All of lore.kernel.org
 help / color / mirror / Atom feed
* [Buildroot] [PATCH v1 1/2] package/libglib2: bump to version 2.90.1
@ 2026-10-31 18:36 Thomas Devoogdt
  2026-10-31 18:36 ` [Buildroot] [PATCH v1 2/2] package/libgtk4: bump to version 4.24.1 Thomas Devoogdt
  0 siblings, 1 reply; 2+ messages in thread
From: Thomas Devoogdt @ 2026-10-31 18:36 UTC (permalink / raw)
  To: buildroot; +Cc: Fabrice Fontaine, Thomas Devoogdt

Changelog: https://gitlab.gnome.org/GNOME/glib/-/blob/2.90.1/NEWS

- COPYING is now a symlink to LICENSES/LGPL-2.1-or-later.txt
- CVE-2026-58016 is fixed upstream, drop the patch

Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
---
 ...on-Fix-XML-parser-state-handling-for.patch | 42 -------------------
 package/libglib2/libglib2.hash                |  6 +--
 package/libglib2/libglib2.mk                  |  9 ++--
 3 files changed, 6 insertions(+), 51 deletions(-)
 delete mode 100644 package/libglib2/0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch

diff --git a/package/libglib2/0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch b/package/libglib2/0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch
deleted file mode 100644
index 4582382f806..00000000000
--- a/package/libglib2/0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2 Mon Sep 17 00:00:00 2001
-From: Philip Withnall <pwithnall@gnome.org>
-Date: Thu, 16 Apr 2026 15:27:37 +0100
-Subject: [PATCH] gdbusintrospection: Fix XML parser state handling for <node>
- element nesting
-
-The check for whether a `<node>` element in D-Bus introspection XML was
-nested correctly was broken. `<node>` elements can only be at the top
-level, or nested immediately within another `<node>` element.
-
-Fix the check and add some unit tests for it.
-
-Spotted by linhlhq as #YWH-PGM9867-204. The fix is mine, and the unit test
-uses example XML strings adapted from their report.
-
-Signed-off-by: Philip Withnall <pwithnall@gnome.org>
-
-Fixes: #3932
-CVE: CVE-2026-58016
-Upstream: https://gitlab.gnome.org/GNOME/glib/-/commit/c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2
-Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
-[Peter: drop tests]
----
- gio/gdbusintrospection.c        |  2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/gio/gdbusintrospection.c b/gio/gdbusintrospection.c
-index 1138ba9d7..4df8e87db 100644
---- a/gio/gdbusintrospection.c
-+++ b/gio/gdbusintrospection.c
-@@ -1266,7 +1266,7 @@ parser_start_element (GMarkupParseContext  *context,
-   /* ---------------------------------------------------------------------------------------------------- */
-   if (strcmp (element_name, "node") == 0)
-     {
--      if (!(g_slist_length (stack) >= 1 || strcmp (stack->next->data, "node") != 0))
-+      if (stack->next != NULL && strcmp (stack->next->data, "node") != 0)
-         {
-           g_set_error_literal (error,
-                                G_MARKUP_ERROR,
--- 
-2.47.3
-
diff --git a/package/libglib2/libglib2.hash b/package/libglib2/libglib2.hash
index 95bf4d3179a..b6203dd0271 100644
--- a/package/libglib2/libglib2.hash
+++ b/package/libglib2/libglib2.hash
@@ -1,4 +1,4 @@
-# https://download.gnome.org/sources/glib/2.88/glib-2.88.4.sha256sum
-sha256  25fd169f3b2f91fe2391ad297883ce0fcf30c69fc789ffd1c9672d1332b1c5a8  glib-2.88.4.tar.xz
+# https://download.gnome.org/sources/glib/2.90/glib-2.90.1.sha256sum
+sha256  93c941aa17d5eb1d53fe838365f29a8b4e539c222a256d974ec8f30fc413e396  glib-2.90.1.tar.xz
 # License files, locally calculated
-sha256  fa6f36630bb1e0c571d34b2bbdf188d08495c9dbf58f28cac112f303fc1f58fb  COPYING
+sha256  fa6f36630bb1e0c571d34b2bbdf188d08495c9dbf58f28cac112f303fc1f58fb  LICENSES/LGPL-2.1-or-later.txt
diff --git a/package/libglib2/libglib2.mk b/package/libglib2/libglib2.mk
index 3770e8671a1..23f6643f10a 100644
--- a/package/libglib2/libglib2.mk
+++ b/package/libglib2/libglib2.mk
@@ -4,12 +4,12 @@
 #
 ################################################################################
 
-LIBGLIB2_VERSION_MAJOR = 2.88
-LIBGLIB2_VERSION = $(LIBGLIB2_VERSION_MAJOR).4
+LIBGLIB2_VERSION_MAJOR = 2.90
+LIBGLIB2_VERSION = $(LIBGLIB2_VERSION_MAJOR).1
 LIBGLIB2_SOURCE = glib-$(LIBGLIB2_VERSION).tar.xz
 LIBGLIB2_SITE = https://download.gnome.org/sources/glib/$(LIBGLIB2_VERSION_MAJOR)
 LIBGLIB2_LICENSE = LGPL-2.1+
-LIBGLIB2_LICENSE_FILES = COPYING
+LIBGLIB2_LICENSE_FILES = LICENSES/LGPL-2.1-or-later.txt
 LIBGLIB2_CPE_ID_VENDOR = gnome
 LIBGLIB2_CPE_ID_PRODUCT = glib
 LIBGLIB2_INSTALL_STAGING = YES
@@ -17,9 +17,6 @@ LIBGLIB2_INSTALL_STAGING = YES
 LIBGLIB2_CFLAGS = $(TARGET_CFLAGS)
 LIBGLIB2_LDFLAGS = $(TARGET_LDFLAGS) $(TARGET_NLS_LIBS)
 
-# 0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch
-LIBGLIB2_IGNORE_CVES += CVE-2026-58016
-
 # glib/valgrind.h contains inline asm not compatible with thumb1
 ifeq ($(BR2_ARM_INSTRUCTIONS_THUMB),y)
 LIBGLIB2_CFLAGS += -marm
-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2026-10-31 18:36 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-31 18:36 [Buildroot] [PATCH v1 1/2] package/libglib2: bump to version 2.90.1 Thomas Devoogdt
2026-10-31 18:36 ` [Buildroot] [PATCH v1 2/2] package/libgtk4: bump to version 4.24.1 Thomas Devoogdt

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.