[Buildroot] [PATCH] package/webkitgtk: bump to version 2.52.4

[Buildroot] [PATCH] package/webkitgtk: bump to version 2.52.4

[Thomas Devoogdt]

Release notes:

https://webkitgtk.org/2026/06/02/webkitgtk2.52.4-released.html

Fixes the following security issues:

https://webkitgtk.org/security/WSA-2026-0003.html

Includes fixes (among others) for CVE-2026-28847, CVE-2026-28883,
CVE-2026-28901, CVE-2026-28902, CVE-2026-28903, CVE-2026-28904,
CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946,
CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958,
CVE-2026-43658, and CVE-2026-43660.

Also added 0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch,
to get webkitgtk compiled when -DUSE_SYSTEM_MALLOC=ON is in use.

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
---
 ...6-main-Fails-to-build-with-system-ma.patch | 52 +++++++++++++++++++
 package/webkitgtk/webkitgtk.hash              |  6 +--
 package/webkitgtk/webkitgtk.mk                |  2 +-
 3 files changed, 56 insertions(+), 4 deletions(-)
 create mode 100644 package/webkitgtk/0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch

diff --git a/package/webkitgtk/0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch b/package/webkitgtk/0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch
new file mode 100644
index 00000000000..decdba68148
--- /dev/null
+++ b/package/webkitgtk/0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch
@@ -0,0 +1,52 @@
+From 146cdc86b7345ac8f513fdf649979e80db01a2ca Mon Sep 17 00:00:00 2001
+From: Alberto Garcia <berto@igalia.com>
+Date: Tue, 2 Jun 2026 07:24:38 -0700
+Subject: [PATCH] REGRESSION(313606@main): Fails to build with system malloc
+ https://bugs.webkit.org/show_bug.cgi?id=316083
+
+Reviewed by Fujii Hironori.
+
+Don't add bmalloc_CopyHeaders to LLIntOffsetsExtractor_DEPENDENCIES if
+USE_SYSTEM_MALLOC is on.
+
+* Source/JavaScriptCore/CMakeLists.txt:
+
+Canonical link: https://commits.webkit.org/305877.698@webkitglib/2.52
+
+Upstream: https://github.com/WebKit/WebKit/commit/a6bc685a685c8f16c919dc6310a62a26971d396e
+Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
+---
+ Source/JavaScriptCore/CMakeLists.txt | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
+index a2a6d724608a..ea9ea17802f2 100644
+--- a/Source/JavaScriptCore/CMakeLists.txt
++++ b/Source/JavaScriptCore/CMakeLists.txt
+@@ -412,8 +412,10 @@ set(LLIntSettingsExtractor_DEPENDENCIES
+     JavaScriptCore_CopyHeaders
+     JavaScriptCore_CopyPrivateHeaders
+     WTF_CopyHeaders
+-    bmalloc_CopyHeaders
+ )
++if (NOT USE_SYSTEM_MALLOC)
++    list(APPEND LLIntSettingsExtractor_DEPENDENCIES bmalloc_CopyHeaders)
++endif ()
+ WEBKIT_EXECUTABLE(LLIntSettingsExtractor)
+ 
+ # LLIntSettingsExtractor target needs to have a direct or indirect
+@@ -439,8 +441,10 @@ set(LLIntOffsetsExtractor_DEPENDENCIES
+     JavaScriptCore_CopyHeaders
+     JavaScriptCore_CopyPrivateHeaders
+     WTF_CopyHeaders
+-    bmalloc_CopyHeaders
+ )
++if (NOT USE_SYSTEM_MALLOC)
++    list(APPEND LLIntOffsetsExtractor_DEPENDENCIES bmalloc_CopyHeaders)
++endif ()
+ WEBKIT_EXECUTABLE(LLIntOffsetsExtractor)
+ 
+ # The build system will execute asm.rb every time LLIntOffsetsExtractor's mtime is newer than
+-- 
+2.43.0
+
diff --git a/package/webkitgtk/webkitgtk.hash b/package/webkitgtk/webkitgtk.hash
index 03b8d0a9bec..f8c0e0297a3 100644
--- a/package/webkitgtk/webkitgtk.hash
+++ b/package/webkitgtk/webkitgtk.hash
@@ -1,6 +1,6 @@
-# From https://webkitgtk.org/releases/webkitgtk-2.52.3.tar.xz.sums
-sha1  17f9b127618040a5f3fcbb70e37ea16ab6d69b0b  webkitgtk-2.52.3.tar.xz
-sha256  5b3e0d174e63dcc28848b1194e0e7448d5948c3c2427ecd931c2c5be5261aebb  webkitgtk-2.52.3.tar.xz
+# From https://webkitgtk.org/releases/webkitgtk-2.52.4.tar.xz.sums
+sha1  1bfaa562ae46a420abaad2b3b9175dc823cc7a93  webkitgtk-2.52.4.tar.xz
+sha256  cf4076a1ca2a64788edca8c452d8ebb68d5e2965e588fe46a388a016513edce4  webkitgtk-2.52.4.tar.xz
 
 # Hashes for license files:
 sha256  0b5d3a7cc325942567373b0ecd757d07c132e0ebd7c97bfc63f7e1a76094edb4  Source/WebCore/LICENSE-APPLE
diff --git a/package/webkitgtk/webkitgtk.mk b/package/webkitgtk/webkitgtk.mk
index 54e769d5892..6cab2c6a247 100644
--- a/package/webkitgtk/webkitgtk.mk
+++ b/package/webkitgtk/webkitgtk.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-WEBKITGTK_VERSION = 2.52.3
+WEBKITGTK_VERSION = 2.52.4
 WEBKITGTK_SITE = https://www.webkitgtk.org/releases
 WEBKITGTK_SOURCE = webkitgtk-$(WEBKITGTK_VERSION).tar.xz
 WEBKITGTK_INSTALL_STAGING = YES
-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/webkitgtk: bump to version 2.52.4

[Julien Olivain via buildroot]

On 24/06/2026 20:21, Thomas Devoogdt wrote:
> Release notes:
> 
> https://webkitgtk.org/2026/06/02/webkitgtk2.52.4-released.html
> 
> Fixes the following security issues:
> 
> https://webkitgtk.org/security/WSA-2026-0003.html
> 
> Includes fixes (among others) for CVE-2026-28847, CVE-2026-28883,
> CVE-2026-28901, CVE-2026-28902, CVE-2026-28903, CVE-2026-28904,
> CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946,
> CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958,
> CVE-2026-43658, and CVE-2026-43660.
> 
> Also added 
> 0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch,
> to get webkitgtk compiled when -DUSE_SYSTEM_MALLOC=ON is in use.
> 
> Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>

Applied to master.

Since this bump fixes several CVEs, I added the "security" mention in 
the commit title.

Best regards,

Julien.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot