Skip to content

meta-openembedded: Merge latest upstream#116

Open
Shreejit-03 wants to merge 27 commits into
ni:nilrt/master/nextfrom
Shreejit-03:dev/automerge/ni
Open

meta-openembedded: Merge latest upstream#116
Shreejit-03 wants to merge 27 commits into
ni:nilrt/master/nextfrom
Shreejit-03:dev/automerge/ni

Conversation

@Shreejit-03

@Shreejit-03 Shreejit-03 commented Jun 16, 2026 •
edited by ni-github-admins
Loading

Copy link
Copy Markdown

Merge latest from upstream. No conflicts.

Justification

AB#3738533

Testing

  • Built pyrex container
  • bitbake packagefeed-ni-core
  • bitbake packagegroup-ni-desirable
  • bitbake package-index && bitbake nilrt-base-system-image
  • Installed BSI on a VM and verified it boots successfully
    @ni/rtos

Jason Schonberg and others added 27 commits May 29, 2026 09:07
@anujm1
Update README.md example with new branch name.
563d2c5 
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@wangmingyu84 @anujm1
localsearch: upgrade 3.11.0 -> 3.11.1
ca24d4c 
Changelog:
  Fix possible failures when extracting metadata from EPUB, ODF and OOXML documents

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 5a08d78)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@wangmingyu84 @anujm1
neatvnc: upgrade 0.9.5 -> 0.9.6
009207f 
0001-Use-aml-v1.patch
refreshed for 0.9.6

Changelog:
===========
- auth: rsa-aes: Fix potential buffer overflow
- auth: vencrypt: Reject excessively long usernames and passwords

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 9222ec0)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@wangmingyu84 @anujm1
python3-inline-snapshot: upgrade 0.32.6 -> 0.32.7
0f94b8a 
Changelog:
============
- Fixed snapshot comparison for dicts where keys are dataclass instances (or
  other custom objects used as dict keys), which previously caused corrupted
  snapshots - either collapsing multiple entries into one or appending duplicate
  keys on subsequent runs
- Fixed tuple snapshot updates to compare elements positionally rather than
  using sequence alignment, so existing expressions (e.g. 3 + 3) are preserved
  when elements are removed from or added to a tuple.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit fe086de)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@wangmingyu84 @anujm1
python3-tzdata: upgrade 2026.1 -> 2026.2
eff6fc8 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6321202)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@wangmingyu84 @anujm1
python3-typeguard: upgrade 4.5.1 -> 4.5.2
4dc8358 
Changelog:
 Fixed IndexError raised from check_signature_compatible when the subject method has no positional parameters

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 537a4c4)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@wangmingyu84 @anujm1
python3-huey: upgrade 3.0.0 -> 3.0.1
be10315 
Changelog:
==========
- Fix bug in redis version parsing when using Elasticache or any other that
  sends major/minor. redis-py incorrectly parses these as floats because
  there's only a single decimal, so the version check was breaking.
- Rename max task option --max-tasks (previously was --max_tasks).

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c14a56b)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@trukna @anujm1
python3-django: upgrade 5.2.13 -> 5.2.14
9148bf8 
https://docs.djangoproject.com/en/dev/releases/5.2.14/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit ef903fc)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@trukna @anujm1
python3-django: upgrade 6.0.4 -> 6.0.5
815a038 
https://docs.djangoproject.com/en/dev/releases/6.0.5/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 2f64c27)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@wangmingyu84 @anujm1
swagger-ui: upgrade 5.32.2 -> 5.32.5
d8cfc58 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 137e8d2)

Bugfixes and performance improvements:
https://github.com/swagger-api/swagger-ui/releases/tag/v5.32.3
https://github.com/swagger-api/swagger-ui/releases/tag/v5.32.4
https://github.com/swagger-api/swagger-ui/releases/tag/v5.32.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@wangmingyu84 @anujm1
swagger-ui: upgrade 5.32.5 -> 5.32.6
38c0ee7 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a86ee0d)

Bugfix release
https://github.com/swagger-api/swagger-ui/releases/tag/v5.32.6

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@wangmingyu84 @anujm1
imagemagick: upgrade 7.1.2-21 -> 7.1.2-22
f9eea94 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 5063ac8)

Bug and security fixes
ImageMagick/ImageMagick@7.1.2-21...7.1.2-22

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@wangmingyu84 @anujm1
bit7z: upgrade 4.0.11 -> 4.0.12
915cca7 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 84d4d96)

https://github.com/rikyoz/bit7z/releases/tag/v4.0.12

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@wangmingyu84 @anujm1
uriparser: upgrade 1.0.0 -> 1.0.1
343e59e 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 03255a8)

https://github.com/uriparser/uriparser/blob/uriparser-1.0.1/ChangeLog

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@wangmingyu84 @anujm1
uriparser: upgrade 1.0.1 -> 1.0.2
6193126 
Changelog:
==============
* Fixed: [CVE-2026-44927]
    Stop truncating 'ptrdiff_t' to 'int'
* Fixed: [CVE-2026-44928]
    Fix 'EqualsUri' with regard to '.absolutePath'
* Fixed: Fix OOM related memory leak in 'CopyUriMm'
* Improved: Simplify internal function 'CompareRange' into 'RangeEquals'
* Improved: Make function 'RangeEquals' use size_t' internally
* Soname: 3:2:2 - see https://verbump.de/ for what these numbers do

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a0589ae)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@Guocai-he @anujm1
postgresql: upgrade 17.8 -> 17.10
c51bb39 
Refreshed 0003-configure.ac-bypass-autoconf-2.69-version-check.patch
for 17.10

Includes fix for CVE-2026-6472, CVE-2026-6473, CVE-2026-6474, CVE-2026-6475,
CVE-2026-6476, CVE-2026-6477, CVE-2026-6478, CVE-2026-6479, CVE-2026-6637,
CVE-2026-6638 CVE-2026-6575

Release Notes:
https://www.postgresql.org/docs/release/17.10/

Signed-off-by: Guocai He <guocai.he.cn@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 83cad39)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@wangmingyu84 @anujm1
lldpd: upgrade 1.0.21 -> 1.0.22
82dc554 
 * Fix:
   + Fix out-of-bound read access when removing VLAN tag (CVE-2026-46433, openembedded#787)
   + Reject 0-length management address in LLDP
   + Fix race condition when creating the control socket
   + Fix FDP MAC address
   + Fix memory leak in the BSD bridge query path
   + Fix duplicate management addresses when merging EDP VLAN frames

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 74cd808)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@anujm1
dnsmasq: fix CVE-2026-4891
81572e1 
A heap-based out-of-bounds read vulnerability in the
DNSSEC validation of dnsmasq allows remote attackers
to cause a denial of service via a crafted DNS packet.

Reference:
[ https://nvd.nist.gov/vuln/detail/CVE-2026-4891 ]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a9de48a)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@anujm1
dnsmasq: fix CVE-2026-4892
be8d0f0 
A heap-based out-of-bounds write vulnerability in the DHCPv6
implementation of dnsmasq allows local attackers to execute
arbitrary code with root privileges via a crafted DHCPv6 packet.

Reference:
[ https://nvd.nist.gov/vuln/detail/CVE-2026-4892 ]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 21c3d7e)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@anujm1
dnsmasq: fix CVE-2026-4893
b81fd0e 
An information disclosure vulnerability in dnsmasq allows remote
attackers to bypass source checks via a crafted DNS packet with
RFC 7871 client subnet information.

Reference:
[ https://nvd.nist.gov/vuln/detail/CVE-2026-4893 ]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit b4c4853)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@anujm1
dnsmasq: fix CVE-2026-5172
ed94659 
A buffer overflow in dnsmasq’s extract_addresses() function allows
an attacker to trigger a heap out-of-bounds read and crash by
exploiting a malformed DNS response, enabling extract_name()
to advance the pointer past the record’s end.

Reference:
[ https://nvd.nist.gov/vuln/detail/CVE-2026-5172 ]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 44c8962)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@MarkusVolk @anujm1
pipewire: update 1.6.3 -> 1.6.5
0537a67 
PipeWire 1.6.5 (2026-05-13)

This is a bugfix release that is API and ABI compatible with the previous
1.6.x releases.

Highlights
  - Fix muted output in some cases.
  - Removed the pipe filter in filter-graph.
  - More fixes and improvements.

PipeWire
  - Fix an issue in pw-filter where it could end up in a loop where buffers
    are stuck on a port and the port becomes silent. (#5249)

Modules
  - Improve ROC receiver start/stop, fixes memory leaks. (#5250)
  - Remove the pipe filter from filter-graph, it's broken by design and a
    security nightmare.
  - Fix the midi buffer size in jack-tunnel.

SPA
  - Rate limit out-of-buffers errors. (#5249)
  - Partially revert the line-out mute patch, it seems to break things and leave
    audio muted when plugging-unplugging jacks.  (#5246)
  - Improve renegotiation in audioconvert when the graph rate changes and the
    resampler was disabled. (#4933).
  - Fix potential crash in alsa when logging.

Pulse-server
  - A whole bunch of extra security checks and hardening fixes.

Older versions:

PipeWire 1.6.4 (2026-04-22)

This is a bugfix release that is API and ABI compatible with the previous
1.6.x releases.

Highlights
  - Small improvements and seqfault fixes.
  - Try to not emit ports that JACK doesn't understand. Fixes glitches in
    ardour and other JACK apps.

PipeWire
  - Refuse to load plugins and crash when pw_init() was not called. (!2784)

SPA
  - Fix LADSPA plugin loading, support LADSPA_PATH ending with /
  - Fix segfault in alsa-seq when removing devices in some cases. (#5221)
  - Allow negative gain in mixer. (#5228)
  - Improve alsa-seq port names, add : between client and port. (#5229)
  - ACP: don’t override user-selected port on availability changes.

Bluetooth
  - Backport some important fixes and minor improvements.

JACK
  - Ignore non DSP ports to avoid emitting extra callbacks.

GStreamer
  - Fix crop metadata.

Tools
  - Fix WAVEX saving in pw-cat. (#5233)

Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit babcd87)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@trukna @anujm1
imagemagick: upgrade 7.1.2-22 -> 7.1.2-23
a1ffc49 
Bug and security fixes
ImageMagick/ImageMagick@7.1.2-22...7.1.2-23

PTEST passed:

root@qemuarm64:~# ptest-runner imagemagick
START: ptest-runner
2026-05-23T03:43
BEGIN: /usr/lib/imagemagick/ptest
...
...
DURATION: 1
END: /usr/lib/imagemagick/ptest
2026-05-23T03:43
STOP: ptest-runner
TOTAL: 1 FAIL: 0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@anujm1
nodejs: upgrade 22.22.2 -> 22.22.3
74c663d 
With this upgrade, nodejs updated the llhttp dependency to version 9.3.1
So some of the patches are nolonger necessary.

Changelog: https://github.com/nodejs/node/releases/tag/v22.22.3

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit ea56a5e)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@anujm1
kmscon: fix zlib cross-compiling errors
7d1f4b0 
zlib compression was introduced in version 9.3.3. However, when
cross-compiling kmscon for an architecture other than x86_64, the
genunifont executable tries to use the build-systems zlib instead
of the hosts zlib.

This leads to the following error during compiling:
libz.so: error adding symbols: file in wrong format

Fix this by adding a new native zlib dependency specifically for the
genunifont executable.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 72154f3)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@jiajia123-wind @anujm1
layer.conf: remove dead BBFILES_DYNAMIC entry for clang-layer
34debec 
The dynamic-layers/clang-layer/ directory does not exist under meta-oe.
Remove the stale BBFILES_DYNAMIC references as they match nothing.

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a07b2dd)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
@anujm1
README: update listed maintainer
a43f0d5 
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@Shreejit-03 @wangmingyu84 @trukna @Guocai-he @MarkusVolk @jiajia123-wind @anujm1