[OE-core] [PATCH 01/16] alsa-lib: upgrade 1.2.15.3 -> 1.2.16

[OE-core] [PATCH 01/16] alsa-lib: upgrade 1.2.15.3 -> 1.2.16

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

CVE-2026-25068.patch
removed since it's included in 1.2.16

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 .../alsa/alsa-lib/CVE-2026-25068.patch        | 34 -------------------
 ...lsa-lib_1.2.15.3.bb => alsa-lib_1.2.16.bb} |  3 +-
 2 files changed, 1 insertion(+), 36 deletions(-)
 delete mode 100644 meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch
 rename meta/recipes-multimedia/alsa/{alsa-lib_1.2.15.3.bb => alsa-lib_1.2.16.bb} (91%)

diff --git a/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch b/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch
deleted file mode 100644
index 9bb24c24e2..0000000000
--- a/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40 Mon Sep 17 00:00:00 2001
-From: Jaroslav Kysela <perex@perex.cz>
-Date: Thu, 29 Jan 2026 16:51:09 +0100
-Subject: [PATCH] topology: decoder - add boundary check for channel mixer
- count
-
-Malicious binary topology file may cause heap corruption.
-
-CVE: CVE-2026-25068
-
-Signed-off-by: Jaroslav Kysela <perex@perex.cz>
-
-Upstream-Status: Backport [https://github.com/alsa-project/alsa-lib/commit/5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40]
-Signed-off-by: Peter Marko <peter.marko@siemens.com>
----
- src/topology/ctl.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/src/topology/ctl.c b/src/topology/ctl.c
-index a0c24518..322c461c 100644
---- a/src/topology/ctl.c
-+++ b/src/topology/ctl.c
-@@ -1250,6 +1250,11 @@ int tplg_decode_control_mixer1(snd_tplg_t *tplg,
- 	if (mc->num_channels > 0) {
- 		map = tplg_calloc(heap, sizeof(*map));
- 		map->num_channels = mc->num_channels;
-+		if (map->num_channels > SND_TPLG_MAX_CHAN ||
-+		    map->num_channels > SND_SOC_TPLG_MAX_CHAN) {
-+			snd_error(TOPOLOGY, "mixer: unexpected channel count %d", map->num_channels);
-+			return -EINVAL;
-+		}
- 		for (i = 0; i < map->num_channels; i++) {
- 			map->channel[i].reg = mc->channel[i].reg;
- 			map->channel[i].shift = mc->channel[i].shift;
diff --git a/meta/recipes-multimedia/alsa/alsa-lib_1.2.15.3.bb b/meta/recipes-multimedia/alsa/alsa-lib_1.2.16.bb
similarity index 91%
rename from meta/recipes-multimedia/alsa/alsa-lib_1.2.15.3.bb
rename to meta/recipes-multimedia/alsa/alsa-lib_1.2.16.bb
index 1ebb356925..25b2dcde17 100644
--- a/meta/recipes-multimedia/alsa/alsa-lib_1.2.15.3.bb
+++ b/meta/recipes-multimedia/alsa/alsa-lib_1.2.16.bb
@@ -10,8 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=a916467b91076e631dd8edb7424769c7 \
                     "
 
 SRC_URI = "https://www.alsa-project.org/files/pub/lib/${BP}.tar.bz2"
-SRC_URI += "file://CVE-2026-25068.patch"
-SRC_URI[sha256sum] = "7b079d614d582cade7ab8db2364e65271d0877a37df8757ac4ac0c8970be861e"
+SRC_URI[sha256sum] = "122b1e3166d55fe19bcde656535d7a36f2ab10e66c72c6ad2f43f20ffded0a96"
 
 inherit autotools pkgconfig
 
-- 
2.43.0

[OE-core] [PATCH 02/16] alsa-utils: upgrade 1.2.15.2 -> 1.2.16

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 .../alsa/{alsa-utils_1.2.15.2.bb => alsa-utils_1.2.16.bb}      | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
 rename meta/recipes-multimedia/alsa/{alsa-utils_1.2.15.2.bb => alsa-utils_1.2.16.bb} (97%)

diff --git a/meta/recipes-multimedia/alsa/alsa-utils_1.2.15.2.bb b/meta/recipes-multimedia/alsa/alsa-utils_1.2.16.bb
similarity index 97%
rename from meta/recipes-multimedia/alsa/alsa-utils_1.2.15.2.bb
rename to meta/recipes-multimedia/alsa/alsa-utils_1.2.16.bb
index b792302c9f..40515e0d73 100644
--- a/meta/recipes-multimedia/alsa/alsa-utils_1.2.15.2.bb
+++ b/meta/recipes-multimedia/alsa/alsa-utils_1.2.16.bb
@@ -12,11 +12,10 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=59530bdf33659b29e73d4adb9f9f6552 \
 DEPENDS = "alsa-lib ncurses libsamplerate0 bash"
 
 # Only needed as the dynamic packaging was altered, remove on upgrade
-PR = "r2"
 
 # alsa-utils specified in SRC_URI due to alsa-utils-scripts recipe
 SRC_URI = "https://www.alsa-project.org/files/pub/utils/alsa-utils-${PV}.tar.bz2"
-SRC_URI[sha256sum] = "7aaaafbfb01942113ec0c31e51f705910e81079205088ca2f8f137a3869e1a3a"
+SRC_URI[sha256sum] = "092399d5e8749a1d5e188e393157521cec4b75693b60ebb79bbce728cff2232c"
 
 inherit autotools gettext pkgconfig manpages
 
-- 
2.43.0

[OE-core] [PATCH 03/16] barebox-tools: upgrade 2026.04.0 -> 2026.06.0

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 meta/recipes-bsp/barebox/barebox-common.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-bsp/barebox/barebox-common.inc b/meta/recipes-bsp/barebox/barebox-common.inc
index f736ca68e0..6467ed3653 100644
--- a/meta/recipes-bsp/barebox/barebox-common.inc
+++ b/meta/recipes-bsp/barebox/barebox-common.inc
@@ -3,6 +3,6 @@ SECTION = "bootloaders"
 
 LIC_FILES_CHKSUM = "file://COPYING;md5=f5125d13e000b9ca1f0d3364286c4192"
 
-PV = "2026.04.0"
+PV = "2026.06.0"
 SRC_URI = "https://barebox.org/download/barebox-${PV}.tar.bz2"
-SRC_URI[sha256sum] = "07fd3e3440c23e27d0094432f67827887fcc0e37d5fe24dc257c39b97c4294a0"
+SRC_URI[sha256sum] = "521b427efe4d5199641fd6440ed77226fed3ba7088ee2f6361b510187f700f09"
-- 
2.43.0

[OE-core] [PATCH 04/16] btrfs-tools: upgrade 6.19.1 -> 7.0

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

Changelog:
===========
- btrfstune: add ability to do offline conversion to the remap tree
  (experimental feature)
- mkfs: add hole detection when precalculating size for --rootdir
- fixes: recognize fs-verity tree items in various tools (check)
- enable PCLMUL implementation on Musl (previously using SSE 4.2 at best)
- help format changed to be in line with common packages like util-linux
- reject writes to filesystem during check/btrfstune in case there's pending
  state of device replace or balance
- other:
  build ARM64 static binaries (attached to GH release) backward compatibility level is 'archv8-a'
  CI updates
  documentation updates

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 .../btrfs-tools/{btrfs-tools_6.19.1.bb => btrfs-tools_7.0.bb}   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/btrfs-tools/{btrfs-tools_6.19.1.bb => btrfs-tools_7.0.bb} (98%)

diff --git a/meta/recipes-devtools/btrfs-tools/btrfs-tools_6.19.1.bb b/meta/recipes-devtools/btrfs-tools/btrfs-tools_7.0.bb
similarity index 98%
rename from meta/recipes-devtools/btrfs-tools/btrfs-tools_6.19.1.bb
rename to meta/recipes-devtools/btrfs-tools/btrfs-tools_7.0.bb
index dee1270fa0..72b5575703 100644
--- a/meta/recipes-devtools/btrfs-tools/btrfs-tools_6.19.1.bb
+++ b/meta/recipes-devtools/btrfs-tools/btrfs-tools_7.0.bb
@@ -18,7 +18,7 @@ DEPENDS = "util-linux zlib"
 SRC_URI = "git://github.com/kdave/btrfs-progs.git;branch=master;protocol=https;tag=v${PV} \
            file://0001-Add-a-possibility-to-specify-where-python-modules-ar.patch \
            "
-SRCREV = "fa79dbea32d39ac0ae41a88a079013c7ad2a8a58"
+SRCREV = "9c5987432906daebde23f9703c0f6f90c35fa9da"
 
 PACKAGECONFIG ??= " \
     programs \
-- 
2.43.0

[OE-core] [PATCH 05/16] dos2unix: upgrade 7.5.5 -> 7.5.6

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

Changelog:
============
 * New homepage https://waterlander.net/dos2unix/
 * Updated translations of the manual.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 .../dos2unix/{dos2unix_7.5.5.bb => dos2unix_7.5.6.bb}       | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 rename meta/recipes-support/dos2unix/{dos2unix_7.5.5.bb => dos2unix_7.5.6.bb} (88%)

diff --git a/meta/recipes-support/dos2unix/dos2unix_7.5.5.bb b/meta/recipes-support/dos2unix/dos2unix_7.5.6.bb
similarity index 88%
rename from meta/recipes-support/dos2unix/dos2unix_7.5.5.bb
rename to meta/recipes-support/dos2unix/dos2unix_7.5.6.bb
index aa078ed200..8ef1d427e3 100644
--- a/meta/recipes-support/dos2unix/dos2unix_7.5.5.bb
+++ b/meta/recipes-support/dos2unix/dos2unix_7.5.6.bb
@@ -2,16 +2,16 @@ SUMMARY = "Convert text file line endings between CRLF and LF"
 DESCRIPTION = "The Dos2unix package includes utilities dos2unix and \
 unix2dos to convert plain text files in DOS or Mac format to Unix \
 format and vice versa."
-HOMEPAGE = "http://waterlan.home.xs4all.nl/dos2unix.html"
+HOMEPAGE = "https://waterlander.net/dos2unix/"
 SECTION = "support"
 
 LICENSE = "BSD-2-Clause"
 LIC_FILES_CHKSUM = "file://COPYING.txt;md5=af1174fd3d1a254eec3a4a1d1da170a9"
 
-SRC_URI = "git://git.code.sf.net/p/dos2unix/dos2unix;branch=master;protocol=https"
+SRC_URI = "git://git.code.sf.net/p/dos2unix/dos2unix;branch=master;protocol=https;tag=${BPN}-${PV}"
 UPSTREAM_CHECK_GITTAGREGEX = "dos2unix-(?P<pver>(\d+(\.\d+)+))"
 
-SRCREV = "54524999eece4e9ad0dab580c79b02855fc85028"
+SRCREV = "9c2ea173af3bc49324f8288d81c5a2bbfc0884d0"
 
 S = "${UNPACKDIR}/${BP}/dos2unix"
 
-- 
2.43.0

[OE-core] [PATCH 06/16] dropbear: upgrade 2025.89 -> 2026.91

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 .../dropbear/{dropbear_2025.89.bb => dropbear_2026.91.bb}       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-core/dropbear/{dropbear_2025.89.bb => dropbear_2026.91.bb} (98%)

diff --git a/meta/recipes-core/dropbear/dropbear_2025.89.bb b/meta/recipes-core/dropbear/dropbear_2026.91.bb
similarity index 98%
rename from meta/recipes-core/dropbear/dropbear_2025.89.bb
rename to meta/recipes-core/dropbear/dropbear_2026.91.bb
index ece065265f..826a691b04 100644
--- a/meta/recipes-core/dropbear/dropbear_2025.89.bb
+++ b/meta/recipes-core/dropbear/dropbear_2026.91.bb
@@ -23,7 +23,7 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \
            ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \
            "
 
-SRC_URI[sha256sum] = "0d1f7ca711cfc336dc8a85e672cab9cfd8223a02fe2da0a4a7aeb58c9e113634"
+SRC_URI[sha256sum] = "defa924475abf6bc1e74abc00173e46bfdc804bd47caafa14f5a4ef0cc76da34"
 MIRRORS += "http://matt.ucc.asn.au/dropbear/releases/ https://dropbear.nl/mirror/releases/"
 
 PAM_SRC_URI = "file://0005-dropbear-enable-pam.patch \
-- 
2.43.0

[OE-core] [PATCH 07/16] fastfloat: upgrade 8.2.5 -> 8.2.8

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

Changelog:
===========
- Unroll the integer-part digit scan (straight-line for the common 1-5 digit case)
- Add a 4-digit SWAR follow-up to loop_parse_if_eight_digits (clang)
- Parallelize the exhaustive float32 sweeps across hardware threads (~75-88x)
- Fix spelling
- Fix compile error in clang<10: fails on pragma -Wc++20-extensions

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 .../fastfloat/{fastfloat_8.2.5.bb => fastfloat_8.2.8.bb}        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/fastfloat/{fastfloat_8.2.5.bb => fastfloat_8.2.8.bb} (90%)

diff --git a/meta/recipes-devtools/fastfloat/fastfloat_8.2.5.bb b/meta/recipes-devtools/fastfloat/fastfloat_8.2.8.bb
similarity index 90%
rename from meta/recipes-devtools/fastfloat/fastfloat_8.2.5.bb
rename to meta/recipes-devtools/fastfloat/fastfloat_8.2.8.bb
index cbd7151f85..761bab84d7 100644
--- a/meta/recipes-devtools/fastfloat/fastfloat_8.2.5.bb
+++ b/meta/recipes-devtools/fastfloat/fastfloat_8.2.8.bb
@@ -9,6 +9,6 @@ LIC_FILES_CHKSUM = " \
 
 SRC_URI = "git://github.com/fastfloat/fast_float.git;protocol=https;branch=main;tag=v${PV}"
 
-SRCREV = "05087a303dad9c98768b33c829d398223a649bc6"
+SRCREV = "e8ec8e8f34bd6142efdbf4c714734dcff51ea9ac"
 
 inherit cmake
-- 
2.43.0

[OE-core] [PATCH 08/16] file: upgrade 5.47 -> 5.48

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

Changelog:
=============
* add landlock support
* add BE/LE GUID
* multiple fixes to prevent integer overflow in 32 bits
* PR/745: streamout: Don't flush when trying to set negative offsets
          on pipes, just continue, fixes 'cat file.zip | file -'
* PR/753: vmihalko: Fix race is magic_getpath()
* PR/728: Anton Monroe: Reinstate regex/c

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 meta/recipes-devtools/file/{file_5.47.bb => file_5.48.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/file/{file_5.47.bb => file_5.48.bb} (97%)

diff --git a/meta/recipes-devtools/file/file_5.47.bb b/meta/recipes-devtools/file/file_5.48.bb
similarity index 97%
rename from meta/recipes-devtools/file/file_5.47.bb
rename to meta/recipes-devtools/file/file_5.48.bb
index 528ed49a12..20e167f436 100644
--- a/meta/recipes-devtools/file/file_5.47.bb
+++ b/meta/recipes-devtools/file/file_5.48.bb
@@ -14,7 +14,7 @@ DEPENDS:class-native = "bzip2-replacement-native"
 SRC_URI = "git://github.com/file/file.git;branch=master;protocol=https \
            "
 
-SRCREV = "7d20612996567ecedec7f5c58f7bf15c2cf42c19"
+SRCREV = "eb754ace19fed5481d8142426543100a2d6bae4e"
 
 inherit autotools update-alternatives
 
-- 
2.43.0

[OE-core] [PATCH 09/16] fontconfig: upgrade 2.17.1 -> 2.18.1

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

0001-build-Added-missing-target-rule-dependencies.patch
musl-fix.patch
removed since they're included in 2.18.1

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 ...ded-missing-target-rule-dependencies.patch | 31 ---------
 .../fontconfig/fontconfig/musl-fix.patch      | 66 -------------------
 ...tconfig_2.17.1.bb => fontconfig_2.18.1.bb} |  4 +-
 3 files changed, 1 insertion(+), 100 deletions(-)
 delete mode 100644 meta/recipes-graphics/fontconfig/fontconfig/0001-build-Added-missing-target-rule-dependencies.patch
 delete mode 100644 meta/recipes-graphics/fontconfig/fontconfig/musl-fix.patch
 rename meta/recipes-graphics/fontconfig/{fontconfig_2.17.1.bb => fontconfig_2.18.1.bb} (92%)

diff --git a/meta/recipes-graphics/fontconfig/fontconfig/0001-build-Added-missing-target-rule-dependencies.patch b/meta/recipes-graphics/fontconfig/fontconfig/0001-build-Added-missing-target-rule-dependencies.patch
deleted file mode 100644
index 40b25cc926..0000000000
--- a/meta/recipes-graphics/fontconfig/fontconfig/0001-build-Added-missing-target-rule-dependencies.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 0bba79bfd3d8a216794d15af97ce4abefd4b8748 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Florian=20=22sp1rit=22=E2=80=8B?= <sp1rit@disroot.org>
-Date: Sat, 9 Aug 2025 20:22:43 +0200
-Subject: [PATCH] build: Added missing target rule-dependencies
-
-02b835b62 did not appropriately ensure, that the patternlib_internal
-target waits until the {ft_,}alias_headers have finished generating the
-headers that it depends on.
-
-Upstream-Status: Backport [0bba79bfd3d8a216794d15af97ce4abefd4b8748]
-Signed-off-by: Ross Burton <ross.burton@arm.com>
----
- src/meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/meson.build b/src/meson.build
-index c4d65d6c..10866aa8 100644
---- a/src/meson.build
-+++ b/src/meson.build
-@@ -9,7 +9,7 @@ endif
- # Factor our pattern manipulation code into its own library
- # to break the depedency cycle:
- # FontConfig pattern handling - Fontations code - FontConfig.
--pattern_sources = [ 'fcpat.c', fcstdint_h, fclang_h ]
-+pattern_sources = [ 'fcpat.c', fcstdint_h, fclang_h, alias_headers, ft_alias_headers ]
- pattern_lib = static_library('patternlib_internal',
-                                     pattern_sources,
-                                     include_directories: incbase,
--- 
-2.43.0
-
diff --git a/meta/recipes-graphics/fontconfig/fontconfig/musl-fix.patch b/meta/recipes-graphics/fontconfig/fontconfig/musl-fix.patch
deleted file mode 100644
index c4508bd15a..0000000000
--- a/meta/recipes-graphics/fontconfig/fontconfig/musl-fix.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 75cc3e6ef0e451f42d3464ed4d639304ad9a4f58 Mon Sep 17 00:00:00 2001
-From: Akira TAGOH <akira@tagoh.org>
-Date: Thu, 3 Jul 2025 03:31:49 +0900
-Subject: [PATCH] test: Fix a build issue with musl libc
-
-Fixes https://gitlab.freedesktop.org/fontconfig/fontconfig/-/issues/484
-
-Changelog: fixed
-Upstream-Status: Backport [https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/75cc3e6ef0e451f42d3464ed4d639304ad9a4f58]
-Signed-off-by: Alexander Kanavin <alex@linutronix.de>
----
- test/test-mt-fccfg.c | 22 ++++++++++++++++++++--
- 1 file changed, 20 insertions(+), 2 deletions(-)
-
-diff --git a/test/test-mt-fccfg.c b/test/test-mt-fccfg.c
-index 24ad7583..3b7d843d 100644
---- a/test/test-mt-fccfg.c
-+++ b/test/test-mt-fccfg.c
-@@ -1,9 +1,12 @@
- /* Copyright (C) 2025 fontconfig Authors */
- /* SPDX-License-Identifier: HPND */
-+#ifdef HAVE_CONFIG_H
-+#  include "config.h"
-+#endif
-+
- #include <fontconfig/fontconfig.h>
- 
- #include <stdio.h>
--#define __USE_XOPEN
- #include <pthread.h>
- #include <stdlib.h>
- 
-@@ -13,6 +16,21 @@ struct thr_arg_s {
-     int thr_num;
- };
- 
-+#ifdef _WIN32
-+int
-+setenv (const char *name, const char *value, int o)
-+{
-+    size_t len = strlen (name) + strlen (value) + 1;
-+    char  *s = malloc (len + 1);
-+    int    ret;
-+
-+    snprintf (s, len, "%s=%s", name, value);
-+    ret = _putenv (s);
-+    free (s);
-+    return ret;
-+}
-+#endif
-+
- static void *
- run_test_in_thread (void *arg)
- {
-@@ -61,7 +79,7 @@ test (void)
-     if (c1 == c2)
- 	return 1;
-     /* To make visible if we have any references */
--    putenv ("FC_DEBUG=16");
-+    setenv ("FC_DEBUG", "16", 1);
-     FcFini();
- 
-     return 0;
--- 
-GitLab
-
diff --git a/meta/recipes-graphics/fontconfig/fontconfig_2.17.1.bb b/meta/recipes-graphics/fontconfig/fontconfig_2.18.1.bb
similarity index 92%
rename from meta/recipes-graphics/fontconfig/fontconfig_2.17.1.bb
rename to meta/recipes-graphics/fontconfig/fontconfig_2.18.1.bb
index 0d0fcfcceb..76b2652738 100644
--- a/meta/recipes-graphics/fontconfig/fontconfig_2.17.1.bb
+++ b/meta/recipes-graphics/fontconfig/fontconfig_2.18.1.bb
@@ -22,10 +22,8 @@ DEPENDS = "expat freetype zlib gperf-native util-linux"
 
 SRC_URI = "https://gitlab.freedesktop.org/api/v4/projects/890/packages/generic/fontconfig/${PV}/fontconfig-${PV}.tar.xz \
            file://revert-static-pkgconfig.patch \
-           file://musl-fix.patch \
-           file://0001-build-Added-missing-target-rule-dependencies.patch \
            "
-SRC_URI[sha256sum] = "9f5cae93f4fffc1fbc05ae99cdfc708cd60dfd6612ffc0512827025c026fa541"
+SRC_URI[sha256sum] = "2300f3dbfa7253b3a44f4feecdbc8dfa45dde5dc2cfb71fceaf31f394cb41031"
 
 UPSTREAM_CHECK_URI = "https://gitlab.freedesktop.org/fontconfig/fontconfig/-/tags"
 UPSTREAM_CHECK_REGEX = "releases/(?P<pver>.+)"
-- 
2.43.0

[OE-core] [PATCH 10/16] ghostscript: upgrade 10.07.0 -> 10.07.1

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

out-of-tree.patch
refreshed for 10.07.1

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 .../ghostscript/ghostscript/out-of-tree.patch | 30 ++++++++-----------
 ...ript_10.07.0.bb => ghostscript_10.07.1.bb} |  2 +-
 2 files changed, 14 insertions(+), 18 deletions(-)
 rename meta/recipes-extended/ghostscript/{ghostscript_10.07.0.bb => ghostscript_10.07.1.bb} (97%)

diff --git a/meta/recipes-extended/ghostscript/ghostscript/out-of-tree.patch b/meta/recipes-extended/ghostscript/ghostscript/out-of-tree.patch
index 202c9d6c7c..8cf539a3cd 100644
--- a/meta/recipes-extended/ghostscript/ghostscript/out-of-tree.patch
+++ b/meta/recipes-extended/ghostscript/ghostscript/out-of-tree.patch
@@ -1,14 +1,21 @@
-Fix the build to do out-of-tree properly.
+From 6d9852d5bac17a5fc7f605bd596e93528b0fcf81 Mon Sep 17 00:00:00 2001
+From: Ross Burton <ross.burton@arm.com>
+Date: Thu, 2 Apr 2026 14:41:42 +0100
+Subject: [PATCH] Fix the build to do out-of-tree properly.
 
 The patches are in progress but are being submitted upstream.
 
 Upstream-Status: Submitted [https://bugs.ghostscript.com/show_bug.cgi?id=709289]
 Signed-off-by: Ross Burton <ross.burton@arm.com>
+---
+ configure.ac | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
 
-diff -rU3 a/configure.ac b/configure.ac
---- a/configure.ac	2025-09-09 10:36:39.000000000 +0100
-+++ b/configure.ac	2026-03-31 15:35:08.988262612 +0100
-@@ -400,7 +400,7 @@
+diff --git a/configure.ac b/configure.ac
+index b2b3678..dd00e86 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -400,7 +400,7 @@ if test x"$with_arch_h" = x""; then
            *)
              ARCH_CONF_HEADER=
              if test x"$host" != x"$build"; then
@@ -17,18 +24,7 @@ diff -rU3 a/configure.ac b/configure.ac
              else
                ARCH_CONF_HEADER=
              fi
-@@ -869,8 +869,8 @@
- AC_SUBST(RECURSIVE_MUTEXATTR)
- 
- dnl Tesseract/Leptonica detection
--TESSERACTDIR=tesseract
--LEPTONICADIR=leptonica
-+TESSERACTDIR=$srcdir/tesseract
-+LEPTONICADIR=$srcdir/leptonica
- OCR_VERSION=0
- OCR_SHARED=0
- LEPTONICAINCLUDE=
-@@ -886,7 +886,7 @@
+@@ -889,7 +889,7 @@ AC_ARG_WITH([tesseract], AS_HELP_STRING([--without-tesseract],
  
  if test x$with_tesseract != xno; then
    AC_MSG_CHECKING([for local Tesseract library source])
diff --git a/meta/recipes-extended/ghostscript/ghostscript_10.07.0.bb b/meta/recipes-extended/ghostscript/ghostscript_10.07.1.bb
similarity index 97%
rename from meta/recipes-extended/ghostscript/ghostscript_10.07.0.bb
rename to meta/recipes-extended/ghostscript/ghostscript_10.07.1.bb
index 1b6cb4aaae..3254872036 100644
--- a/meta/recipes-extended/ghostscript/ghostscript_10.07.0.bb
+++ b/meta/recipes-extended/ghostscript/ghostscript_10.07.1.bb
@@ -28,7 +28,7 @@ SRC_URI = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/downlo
            file://0001-psi-ztype.c-replace-static-const-double-with-macros-.patch \
            "
 
-SRC_URI[sha256sum] = "ed6ea62022e3f4d5a6569b6efc9361b63a6d118bfcad8f0beb897c37885b5cad"
+SRC_URI[sha256sum] = "2fc74362f9be6fae1b0a65d38fdcfd4f0b518cc3b07c5581fb661eb4d2e15251"
 
 PACKAGECONFIG ??= ""
 PACKAGECONFIG[gtk] = "--enable-gtk,--disable-gtk,gtk+3"
-- 
2.43.0

[OE-core] [PATCH 11/16] gpgme: upgrade 2.0.1 -> 2.1.0

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

Changelog:
===========
 * New flags "is_de_vs" and "beta_compliance" for encryption results.
 * New decryption flag GPGME_DECRYPT_SESSION_HASH and new field
   session_hash in gpgme_decrypt_result_t.  For details see the gpg
   option --show-session-key.
 * Setting of attributes for CMS signatures is now supported via
   gpgme_sig_notation_add.
 * New context flag "export-filter".
 * Extend the internal gpgsm_assuan_simple_command to consume all
   received lines.  This fixes a possible lockup introduced by the
   fix for T7759.
 * Fix passphrase cancel handling.
 * Fix a regression wrt the auto-key-locate option.
 * Handle the case when pinentry is invoked multiple times.
 * Don't cap ISO dates beyond year 2037 on Windows.
 * Treat empty DISPLAY envvar as unset.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 meta/recipes-support/gpgme/{gpgme_2.0.1.bb => gpgme_2.1.0.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-support/gpgme/{gpgme_2.0.1.bb => gpgme_2.1.0.bb} (96%)

diff --git a/meta/recipes-support/gpgme/gpgme_2.0.1.bb b/meta/recipes-support/gpgme/gpgme_2.1.0.bb
similarity index 96%
rename from meta/recipes-support/gpgme/gpgme_2.0.1.bb
rename to meta/recipes-support/gpgme/gpgme_2.1.0.bb
index ae20f785e6..269070b10b 100644
--- a/meta/recipes-support/gpgme/gpgme_2.0.1.bb
+++ b/meta/recipes-support/gpgme/gpgme_2.1.0.bb
@@ -24,7 +24,7 @@ SRC_URI = "${GNUPG_MIRROR}/gpgme/${BP}.tar.bz2 \
            file://0001-autogen.sh-remove-unknown-in-version.patch \
            "
 
-SRC_URI[sha256sum] = "821ab0695c842eab51752a81980c92b0410c7eadd04103f791d5d2a526784966"
+SRC_URI[sha256sum] = "841c5ea53fc26259f4fbf0e8bde982dea1b8a1ca0cb77e681c82b050566bf92b"
 
 DEPENDS = "libgpg-error-native libgpg-error libassuan"
 
-- 
2.43.0

[OE-core] [PATCH 12/16] harfbuzz: upgrade 14.2.0 -> 14.2.1

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 .../harfbuzz/{harfbuzz_14.2.0.bb => harfbuzz_14.2.1.bb}         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-graphics/harfbuzz/{harfbuzz_14.2.0.bb => harfbuzz_14.2.1.bb} (96%)

diff --git a/meta/recipes-graphics/harfbuzz/harfbuzz_14.2.0.bb b/meta/recipes-graphics/harfbuzz/harfbuzz_14.2.1.bb
similarity index 96%
rename from meta/recipes-graphics/harfbuzz/harfbuzz_14.2.0.bb
rename to meta/recipes-graphics/harfbuzz/harfbuzz_14.2.1.bb
index c130819f31..6b6c6a0f60 100644
--- a/meta/recipes-graphics/harfbuzz/harfbuzz_14.2.0.bb
+++ b/meta/recipes-graphics/harfbuzz/harfbuzz_14.2.1.bb
@@ -9,7 +9,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b98429b8e8e3c2a67cfef01e99e4893d \
                     "
 
 SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BPN}-${PV}.tar.xz"
-SRC_URI[sha256sum] = "94017020f96d025bb66ae91574e4cf334bcad23e8175a8a40565b3721bc2eaff"
+SRC_URI[sha256sum] = "a54a5d8e9380a41fbb762ce367bcbf7704792dfca0d93f1bbca86c5a57902e0e"
 
 inherit meson pkgconfig lib_package gtk-doc gobject-introspection github-releases
 
-- 
2.43.0

[OE-core] [PATCH 13/16] hwdata: upgrade 0.406 -> 0.408

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 .../recipes-support/hwdata/{hwdata_0.406.bb => hwdata_0.408.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-support/hwdata/{hwdata_0.406.bb => hwdata_0.408.bb} (93%)

diff --git a/meta/recipes-support/hwdata/hwdata_0.406.bb b/meta/recipes-support/hwdata/hwdata_0.408.bb
similarity index 93%
rename from meta/recipes-support/hwdata/hwdata_0.406.bb
rename to meta/recipes-support/hwdata/hwdata_0.408.bb
index 602ab7c9e2..5cb082d5c9 100644
--- a/meta/recipes-support/hwdata/hwdata_0.406.bb
+++ b/meta/recipes-support/hwdata/hwdata_0.408.bb
@@ -8,7 +8,7 @@ LICENSE = "GPL-2.0-or-later | X11"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=1556547711e8246992b999edd9445a57"
 
 SRC_URI = "git://github.com/vcrhonek/${BPN}.git;branch=master;protocol=https;tag=v${PV}"
-SRCREV = "9ae3b9da5cbb93eed30f812aa7edb4b9ad3e3868"
+SRCREV = "4456b256a1a5b1d1c1c1a60a9f69c59f7743c522"
 
 inherit allarch
 
-- 
2.43.0

[OE-core] [PATCH 14/16] kbd: upgrade 2.9.0 -> 2.10.0

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

0001-Preserve-only-necessary-metadata-during-install.patch
0001-libkbdfile-Fix-problem-with-undeclared-sym_gzopen.patch
removed since they're included in 2.10.0

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 ...ly-necessary-metadata-during-install.patch | 54 ------------------
 ...x-problem-with-undeclared-sym_gzopen.patch | 57 -------------------
 .../kbd/{kbd_2.9.0.bb => kbd_2.10.0.bb}       |  7 +--
 3 files changed, 2 insertions(+), 116 deletions(-)
 delete mode 100644 meta/recipes-core/kbd/kbd/0001-Preserve-only-necessary-metadata-during-install.patch
 delete mode 100644 meta/recipes-core/kbd/kbd/0001-libkbdfile-Fix-problem-with-undeclared-sym_gzopen.patch
 rename meta/recipes-core/kbd/{kbd_2.9.0.bb => kbd_2.10.0.bb} (87%)

diff --git a/meta/recipes-core/kbd/kbd/0001-Preserve-only-necessary-metadata-during-install.patch b/meta/recipes-core/kbd/kbd/0001-Preserve-only-necessary-metadata-during-install.patch
deleted file mode 100644
index 87275040c1..0000000000
--- a/meta/recipes-core/kbd/kbd/0001-Preserve-only-necessary-metadata-during-install.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From d9d1c22592b6ce21bf455a22bca9000bf9b3fe61 Mon Sep 17 00:00:00 2001
-From: Alexey Gladkov <legion@kernel.org>
-Date: Wed, 10 Sep 2025 10:45:25 +0200
-Subject: [PATCH] Preserve only necessary metadata during install
-
-"cp -a" tries to preserve all attributes if possible. This implies
-preserving mode, any ACL, xattr permissions, and security context.
-
-In some cases (such as fakeroot), it is not possible to preserve that
-all attributes are preserved.
-
-  cp: failed to preserve ownership for /tmp/.pkgmk/pkg/usr/share/kbd/keymaps/i386/qwertz/sr-latin.map.gz: Operation not supported
-
-To avoid this, we will require that only the necessary attributes be
-preserved. It is important for us to preserve the simlinks.
-
-Signed-off-by: Alexey Gladkov <legion@kernel.org>
-Upstream-Status: Backport [https://github.com/legionus/kbd/commit/db82eb6f86e6c0b8ac4260e88b88d66e1cd7c077]
-Signed-off-by: Alexander Kanavin <alex@linutronix.de>
----
- data/Makefile.am | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/data/Makefile.am b/data/Makefile.am
-index a730062..4d2ae3d 100644
---- a/data/Makefile.am
-+++ b/data/Makefile.am
-@@ -44,21 +44,21 @@ endif
- 
- install-consolefonts: $(SRC_FONTDIR) $(SRC_PARTIALDIR)
- 	mkdir -p -m 755 -- $(DESTDIR)$(datadir)/$(FONTDIR)
--	cp -a -- $(SRC_FONTDIR)/* $(DESTDIR)$(datadir)/$(FONTDIR)/
-+	cp -dPR -- $(SRC_FONTDIR)/* $(DESTDIR)$(datadir)/$(FONTDIR)/
- 	mkdir -p -m 755 -- $(DESTDIR)$(datadir)/$(FONTDIR)/$(PARTIALDIR)
--	cp -a -- $(SRC_PARTIALDIR)/* $(DESTDIR)$(datadir)/$(FONTDIR)/$(PARTIALDIR)/
-+	cp -dPR -- $(SRC_PARTIALDIR)/* $(DESTDIR)$(datadir)/$(FONTDIR)/$(PARTIALDIR)/
- 
- install-consoletrans:
- 	mkdir -p -m 755 -- $(DESTDIR)$(datadir)/$(TRANSDIR)
--	cp -a -- $(srcdir)/$(TRANSDIR)/* $(DESTDIR)$(datadir)/$(TRANSDIR)/
-+	cp -dPR -- $(srcdir)/$(TRANSDIR)/* $(DESTDIR)$(datadir)/$(TRANSDIR)/
- 
- install-unimaps:
- 	mkdir -p -m 755 -- $(DESTDIR)$(datadir)/$(UNIMAPDIR)
--	cp -a -- $(srcdir)/$(UNIMAPDIR)/* $(DESTDIR)$(datadir)/$(UNIMAPDIR)/
-+	cp -dPR -- $(srcdir)/$(UNIMAPDIR)/* $(DESTDIR)$(datadir)/$(UNIMAPDIR)/
- 
- install-keymaps: $(SRC_KEYMAPDIR)
- 	mkdir -p -m 755 -- $(DESTDIR)$(datadir)/$(KEYMAPDIR)
--	cp -ar -- $(SRC_KEYMAPDIR)/* $(DESTDIR)$(datadir)/$(KEYMAPDIR)/
-+	cp -dPR -- $(SRC_KEYMAPDIR)/* $(DESTDIR)$(datadir)/$(KEYMAPDIR)/
- 	cd "$(DESTDIR)$(datadir)/$(KEYMAPDIR)"; \
- 	  for f in $(IGNORE_KEYMAPS); do ! test -e "$$f" || rm -f -- "$$f"; done
- 	rm -f $(DESTDIR)$(datadir)/$(KEYMAPDIR)/ppc
diff --git a/meta/recipes-core/kbd/kbd/0001-libkbdfile-Fix-problem-with-undeclared-sym_gzopen.patch b/meta/recipes-core/kbd/kbd/0001-libkbdfile-Fix-problem-with-undeclared-sym_gzopen.patch
deleted file mode 100644
index 84d273c19a..0000000000
--- a/meta/recipes-core/kbd/kbd/0001-libkbdfile-Fix-problem-with-undeclared-sym_gzopen.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 2f9a4e56c2ef245fbe840677aad9d5932e17f50d Mon Sep 17 00:00:00 2001
-From: Alexey Gladkov <legion@kernel.org>
-Date: Mon, 8 Dec 2025 11:28:24 +0100
-Subject: [PATCH] libkbdfile: Fix problem with undeclared sym_gzopen
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-A compile error occurs on certain systems:
-
-kbdfile-zlib.c: In function 'dlopen_note':
-elf-note.h:27:30: error: 'sym_gzopen' undeclared (first use in this function); did you mean 'sym_gzopen64'?
-   27 | #define DLSYM_ARG(symbol__) &sym_##symbol__, STRINGIFY(symbol__),
-
-kbdfile-zlib.c: In function 'kbdfile_decompressor_zlib': kbdfile-zlib.c:61:15: error: implicit declaration of function 'sym_gzopen'; did you mean 'sym_gzopen64'?
- [-Wimplicit-function-declaration]
-   61 |         gzf = sym_gzopen(file->pathname, "rb");
-
-The problem arises because if -D_FILE_OFFSET_BITS=64 is specified, which
-in zlib ultimately makes gzopen a macro that expands to gzopen64.
-DECLARE_SYM(gzopen) from elf-note.h then expands gzopen to gzopen64,
-resulting in sym_gzopen64 declared. That's why no sym_gzopen exists.
-
-Link: https://github.com/legionus/kbd/pull/150
-Suggested-by: Jan Čermák <sairon@sairon.cz>
-Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
-Signed-off-by: Alexey Gladkov <legion@kernel.org>
-
-Upstream-Status: Backport [https://github.com/legionus/kbd/commit/2f9a4e56c2ef245fbe840677aad9d5932e17f50d]
-Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
----
- src/libkbdfile/elf-note.h | 5 +----
- 1 file changed, 1 insertion(+), 4 deletions(-)
-
-diff --git a/src/libkbdfile/elf-note.h b/src/libkbdfile/elf-note.h
-index a0fd9e2..d3b8d5c 100644
---- a/src/libkbdfile/elf-note.h
-+++ b/src/libkbdfile/elf-note.h
-@@ -26,14 +26,11 @@ int dlsym_many(void **dlp, const char *filename, ...);
-  */
- #define DLSYM_ARG(symbol__) &sym_##symbol__, STRINGIFY(symbol__),
- 
--/* For symbols being dynamically loaded */
--#define DECLARE_DLSYM(symbol) static typeof(symbol) *sym_##symbol
--
- /*
-  * Helper defines, to be done locally before including this header to switch between
-  * implementations
-  */
--#define DECLARE_SYM(sym__) DECLARE_DLSYM(sym__);
-+#define DECLARE_SYM(sym__) static typeof(sym__) *sym_##sym__;
- 
- /*
-  * Originally from systemd codebase.
--- 
-2.49.0
-
diff --git a/meta/recipes-core/kbd/kbd_2.9.0.bb b/meta/recipes-core/kbd/kbd_2.10.0.bb
similarity index 87%
rename from meta/recipes-core/kbd/kbd_2.9.0.bb
rename to meta/recipes-core/kbd/kbd_2.10.0.bb
index 79b011e529..5a877b9c04 100644
--- a/meta/recipes-core/kbd/kbd_2.9.0.bb
+++ b/meta/recipes-core/kbd/kbd_2.10.0.bb
@@ -23,12 +23,9 @@ RREPLACES:${PN} = "console-tools"
 RPROVIDES:${PN} = "console-tools"
 RCONFLICTS:${PN} = "console-tools"
 
-SRC_URI = "${KERNELORG_MIRROR}/linux/utils/${BPN}/${BP}.tar.xz \
-           file://0001-Preserve-only-necessary-metadata-during-install.patch \
-           file://0001-libkbdfile-Fix-problem-with-undeclared-sym_gzopen.patch \
-           "
+SRC_URI = "${KERNELORG_MIRROR}/linux/utils/${BPN}/${BP}.tar.xz"
 
-SRC_URI[sha256sum] = "fb3197f17a99eb44d22a3a1a71f755f9622dd963e66acfdea1a45120951b02ed"
+SRC_URI[sha256sum] = "6e5ca4f8d76ee9e3a8db700b667f13e12aac9933828a64e1aaad93d26be9b479"
 
 # 'gzip -n' is set due to https://github.com/legionus/kbd/issues/124
 EXTRA_OECONF = "--disable-tests --enable-compress='gzip -n'"
-- 
2.43.0

[OE-core] [PATCH 15/16] mesa: upgrade 26.0.6 -> 26.1.2,26.0.6 -> 26.1.2

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 meta/recipes-graphics/mesa/mesa.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-graphics/mesa/mesa.inc b/meta/recipes-graphics/mesa/mesa.inc
index 15dad6eedd..c5bbf13def 100644
--- a/meta/recipes-graphics/mesa/mesa.inc
+++ b/meta/recipes-graphics/mesa/mesa.inc
@@ -20,8 +20,8 @@ SRC_URI = "https://archive.mesa3d.org/mesa-${PV}.tar.xz \
            file://0001-gallivm-Fix-armhf-build-against-LLVM-22.patch \
 "
 
-SRC_URI[sha256sum] = "1d3c3b8a8363b8cc354175bb4a684ad8b035211cc1d6fa17aeb9b9623c513f89"
-PV = "26.0.6"
+SRC_URI[sha256sum] = "bac2bca9121897a2b8162e79636b50ac998fca799c8e6cf914edd85962babdf0"
+PV = "26.1.2"
 
 UPSTREAM_CHECK_GITTAGREGEX = "mesa-(?P<pver>\d+(\.\d+)+)"
 
-- 
2.43.0

[OE-core] [PATCH 16/16] sbom-cve-check-update-nvd-native: upgrade 2026.05.07-000006 -> 2026.06.09-000006

[Wang Mingyu]

From: Wang Mingyu <wangmy@fujitsu.com>

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
 ...bb => sbom-cve-check-update-nvd-native_2026.06.09-000006.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/sbom-cve-check/{sbom-cve-check-update-nvd-native_2026.05.07-000006.bb => sbom-cve-check-update-nvd-native_2026.06.09-000006.bb} (89%)

diff --git a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.05.07-000006.bb b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.06.09-000006.bb
similarity index 89%
rename from meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.05.07-000006.bb
rename to meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.06.09-000006.bb
index 02446e30ce..2917c89e62 100644
--- a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.05.07-000006.bb
+++ b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.06.09-000006.bb
@@ -6,7 +6,7 @@ HOMEPAGE = "https://github.com/fkie-cad/nvd-json-data-feeds"
 SRC_URI = "git://github.com/fkie-cad/nvd-json-data-feeds.git;branch=main;protocol=https;destsuffix="
 SBOM_CVE_CHECK_DB_NAME = "nvd-fkie"
 
-SRCREV = "72d8841c8ad9083ebf6723063f275444ea0d76f9"
+SRCREV = "7ff4a0622bfdf5313c79635951112d2a45bbe9fd"
 UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>.+)"
 
 require sbom-cve-check-update-db.inc
-- 
2.43.0

Re: [OE-core] [PATCH 15/16] mesa: upgrade 26.0.6 -> 26.1.2,26.0.6 -> 26.1.2

[Mathieu Dubois-Briand]

On Wed Jun 10, 2026 at 11:49 AM CEST, wangmy via lists.openembedded.org wrote:
> From: Wang Mingyu <wangmy@fujitsu.com>
>
> Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
> ---

Hi,

Thanks for the upgrade.

It looks like this is failing to build:

ERROR: mesa-native-2_26.1.2-r0 do_compile: Execution of '/srv/pokybuild/yocto-worker/musl-qemux86-64/build/build/tmp/work/x86_64-linux/mesa-native/26.1.2/temp/run.do_compile.2839729' failed with exit code 1
...
| In file included from ../sources/mesa-26.1.2/src/intel/compiler/jay/jay_private.h:8,
|                  from src/intel/compiler/jay/jay_nir_algebraic.c:1:
| ../sources/mesa-26.1.2/src/intel/compiler/jay/jay_ir.h:582:22: error: expected identifier or ‘(’ before ‘:’ token
|   582 | enum jay_predication : uint8_t {
|       |                      ^
| ../sources/mesa-26.1.2/src/intel/compiler/jay/jay_ir.h:637:25: error: field ‘predication’ has incomplete type
|   637 |    enum jay_predication predication;
|       |                         ^~~~~~~~~~~
| ../sources/mesa-26.1.2/src/intel/compiler/jay/jay_ir.h: In function ‘jay_inst_has_default’:
| ../sources/mesa-26.1.2/src/intel/compiler/jay/jay_ir.h:681:29: error: ‘JAY_PREDICATED_DEFAULT’ undeclared (first use in this function)
|   681 |    return I->predication >= JAY_PREDICATED_DEFAULT;
|       |                             ^~~~~~~~~~~~~~~~~~~~~~

https://autobuilder.yoctoproject.org/valkyrie/#/builders/3/builds/3964
https://autobuilder.yoctoproject.org/valkyrie/#/builders/6/builds/3928
https://autobuilder.yoctoproject.org/valkyrie/#/builders/11/builds/3859

Can you have a look at the issue?

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

RE: [OE-core] [PATCH 15/16] mesa: upgrade 26.0.6 -> 26.1.2,26.0.6 -> 26.1.2

[Mingyu Wang (Fujitsu)]

I ran into a build failure for mesa 26.1.2 while testing the upgrade, and after some investigation I believe the root cause is that mesa 26.1.x requires GCC 13 or later.

My host is Ubuntu 24.04, which ships GCC 13 by default, and mesa 26.1.2 builds without any issues in that environment. However, when I explicitly switch to GCC 11,  the build fails with errors like:

expected identifier or '(' before ':' token
static assertion failed: "packed"
control reaches end of non-void function

These are caused by mesa's use of C23 features (e.g. enum : uint8_t syntax) that are not available in GCC older then 13, and by some code paths that only become problematic with the older compiler. I tried various workarounds (passing -Dc_std=gnu2x, -Dwerror=false, etc.) but they are not sufficient because mesa's internal meson definitions hard-code c_std=c11 for certain components, which overrides our flags.

If we want to upgrade mesa to 26.1.x now, we likely need to bump the minimum GCC version to 13 (or at least ensure GCC 13 is used for mesa).

Alternatively, we could hold off on the mesa upgrade.

Thanks


  --
Best Regards
---------------------------------------------------
Wang Mingyu
FUJITSU NANJING SOFTWARE TECHNOLOGY CO., LTD. (FNST)
No.6 Wenzhu Road, Nanjing, 210012, China
TEL：+86+25-86630566--8568
COINS: 79988548
FAX: +86+25-83317685
MAIL: wangmy@fujitsu.com

> -----Original Message-----
> From: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
> Sent: Thursday, June 11, 2026 1:15 PM
> To: Wang, Mingyu/王 鸣瑜 <wangmy@fujitsu.com>;
> openembedded-core@lists.openembedded.org
> Subject: Re: [OE-core] [PATCH 15/16] mesa: upgrade 26.0.6 -> 26.1.2,26.0.6 ->
> 26.1.2
> 
> On Wed Jun 10, 2026 at 11:49 AM CEST, wangmy via lists.openembedded.org
> wrote:
> > From: Wang Mingyu <wangmy@fujitsu.com>
> >
> > Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
> > ---
> 
> Hi,
> 
> Thanks for the upgrade.
> 
> It looks like this is failing to build:
> 
> ERROR: mesa-native-2_26.1.2-r0 do_compile: Execution of
> '/srv/pokybuild/yocto-worker/musl-qemux86-64/build/build/tmp/work/x86_64-li
> nux/mesa-native/26.1.2/temp/run.do_compile.2839729' failed with exit code
> 1 ...
> | In file included
> from ../sources/mesa-26.1.2/src/intel/compiler/jay/jay_private.h:8,
> |                  from src/intel/compiler/jay/jay_nir_algebraic.c:1:
> | ../sources/mesa-26.1.2/src/intel/compiler/jay/jay_ir.h:582:22: error: expected
> identifier or ‘(’ before ‘:’ token
> |   582 | enum jay_predication : uint8_t {
> |       |                      ^
> | ../sources/mesa-26.1.2/src/intel/compiler/jay/jay_ir.h:637:25: error: field
> ‘predication’ has incomplete type
> |   637 |    enum jay_predication predication;
> |       |                         ^~~~~~~~~~~
> | ../sources/mesa-26.1.2/src/intel/compiler/jay/jay_ir.h: In function
> ‘jay_inst_has_default’:
> | ../sources/mesa-26.1.2/src/intel/compiler/jay/jay_ir.h:681:29: error:
> ‘JAY_PREDICATED_DEFAULT’ undeclared (first use in this function)
> |   681 |    return I->predication >= JAY_PREDICATED_DEFAULT;
> |       |                             ^~~~~~~~~~~~~~~~~~~~~~
> 
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/3/builds/3964
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/6/builds/3928
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/11/builds/3859
> 
> Can you have a look at the issue?
> 
> Thanks,
> Mathieu
> 
> --
> Mathieu Dubois-Briand, Bootlin
> Embedded Linux and Kernel engineering
> https://bootlin.com

Re: [OE-core] [PATCH 15/16] mesa: upgrade 26.0.6 -> 26.1.2,26.0.6 -> 26.1.2

[Alexander Kanavin]

On Fri, 12 Jun 2026 at 11:26, wangmy via lists.openembedded.org
<wangmy=fujitsu.com@lists.openembedded.org> wrote:
> If we want to upgrade mesa to 26.1.x now, we likely need to bump the minimum GCC version to 13 (or at least ensure GCC 13 is used for mesa).
>
> Alternatively, we could hold off on the mesa upgrade.

I don't think we can hold it off, because that would require waiting
until all affected host distros reach end of life. For example, Debian
12 still has two years of support.

Equally adding buildtools requirement to relatively recent
distributions isn't a great option.

Looking at the logs, they show only one file where the issue happens:

| ../sources/mesa-26.1.2/src/intel/compiler/jay/jay_ir.h:582:22:
error: expected identifier or ‘(’ before ‘:’ token
|   582 | enum jay_predication : uint8_t {
|       |                      ^

Can you patch out the ': uint8_t' part and see if the rest of it
builds without errors? Maybe adding an 'Upstream-status:
Inappropriate' patch with that tweak is the easiest way out.

Alex

RE: [OE-core] [PATCH 15/16] mesa: upgrade 26.0.6 -> 26.1.2,26.0.6 -> 26.1.2

[Mingyu Wang (Fujitsu)]

Thank you for the suggestion. I tried patching out the : uint8_t part from enum jay_predication as you suggested, but that alone is not enough. After removing it, the build immediately fails with a static assertion:

static_assert(sizeof(jay_inst) == 32 + (sizeof(uintptr_t) * 2), "packed");
because the struct layout depends on the enum's underlying type.

Beyond that, there are additional errors in other files that appear one after another when compiled with GCC 11:

src/imagination/pco/pco_nir_pvfio.c: function lower_pfo returns false but should return nir_def *, causing error: incompatible types when returning type '_Bool' but 'nir_def *' was expected

src/intel/compiler/jay/jay_from_nir.c: missing return in a non-void function, leading to error: control reaches end of non-void function

I also tried passing -Dc_std=gnu2x and -Dwerror=false to Meson, but they were not enough to get past all the failures, and the build never completed successfully. It's therefore unclear how many more such issues might still be hidden – we simply weren't able to reach a clean build with GCC 11.

  --
Best Regards
---------------------------------------------------
Wang Mingyu
FUJITSU NANJING SOFTWARE TECHNOLOGY CO., LTD. (FNST)
No.6 Wenzhu Road, Nanjing, 210012, China
TEL：+86+25-86630566--8568
COINS: 79988548
FAX: +86+25-83317685
MAIL: wangmy@fujitsu.com

> -----Original Message-----
> From: Alexander Kanavin <alex.kanavin@gmail.com>
> Sent: Sunday, June 14, 2026 2:02 AM
> To: Wang, Mingyu/王 鸣瑜 <wangmy@fujitsu.com>
> Cc: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>;
> openembedded-core@lists.openembedded.org
> Subject: Re: [OE-core] [PATCH 15/16] mesa: upgrade 26.0.6 -> 26.1.2,26.0.6 ->
> 26.1.2
> 
> On Fri, 12 Jun 2026 at 11:26, wangmy via lists.openembedded.org
> <wangmy=fujitsu.com@lists.openembedded.org> wrote:
> > If we want to upgrade mesa to 26.1.x now, we likely need to bump the
> minimum GCC version to 13 (or at least ensure GCC 13 is used for mesa).
> >
> > Alternatively, we could hold off on the mesa upgrade.
> 
> I don't think we can hold it off, because that would require waiting until all
> affected host distros reach end of life. For example, Debian
> 12 still has two years of support.
> 
> Equally adding buildtools requirement to relatively recent distributions isn't a
> great option.
> 
> Looking at the logs, they show only one file where the issue happens:
> 
> | ../sources/mesa-26.1.2/src/intel/compiler/jay/jay_ir.h:582:22:
> error: expected identifier or ‘(’ before ‘:’ token
> |   582 | enum jay_predication : uint8_t {
> |       |                      ^
> 
> Can you patch out the ': uint8_t' part and see if the rest of it builds without
> errors? Maybe adding an 'Upstream-status:
> Inappropriate' patch with that tweak is the easiest way out.
> 
> Alex

Re: [OE-core] [PATCH 15/16] mesa: upgrade 26.0.6 -> 26.1.2,26.0.6 -> 26.1.2

[Alexander Kanavin]

On Mon, 15 Jun 2026 at 04:04, Mingyu Wang (Fujitsu) <wangmy@fujitsu.com> wrote:
>
> Thank you for the suggestion. I tried patching out the : uint8_t part from enum jay_predication as you suggested, but that alone is not enough. After removing it, the build immediately fails with a static assertion:
>
> static_assert(sizeof(jay_inst) == 32 + (sizeof(uintptr_t) * 2), "packed");
> because the struct layout depends on the enum's underlying type.

You also need to adjust the type of the struct member, so that the
struct itself enforces the type:

@@ -634,7 +634,7 @@ typedef struct jay_inst {
    bool decrement_dep:1;
    unsigned padding  :12;

-   enum jay_predication predication;
+   uint8_t predication;
    enum jay_conditional_mod conditional_mod;

    jay_def cond_flag; /**< conditional flag */

Or just take the full patch from here :)
https://git.openembedded.org/openembedded-core-contrib/plain/meta/recipes-graphics/mesa/files/0001-src-intel-compiler-jay-jay_ir.h-do-not-used-typed-en.patch?h=akanavin/package-version-updates

I just confirmed that with the patch gcc-11 builds mesa-native successfully.

> Beyond that, there are additional errors in other files that appear one after another when compiled with GCC 11:
>
> src/imagination/pco/pco_nir_pvfio.c: function lower_pfo returns false but should return nir_def *, causing error: incompatible types when returning type '_Bool' but 'nir_def *' was expected

This (imagination) is not enabled by default in poky or oe-core, and
does not appear in my build logs for mesa-native. You should check and
adjust your configuration, or perform test builds using exact
unmodified poky or oe-core.

> src/intel/compiler/jay/jay_from_nir.c: missing return in a non-void function, leading to error: control reaches end of non-void function

This is the same error as the typed enum issue above.

> I also tried passing -Dc_std=gnu2x and -Dwerror=false to Meson, but they were not enough to get past all the failures, and the build never completed successfully. It's therefore unclear how many more such issues might still be hidden – we simply weren't able to reach a clean build with GCC 11.

I just succeeded in that :) so hope you can take the patch and make it work.

Alex