Includes fix for CVE-2024-54551, CVE-2025-24208,CVE-2025-24209,
CVE-2025-24213, CVE-2025-24216, CVE-2025-24264 and CVE-2025-30427
Changelog:
=========
- Limit the data stored in session state.
- Remove the empty area below the title bar in Web Inspector when not docked.
- Fix the build with GST_DISABLE_GST_DEBUG.
- Fix the build with GStreamer < 1.20.
- Fix the build with video disabled.
- Fix the build with clang 20.
Drop 0001-EnumTraits.h-error-no-matching-function-for-call-to-.patch
and 0001-Cherry-pick-292304-main-7ffc29624258-.-https-bugs.we.patch
which are part of upgrade.
(From OE-Core rev: f03c7c572e3dcc1d1966e76b7a73df6e96ee0df1)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Includes fix for CVE-2025-24143, CVE-2025-24150, CVE-2025-24158 and
CVE-2025-24162
Drop 0001-Support-ICU-76.1-build.patch fix is part of upgrade.
Changelog:
==========
- Fix a crash when enabling Skia CPU rendering.
- Fix several crashes and rendering issues.
(From OE-Core rev: 289e09c1a090d06146406886d4763dd22203c231)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is a fix needed in angle module which is vendored in webkit repo.
glibc does not define SYS_futex on 32bit arches with 64bit time_t only
e.g. riscv32
(From OE-Core rev: fab8dbdc48b6ae59bb1ea4cb47204f99f195b12c)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop 0001-Fix-build-issues-with-latest-Clang.patch
(backport)
30e1d5e22213fdaca2a29ec3400c927d710a37a8.patch
(issue fixed upstream)
Add an option that when absent causes a build failure.
(From OE-Core rev: dc72933c3393339c7e8b50f62a16832aeac32887)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ths allows us to upgrade icu.
(From OE-Core rev: 059155fbcf799507cb58e35dbe5830d8ae9dfea3)
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update webkitgtk from 2.44.0 to the first bug fix release in the stable
2.44 series 2.44.1.
* remove backported patch
What's new in the WebKitGTK 2.44.1 release?
===========================================
- Fix handling of lifetime of web view child dialogs in GTK4.
- Do not schedule layer flushes when drawing area size is empty.
- Fix videos with alpha when using the DMA-BUF sink.
- Fix the build with USE_GBM=OFF.
- Fix the build in 32bit platforms
- Fix several crashes and rendering issues.
(From OE-Core rev: c129c47cf9fa119005ea6e3946ebdee0da1db7e0)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- add a PACKAGECONFIG for libbacktrace to avoid:
| -- Could NOT find LibBacktrace (missing: LIBBACKTRACE_INCLUDE_DIR LIBBACKTRACE_LIBRARY)
| CMake Error at Source/cmake/OptionsGTK.cmake:425 (message):
| libbacktrace is required for USE_LIBBACKTRACE
- while at it also add a PACKAGECONFIG for gamepad
- remove submitted patch. Issue seems to be fixed. Not entirely
sure about that, but there has been rework:
[https://bugs.webkit.org/show_bug.cgi?id=267349]
I also did a test build with oe-core/poky for qemuarm.
It completed without error
- There is an issue with creating the json files if
CMAKE_EXPORT_COMPILE_COMMANDS is enabled. Disable this
for now to fix the build:
FAILED: CMakeFiles/RewriteCompileCommands DeveloperTools/compile_commands.json /home/flk/poky/build-hypr/tmp/work/corei7-64-poky-linux/webkitgtk/2.44.0/build/CMakeFiles/RewriteCompileCommands /home/flk/poky/build-hypr/tmp/work/corei7-64-poky-linux/webkitgtk/2.44.0/build/DeveloperTools/compile_commands.json
cd /home/flk/poky/build-hypr/tmp/work/corei7-64-poky-linux/webkitgtk/2.44.0/build && /home/flk/poky/build-hypr/tmp/work/corei7-64-poky-linux/webkitgtk/2.44.0/recipe-sysroot-native/usr/bin/python3-native/python3 /home/flk/poky/build-hypr/tmp/work/corei7-64-poky-linux/webkitgtk/2.44.0/webkitgtk-2.44.0/Tools/Scripts/rewrite-compile-commands /home/flk/poky/build-hypr/tmp/work/corei7-64-poky-linux/webkitgtk/2.44.0/build/compile_commands.json /home/flk/poky/build-hypr/tmp/work/corei7-64-poky-linux/webkitgtk/2.44.0/build/DeveloperTools/compile_commands.json /home/flk/poky/build-hypr/tmp/work/corei7-64-poky-linux/webkitgtk/2.44.0/webkitgtk-2.44.0 /home/flk/poky/build-hypr/tmp/work/corei7-64-poky-linux/webkitgtk/2.44.0/build
/home/flk/poky/build-hypr/tmp/work/corei7-64-poky-linux/webkitgtk/2.44.0/recipe-sysroot-native/usr/bin/python3-native/python3: can't open file '/home/flk/poky/build-hypr/tmp/work/corei7-64-poky-linux/webkitgtk/2.44.0/webkitgtk-2.44.0/Tools/Scripts/rewrite-compile-commands': [Errno 2] No such file or directory
- Add a patch to fix webassembly for riscv64
- Add a backport patch to fix the build for 32bit architectures
================
WebKitGTK 2.44.0
================
What's new in WebKitGTK 2.44.0?
- Fix connection of UI and web process accessibility tree in GTK4.
- Add BubblewrapLauncher sandbox directory for the gstreamer user registry cache directory.
- Fix bug causing preferred language to not be passed to NetworkProcess if set in WebContext before creating WebView.
- Do not use real time priority for the display link thread.
- Use a shorter web process cache lifetime.
- Fix several crashes and rendering issues.
- Translation updates: German, Polish, Swedish, Turkish.
================
WebKitGTK 2.43.4
================
What's new in WebKitGTK 2.43.4?
- Remove key event reinjection in GTK4 to make keyboard shortcuts work in web sites.
- Use the new GTK API to create a GdkTexture from a DMA-BUF buffer when available.
- Fix rendering when GTK is using the vulkan renderer.
- Fix gamepads detection by correctly handling focused window in GTK4.
- Fix rendering after history navigation.
- Write bwrapinfo.json to disk for xdg-desktop-portal.
- Fixed several memory leaks in media backend.
- Fix several crashes and rendering issues.
================
WebKitGTK 2.43.3
================
What's new in WebKitGTK 2.43.3?
- Show vblank monitor information in webkit://gpu.
- Fallback to timer based vblank monitor if drmWaitVBlank fails.
- Fix several memory leaks in media backend.
- Fix several crashes and rendering issues.
================
WebKitGTK 2.43.2
================
What's new in WebKitGTK 2.43.2?
- Remove the X11 and WPE renderers.
- Release unused buffers when the view is hidden.
- Fix flickering while playing videos with DMA-BUF sink.
- Do not special case the "sans" font family name.
- Fix webkit_web_context_allow_tls_certificate_for_host() for IPv6 URIs produced by SoupURI.
- Fix several crashes and rendering issues.
================
WebKitGTK 2.43.1
================
What's new in WebKitGTK 2.43.1?
- Improve vblank synchronization when rendering.
- Improve DMA-BUF buffers handling for video frames.
- Use the buffer format preferred by the driver in DMA-BUF renderer.
- Do not block the compositing thread waiting for rendering threads.
- Improve performance when scaling images in a canvas.
- Fix several crashes and rendering
(From OE-Core rev: 7b96a7e433eb6b85c35dd6a36a12ad55d2e6a108)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is a compiler crash which is under works upstream, until its fixed
lets disable musttail calls on clang+arm
(From OE-Core rev: a61205f364c2e9f40736c081bbae0b045e317093)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It fails to compile webkitgtk when debug build enabled:
| /path_to/tmp/work/core2-64-poky-linux/webkitgtk/2.40.5/webkitgtk-2.40.5/Source/bmalloc/libpas/src/libpas/pas_allocation_result.h:76:1:
error: inlining failed in call to 'always_inline' 'pas_allocation_result pas_allocation_result_identity(pas_allocation_result)':
function not considered for inlining
| 76 | pas_allocation_result_identity(pas_allocation_result result)
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Add a cmake variable WEBKIT_NO_INLINE_HINTS to disable gcc function
attribute `always_inline` when debug build is enabled.
And adjust indent as well.
(From OE-Core rev: 8a33cd60f89685eeda7c5b3513540561df06160d)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- Remove unneeded patches
What’s new in the WebKitGTK 2.40.5 release?
- Fix several crashes and rendering issues.
What’s new in the WebKitGTK 2.40.4 release?
- Fix a bug in JavaScript reading variable arguments in a call.
What’s new in the WebKitGTK 2.40.3 release?
- Make memory pressure monitor honor memory.memsw.usage_in_bytes if exists.
- Include key modifiers in wheel events.
- Apply cookie blocking policy to WebSocket handshakes.
- Remove accidental dependency on GLib 2.70.
- Fix the build with BUBBLEWRAP_SANDBOX disabled.
- Fix several crashes and rendering issues.
(From OE-Core rev: c2f10d54341d84dcb21aaabe0828bff774de4f6e)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop backports.
Add extra options that require additional dependencies, and fail without them.
Disable the recipe on ancient x86 without SSE support; SSE is now
required.
(From OE-Core rev: fdc50a50d8f2c4975584c04db0c5e0e83cf62f99)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update webkitgtk from 2.38.3 to 2.38.4.
* remove 0001-When-building-introspection-files-do-not-quote-CFLAG.patch
which has been merged in upstream
What’s new in the WebKitGTK 2.38.4 release?[1]
* Improve GStreamer multimedia playback across the board with improved
codec selection logic, better handling of latency, and improving frame
discard to avoid audio/video desynchronization, among other fixes.
* Disable HLS media playback by default, which makes web sites use MSE
instead. If needed WEBKIT_GST_ENABLE_HLS_SUPPORT=1 can be set in the
environment to enable it back.
* Disable threaded rendering in GTK4 builds by default, as it was
causing crashes.
* Fix MediaSession API not showing artwork images.
* Fix MediaSession MPRIS usage when running inside a Flatpak sandbox.
* Fix input element controls to correctly scale when applying a zoom
factor different than the default.
* Fix leakage of Web processes in certain situations.
* Fix the injected bundle not being found when running inside a sandbox.
* Fix the build with ENABLE_INTROSPECTION when cross-compiling.
* FIx the build with ENABLE_WEBGL disabled.
* Fix the build with GStreamer-based WebRTC enabled.
* Fix the build with USE_GTK4 enabled.
* Fix several crashes and rendering issues.
[1]: https://webkitgtk.org/2023/02/02/webkitgtk2.38.4-released.html
(From OE-Core rev: a535ea38cb386f88afdfb086b07c047826368e9c)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upstream has rewritten gobject introspection support,
so the two related patches are ported to that:
0001-FindGObjectIntrospection.cmake-prefix-variables-obta.patch
0001-When-building-introspection-files-do-not-quote-CFLAG.patch
The latter patch is also promoted from Inappropriate to Pending
gtk-doc has been replaced with gi-docgen, accordingly
0001-Tweak-gtkdoc-settings-so-that-gtkdoc-generation-work.patch is removed.
Drop
fix-gstreamer-include-paths.patch
(backport)
0001-Fix-build-without-opengl-or-es.patch
(upstream fixed the issue; follow the link in the patch for details)
(From OE-Core rev: ac06af29503d2d3e0e43ef69d1d1580ce301bdfb)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This fixes build issues seen on mips, but problem is generic
(From OE-Core rev: 08c06980648d3f72cddbf62a96d6915f5d54b94e)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop patches:
0001-Fix-racy-parallel-build-of-WebKit2-4.0.gir.patch
0001-When-building-introspection-files-add-CMAKE_C_FLAGS-.patch
(both merged upstream)
reduce-memory-overheads.patch
(rejected by upstream, there's no use case - see the discussion)
Rebase to version submitted upstream:
0001-FindGObjectIntrospection.cmake-prefix-variables-obta.patch
Add:
0001-When-building-introspection-files-do-not-quote-CFLAG.patch
angle is no longer needed for x11-less setups.
(From OE-Core rev: 05582e9e6583126879977b0bbb88b691d625056b)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upstream has first accepted, then reverted this change,
so this needs to be re-submitted, after verifying that it is
still relevant.
(From OE-Core rev: 389ac5f324d231525776456a64c5aaf32a6a4858)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Portions of it were then further refactored upstream, leading
to some bits of the patch dropped and some re-applied on a
automated version upgrade.
(From OE-Core rev: d9de00cd5228d42f628af455ad42c06a0883f6d0)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When the date rolled from one year to another this highlighted a reproducibility
issue. This could be better fixed by using SOURCE_DATE_EPOCH from the environment
but I'm not sure how you do that in ruby. Help from someone with that knowledge
to submit that upstream very welcome.
(From OE-Core rev: 4d561c98f4d2e68d595aae4b03df1420cb01c3f7)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The file is already included just three lines below.
(From OE-Core rev: bcfb2539ed319fefd2b3605d8505666bdfc4704c)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* added in:
29421afdcd
* fixes build without opengl in DISTRO_FEATURES which was failing since upgrade to 2.34.0 with:
| CMake Error at Source/cmake/OptionsGTK.cmake:353 (message):
| Either GLX or EGL is needed.
| Call Stack (most recent call first):
| Source/cmake/WebKitCommon.cmake:220 (include)
| CMakeLists.txt:20 (include)
* and add a patch to fix building this version with opengl and gles disabled
(default oe-core setup without opengl in DISTRO_FEATURES)
(From OE-Core rev: 7214f09c77675b66e63b8f342a93c6b4db16e53d)
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop 0001-Extend-atomics-check-to-include-1-byte-CAS-test.patch
(merged upstream).
Rebase other patches.
(From OE-Core rev: f64e9ba5f0d48e34d7022bf74bd9765f9e8a792c)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
