Re: [Buildroot] [PATCH 2/2] package/wpewebkit: security bump to version 2.50.5

[Adrian Perez de Castro <aperez@igalia.com>]

[-- Attachment #1.1: Type: text/plain, Size: 5472 bytes --]

On Wed, 18 Feb 2026 20:58:12 +0100 Bernd Kuhls <bernd@kuhls.net> wrote:
> From: Adrian Perez de Castro <aperez@igalia.com>
> 
> This updates WPE WebKit to the 2.50 stable series.
> WPE WebKit 2.50 highlights and 2.50.[1-5] release notes:
> 
> - https://wpewebkit.org/release/wpewebkit-2.50.0.html
> - https://wpewebkit.org/release/wpewebkit-2.50.1.html
> - https://wpewebkit.org/release/wpewebkit-2.50.2.html
> - https://wpewebkit.org/release/wpewebkit-2.50.3.html
> - https://wpewebkit.org/release/wpewebkit-2.50.4.html
> - https://wpewebkit.org/release/wpewebkit-2.50.5.html
> 
> Fixes the following security issues:
> 
> - From https://wpewebkit.org/security/WSA-2025-0007.html
>   CVE-2025-43343
> 
> - From https://wpewebkit.org/security/WSA-2025-0006.html
>   CVE-2025-43272, CVE-2025-43342, CVE-2025-43356, CVE-2025-43368
> 
> - From https://wpewebkit.org/security/WSA-2025-0005.html
>   CVE-2025-31273, CVE-2025-31278, CVE-2025-43211, CVE-2025-43212,
>   CVE-2025-43216, CVE-2025-43227, CVE-2025-43228, CVE-2025-43240,
>   CVE-2025-43265, CVE-2025-6558
> 
> Removed patch 0001 which is included in this release.
> 
> Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
> [Bernd: bumped to 2.50.5, removed two patches originally added by Adrian
>  which were added to upstream version 2.50.2]
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

Acked-by: Adrian Perez de Castro <aperez@igalia.com>

> ---
>  ...d-with-USE_SKIA_OPENTYPE_SVG-ON-and-.patch | 44 -------------------
>  package/wpewebkit/wpewebkit.hash              |  8 ++--
>  package/wpewebkit/wpewebkit.mk                |  2 +-
>  3 files changed, 5 insertions(+), 49 deletions(-)
>  delete mode 100644 package/wpewebkit/0001-WPE-Fix-the-build-with-USE_SKIA_OPENTYPE_SVG-ON-and-.patch
> 
> diff --git a/package/wpewebkit/0001-WPE-Fix-the-build-with-USE_SKIA_OPENTYPE_SVG-ON-and-.patch b/package/wpewebkit/0001-WPE-Fix-the-build-with-USE_SKIA_OPENTYPE_SVG-ON-and-.patch
> deleted file mode 100644
> index 8432543e07..0000000000
> --- a/package/wpewebkit/0001-WPE-Fix-the-build-with-USE_SKIA_OPENTYPE_SVG-ON-and-.patch
> +++ /dev/null
> @@ -1,44 +0,0 @@
> -From 94acd1ce0ff2860b19f22ab2d386d7711c9699b7 Mon Sep 17 00:00:00 2001
> -From: Adrian Perez de Castro <aperez@igalia.com>
> -Date: Tue, 8 Jul 2025 21:46:44 +0300
> -Subject: [PATCH] [WPE] Fix the build with USE_SKIA_OPENTYPE_SVG=ON and
> - USE_SYSPROF_CAPTURE=OFF
> -
> -Unreviewed build fix.
> -
> -When backporting 287859@main the #include for the needed Skia header
> -slipped inside an USE(SYSPROF_CAPTURE) guard. This moves the guards
> -and #include statements to their correct places.
> -
> -* Source/WebKit/WebProcess/wpe/WebProcessMainWPE.cpp:
> -
> -Canonical link: https://commits.webkit.org/290945.273@webkitglib/2.48
> -
> -Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
> -Upstream: https://github.com/WebKit/WebKit/commit/943d05f0c9b03c053a456c90c2a8817c1f679711
> ----
> - Source/WebKit/WebProcess/wpe/WebProcessMainWPE.cpp | 5 +++--
> - 1 file changed, 3 insertions(+), 2 deletions(-)
> -
> -diff --git a/Source/WebKit/WebProcess/wpe/WebProcessMainWPE.cpp b/Source/WebKit/WebProcess/wpe/WebProcessMainWPE.cpp
> -index a06e33fd04f8..5fb245ce0b66 100644
> ---- a/Source/WebKit/WebProcess/wpe/WebProcessMainWPE.cpp
> -+++ b/Source/WebKit/WebProcess/wpe/WebProcessMainWPE.cpp
> -@@ -43,11 +43,12 @@
> - #include <skia/core/SkGraphics.h>
> - #endif
> - 
> --#if USE(SYSPROF_CAPTURE)
> --#include <wtf/SystemTracing.h>
> - #if USE(SKIA_OPENTYPE_SVG)
> - #include <skia/modules/svg/SkSVGOpenTypeSVGDecoder.h>
> - #endif
> -+
> -+#if USE(SYSPROF_CAPTURE)
> -+#include <wtf/SystemTracing.h>
> - #endif
> - 
> - namespace WebKit {
> --- 
> -2.50.1
> -
> diff --git a/package/wpewebkit/wpewebkit.hash b/package/wpewebkit/wpewebkit.hash
> index 332fd9deaa..60a51c3e49 100644
> --- a/package/wpewebkit/wpewebkit.hash
> +++ b/package/wpewebkit/wpewebkit.hash
> @@ -1,7 +1,7 @@
> -# From https://wpewebkit.org/releases/wpewebkit-2.48.3.tar.xz.sums
> -md5  2d3b7fa3c62886546f918fcc289cabbe  wpewebkit-2.48.3.tar.xz
> -sha1  8a90b9ff8809c99c306defc1a08e50a31a09c590  wpewebkit-2.48.3.tar.xz
> -sha256  807571f07e87823b8fb79564692c9b1ef81ee62edbf51345a15bd0e7e1f2e07b  wpewebkit-2.48.3.tar.xz
> +# From https://wpewebkit.org/releases/wpewebkit-2.50.5.tar.xz.sums
> +md5  1d81485379005cca0236a278706f194f  wpewebkit-2.50.5.tar.xz
> +sha1  dd56b76eff8ba157a0291c0b61220666eed59313  wpewebkit-2.50.5.tar.xz
> +sha256  de4bfd20bfc921cdfc77e839ee4da84e2674bcb58b2f916172978d62fa115fc2  wpewebkit-2.50.5.tar.xz
>  
>  # Hashes for license files:
>  sha256  0b5d3a7cc325942567373b0ecd757d07c132e0ebd7c97bfc63f7e1a76094edb4  Source/WebCore/LICENSE-APPLE
> diff --git a/package/wpewebkit/wpewebkit.mk b/package/wpewebkit/wpewebkit.mk
> index 31aba2a0b9..03deb6e991 100644
> --- a/package/wpewebkit/wpewebkit.mk
> +++ b/package/wpewebkit/wpewebkit.mk
> @@ -5,7 +5,7 @@
>  ################################################################################
>  
>  # The middle number is even for stable releases, odd for development ones.
> -WPEWEBKIT_VERSION = 2.48.3
> +WPEWEBKIT_VERSION = 2.50.5
>  WPEWEBKIT_SITE = https://wpewebkit.org/releases
>  WPEWEBKIT_SOURCE = wpewebkit-$(WPEWEBKIT_VERSION).tar.xz
>  WPEWEBKIT_INSTALL_STAGING = YES
> -- 
> 2.47.3
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
> 

Cheers,
—Adrián

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot