[Buildroot] [PATCH v1 1/2] package/libglib2: bump to version 2.90.1

* [Buildroot] [PATCH v1 1/2] package/libglib2: bump to version 2.90.1
@ 2026-10-31 18:36 Thomas Devoogdt
  2026-10-31 18:36 ` [Buildroot] [PATCH v1 2/2] package/libgtk4: bump to version 4.24.1 Thomas Devoogdt
  2026-11-01 16:39 ` [Buildroot] [PATCH v1 1/2] package/libglib2: bump to version 2.90.1 Thomas Petazzoni via buildroot
  0 siblings, 2 replies; 4+ messages in thread
From: Thomas Devoogdt @ 2026-10-31 18:36 UTC (permalink / raw)
  To: buildroot; +Cc: Fabrice Fontaine, Thomas Devoogdt

Changelog: https://gitlab.gnome.org/GNOME/glib/-/blob/2.90.1/NEWS

- COPYING is now a symlink to LICENSES/LGPL-2.1-or-later.txt
- CVE-2026-58016 is fixed upstream, drop the patch

Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
---
 ...on-Fix-XML-parser-state-handling-for.patch | 42 -------------------
 package/libglib2/libglib2.hash                |  6 +--
 package/libglib2/libglib2.mk                  |  9 ++--
 3 files changed, 6 insertions(+), 51 deletions(-)
 delete mode 100644 package/libglib2/0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch

diff --git a/package/libglib2/0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch b/package/libglib2/0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch
deleted file mode 100644
index 4582382f806..00000000000
--- a/package/libglib2/0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2 Mon Sep 17 00:00:00 2001
-From: Philip Withnall <pwithnall@gnome.org>
-Date: Thu, 16 Apr 2026 15:27:37 +0100
-Subject: [PATCH] gdbusintrospection: Fix XML parser state handling for <node>
- element nesting
-
-The check for whether a `<node>` element in D-Bus introspection XML was
-nested correctly was broken. `<node>` elements can only be at the top
-level, or nested immediately within another `<node>` element.
-
-Fix the check and add some unit tests for it.
-
-Spotted by linhlhq as #YWH-PGM9867-204. The fix is mine, and the unit test
-uses example XML strings adapted from their report.
-
-Signed-off-by: Philip Withnall <pwithnall@gnome.org>
-
-Fixes: #3932
-CVE: CVE-2026-58016
-Upstream: https://gitlab.gnome.org/GNOME/glib/-/commit/c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2
-Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
-[Peter: drop tests]
----
- gio/gdbusintrospection.c        |  2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/gio/gdbusintrospection.c b/gio/gdbusintrospection.c
-index 1138ba9d7..4df8e87db 100644
---- a/gio/gdbusintrospection.c
-+++ b/gio/gdbusintrospection.c
-@@ -1266,7 +1266,7 @@ parser_start_element (GMarkupParseContext  *context,
-   /* ---------------------------------------------------------------------------------------------------- */
-   if (strcmp (element_name, "node") == 0)
-     {
--      if (!(g_slist_length (stack) >= 1 || strcmp (stack->next->data, "node") != 0))
-+      if (stack->next != NULL && strcmp (stack->next->data, "node") != 0)
-         {
-           g_set_error_literal (error,
-                                G_MARKUP_ERROR,
--- 
-2.47.3
-
diff --git a/package/libglib2/libglib2.hash b/package/libglib2/libglib2.hash
index 95bf4d3179a..b6203dd0271 100644
--- a/package/libglib2/libglib2.hash
+++ b/package/libglib2/libglib2.hash
@@ -1,4 +1,4 @@
-# https://download.gnome.org/sources/glib/2.88/glib-2.88.4.sha256sum
-sha256  25fd169f3b2f91fe2391ad297883ce0fcf30c69fc789ffd1c9672d1332b1c5a8  glib-2.88.4.tar.xz
+# https://download.gnome.org/sources/glib/2.90/glib-2.90.1.sha256sum
+sha256  93c941aa17d5eb1d53fe838365f29a8b4e539c222a256d974ec8f30fc413e396  glib-2.90.1.tar.xz
 # License files, locally calculated
-sha256  fa6f36630bb1e0c571d34b2bbdf188d08495c9dbf58f28cac112f303fc1f58fb  COPYING
+sha256  fa6f36630bb1e0c571d34b2bbdf188d08495c9dbf58f28cac112f303fc1f58fb  LICENSES/LGPL-2.1-or-later.txt
diff --git a/package/libglib2/libglib2.mk b/package/libglib2/libglib2.mk
index 3770e8671a1..23f6643f10a 100644
--- a/package/libglib2/libglib2.mk
+++ b/package/libglib2/libglib2.mk
@@ -4,12 +4,12 @@
 #
 ################################################################################
 
-LIBGLIB2_VERSION_MAJOR = 2.88
-LIBGLIB2_VERSION = $(LIBGLIB2_VERSION_MAJOR).4
+LIBGLIB2_VERSION_MAJOR = 2.90
+LIBGLIB2_VERSION = $(LIBGLIB2_VERSION_MAJOR).1
 LIBGLIB2_SOURCE = glib-$(LIBGLIB2_VERSION).tar.xz
 LIBGLIB2_SITE = https://download.gnome.org/sources/glib/$(LIBGLIB2_VERSION_MAJOR)
 LIBGLIB2_LICENSE = LGPL-2.1+
-LIBGLIB2_LICENSE_FILES = COPYING
+LIBGLIB2_LICENSE_FILES = LICENSES/LGPL-2.1-or-later.txt
 LIBGLIB2_CPE_ID_VENDOR = gnome
 LIBGLIB2_CPE_ID_PRODUCT = glib
 LIBGLIB2_INSTALL_STAGING = YES
@@ -17,9 +17,6 @@ LIBGLIB2_INSTALL_STAGING = YES
 LIBGLIB2_CFLAGS = $(TARGET_CFLAGS)
 LIBGLIB2_LDFLAGS = $(TARGET_LDFLAGS) $(TARGET_NLS_LIBS)
 
-# 0001-gdbusintrospection-Fix-XML-parser-state-handling-for.patch
-LIBGLIB2_IGNORE_CVES += CVE-2026-58016
-
 # glib/valgrind.h contains inline asm not compatible with thumb1
 ifeq ($(BR2_ARM_INSTRUCTIONS_THUMB),y)
 LIBGLIB2_CFLAGS += -marm
-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 4+ messages in thread