> libuv was vulnerable to out-of-bounds reads in the uv__idna_toascii()
> function which is used to convert strings to ASCII. This is called by
> the DNS resolution function and can lead to information disclosures or
> crashes.
https://github.com/libuv/libuv/commit/b7466e31e4bee160d82a68fca11b1f61d46debae
Fixes: CVE-2021-22918
(cherry picked from commit 742b8f71f7e101bf3ecd48f28af9eda67591339e)
The new release comes with breaking changes so we temporarily introduce
wlroots_0_13 for packages that don't yet support wlroots 0.14.
For the rest of the packages the required upstream patches for this new
wlroots release are fetched (if feasible).
(cherry picked from commit 203c8edcdac9491912cb21fa9d84392cb6a69eef)
The upstream tarball changed. Specifically, files now extract onto a
box2d-2.3.1/ directory rather than Box2D-2.3.1/. The files themselves
(and their contents) seem to remain the same.
(cherry picked from commit a8b85f6d68d4fc96a0f8473aa38a3e773b82c4f0)
The old URL doesn't seem to be available anymore (fails with 403
Forbidden error).
The tarball in the new URL contains a few changes from the old one, so
the hash has changed.
Specifically, only the following files have changed:
sundials-5.7.0/doc/arkode/ark_examples.pdf
sundials-5.7.0/doc/arkode/ark_guide.pdf
sundials-5.7.0/doc/cvode/cv_examples.pdf
sundials-5.7.0/doc/cvode/cv_guide.pdf
sundials-5.7.0/doc/cvodes/cvs_examples.pdf
sundials-5.7.0/doc/cvodes/cvs_guide.pdf
sundials-5.7.0/doc/ida/ida_examples.pdf
sundials-5.7.0/doc/ida/ida_guide.pdf
sundials-5.7.0/doc/idas/idas_examples.pdf
sundials-5.7.0/doc/idas/idas_guide.pdf
sundials-5.7.0/doc/kinsol/kin_examples.pdf
sundials-5.7.0/doc/kinsol/kin_guide.pdf
(cherry picked from commit 4ab604c4c436505c98eb11e4a5c0323a1a835279)
Fixes a local privilege escalation using polkit_system_bus_name_get_creds_sync()
Fixes: CVE-2021-3560
(cherry picked from commit 26ac1d5db953292d78f0585dd8baccd9a36a44a4)
libccd has the common bug of assuming CMAKE_INSTALL_*DIR is relative. I have
submitted the fix upstream, but don't have much hope of getting it merged
because there have been no updates since 2018.
(cherry picked from commit 3d2092ab58fe83e89a3162728e9d4b733295b561)
Some python packages (e.g. functools32) are conditionally disabled for
certain interpreter versions by having them return null instead of a
derivation. `getRecursivePropagatedBuildInputs` fails if such a package
is part of the dependency tree. This commit makes it only recurse into
derivations and ignore everything else.
This also deduplicates the final plugin list to improve startup time.
(cherry picked from commit 9b3a2e66b141733fe7cb5372f64d30b66445cccd)
Sandro Jäckel