[meta-oe][PATCH 1/8] 7zip: Disable Werror

[meta-oe][PATCH 1/8] 7zip: Disable Werror

[Khem Raj]

Clang-21 finds more warnings, its a constant fight, lets disable
warning as errors and let upstream handle it

Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
 meta-oe/recipes-extended/7zip/7zip_25.01.bb   |  8 +----
 ...01-Remove-treating-warning-as-errors.patch | 31 +++++++++++++++++++
 2 files changed, 32 insertions(+), 7 deletions(-)
 create mode 100644 meta-oe/recipes-extended/7zip/files/0001-Remove-treating-warning-as-errors.patch

diff --git a/meta-oe/recipes-extended/7zip/7zip_25.01.bb b/meta-oe/recipes-extended/7zip/7zip_25.01.bb
index 779b708eee..f4ea6506e1 100644
--- a/meta-oe/recipes-extended/7zip/7zip_25.01.bb
+++ b/meta-oe/recipes-extended/7zip/7zip_25.01.bb
@@ -9,19 +9,13 @@ LIC_FILES_CHKSUM = "file://DOC/copying.txt;md5=4fbd65380cdd255951079008b364516c
 CVE_PRODUCT = "7-zip 7zip"
 SRC_URI = "git://github.com/ip7z/7zip.git;protocol=https;branch=main \
            file://0001-support-yocto-cross-compiling.patch \
+           file://0001-Remove-treating-warning-as-errors.patch \
            file://7z_wrapper.sh \
            "
 SRCREV = "5e96a8279489832924056b1fa82f29d5837c9469"
 
 UPSTREAM_CHECK_URI = "https://github.com/ip7z/7zip/releases/latest"
 
-
-# Support Yocto cross compiling
-CXXFLAGS:append:toolchain-clang = " -Wno-error=cast-qual -Wno-error=sign-conversion \
-                                    -Wno-error=disabled-macro-expansion \
-                                    -Wno-error=shorten-64-to-32 \
-                                    -Wno-error=cast-function-type-strict"
-
 EXTRA_OEMAKE += " \
     CXXFLAGS_EXTRA='${CXXFLAGS}' \
     CFLAGS_BASE2='${CFLAGS}' \
diff --git a/meta-oe/recipes-extended/7zip/files/0001-Remove-treating-warning-as-errors.patch b/meta-oe/recipes-extended/7zip/files/0001-Remove-treating-warning-as-errors.patch
new file mode 100644
index 0000000000..c2bef9616a
--- /dev/null
+++ b/meta-oe/recipes-extended/7zip/files/0001-Remove-treating-warning-as-errors.patch
@@ -0,0 +1,31 @@
+From 4d12624e7d6f09d07816d3d0007465c8533af192 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Fri, 29 Aug 2025 15:29:13 -0700
+Subject: [PATCH] Remove treating warning as errors
+
+clang finds additional warnings with new versions e.g.
+Clang 21 added a new warning, -Wimplicit-void-ptr-cast
+(grouped under -Wc++-compat), which fires whenever a
+void* is implicitly converted to another pointer
+type (or returned as such).
+
+Upstream-Status: Inappropriate [Distro-specific]
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ CPP/7zip/7zip_gcc.mak | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/CPP/7zip/7zip_gcc.mak b/CPP/7zip/7zip_gcc.mak
+index 2722c93..b7db06a 100644
+--- a/CPP/7zip/7zip_gcc.mak
++++ b/CPP/7zip/7zip_gcc.mak
+@@ -24,7 +24,7 @@ PROGPATH_STATIC = $(O)/$(PROG)s
+ 
+ 
+ ifneq ($(CC), xlc)
+-CFLAGS_WARN_WALL = -Werror -Wall -Wextra
++CFLAGS_WARN_WALL = -Wall -Wextra
+ endif
+ 
+ # for object file

[meta-oe][PATCH 2/8] bcc: Fix build with LLVM/Clang 21

[Khem Raj]

Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
 ...ix-a-build-failure-with-clang21-5369.patch | 50 +++++++++++++++++++
 .../recipes-devtools/bcc/bcc_0.35.0.bb        |  1 +
 2 files changed, 51 insertions(+)
 create mode 100644 meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc/0001-Fix-a-build-failure-with-clang21-5369.patch

diff --git a/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc/0001-Fix-a-build-failure-with-clang21-5369.patch b/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc/0001-Fix-a-build-failure-with-clang21-5369.patch
new file mode 100644
index 0000000000..571b496f71
--- /dev/null
+++ b/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc/0001-Fix-a-build-failure-with-clang21-5369.patch
@@ -0,0 +1,50 @@
+From 2e3997121af597f3a54d97505a38b7fdb9febae3 Mon Sep 17 00:00:00 2001
+From: yonghong-song <ys114321@gmail.com>
+Date: Mon, 14 Jul 2025 20:21:59 -0700
+Subject: [PATCH] Fix a build failure with clang21 (#5369)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The build error message:
+  src/cc/frontends/clang/loader.cc:400:73: error: no matching function for
+   call to ‘clang::TextDiagnosticPrinter::TextDiagnosticPrinter(
+     llvm::raw_fd_ostream&, clang::DiagnosticOptions*)’
+  400 |   auto diag_client = new TextDiagnosticPrinter(llvm::errs(), &*diag_opts);
+      |                                                                         ^
+The llvm commit
+  https://github.com/llvm/llvm-project/pull/139584
+caused the build failure.
+
+Adjust the code properly and the error is fixed.
+
+Upstream-Status: Backport [https://github.com/iovisor/bcc/commit/8c5c96ad3beeed2fa827017f451a952306826974]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ src/cc/frontends/clang/loader.cc | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/src/cc/frontends/clang/loader.cc b/src/cc/frontends/clang/loader.cc
+index 07dc9d6a..6f8387aa 100644
+--- a/src/cc/frontends/clang/loader.cc
++++ b/src/cc/frontends/clang/loader.cc
+@@ -396,11 +396,19 @@ int ClangLoader::do_compile(
+                     flags_cstr_rem.end());
+ 
+   // set up the error reporting class
++#if LLVM_VERSION_MAJOR >= 21
++  DiagnosticOptions diag_opts;
++  auto diag_client = new TextDiagnosticPrinter(llvm::errs(), diag_opts);
++
++  IntrusiveRefCntPtr<DiagnosticIDs> DiagID(new DiagnosticIDs());
++  DiagnosticsEngine diags(DiagID, diag_opts, diag_client);
++#else
+   IntrusiveRefCntPtr<DiagnosticOptions> diag_opts(new DiagnosticOptions());
+   auto diag_client = new TextDiagnosticPrinter(llvm::errs(), &*diag_opts);
+ 
+   IntrusiveRefCntPtr<DiagnosticIDs> DiagID(new DiagnosticIDs());
+   DiagnosticsEngine diags(DiagID, &*diag_opts, diag_client);
++#endif
+ 
+   // set up the command line argument wrapper
+ 
diff --git a/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.35.0.bb b/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.35.0.bb
index b810f6ec77..8c6e44edbc 100644
--- a/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.35.0.bb
+++ b/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.35.0.bb
@@ -21,6 +21,7 @@ RDEPENDS:${PN}-ptest = "kernel-devsrc packagegroup-core-buildessential cmake bas
 SRC_URI = "gitsm://github.com/iovisor/bcc;branch=master;protocol=https;tag=v${PV} \
            file://0001-CMakeLists.txt-override-the-PY_CMD_ESCAPED.patch \
            file://0001-Vendor-just-enough-extra-headers-to-allow-libbpf-to-.patch \
+           file://0001-Fix-a-build-failure-with-clang21-5369.patch \
            file://run-ptest \
            file://ptest_wrapper.sh \
            file://fix_for_memleak.patch \

[meta-multimedia][PATCH 3/8] openal-soft: Fix build with clang-21

[Khem Raj]

Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
 ...-Add-missing-include-for-malloc-free.patch | 38 +++++++++++++++++++
 .../openal/openal-soft_1.24.3.bb              |  5 ++-
 2 files changed, 41 insertions(+), 2 deletions(-)
 create mode 100644 meta-multimedia/recipes-multimedia/openal/openal-soft/0001-Add-missing-include-for-malloc-free.patch

diff --git a/meta-multimedia/recipes-multimedia/openal/openal-soft/0001-Add-missing-include-for-malloc-free.patch b/meta-multimedia/recipes-multimedia/openal/openal-soft/0001-Add-missing-include-for-malloc-free.patch
new file mode 100644
index 0000000000..cd966c04f7
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/openal/openal-soft/0001-Add-missing-include-for-malloc-free.patch
@@ -0,0 +1,38 @@
+From 468b52958ded2dd942386d52e456ed259875b6e3 Mon Sep 17 00:00:00 2001
+From: Chris Robinson <chris.kcat@gmail.com>
+Date: Fri, 18 Jul 2025 01:57:32 -0700
+Subject: [PATCH] Add missing include for malloc/free
+
+Upstream-Status: Backport [https://github.com/kcat/openal-soft/commit/6b69e11867e6498f244da95de7a3d6c25f79f205]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ fmt-11.1.1/include/fmt/format.h | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fmt-11.1.1/include/fmt/format.h b/fmt-11.1.1/include/fmt/format.h
+index d1b83d18..ae5700ff 100644
+--- a/fmt-11.1.1/include/fmt/format.h
++++ b/fmt-11.1.1/include/fmt/format.h
+@@ -44,6 +44,7 @@
+ #  include <cmath>    // std::signbit
+ #  include <cstddef>  // std::byte
+ #  include <cstdint>  // uint32_t
++#  include <cstdlib>  // std::malloc, std::free
+ #  include <cstring>  // std::memcpy
+ #  include <limits>   // std::numeric_limits
+ #  include <new>      // std::bad_alloc
+@@ -742,12 +743,12 @@ template <typename T> struct allocator {
+ 
+   T* allocate(size_t n) {
+     FMT_ASSERT(n <= max_value<size_t>() / sizeof(T), "");
+-    T* p = static_cast<T*>(malloc(n * sizeof(T)));
++    T* p = static_cast<T*>(std::malloc(n * sizeof(T)));
+     if (!p) FMT_THROW(std::bad_alloc());
+     return p;
+   }
+ 
+-  void deallocate(T* p, size_t) { free(p); }
++  void deallocate(T* p, size_t) { std::free(p); }
+ };
+ 
+ }  // namespace detail
diff --git a/meta-multimedia/recipes-multimedia/openal/openal-soft_1.24.3.bb b/meta-multimedia/recipes-multimedia/openal/openal-soft_1.24.3.bb
index 4204017c20..a1d2932f93 100644
--- a/meta-multimedia/recipes-multimedia/openal/openal-soft_1.24.3.bb
+++ b/meta-multimedia/recipes-multimedia/openal/openal-soft_1.24.3.bb
@@ -8,8 +8,9 @@ inherit cmake pkgconfig
 DEPENDS = "zlib libsndfile1"
 
 SRCREV = "dc7d7054a5b4f3bec1dc23a42fd616a0847af948"
-SRC_URI = "git://github.com/kcat/openal-soft.git;protocol=https;branch=master"
-
+SRC_URI = "git://github.com/kcat/openal-soft.git;protocol=https;branch=master \
+           file://0001-Add-missing-include-for-malloc-free.patch \
+          "
 
 PACKAGECONFIG ?= "${@bb.utils.filter('DISTRO_FEATURES', 'alsa pipewire pulseaudio', d)}"
 PACKAGECONFIG[alsa] = "-DALSOFT_BACKEND_ALSA=ON,-DALSOFT_BACKEND_ALSA=OFF,alsa-lib"

[meta-networking][PATCH 4/8] ot-br-posix: Fix build with clang-21

[Khem Raj]

Update to latest tip of trunk
Fix mbedTLS issue seen with clang-21

Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
 ...itialize-mbedtls_x509_time-at-declar.patch | 32 +++++++++++++++++++
 .../openthread/ot-br-posix_git.bb             |  3 +-
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 meta-networking/recipes-connectivity/openthread/ot-br-posix/0001-x509_crt-Zero-initialize-mbedtls_x509_time-at-declar.patch

diff --git a/meta-networking/recipes-connectivity/openthread/ot-br-posix/0001-x509_crt-Zero-initialize-mbedtls_x509_time-at-declar.patch b/meta-networking/recipes-connectivity/openthread/ot-br-posix/0001-x509_crt-Zero-initialize-mbedtls_x509_time-at-declar.patch
new file mode 100644
index 0000000000..3949caa94f
--- /dev/null
+++ b/meta-networking/recipes-connectivity/openthread/ot-br-posix/0001-x509_crt-Zero-initialize-mbedtls_x509_time-at-declar.patch
@@ -0,0 +1,32 @@
+From c214f7884155607861d43dbfceaeb1c2d9f20740 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Fri, 29 Aug 2025 17:08:23 -0700
+Subject: [PATCH] x509_crt: Zero-initialize mbedtls_x509_time at declaration
+
+'mbedtls_x509_time now' is a local struct variable. passing an uninitialized local as a const *
+argument is UB-risk, since the callee is not
+allowed to write into it.
+
+Clang-21 got stricter about const pointer arguments finds it and flags it.
+
+zero-initializing ensures all fields are defined.
+
+Upstream-Status: Submitted [https://github.com/Mbed-TLS/mbedtls/pull/10377]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ third_party/mbedtls/repo/library/x509_crt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/third_party/mbedtls/repo/library/x509_crt.c b/third_party/mbedtls/repo/library/x509_crt.c
+index 2fd56fbd7..d09060fd7 100644
+--- a/third_party/mbedtls/repo/library/x509_crt.c
++++ b/third_party/mbedtls/repo/library/x509_crt.c
+@@ -2523,7 +2523,7 @@ static int x509_crt_verify_chain(
+     int signature_is_good;
+     unsigned self_cnt;
+     mbedtls_x509_crt *cur_trust_ca = NULL;
+-    mbedtls_x509_time now;
++    mbedtls_x509_time now = {0};
+ 
+ #if defined(MBEDTLS_HAVE_TIME_DATE)
+     if (mbedtls_x509_time_gmtime(mbedtls_time(NULL), &now) != 0) {
diff --git a/meta-networking/recipes-connectivity/openthread/ot-br-posix_git.bb b/meta-networking/recipes-connectivity/openthread/ot-br-posix_git.bb
index d0b4f81a4c..ff8b103a9f 100644
--- a/meta-networking/recipes-connectivity/openthread/ot-br-posix_git.bb
+++ b/meta-networking/recipes-connectivity/openthread/ot-br-posix_git.bb
@@ -10,13 +10,14 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=87109e44b2fda96a8991f27684a7349c \
                     file://third_party/openthread/repo/LICENSE;md5=543b6fe90ec5901a683320a36390c65f \
                     "
 DEPENDS = "autoconf-archive dbus readline avahi jsoncpp boost libnetfilter-queue protobuf protobuf-native"
-SRCREV = "7142b740479e50f6f2c2a91a369b9c36e024fe0d"
+SRCREV = "0700948634b85947e893a65e3d510ed870a5755b"
 PV = "0.3.0+git"
 
 SRC_URI = "gitsm://github.com/openthread/ot-br-posix.git;protocol=https;branch=main \
            file://0001-otbr-agent.service.in-remove-pre-exec-hook-for-mdns-.patch \
            file://0001-cmake-Disable-nonnull-compare-warning-on-gcc.patch \
            file://default-cxx-std.patch \
+           file://0001-x509_crt-Zero-initialize-mbedtls_x509_time-at-declar.patch;patchdir=third_party/openthread/repo \
            "
 
 SYSTEMD_SERVICE:${PN} = "otbr-agent.service"

[meta-webserver][PATCH 5/8] hiawatha: Fix bundled mbedtls with clang-21

[Khem Raj]

Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
 ..._-nonstring-to-remove-unterminated-s.patch | 43 +++++++++++++++++++
 ...ute__-nonstring-with-macro-MBEDTLS_A.patch | 42 ++++++++++++++++++
 ...BEDTLS_ATTRIBUTE_UNTERMINATED_STRING.patch | 33 ++++++++++++++
 .../recipes-httpd/hiawatha/hiawatha_11.7.bb   |  6 ++-
 4 files changed, 123 insertions(+), 1 deletion(-)
 create mode 100644 meta-webserver/recipes-httpd/hiawatha/files/0001-Add-__attribute__-nonstring-to-remove-unterminated-s.patch
 create mode 100644 meta-webserver/recipes-httpd/hiawatha/files/0002-Replace-__attribute__-nonstring-with-macro-MBEDTLS_A.patch
 create mode 100644 meta-webserver/recipes-httpd/hiawatha/files/define-MBEDTLS_ATTRIBUTE_UNTERMINATED_STRING.patch

diff --git a/meta-webserver/recipes-httpd/hiawatha/files/0001-Add-__attribute__-nonstring-to-remove-unterminated-s.patch b/meta-webserver/recipes-httpd/hiawatha/files/0001-Add-__attribute__-nonstring-to-remove-unterminated-s.patch
new file mode 100644
index 0000000000..5a9c719b6d
--- /dev/null
+++ b/meta-webserver/recipes-httpd/hiawatha/files/0001-Add-__attribute__-nonstring-to-remove-unterminated-s.patch
@@ -0,0 +1,43 @@
+From 56b26ede007453a4ee9832076597e82d2a903700 Mon Sep 17 00:00:00 2001
+From: Felix Conway <felix.conway@arm.com>
+Date: Wed, 11 Jun 2025 16:04:06 +0100
+Subject: [PATCH 1/2] Add __attribute__ ((nonstring)) to remove
+ unterminated-string-initialization warning
+
+Upstream-Status: Backport [https://github.com/Mbed-TLS/mbedtls/pull/10216]
+Signed-off-by: Felix Conway <felix.conway@arm.com>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ library/ssl_tls13_keys.c | 3 ++-
+ library/ssl_tls13_keys.h | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c
+index 739414e..375814c 100644
+--- a/library/ssl_tls13_keys.c
++++ b/library/ssl_tls13_keys.c
+@@ -81,7 +81,8 @@ struct mbedtls_ssl_tls13_labels_struct const mbedtls_ssl_tls13_labels =
+  *            the HkdfLabel structure on success.
+  */
+ 
+-static const char tls13_label_prefix[6] = "tls13 ";
++/* We need to tell the compiler that we meant to leave out the null character. */
++static const char tls13_label_prefix[6] __attribute__ ((nonstring)) = "tls13 ";
+ 
+ #define SSL_TLS1_3_KEY_SCHEDULE_HKDF_LABEL_LEN(label_len, context_len) \
+     (2                     /* expansion length           */ \
+diff --git a/library/ssl_tls13_keys.h b/library/ssl_tls13_keys.h
+index d3a4c6c..95cde7a 100644
+--- a/library/ssl_tls13_keys.h
++++ b/library/ssl_tls13_keys.h
+@@ -40,8 +40,9 @@
+ 
+ #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+ 
++/* We need to tell the compiler that we meant to leave out the null character. */
+ #define MBEDTLS_SSL_TLS1_3_LABEL(name, string)       \
+-    const unsigned char name    [sizeof(string) - 1];
++    const unsigned char name    [sizeof(string) - 1] __attribute__ ((nonstring));
+ 
+ union mbedtls_ssl_tls13_labels_union {
+     MBEDTLS_SSL_TLS1_3_LABEL_LIST
diff --git a/meta-webserver/recipes-httpd/hiawatha/files/0002-Replace-__attribute__-nonstring-with-macro-MBEDTLS_A.patch b/meta-webserver/recipes-httpd/hiawatha/files/0002-Replace-__attribute__-nonstring-with-macro-MBEDTLS_A.patch
new file mode 100644
index 0000000000..2f94cee277
--- /dev/null
+++ b/meta-webserver/recipes-httpd/hiawatha/files/0002-Replace-__attribute__-nonstring-with-macro-MBEDTLS_A.patch
@@ -0,0 +1,42 @@
+From 91ec670d3f6399510995dedbf99dca2e7e9bd2d8 Mon Sep 17 00:00:00 2001
+From: Felix Conway <felix.conway@arm.com>
+Date: Thu, 12 Jun 2025 11:28:56 +0100
+Subject: [PATCH 2/2] Replace __attribute__((nonstring)) with macro
+ MBEDTLS_ATTRIBUTE_UNTERMINATED_STRING
+
+This macro applies __attribute__((nonstring)) when using a compiler that supports it
+
+Upstream-Status: Backport [https://github.com/Mbed-TLS/mbedtls/pull/10216]
+Signed-off-by: Felix Conway <felix.conway@arm.com>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ library/ssl_tls13_keys.c | 2 +-
+ library/ssl_tls13_keys.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c
+index 375814c..621a7d5 100644
+--- a/library/ssl_tls13_keys.c
++++ b/library/ssl_tls13_keys.c
+@@ -82,7 +82,7 @@ struct mbedtls_ssl_tls13_labels_struct const mbedtls_ssl_tls13_labels =
+  */
+ 
+ /* We need to tell the compiler that we meant to leave out the null character. */
+-static const char tls13_label_prefix[6] __attribute__ ((nonstring)) = "tls13 ";
++static const char tls13_label_prefix[6] MBEDTLS_ATTRIBUTE_UNTERMINATED_STRING = "tls13 ";
+ 
+ #define SSL_TLS1_3_KEY_SCHEDULE_HKDF_LABEL_LEN(label_len, context_len) \
+     (2                     /* expansion length           */ \
+diff --git a/library/ssl_tls13_keys.h b/library/ssl_tls13_keys.h
+index 95cde7a..3aa94d7 100644
+--- a/library/ssl_tls13_keys.h
++++ b/library/ssl_tls13_keys.h
+@@ -42,7 +42,7 @@
+ 
+ /* We need to tell the compiler that we meant to leave out the null character. */
+ #define MBEDTLS_SSL_TLS1_3_LABEL(name, string)       \
+-    const unsigned char name    [sizeof(string) - 1] __attribute__ ((nonstring));
++    const unsigned char name    [sizeof(string) - 1] MBEDTLS_ATTRIBUTE_UNTERMINATED_STRING;
+ 
+ union mbedtls_ssl_tls13_labels_union {
+     MBEDTLS_SSL_TLS1_3_LABEL_LIST
diff --git a/meta-webserver/recipes-httpd/hiawatha/files/define-MBEDTLS_ATTRIBUTE_UNTERMINATED_STRING.patch b/meta-webserver/recipes-httpd/hiawatha/files/define-MBEDTLS_ATTRIBUTE_UNTERMINATED_STRING.patch
new file mode 100644
index 0000000000..6e2d9eb5f1
--- /dev/null
+++ b/meta-webserver/recipes-httpd/hiawatha/files/define-MBEDTLS_ATTRIBUTE_UNTERMINATED_STRING.patch
@@ -0,0 +1,33 @@
+Replace __attribute__((nonstring)) with macro MBEDTLS_ATTRIBUTE_UNTERMINATED_STRING
+This macro applies __attribute__((nonstring)) when using a compiler that supports it
+
+Upstream-Status: Backport [https://github.com/Mbed-TLS/TF-PSA-Crypto/commit/996f4fa3a2fbe8792ed3efd1bcb3657001f35ae1]
+
+Signed-off-by: Felix Conway <felix.conway@arm.com>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+
+--- a/library/ssl_tls13_keys.h
++++ b/library/ssl_tls13_keys.h
+@@ -7,6 +7,22 @@
+ #if !defined(MBEDTLS_SSL_TLS1_3_KEYS_H)
+ #define MBEDTLS_SSL_TLS1_3_KEYS_H
+ 
++/* GCC >= 15 has a warning 'unterminated-string-initialization' which complains if you initialize
++ * a string into an array without space for a terminating NULL character. In some places in the
++ * codebase this behaviour is intended, so we add the macro MBEDTLS_ATTRIBUTE_UNTERMINATED_STRING
++ * to suppress the warning in these places.
++ */
++#if defined(__has_attribute)
++#if __has_attribute(nonstring)
++#define MBEDTLS_HAS_ATTRIBUTE_NONSTRING
++#endif /* __has_attribute(nonstring) */
++#endif /* __has_attribute */
++#if defined(MBEDTLS_HAS_ATTRIBUTE_NONSTRING)
++#define MBEDTLS_ATTRIBUTE_UNTERMINATED_STRING __attribute__((nonstring))
++#else
++#define MBEDTLS_ATTRIBUTE_UNTERMINATED_STRING
++#endif /* MBEDTLS_HAS_ATTRIBUTE_NONSTRING */
++
+ /* This requires MBEDTLS_SSL_TLS1_3_LABEL( idx, name, string ) to be defined at
+  * the point of use. See e.g. the definition of mbedtls_ssl_tls13_labels_union
+  * below. */
diff --git a/meta-webserver/recipes-httpd/hiawatha/hiawatha_11.7.bb b/meta-webserver/recipes-httpd/hiawatha/hiawatha_11.7.bb
index fac1498b3b..4e7e5fa31d 100644
--- a/meta-webserver/recipes-httpd/hiawatha/hiawatha_11.7.bb
+++ b/meta-webserver/recipes-httpd/hiawatha/hiawatha_11.7.bb
@@ -7,8 +7,12 @@ DEPENDS = "libxml2 libxslt virtual/crypt"
 SECTION = "net"
 
 SRC_URI = "https://hiawatha.leisink.net/files/hiawatha-${PV}.tar.gz \
+           file://0001-Add-__attribute__-nonstring-to-remove-unterminated-s.patch;patchdir=mbedtls \
+           file://0002-Replace-__attribute__-nonstring-with-macro-MBEDTLS_A.patch;patchdir=mbedtls \
+           file://define-MBEDTLS_ATTRIBUTE_UNTERMINATED_STRING.patch;patchdir=mbedtls \
            file://hiawatha-init \
-           file://hiawatha.service "
+           file://hiawatha.service \
+          "
 
 SRC_URI[sha256sum] = "8bc180ae3b986d02466f081efeefdb1595d96783f581fded2a9b198752ab7ae1"
 

[meta-oe][PATCH 6/8] castxml: Upgrade to 0.6.13 release

[Khem Raj]

Fixes build with clang-21

Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
 .../castxml/{castxml_0.6.11.bb => castxml_0.6.13.bb}        | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 rename meta-oe/recipes-devtools/castxml/{castxml_0.6.11.bb => castxml_0.6.13.bb} (81%)

diff --git a/meta-oe/recipes-devtools/castxml/castxml_0.6.11.bb b/meta-oe/recipes-devtools/castxml/castxml_0.6.13.bb
similarity index 81%
rename from meta-oe/recipes-devtools/castxml/castxml_0.6.11.bb
rename to meta-oe/recipes-devtools/castxml/castxml_0.6.13.bb
index 69663e01ab..9e506a8709 100644
--- a/meta-oe/recipes-devtools/castxml/castxml_0.6.11.bb
+++ b/meta-oe/recipes-devtools/castxml/castxml_0.6.13.bb
@@ -2,11 +2,11 @@ SUMMARY = "C-family abstract syntax tree XML output tool."
 LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
 
-SRC_URI = "git://github.com/CastXML/CastXML;protocol=https;branch=master"
-
-SRCREV = "f38c024b395187814f14f77974d8f5240bb2e71f"
+SRCREV = "13e1572729981289a7a96d762960994134f73f76"
+SRC_URI = "git://github.com/CastXML/CastXML;protocol=https;branch=master;tag=v${PV}"
 
 DEPENDS = "clang"
+
 inherit cmake pkgconfig python3native
 
 BBCLASSEXTEND = "native nativesdk"

[meta-oe][PATCH 7/8] minifi-cpp: Include cstdlib in fmt for free/malloc

[Khem Raj]

This helps in compiling with clang-21

Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
 ...-Add-missing-include-for-malloc-free.patch | 38 +++++++++++++++++++
 .../minifi-cpp/minifi-cpp_0.99.1.bb           |  1 +
 2 files changed, 39 insertions(+)
 create mode 100644 meta-oe/recipes-extended/minifi-cpp/files/0001-Add-missing-include-for-malloc-free.patch

diff --git a/meta-oe/recipes-extended/minifi-cpp/files/0001-Add-missing-include-for-malloc-free.patch b/meta-oe/recipes-extended/minifi-cpp/files/0001-Add-missing-include-for-malloc-free.patch
new file mode 100644
index 0000000000..e844bf9b7d
--- /dev/null
+++ b/meta-oe/recipes-extended/minifi-cpp/files/0001-Add-missing-include-for-malloc-free.patch
@@ -0,0 +1,38 @@
+From f01a1ae37d3e502a900b5a6cfa5be217003cf7d4 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Fri, 29 Aug 2025 21:46:26 -0700
+Subject: [PATCH] Add missing include for malloc/free
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ include/fmt/format.h | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/include/fmt/format.h b/include/fmt/format.h
+index 287e7163..0412812f 100644
+--- a/include/fmt/format.h
++++ b/include/fmt/format.h
+@@ -44,6 +44,7 @@
+ #  include <cmath>    // std::signbit
+ #  include <cstddef>  // std::byte
+ #  include <cstdint>  // uint32_t
++#  include <cstdlib>  // std::malloc, std::free
+ #  include <cstring>  // std::memcpy
+ #  include <limits>   // std::numeric_limits
+ #  include <new>      // std::bad_alloc
+@@ -744,12 +745,12 @@ template <typename T> struct allocator {
+ 
+   T* allocate(size_t n) {
+     FMT_ASSERT(n <= max_value<size_t>() / sizeof(T), "");
+-    T* p = static_cast<T*>(malloc(n * sizeof(T)));
++    T* p = static_cast<T*>(std::malloc(n * sizeof(T)));
+     if (!p) FMT_THROW(std::bad_alloc());
+     return p;
+   }
+ 
+-  void deallocate(T* p, size_t) { free(p); }
++  void deallocate(T* p, size_t) { std::free(p); }
+ };
+ 
+ }  // namespace detail
diff --git a/meta-oe/recipes-extended/minifi-cpp/minifi-cpp_0.99.1.bb b/meta-oe/recipes-extended/minifi-cpp/minifi-cpp_0.99.1.bb
index 16dc46275a..0d9a503793 100644
--- a/meta-oe/recipes-extended/minifi-cpp/minifi-cpp_0.99.1.bb
+++ b/meta-oe/recipes-extended/minifi-cpp/minifi-cpp_0.99.1.bb
@@ -27,6 +27,7 @@ SRC_URI = "git://github.com/apache/nifi-minifi-cpp.git;protocol=https;branch=mai
            file://0006-CMakeLists.txt-do-not-use-ccache.patch \
            file://0007-libsodium-aarch64-set-compiler-attributes-after-including-arm_.patch \
            file://0008-MINIFICPP-2553-CMP0065-OLD-removed-in-cmake-4.0-remo.patch \
+           file://0001-Add-missing-include-for-malloc-free.patch;patchdir=thirdparty/fmt-src \
            file://systemd-volatile.conf \
            file://sysvinit-volatile.conf \
           "

[meta-oe][PATCH 8/8] include-what-you-use: Upgrade to 0.24

[Khem Raj]

Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
 ...ude-what-you-use_0.23.bb => include-what-you-use_0.24.bb} | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)
 rename meta-oe/recipes-devtools/include-what-you-use/{include-what-you-use_0.23.bb => include-what-you-use_0.24.bb} (94%)

diff --git a/meta-oe/recipes-devtools/include-what-you-use/include-what-you-use_0.23.bb b/meta-oe/recipes-devtools/include-what-you-use/include-what-you-use_0.24.bb
similarity index 94%
rename from meta-oe/recipes-devtools/include-what-you-use/include-what-you-use_0.23.bb
rename to meta-oe/recipes-devtools/include-what-you-use/include-what-you-use_0.24.bb
index 7c4392fdd1..6ae8eaa6ee 100644
--- a/meta-oe/recipes-devtools/include-what-you-use/include-what-you-use_0.23.bb
+++ b/meta-oe/recipes-devtools/include-what-you-use/include-what-you-use_0.24.bb
@@ -10,10 +10,9 @@ LIC_FILES_CHKSUM = "file://LICENSE.TXT;md5=3bb66a14534286912cd6f26649b5c60a \
 
 DEPENDS = "clang"
 
-SRC_URI = "git://github.com/include-what-you-use/include-what-you-use.git;protocol=https;branch=master"
-SRCREV = "fa1094c0b3848f82244778bc6153cc84f8a890f6"
-
 PV .= "+git"
+SRCREV = "27e91c0ffd035c82706da3d3d07e4a036c6b5876"
+SRC_URI = "git://github.com/include-what-you-use/include-what-you-use.git;protocol=https;branch=master"
 
 inherit cmake python3native