From afc0ca1723a7e0e862ccccd9a8a5c7d419b6fd44 Mon Sep 17 00:00:00 2001 From: Thomas Devoogdt Date: Wed, 24 Jun 2026 20:21:17 +0200 Subject: [PATCH] package/webkitgtk: security bump to version 2.52.4 Release notes: https://webkitgtk.org/2026/06/02/webkitgtk2.52.4-released.html Fixes the following security issues: https://webkitgtk.org/security/WSA-2026-0003.html Includes fixes (among others) for CVE-2026-28847, CVE-2026-28883, CVE-2026-28901, CVE-2026-28902, CVE-2026-28903, CVE-2026-28904, CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658, and CVE-2026-43660. Also added 0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch, to get webkitgtk compiled when -DUSE_SYSTEM_MALLOC=ON is in use. Signed-off-by: Thomas Devoogdt [Julien: add "security" in commit log title] Signed-off-by: Julien Olivain (cherry picked from commit 013612b4962332ef528682a037a91c7a420f5bab) Signed-off-by: Thomas Perale --- ...6-main-Fails-to-build-with-system-ma.patch | 52 +++++++++++++++++++ package/webkitgtk/webkitgtk.hash | 6 +-- package/webkitgtk/webkitgtk.mk | 2 +- 3 files changed, 56 insertions(+), 4 deletions(-) create mode 100644 package/webkitgtk/0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch diff --git a/package/webkitgtk/0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch b/package/webkitgtk/0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch new file mode 100644 index 0000000000..decdba6814 --- /dev/null +++ b/package/webkitgtk/0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch @@ -0,0 +1,52 @@ +From 146cdc86b7345ac8f513fdf649979e80db01a2ca Mon Sep 17 00:00:00 2001 +From: Alberto Garcia +Date: Tue, 2 Jun 2026 07:24:38 -0700 +Subject: [PATCH] REGRESSION(313606@main): Fails to build with system malloc + https://bugs.webkit.org/show_bug.cgi?id=316083 + +Reviewed by Fujii Hironori. + +Don't add bmalloc_CopyHeaders to LLIntOffsetsExtractor_DEPENDENCIES if +USE_SYSTEM_MALLOC is on. + +* Source/JavaScriptCore/CMakeLists.txt: + +Canonical link: https://commits.webkit.org/305877.698@webkitglib/2.52 + +Upstream: https://github.com/WebKit/WebKit/commit/a6bc685a685c8f16c919dc6310a62a26971d396e +Signed-off-by: Thomas Devoogdt +--- + Source/JavaScriptCore/CMakeLists.txt | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt +index a2a6d724608a..ea9ea17802f2 100644 +--- a/Source/JavaScriptCore/CMakeLists.txt ++++ b/Source/JavaScriptCore/CMakeLists.txt +@@ -412,8 +412,10 @@ set(LLIntSettingsExtractor_DEPENDENCIES + JavaScriptCore_CopyHeaders + JavaScriptCore_CopyPrivateHeaders + WTF_CopyHeaders +- bmalloc_CopyHeaders + ) ++if (NOT USE_SYSTEM_MALLOC) ++ list(APPEND LLIntSettingsExtractor_DEPENDENCIES bmalloc_CopyHeaders) ++endif () + WEBKIT_EXECUTABLE(LLIntSettingsExtractor) + + # LLIntSettingsExtractor target needs to have a direct or indirect +@@ -439,8 +441,10 @@ set(LLIntOffsetsExtractor_DEPENDENCIES + JavaScriptCore_CopyHeaders + JavaScriptCore_CopyPrivateHeaders + WTF_CopyHeaders +- bmalloc_CopyHeaders + ) ++if (NOT USE_SYSTEM_MALLOC) ++ list(APPEND LLIntOffsetsExtractor_DEPENDENCIES bmalloc_CopyHeaders) ++endif () + WEBKIT_EXECUTABLE(LLIntOffsetsExtractor) + + # The build system will execute asm.rb every time LLIntOffsetsExtractor's mtime is newer than +-- +2.43.0 + diff --git a/package/webkitgtk/webkitgtk.hash b/package/webkitgtk/webkitgtk.hash index 03b8d0a9be..f8c0e0297a 100644 --- a/package/webkitgtk/webkitgtk.hash +++ b/package/webkitgtk/webkitgtk.hash @@ -1,6 +1,6 @@ -# From https://webkitgtk.org/releases/webkitgtk-2.52.3.tar.xz.sums -sha1 17f9b127618040a5f3fcbb70e37ea16ab6d69b0b webkitgtk-2.52.3.tar.xz -sha256 5b3e0d174e63dcc28848b1194e0e7448d5948c3c2427ecd931c2c5be5261aebb webkitgtk-2.52.3.tar.xz +# From https://webkitgtk.org/releases/webkitgtk-2.52.4.tar.xz.sums +sha1 1bfaa562ae46a420abaad2b3b9175dc823cc7a93 webkitgtk-2.52.4.tar.xz +sha256 cf4076a1ca2a64788edca8c452d8ebb68d5e2965e588fe46a388a016513edce4 webkitgtk-2.52.4.tar.xz # Hashes for license files: sha256 0b5d3a7cc325942567373b0ecd757d07c132e0ebd7c97bfc63f7e1a76094edb4 Source/WebCore/LICENSE-APPLE diff --git a/package/webkitgtk/webkitgtk.mk b/package/webkitgtk/webkitgtk.mk index 54e769d589..6cab2c6a24 100644 --- a/package/webkitgtk/webkitgtk.mk +++ b/package/webkitgtk/webkitgtk.mk @@ -4,7 +4,7 @@ # ################################################################################ -WEBKITGTK_VERSION = 2.52.3 +WEBKITGTK_VERSION = 2.52.4 WEBKITGTK_SITE = https://www.webkitgtk.org/releases WEBKITGTK_SOURCE = webkitgtk-$(WEBKITGTK_VERSION).tar.xz WEBKITGTK_INSTALL_STAGING = YES