events
* 0a6950d: gst-libav: avvidcmp: set colorimetry on AVFrame
* adc82d2: libav: Don't process lines that won't be outputted
* 835da19: modules: Remove NEWS from git which is generated from full
  release notes
* 201b14e: modules: remove RELEASE from git, will be generated from
  template on dist
* 7694a7d: modules: remove subproject README.md from git
* 6376a84: modules: dist common files from monorepo root
* 60c9be9: avviddec: Simplify conditional code in context handling
* b6fbaaf: avviddec: Improve renegotiation debug message
* d94518f: avviddec: Fix handling of mixed interlaced content
* dcb37e2: Release 1.28.1
* 32113a6: Back to development after 1.28.1
* 80cd0ee: avviddec: Refcount codec frame associated with video frame
* 43421c2: Release 1.28.2

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes since 1.28.0
* b2a3b2e: Back to development after 1.28.0
* 539aaa1: python: Caps constructor has a single optional argument
* 18d4781: python: Structure constructor has a single required argument
* 6f21099: python: Add type hints for MapInfo members
* 0df78d0: python: Remove duplicated TestDoubleRange
* d4af24c: python: Add type hint for public fields
* 5f4fe17: python: int|float type is redundant and cause linter issue
* 835da19: modules: Remove NEWS from git which is generated from full
  release notes
* 201b14e: modules: remove RELEASE from git, will be generated from
  template on dist
* 7694a7d: modules: remove subproject README.md from git
* 6376a84: modules: dist common files from monorepo root
* dcb37e2: Release 1.28.1
* 32113a6: Back to development after 1.28.1
* c43f2b2: python: Add item type annotation to Iterator class
* 49ca53f: python: Make Gst.Bin iterable
* 43421c2: Release 1.28.2

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes since 1.28.0
* b2a3b2e: Back to development after 1.28.0
* 835da19: modules: Remove NEWS from git which is generated from full
  release notes
* 201b14e: modules: remove RELEASE from git, will be generated from
  template on dist
* 6376a84: modules: dist common files from monorepo root
* 012b257: rtspclientsink: don't error out when stream transport
  notifies timeout
* dcb37e2: Release 1.28.1
* 32113a6: Back to development after 1.28.1
* c2ef75a: rtsp-stream: Clear send_thread when it's freed
* 20d3e66: rtsp-client: Lock media when unlinking session medias
* 0882b60: gst: Fix a couple of const correctness bugs around strchr()
  usage
* 43421c2: Release 1.28.2

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
petermarko and others added 30 commits May 5, 2026 17:12
Solves CVE-2026-5958.

Release notes: [1]

License-Update: copyright years refreshed

[1] https://gitweb.git.savannah.gnu.org/gitweb/?p=sed.git;a=blob_plain;f=NEWS;hb=v4.10

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d1089f9)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Currently this is in ASSUME_PROVIDED and HOSTTOOLS so doesn't have any
effect, but declaring the dependency is the right thing to do.

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 05e14c4)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Release notes: https://ccache.dev/releasenotes.html#_ccache_4_13_3

> Ccache 4.13.3
> Release date: 2026-04-12
>
> New deliverables
>
>     Added glibc binary release for Linux riscv64.
>     [contributed by Ludovic Henry]
>
> Bug fixes and improvements
>
>     Fixed handling of empty responses from remote storage backends: a
>     response with an empty body is now treated as a storage error rather
>     than a cache miss.
>     [contributed by Björn Svensson]
>
>     Fixed PCH invalidation when the MSVC toolset is updated.
>     [contributed by Philipp Kolberg]
>
>     Fixed base_dir path rewriting when using MSVC’s /Yc option: paths
>     are no longer rewritten to relative when creating a precompiled header,
>     since MSVC then does not like relative paths for the /Yc and /FI
>     arguments.
>     [contributed by Joel Rosdahl]
>
>     Fixed handling of a directory-less path to the MSVC /FI option.
>     [contributed by Joel Rosdahl]
>
>     Added support for -fsanitize-ignorelist (which replaced
>     -fsanitize-blacklist in Clang 13).
>     [contributed by Joel Rosdahl]
>
>     Fixed detection of type for compiler with . in the name (e.g.
>     hppa2.0-unknown-linux-gnu-gcc).
>     [contributed by Joel Rosdahl]
>
>     Fixed install.sh to correctly use sysconfdir and other configuration
>     variables from the Makefile.
>     [contributed by Joel Rosdahl]
>
> Build improvements
>
>     Changed cmake/FindCppHttplib.cmake to use settings from the system’s
>     CMake config if available, supporting systems where cpp-httplib is not
>     provided as a header-only library.
>     [contributed by Jiri Slaby]

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit 30f9f7a)
[YC: Added changelog]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Changelog:
==========
- BSD: don't send uninitialised memory using ps_root_indirectioctl
- Fix fallback_time option
- IPv4: Ignore DHCP state when building routes
- options: Ensure ldop is not NULL dereferenced
- route: Routes may not have an
- options: Ensure that an overly long bitflag string does not crash
- options: Don't assume vsio options have an argument
- common: Cast via uintptr_t rather than unsigned long
- privsep: Ensure we recv for real after a successful recv MSG_PEEK
- DHCP: Add parentheses to macro definitions
- ipv6nd: empty IPV6RA_EXPIRE eloop queue when dropping

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit 6b19f10)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Changelog 1.24.0 -> 1.24.1:
 $ PAGER=cat git log --format=oneline  --abbrev-commit  --no-decorate 1.24.0..1.24.1 --reverse
ebff939de ChangeLog: Log 1.24.0 release.
b7ed0adb9 NEWS: Fix a cosmetic oops.
395f381c9 src/devices/gropdf/.gitignore: Add.
79c950d07 ANNOUNCE: Update template for next release.
b8ef50a3c FOR-RELEASE: Update procedures still more.
c6fadff4a HACKING: Make further clarifications.
e824efce3 MANIFEST: Add item for "contrib/install-font".
7152a44c0 HACKING: Add adding/removing components section.
4f09e7438 FOR-RELEASE: Fix wordo and resequence item.
991c72f8d LICENSES: Update heading.
900841e99 PROBLEMS: Fix grammar nit.
d37235816 Fix typos in top-level plain text files.
91e456e53 doc/automake.mom: Fix typos.
fe3db5400 [doc,man]: Fix typos.
51bc75c0c gropdf(1): Fix typo.
e4b1d4c1f eqn(1): Fix typo.
75d77b7dd tbl(1): Fix typo.
669898d53 groff_mdoc(7): Fix typo.
75850a599 tmac/*: Fix (repeated) typo in comment.
9e162946b .gitattributes: Add some "Linguist" overrides.
6e467c234 [eqn]: Regression-test Savannah #68115.
eee74c1a8 [eqn]: Fix Savannah #68115.
d99cfd9d7 ANNOUNCE: Acknowledge Rocket Ma.
8a6b787b8 [doc,man]: Tweak documentation.
1199bb8db groff_man_style(7): Further explain portability.
67db10f1d doc/groff.texi.in: Parallelize with groff_diff(7).
738d7a66e xtotroff(1): Update copyright notice.
c60093c10 xtotroff(1): Fix unescaped hyphen.
5f8492275 eqn(1): Update copyright notice.
b9d07e0cf eqn(1): Add "roff interface" subsection.
fa1459060 groff_mm(7): Tighten wording.
dc92c2252 HACKING: Add more on component maintenance.
02095b504 contrib/chem/README: Tighten wording.
c7cd4564e [mm]: Update provenance notices.
977034df0 grog(1): Fix mangled man page cross reference.
469bbb2ba roff(7): Fix content and style nits.
8fdeff7d5 [doc,man]: Simplify description of `warn` request.
b4b599e7f groff_diff(7) Advise reader of prerequisite.
f0f7c804a groff(7),groff_diff(7): Update cross references.
cdb97b959 Seed random number if SOURCE_DATE_EPOCH is set.
752a371a6 ChangeLog: Tweak style of most recent entry.
c47dd4ea9 ANNOUNCE: Acknowledge Peng Zhang.
37f0060be groff(7): Document `.S` register as reserved.
95bd5f043 [doc,man]: Make groff(7) introduction cohere.
afa03a297 groff(7): Improve descriptions of `\A`, `\B`.
71bf66d0d doc/groff.texi.in: Tweak documentation.
45afde2cb [troff]: Regression-test Savannah #68132.
9c4e2c8c6 [troff]: Fix Savannah #68132.
c71b99984 Use sequential tag names to avoid possible random duplicates.
cdd553bfe ChangeLog: Fix missing word.
7c04b4254 doc/groff.texi.in: Tighten wording.
ba0908298 [troff]: Improve error diagnostic.
f0be0a65f groff_man*(7): Clarify paragraphing macro actions.
f9420c7b0 tmac/troffrc: Fix misleading diagnostic message.
2e238889c xtotroff(1): Cosmetically revise copyright notice.
7d2fef66a HACKING: Revise material on copyright notices.
833430738 HACKING: Add info on committing changes by others.
6b9a211f2 ANNOUNCE: Acknowledge Dave per commit c71b999842.
5471491b1 ChangeLog: Revise format of earlier entry.
103561eae Update for groff 1.24.1 release.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit fc38c33)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Changelog[0] 50.0 -> 50.1:
* Update Serbian translation
* Update French translation
* Update German translation
* Update Polish translation
* Update Polish translation
* Update French translation

[0]: https://gitlab.gnome.org/GNOME/gsettings-desktop-schemas/-/compare/50.0...50.1?from_project_id=1669

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit a63907b)
[YC: added changelog]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
* Bugs fixed:
  - #6306 [GTK3] Zlib required when broadway is enabled.
  - #7796 [GTK 3] Invalid a11y events when calling `gtk_tree_view_set_cursor` on
    an unfocused GtkTreeView
  - #7976 Firefox crashes at gdk_wayland_drag_context_manage_dnd() when missing
    toplevel wl_surface
  - #8103 gtk3 refresh_rate calculation overflows on 32-bit targets
  - #8114 Images for recolored icons are constantly being reloaded
  - GNOME/gimp#14901 Wild strobing in multi window mode
  - GNOME/gimp#15480 GIMP does not focus on dialogue boxes on Mac
  - !7332 quartz: add automagic uti<->mime conversion for clipboard
  - !8216 Fix position of child tooltips in GTK3 custom windows
  - !9005 a11y: Don't send focus-related events for unfocused treeview
  - !9012 quartz: gtkwindow - fix windows fighting focus
  - !9022 gtkmenu: Await more motion events before deactivating on release
  - !9044 wayland: Handle XKB initialization failures gracefully
  - !9067 gdk/win32: Add missing EGL conditional compilation guard
  - !9098 gdk: do not run gdk_wayland_window_export_handle() callback when
    window is already destroyed.
  - !9119 Declare an explicit dependency on zlib when broadway is enabled
  - !9141 [GTK 3] wayland: Try to open the display even if XDG_RUNTIME_DIR is
    unset
  - !9155 [gtk3] emoji: Update data to CLDR 48
  - !9214 display/wayland: Gracefully handle dispose being called twice
  - !9284 gdk/wayland: Map stylus buttons for BTN_BACK and BTN_FORWARD (Peter
    Hutterer)
  - !9322 [Quartz] Fix dialog keyboard focus while preventing focus fighting
  - !9344 Fix a couple of leaks
  - !9394 gdk/wayland: Map stylus buttons for BTN_BACK and BTN_FORWARD
  - !9397 wayland: Avoid a crash
  - !9600 Replace outdated freedesktop.org Window Manager spec links
  - !9676 x11: fix overflow in refresh_rate calculation on 32-bit systems
  - !9706 cssimage: Store and reuse icon info for recolored images
  - !9707 wayland: Fix uninitialized value when no cursor
  - !9708 fontchooser: Fix signedness of axes count
  - !9709 fontchooser: Remove const on float return values
  - !9710 print: Remove unused variable

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit 015d6e1)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Bugs fixed:
- #8117 Docs for the new SVG parser?
- #8119 Wrong colors used for fallback symbolic icons containing classes
- #8125 svg: Animating hrefs does not work
- !9590 vulkan: fix GDK_VULKAN_FEATURE_SWAPCHAIN_MAINTENANCE check
- !9660 Various Vulkan fixes
- !9665 tests: fix libtestutils build under Windows.
- !9667 Update Serbian translation
- !9678 testsuite: Add dmabuf compare tests to needs-udmabuf suite
- !9681 dmabuf: Support dmabufs with fewer fds than planes
- !9682 Update Galician translation
- !9701 Update Turkish translation
- !9704 Update Catalan translation
- !9711 Load less icons as symbolics
- !9719 Fix traditional symbolic fallback
- !9736 svg: Fix invalidation
- !9739 Assorted backports

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit 4d325cb)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit be9612d)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch according to [1]

[1] https://security-tracker.debian.org/tracker/CVE-2026-34933
[2] avahi/avahi#891
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34933

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit 4ef89e6)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
The test tests/codegen-llvm/issues/multiple-option-or-permutations.rs
uses FileCheck to verify LLVM IR for Option::or operations on slices.
The CHECK-NEXT directives assumed a little-endian memory layout where
the Option discriminant is the low byte, emitting a simple:

  trunc i16 %0 to i1

On big-endian targets (e.g. powerpc), the discriminant resides in the
high byte, so LLVM first emits an lshr before the trunc, causing the
test to fail.

Backport upstream fix from rust-lang/rust#151780 which introduces
BIG/LITTLE revisions with the only-endian-big / ignore-endian-big
directives (also backported via directive_names.rs change) to handle
both layouts correctly.

Fixes: rust-lang/rust#151718
Upstream-Status: Backport [rust-lang/rust#151780]

Signed-off-by: Peter Tatrai <peter.tatrai.ext@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit 1efb76b)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
On bluez5 5.86, the bluetoothctl cli interface does not work outside of
the dedicated shell to list controllers and devices [1]. These patches fix
the issue while version 5.87 is not published.

[1] bluez/bluez#1896

Upstream-Status: Backport [bluez/bluez@b33e923,
                           bluez/bluez@21e1397]

Signed-off-by: Leonardo Costa <leonardo.costa@toradex.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit 922227e)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
for avoiding to enable llvm option under uncommon condition,
make llvm controll under PACKAGECONFIG.

error log:
ERROR: perf-1.0-r2 do_package_qa: QA Issue: /usr/bin/trace contained in package perf requires libLLVM.so.2x.x(LLVM_2x.x)(64bit), but no providers found in RDEPENDS:perf? [file-rdeps]

Signed-off-by: Li Wang <li.wang@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit a7c0c0f)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
…metry

Change the check to f.endswith(".ko"), consistent with strip_execs() and
with the /lib/modules/ guard already present in is_elf() and
splitdebuginfo().

Fixes [YOCTO #2348]

Signed-off-by: Sam Kent <sam.john.kent@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit 2f32e6a)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
These reappeared after update of sbom-cve-check tooling.
Fixed version found by links from Debian security tracker.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit dd3cf15)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pulls in the changes:

  * Makefile.in: Bump version to 1.9.6
  * pseudo_util.c: Fix symlink processing for symlinkat and related
  * test: Add test symlinkat and related
  * ports/unix: realpath: Fix chroot processing
  * test: Add test cases for canonicalize functions
  * ports/unix: fts_open: Fix chroot behavior
  * ports/unix: fts_*: Certain functions were incorrectly returning stat data
  * test: Add fts test case
  * test: Add test for linkat chroot path stripping
  * linkat: Avoid a segmentation fault
  * Only copy xattrs on a rename if it's cross-filesystem

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 50e769a)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
It was confirmed these mirrors were inactive in [1]. Remove them.

[1]: https://lore.kernel.org/r/b9c4ddd5ae72ae21ee0b6e12fb1a1f63661c685c.camel@linuxfoundation.org

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 7a90ba8)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
This removes rust uutils coreutils CVEs from reports.
Comparing sbom-cve-check shows that only
CVE-2026-35338..CVE-2026-35381 are removed and all of them contained
reference to uutils.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5c39687)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Commit fixing this CVE is [2] (per [1]).
That was backported to 3.6.6 as [3].

[1] https://security-tracker.debian.org/tracker/CVE-2026-2436
[2] https://gitlab.gnome.org/GNOME/libsoup/-/commit/e9b681a5b23f8259a5e29c5351a5284ae5cd1189
[3] https://gitlab.gnome.org/GNOME/libsoup/-/commit/31052a2327c81fe3b7a3d4a66d8a7c9c1aaa47ca

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 83d00b9)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick commit which closed [1].

[1] https://gitlab.gnome.org/GNOME/libsoup/-/work_items/502#note_cb3be24d375814549d21c03821672ed6749df36a

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cdc9de4)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
This change removes currently open CVE-2025-64170 and CVE-2025-64517
from reports which are for "trifectatech:sudo-rs".

It also removes following "patched" ones:
* CVE-2023-42456 (memorysafety:sudo)
* CVE-2025-46717 (trifectatech:sudo)
* CVE-2025-46718 (trifectatech:sudo)
All these are also for "sudo-rs".

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0459398)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
apr is tracked in NVD under apache:portable_runtime rather than the
recipe name apr. Set CVE_PRODUCT accordingly so cve-check uses the
correct NVD product identity for APR.

No additional alias was found to be necessary for this recipe.

Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit bc3803e)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
apr-util is tracked in NVD under apache:apr-util, while a smaller set
of newer CVEs also appears under apache:portable_runtime_utility.
Set CVE_PRODUCT accordingly so cve-check can cover both the historical
and current NVD product identities used for APR-util.

Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit 927b505)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
This is a version-less RedHat CVE so needs explicit status.
Fix reference: PR/commit listed in [1] backported as [2].

[1] https://security-tracker.debian.org/tracker/CVE-2026-4426
[2] libarchive/libarchive@ec1bc43

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ab127fa)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch mentioned in both NVD and Debian report.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4cef4ef)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch which references vulnerability report [1] linked in NVD
report (see NEWS file).

[1] https://www.openwall.com/lists/oss-security/2026/03/13/1

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 36bdd32)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
This stops 'devtool modify foo' from failing with an error message like

    ERROR: Execution of 'git -c user.name=\"OpenEmbedded\" -c
    user.email=\"oe.patch@oe\" commit -q -m "Initial commit from upstream at
    version 1.90.0"' failed with exit code 128:
    error: cannot run ssh-keygen: No such file or directory
    error:
    fatal: failed to write commit object

when GPG signing is enabled in the git configuration.

(cherry picked from commit b5c84b0)

Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Fixes [YOCTO #16265]

The glibc recipe is supposed to be building with
--enable-stack-protector=strong, but some CACHED_CONFIGVARS values are
actually breaking this, causing glibc to be built with no stack
protector at all.

Remove these CACHED_CONFIGVARS values so that stack protector support is
detected properly in do_configure and then enabled properly during
do_compile.

Full details are here:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=16265

Signed-off-by: Ivan Nestlerode <ivan.nestlerode@sonos.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 43f0602)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
meta/classes/create-spdx-2.2.bbclass
    Deleted upstream, kept in the merge.
meta/lib/oe/spdx30_tasks.py
    The code we modified was removed upstream. Kept upstream changes.
meta/recipes-bsp/u-boot/u-boot.inc
    Upstream implemented a fix nearly identical to ours. Kept the
    upstream change.
This reverts commit 12abd05.

Multiple conflicts caused by upstream commits in between our last
merge and the deletion of this file upstream being reapplied here.
After looking at the upstream commit history there appeared to be no
true conflicts and I resolved things appropriately.

Signed-off-by: Erick Shepherd <erick.shepherd@ni.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.