From: Ranjitsinh Rathod <ranjitsinh.rathod@...> Add patch to fix CVE-2021-39537 Link:

From: Ross Burton <ross@...> Backport a fix for -3972, and whitelist -3968: it isn't valid as it fixes a bug which was introduced after 8.2. Signed-off-by: Ross Burton

From: Pavel Zhukov <pavel.zhukov@...> A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a

From: Neetika Singh <Neetika.Singh@...> Add patches for below CVE issues: CVE-2021-27218 CVE-2021-27219 CVE-2021-28153 Link:

From: Pavel Zhukov <pavel.zhukov@...> An out-of-bounds heap read in unlzma leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be

Since Oracle relicensed bdb, the open source community is slowly but surely replacing bdb with supported and open source friendly alternatives. As a result these CVEs are unlikely to ever be

Please review this set of patches for dunfell and have comments back by end of day Tuesday. Passed a-full on autobuilder: https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/2988 with

<peter.kjellerstedt@...> wrote: Using = would certainly be OK and an improvement over the current mess. The reason I'd still argue that ?= is better is that it gives a clear hint that

<richard.purdie@...> wrote: What are the possible objections? I agree ??= is way overused and very often in places where ?= or a direct assignment would be better. I'm not the one

Signed-off-by: Ross Burton <ross.burton@...> --- meta/recipes-graphics/xorg-lib/libxkbcommon_1.3.1.bb | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git

Enable by default, now that libraries are split into separate packages this won't cause a change to existing setups. Signed-off-by: Ross Burton <ross.burton@...> ---

The sublibraries, such as libxkbcommon-x11, have specific linkage, so to avoid link creep they can be put into separate packages. Signed-off-by: Ross Burton <ross.burton@...> ---

Not everyone wants the CLI, so put it in a separate package to reduce mandatory dependencies. Signed-off-by: Ross Burton <ross.burton@...> ---

This is a hang-over from the autotools build system. Signed-off-by: Ross Burton <ross.burton@...> --- meta/recipes-graphics/xorg-lib/libxkbcommon_1.3.1.bb | 2 +- 1 file changed, 1 insertion(+),

This patch has now been merged upstream. Signed-off-by: Ross Burton <ross.burton@...> --- .../libx11/Fix-hanging-issue-in-_XReply.patch | 13 ++----------- 1 file changed, 2 insertions(+),

Please merge these changes. Thanks, Anuj The following changes since commit e95ccf6f7fe5a42fffcfa5e43087ff964622e26c: squashfs-tools: fix CVE-2021-41072 (2021-11-22 09:45:46 +0800) are

Signed-off-by: Ross Burton <ross.burton@...> --- .../glew/glew/0001-Fix-build-race-in-Makefile.patch | 2 +- meta/recipes-graphics/glew/glew/no-strip.patch | 2 +-

lists.openembedded.org wrote: Bump. The googletest recipe at meta-oe dunfell branch is for version 1.10. The fact that CMake Find Module masked the targets of the GTest package resulted in a number

Hello, I try to adapt my personal Yocto meta to Isar Project. Currently, I try to add "minimalmodbus" recipie, and for this, I need "python-pyserial". And for "python-pyserial" I need