[PATCH 00/21] Scarthgap pull request

Anuj Mittal <[email protected]> Fri, 31 Jul 2026 09:51:08 +0530
Newsgroups org.openembedded.lists.openembedded-devel
Message-ID <[email protected]>
Please merge these changes in scarthgap. Tested locally and on autobuilder.

https://autobuilder.yoctoproject.org/valkyrie/#/builders/81/builds/1679

The following changes since commit 7eb94107580092f79ff1b639a87762fe6f96aa12:

  nginx: fix CVE-2026-42055 (2026-07-16 15:49:44 +0530)

are available in the Git repository at:

  https://git.openembedded.org/meta-openembedded-contrib anujm/scarthgap
  https://git.openembedded.org/meta-openembedded-contrib/log/?h=anujm/scarthgap

for you to fetch changes up to ef3df29f2cfca6a9513b51ebcdccf82b6c8a836f:

  libdbi-perl: Fix CVE-2026-14740 (2026-07-30 07:53:25 +0530)

----------------------------------------------------------------

Ankur Tyagi (2):
  postfix: upgrade 3.8.17 -> 3.8.19
  haveged: upgrade 1.9.22 -> 1.9.23

Benjamin Robin (Schneider Electric) (1):
  dnsmasq: fix CVE-2026-4890

Darsh Kelaiya (6):
  jq: Fix CVE-2026-43895
  jq: Fix CVE-2026-47770
  jq: Fix CVE-2026-49839
  jq: Fix CVE-2026-54679
  dnsmasq: Fix CVE-2026-12725
  dnsmasq: Fix CVE-2026-12969

Deepak Rathore (1):
  ldns: fix CVE-2026-10846

Hetvi Thakar (5):
  libdbi-perl: Fix CVE-2026-9698
  libdbi-perl: Fix CVE-2026-10879
  libdbi-perl: Fix CVE-2026-14380
  libdbi-perl: Fix CVE-2026-14739
  libdbi-perl: Fix CVE-2026-14740

Joao Marcos Costa (1):
  nginx: backport fixes for CVE-2026-42533

Khem Raj (1):
  apache2: upgrade 2.4.67 -> 2.4.68

Peter Marko (2):
  libwebsockets: patch CVE-2026-10650
  hostapd: set status for CVE-2026-58374

Qliangw (1):
  libuio: fix FILE descriptor leak

Wang Mingyu (1):
  monocypher: upgrade 4.0.2 -> 4.0.3

 .../{postfix_3.8.17.bb => postfix_3.8.19.bb}  |   2 +-
 .../recipes-support/dnsmasq/dnsmasq_2.90.bb   |   3 +
 .../dnsmasq/files/CVE-2026-12725.patch        | 111 +++
 .../dnsmasq/files/CVE-2026-12969.patch        |  54 ++
 .../dnsmasq/files/CVE-2026-4890.patch         |  75 ++
 .../hostapd/hostapd_2.10.bb                   |   2 +
 .../libwebsockets/CVE-2026-10650.patch        |  46 ++
 .../libwebsockets/libwebsockets_4.3.3.bb      |   1 +
 ...onocypher_4.0.2.bb => monocypher_4.0.3.bb} |   2 +-
 .../jq/jq/CVE-2026-43895.patch                | 206 +++++
 .../jq/jq/CVE-2026-47770.patch                | 449 +++++++++++
 .../jq/jq/CVE-2026-49839.patch                |  37 +
 .../jq/jq/CVE-2026-54679.patch                |  74 ++
 meta-oe/recipes-devtools/jq/jq_1.7.1.bb       |   4 +
 .../ldns/ldns/CVE-2026-10846_p1.patch         | 117 +++
 .../ldns/ldns/CVE-2026-10846_p2.patch         | 117 +++
 .../ldns/ldns/CVE-2026-10846_p3.patch         |  34 +
 meta-oe/recipes-devtools/ldns/ldns_1.8.3.bb   |   6 +-
 .../perl/libdbi-perl/CVE-2026-10879.patch     |  34 +
 .../perl/libdbi-perl/CVE-2026-14380_p1.patch  |  37 +
 .../perl/libdbi-perl/CVE-2026-14380_p2.patch  |  65 ++
 .../perl/libdbi-perl/CVE-2026-14380_p3.patch  |  27 +
 .../perl/libdbi-perl/CVE-2026-14380_p4.patch  |  56 ++
 .../perl/libdbi-perl/CVE-2026-14739.patch     | 170 +++++
 .../perl/libdbi-perl/CVE-2026-14740.patch     |  40 +
 .../perl/libdbi-perl/CVE-2026-9698.patch      |  43 ++
 .../perl/libdbi-perl_1.643.bb                 |   9 +
 .../{haveged_1.9.22.bb => haveged_1.9.23.bb}  |   2 +-
 ...ix-fclose-leak-in-uio_line_from_file.patch |  31 +
 .../recipes-extended/libuio/libuio_0.2.1.bb   |   1 +
 .../{apache2_2.4.67.bb => apache2_2.4.68.bb}  |   2 +-
 .../nginx/nginx-1.24.0/CVE-2026-42533-1.patch | 126 ++++
 .../nginx/nginx-1.24.0/CVE-2026-42533-2.patch | 381 ++++++++++
 .../nginx/nginx-1.24.0/CVE-2026-42533-3.patch | 704 ++++++++++++++++++
 .../nginx/nginx-1.24.0/CVE-2026-42533-4.patch | 587 +++++++++++++++
 .../nginx/nginx-1.24.0/CVE-2026-42533-5.patch |  55 ++
 .../recipes-httpd/nginx/nginx_1.24.0.bb       |   5 +
 37 files changed, 3710 insertions(+), 5 deletions(-)
 rename meta-networking/recipes-daemons/postfix/{postfix_3.8.17.bb => postfix_3.8.19.bb} (99%)
 create mode 100644 meta-networking/recipes-support/dnsmasq/files/CVE-2026-12725.patch
 create mode 100644 meta-networking/recipes-support/dnsmasq/files/CVE-2026-12969.patch
 create mode 100644 meta-networking/recipes-support/dnsmasq/files/CVE-2026-4890.patch
 create mode 100644 meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-10650.patch
 rename meta-oe/recipes-crypto/monocypher/{monocypher_4.0.2.bb => monocypher_4.0.3.bb} (85%)
 create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-43895.patch
 create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch
 create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-49839.patch
 create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch
 create mode 100644 meta-oe/recipes-devtools/ldns/ldns/CVE-2026-10846_p1.patch
 create mode 100644 meta-oe/recipes-devtools/ldns/ldns/CVE-2026-10846_p2.patch
 create mode 100644 meta-oe/recipes-devtools/ldns/ldns/CVE-2026-10846_p3.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-10879.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p1.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p2.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p3.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p4.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14739.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14740.patch
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-9698.patch
 rename meta-oe/recipes-extended/haveged/{haveged_1.9.22.bb => haveged_1.9.23.bb} (94%)
 create mode 100644 meta-oe/recipes-extended/libuio/libuio/fix-fclose-leak-in-uio_line_from_file.patch
 rename meta-webserver/recipes-httpd/apache2/{apache2_2.4.67.bb => apache2_2.4.68.bb} (99%)
 create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-42533-1.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-42533-2.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-42533-3.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-42533-4.patch
 create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-42533-5.patch

-- 
2.54.0